Function at 0x644a78
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4f
push 0
push 0
dec ecx
jne 0x644a80
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x645df4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040b464
mov eax, dword [ebp - 0xc]
call fcn.0040b464
movzx eax, bl
cmp eax, 0x53
ja case.0x644ab9.0
jmp dword [eax*4 + 0x644ac0]
xor eax, eax
push ebp
push 0x644cad
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x688220], 0
je 0x644c42
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x644c4c
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x645e10
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x644c95
mov edx, 0x645e70
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x644c8d
lea ecx, [ebp - 4]
mov edx, 0x645e70
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644ab9.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
xor eax, eax
push ebp
push 0x644d51
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x688220], 0
je 0x644ce6
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x644cf0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x645e10
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x644d39
mov edx, 0x645e9c
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x644d31
lea ecx, [ebp - 4]
mov edx, 0x645e9c
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644ab9.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
push 0x104
lea eax, [ebp - 0x22a]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
lea edx, [ebp - 4]
lea eax, [ebp - 0x22a]
call fcn.004298e8
jmp case.0x644ab9.0
push 0x104
lea eax, [ebp - 0x22a]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea edx, [ebp - 4]
lea eax, [ebp - 0x22a]
call fcn.004298e8
jmp case.0x644ab9.0
lea eax, [ebp - 0x22a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
je case.0x644ab9.0
lea edx, [ebp - 4]
lea eax, [ebp - 0x22a]
call fcn.004298e8
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 0x14
call fcn.0064482c
jmp case.0x644ab9.0
push 1
mov ecx, 0x645ec8
mov edx, 0x645ef0
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
setg al
and al, byte [0x688226]
je 0x644e20
mov eax, 0x645f08
call fcn.00643690
test al, al
je 0x644e20
lea edx, [ebp - 4]
mov eax, 0x2e
call fcn.0064482c
jmp case.0x644ab9.0
cmp dword [0x688264], 0
je 0x644e37
mov eax, 0x645f24
call fcn.00643690
test al, al
je 0x644e49
lea edx, [ebp - 4]
mov eax, 5
call fcn.0064482c
jmp case.0x644ab9.0
movzx eax, byte [0x645f34]
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x230]
mov al, 0x36
call fcn.00644a78
mov eax, dword [ebp - 0x230]
push eax
lea edx, [ebp - 0x234]
mov eax, 5
call fcn.0064482c
mov eax, dword [ebp - 0x234]
mov ecx, dword [0x688264]
pop edx
call fcn.00431694
jmp case.0x644ab9.0
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x238]
mov al, 3
call fcn.00644a78
mov eax, dword [ebp - 0x238]
mov ecx, 2
mov edx, 1
call fcn.0040c3d0
jmp case.0x644ab9.0
lea edx, [ebp - 0x23c]
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.0061111c
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 4]
call fcn.00429260
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x450]
call fcn.00551518
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 9
call fcn.0064482c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 6
call fcn.0064482c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 0x1f
call fcn.0064482c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 0x15
call fcn.0064482c
jmp case.0x644ab9.0
push 1
mov ecx, 0x645ec8
mov edx, 0x645ef0
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
setg al
and al, byte [0x688226]
je 0x644f82
mov eax, 0x645f08
call fcn.00643690
test al, al
je 0x644f82
lea edx, [ebp - 4]
mov eax, 0x23
call fcn.0064482c
jmp case.0x644ab9.0
cmp dword [0x688264], 0
je 0x644f99
mov eax, 0x645f24
call fcn.00643690
test al, al
je 0x644fab
lea edx, [ebp - 4]
mov eax, 0x1a
call fcn.0064482c
jmp case.0x644ab9.0
movzx eax, byte [0x645f34]
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x240]
mov al, 0x36
call fcn.00644a78
mov eax, dword [ebp - 0x240]
push eax
lea edx, [ebp - 0x244]
mov eax, 0x1a
call fcn.0064482c
mov eax, dword [ebp - 0x244]
mov ecx, dword [0x688264]
pop edx
call fcn.00431694
jmp case.0x644ab9.0
xor eax, eax
push ebp
push 0x6450b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x688220], 0
je 0x645024
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x64502e
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x645f44
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x64509a
mov edx, 0x645fd4
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645071
lea ecx, [ebp - 4]
mov edx, 0x645fd4
mov eax, dword [ebp - 0x10]
call fcn.00516fac
jmp 0x645092
mov edx, 0x646000
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645092
lea ecx, [ebp - 4]
mov edx, 0x646000
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644ab9.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
lea edx, [ebp - 0x248]
mov al, 0x12
call fcn.00644a78
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 4]
call fcn.00429260
jmp case.0x644ab9.0
lea edx, [ebp - 4]
xor eax, eax
call fcn.0064482c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 0xb
call fcn.0064482c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 2
call fcn.0064482c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 7
call fcn.0064482c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 0x19
call fcn.0064482c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 0x16
call fcn.0064482c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 0x17
call fcn.0064482c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 0x18
call fcn.0064482c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, dword [0x688268]
call fcn.0040b89c
jmp case.0x644ab9.0
lea edx, [ebp - 0x24c]
mov al, 0xf
call fcn.00644a78
mov edx, dword [ebp - 0x24c]
lea eax, [ebp - 4]
mov ecx, 0x646028
call fcn.0040c260
jmp case.0x644ab9.0
push 0
lea eax, [ebp - 0x250]
push eax
mov ecx, 0x646088
mov edx, 0x645ef0
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 4]
call fcn.00644870
jmp case.0x644ab9.0
push 0
lea eax, [ebp - 0x258]
push eax
mov ecx, 0x6460a4
mov edx, 0x645ef0
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x258]
lea edx, [ebp - 0x254]
call fcn.00644870
mov eax, dword [ebp - 0x254]
lea edx, [ebp - 4]
call fcn.00646850
jmp case.0x644ab9.0
push 0
lea eax, [ebp - 0x25c]
push eax
mov ecx, 0x6460c8
mov edx, 0x645ef0
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x25c]
lea edx, [ebp - 4]
call fcn.00644870
jmp case.0x644ab9.0
push 0
lea eax, [ebp - 0x260]
push eax
mov ecx, 0x6460ec
mov edx, 0x645ef0
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x260]
lea edx, [ebp - 4]
call fcn.00644870
jmp case.0x644ab9.0
push 0
lea eax, [ebp - 0x264]
push eax
mov ecx, 0x646108
mov edx, 0x645ef0
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x264]
lea edx, [ebp - 4]
call fcn.00644870
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x498]
call fcn.00551518
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x4a4]
call fcn.00551518
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x488]
call fcn.00551518
jmp case.0x644ab9.0
call fcn.0042b738
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 4]
mov eax, dword [0x680510]
call fcn.0042c6ec
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 0x1c
call fcn.0064482c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, 0x23
call fcn.0064482c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov al, 0x3c
call fcn.00644a78
jmp case.0x644ab9.0
xor eax, eax
push ebp
push 0x6453d8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x688220], 1
jne 0x64536d
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x645377
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x64612c
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x6453c0
mov edx, 0x6461bc
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x6453b8
lea ecx, [ebp - 4]
mov edx, 0x6461bc
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644ab9.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
lea edx, [ebp - 0x268]
mov al, 0x16
call fcn.00644a78
mov eax, dword [ebp - 0x268]
lea edx, [ebp - 4]
call fcn.00429260
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x4a4]
call fcn.00551518
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x478]
call fcn.00551518
jmp case.0x644ab9.0
xor eax, eax
push ebp
push 0x645464
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x6461ec
mov edx, 0x646200
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp case.0x644ab9.0
xor eax, eax
push ebp
push 0x6454a8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x646218
mov edx, 0x646200
mov eax, dword [0x688218]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, dword [0x68824c]
call fcn.0040b89c
jmp case.0x644ab9.0
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
lea edx, [ebp - 4]
call fcn.00427d98
jmp case.0x644ab9.0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x64622c
mov edx, 0x645ef0
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.0061111c
jmp case.0x644ab9.0
xor eax, eax
push ebp
push 0x6455c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x688220], 1
jne 0x645544
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x64554e
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x645e10
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x6455a9
mov edx, 0x646244
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645591
lea ecx, [ebp - 4]
mov edx, 0x646244
mov eax, dword [ebp - 0x10]
call fcn.00516fac
jmp 0x6455a1
lea ecx, [ebp - 4]
mov edx, 0x645e70
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644ab9.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
lea edx, [ebp - 0x26c]
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x450]
call fcn.00551518
cmp dword [ebp - 0x26c], 0
je 0x645672
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x64566b
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x450]
call fcn.00551518
lea edx, [ebp - 0x270]
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x450]
call fcn.00551518
mov eax, dword [ebp - 0x270]
mov ecx, 1
mov edx, eax
mov eax, 0x646270
call fcn.0040c52c
mov ebx, eax
lea eax, [ebp - 4]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040c3d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644ab9.0
lea eax, [ebp - 8]
call fcn.0040b464
pop eax
jmp eax
lea eax, [ebp - 4]
mov edx, 0x646280
call fcn.0040b89c
jmp case.0x644ab9.0
push 0xff
lea eax, [ebp - 0x22a]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea edx, [ebp - 4]
lea eax, [ebp - 0x22a]
call fcn.004298e8
jmp case.0x644ab9.0
xor eax, eax
push ebp
push 0x645757
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x688220], 1
jne 0x6456da
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x6456e4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x645e10
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x64573f
mov edx, 0x646294
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645727
lea ecx, [ebp - 4]
mov edx, 0x646294
mov eax, dword [ebp - 0x10]
call fcn.00516fac
jmp 0x645737
lea ecx, [ebp - 4]
mov edx, 0x645e70
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644ab9.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
lea edx, [ebp - 0x274]
mov eax, 0x28
call fcn.0064482c
mov eax, dword [ebp - 0x274]
lea edx, [ebp - 4]
call fcn.00429384
jmp case.0x644ab9.0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x6462cc
mov edx, 0x645ef0
mov eax, dword [0x688214]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp case.0x644ab9.0
xor eax, eax
push ebp
push 0x64583d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x688220], 1
jne 0x6457d2
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x6457dc
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x645f44
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x645825
mov edx, 0x6462e4
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x64581d
lea ecx, [ebp - 4]
mov edx, 0x6462e4
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644ab9.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
xor eax, eax
push ebp
push 0x6458e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x688220], 1
jne 0x645876
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x645880
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x645f44
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x6458c9
mov edx, 0x646308
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x6458c1
lea ecx, [ebp - 4]
mov edx, 0x646308
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644ab9.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
xor eax, eax
push ebp
push 0x645985
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x688220], 1
jne 0x64591a
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x645924
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x64612c
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x64596d
mov edx, 0x646328
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645965
lea ecx, [ebp - 4]
mov edx, 0x646328
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644ab9.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
xor eax, eax
push ebp
push 0x645a29
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x688220], 1
jne 0x6459be
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x6459c8
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x64612c
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x645a11
mov edx, 0x646354
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645a09
lea ecx, [ebp - 4]
mov edx, 0x646354
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644ab9.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
xor eax, eax
push ebp
push 0x645acd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x688220], 0
je 0x645a62
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x645a6c
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x64612c
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x645ab5
mov edx, 0x646378
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645aad
lea ecx, [ebp - 4]
mov edx, 0x646378
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644ab9.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
call fcn.0042b738
fstp qword [ebp - 0x20]
wait
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea ecx, [ebp - 4]
mov edx, dword [0x680510]
mov eax, 0x6463a8
call fcn.0042c754
jmp case.0x644ab9.0
lea edx, [ebp - 0x278]
mov eax, dword [0x680434]
mov eax, dword [eax]
call fcn.0061111c
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 4]
call fcn.00429384
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, dword [0x688254]
call fcn.0040b89c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, dword [0x68825c]
call fcn.0040b89c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, dword [0x688260]
call fcn.0040b89c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, dword [0x688248]
call fcn.0040b89c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
call fcn.006500bc
jmp case.0x644ab9.0
lea eax, [ebp - 4]
call fcn.0064434c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, dword [0x688270]
call fcn.0040b89c
jmp case.0x644ab9.0
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x4bc]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x645bc2
lea eax, [ebp - 4]
mov edx, 0x6463c8
call fcn.0040b89c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, 0x6463d8
call fcn.0040b89c
jmp case.0x644ab9.0
cmp byte [0x68822a], 0
je 0x645bef
lea eax, [ebp - 4]
mov edx, 0x6463c8
call fcn.0040b89c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, 0x6463d8
call fcn.0040b89c
jmp case.0x644ab9.0
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x4e8]
mov edx, dword [eax]
call dword [edx + 0x150]
inc eax
jle 0x645c41
mov eax, dword [0x6881e0]
mov ebx, dword [eax + 0x4e8]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x150]
mov edx, eax
lea ecx, [ebp - 4]
mov eax, dword [ebx + 0x2ec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp case.0x644ab9.0
lea eax, [ebp - 4]
call fcn.0040b464
jmp case.0x644ab9.0
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x4e8]
mov edx, dword [eax]
call dword [edx + 0x150]
lea edx, [ebp - 4]
call fcn.00427d98
jmp case.0x644ab9.0
cmp byte [0x688223], 0
je 0x645c89
lea eax, [ebp - 4]
mov edx, 0x6463c8
call fcn.0040b89c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, 0x6463d8
call fcn.0040b89c
jmp case.0x644ab9.0
cmp byte [0x688226], 0
je 0x645cb6
lea eax, [ebp - 4]
mov edx, 0x6463c8
call fcn.0040b89c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, 0x6463d8
call fcn.0040b89c
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, dword [0x67f350]
call fcn.00427d98
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, dword [0x67f354]
call fcn.00427d98
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, dword [0x67f358]
call fcn.00427d98
jmp case.0x644ab9.0
lea edx, [ebp - 4]
mov eax, dword [0x67f35c]
call fcn.00427d98
jmp case.0x644ab9.0
mov eax, dword [0x6881e0]
mov eax, dword [eax + 0x4bc]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x645d36
lea eax, [ebp - 4]
mov edx, 0x6463c8
call fcn.0040b89c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, 0x6463d8
call fcn.0040b89c
jmp case.0x644ab9.0
cmp byte [0x68822d], 0
je 0x645d5d
lea eax, [ebp - 4]
mov edx, 0x6463c8
call fcn.0040b89c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, 0x6463d8
call fcn.0040b89c
jmp case.0x644ab9.0
cmp byte [0x68822a], 0
je 0x645d84
lea eax, [ebp - 4]
mov edx, 0x6463e8
call fcn.0040b89c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, 0x6463fc
call fcn.0040b89c
jmp case.0x644ab9.0
lea eax, [ebp - 4]
mov edx, dword [0x688280]
call fcn.0040b89c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00431290
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x645dfb
lea eax, [ebp - 0x278]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x270]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x268]
mov edx, 0xf
call fcn.0040b4c4
lea eax, [ebp - 4]
call fcn.0040b464
pop eax
jmp eax