Function at 0x638e84
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4f
push 0
push 0
dec ecx
jne 0x638e8c
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x63a263
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040b460
mov eax, dword [ebp - 0xc]
call fcn.0040b460
movzx eax, bl
cmp eax, 0x56
ja case.0x638ec5.0
jmp dword [eax*4 + 0x638ecc]
xor eax, eax
push ebp
push 0x6390c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515134]
call fcn.00516280
mov dword [ebp - 0x10], eax
cmp byte [0x67ae18], 0
je 0x63905a
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x639064
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516368
xor ecx, ecx
mov edx, 0x63a280
mov eax, dword [ebp - 0x10]
call fcn.005164c4
test al, al
je 0x6390ad
mov edx, 0x63a2e0
mov eax, dword [ebp - 0x10]
call fcn.00517424
test al, al
je 0x6390a5
lea ecx, [ebp - 4]
mov edx, 0x63a2e0
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
mov eax, dword [ebp - 0x10]
call fcn.00516338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x638ec5.0
mov eax, dword [ebp - 0x10]
call fcn.00409670
pop eax
jmp eax
xor eax, eax
push ebp
push 0x639169
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515134]
call fcn.00516280
mov dword [ebp - 0x10], eax
cmp byte [0x67ae18], 0
je 0x6390fe
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x639108
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516368
xor ecx, ecx
mov edx, 0x63a280
mov eax, dword [ebp - 0x10]
call fcn.005164c4
test al, al
je 0x639151
mov edx, 0x63a30c
mov eax, dword [ebp - 0x10]
call fcn.00517424
test al, al
je 0x639149
lea ecx, [ebp - 4]
mov edx, 0x63a30c
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
mov eax, dword [ebp - 0x10]
call fcn.00516338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x638ec5.0
mov eax, dword [ebp - 0x10]
call fcn.00409670
pop eax
jmp eax
push 0x104
lea eax, [ebp - 0x22a]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
lea edx, [ebp - 4]
lea eax, [ebp - 0x22a]
call fcn.004297f0
jmp case.0x638ec5.0
push 0x104
lea eax, [ebp - 0x22a]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea edx, [ebp - 4]
lea eax, [ebp - 0x22a]
call fcn.004297f0
jmp case.0x638ec5.0
lea eax, [ebp - 0x22a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
je case.0x638ec5.0
lea edx, [ebp - 4]
lea eax, [ebp - 0x22a]
call fcn.004297f0
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 0x14
call fcn.00638c34
jmp case.0x638ec5.0
push 1
mov ecx, 0x63a338
mov edx, 0x63a360
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
setg al
and al, byte [0x67ae1e]
je 0x639238
mov eax, 0x63a378
call fcn.00637aac
test al, al
je 0x639238
lea edx, [ebp - 4]
mov eax, 0x2e
call fcn.00638c34
jmp case.0x638ec5.0
cmp dword [0x67ae60], 0
je 0x63924f
mov eax, 0x63a394
call fcn.00637aac
test al, al
je 0x639261
lea edx, [ebp - 4]
mov eax, 5
call fcn.00638c34
jmp case.0x638ec5.0
movzx eax, byte [0x63a3a4]
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x230]
mov al, 0x36
call fcn.00638e84
mov eax, dword [ebp - 0x230]
push eax
lea edx, [ebp - 0x234]
mov eax, 5
call fcn.00638c34
mov eax, dword [ebp - 0x234]
mov ecx, dword [0x67ae60]
pop edx
call fcn.0043159c
jmp case.0x638ec5.0
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x238]
mov al, 3
call fcn.00638e84
mov eax, dword [ebp - 0x238]
mov ecx, 2
mov edx, 1
call fcn.0040c394
jmp case.0x638ec5.0
lea edx, [ebp - 0x23c]
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610ffc
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 4]
call fcn.00429180
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x450]
call fcn.005513f8
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 9
call fcn.00638c34
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 6
call fcn.00638c34
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 0x1f
call fcn.00638c34
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 0x15
call fcn.00638c34
jmp case.0x638ec5.0
push 1
mov ecx, 0x63a338
mov edx, 0x63a360
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
setg al
and al, byte [0x67ae1e]
je 0x63939a
mov eax, 0x63a378
call fcn.00637aac
test al, al
je 0x63939a
lea edx, [ebp - 4]
mov eax, 0x23
call fcn.00638c34
jmp case.0x638ec5.0
cmp dword [0x67ae60], 0
je 0x6393b1
mov eax, 0x63a394
call fcn.00637aac
test al, al
je 0x6393c3
lea edx, [ebp - 4]
mov eax, 0x1a
call fcn.00638c34
jmp case.0x638ec5.0
movzx eax, byte [0x63a3a4]
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x240]
mov al, 0x36
call fcn.00638e84
mov eax, dword [ebp - 0x240]
push eax
lea edx, [ebp - 0x244]
mov eax, 0x1a
call fcn.00638c34
mov eax, dword [ebp - 0x244]
mov ecx, dword [0x67ae60]
pop edx
call fcn.0043159c
jmp case.0x638ec5.0
xor eax, eax
push ebp
push 0x6394ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515134]
call fcn.00516280
mov dword [ebp - 0x10], eax
cmp byte [0x67ae18], 0
je 0x63943c
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x639446
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00516368
xor ecx, ecx
mov edx, 0x63a3b4
mov eax, dword [ebp - 0x10]
call fcn.005164c4
test al, al
je 0x6394b2
mov edx, 0x63a444
mov eax, dword [ebp - 0x10]
call fcn.00517424
test al, al
je 0x639489
lea ecx, [ebp - 4]
mov edx, 0x63a444
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
jmp 0x6394aa
mov edx, 0x63a470
mov eax, dword [ebp - 0x10]
call fcn.00517424
test al, al
je 0x6394aa
lea ecx, [ebp - 4]
mov edx, 0x63a470
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
mov eax, dword [ebp - 0x10]
call fcn.00516338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x638ec5.0
mov eax, dword [ebp - 0x10]
call fcn.00409670
pop eax
jmp eax
lea edx, [ebp - 0x248]
mov al, 0x12
call fcn.00638e84
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 4]
call fcn.00429180
jmp case.0x638ec5.0
lea edx, [ebp - 4]
xor eax, eax
call fcn.00638c34
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 0xb
call fcn.00638c34
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 2
call fcn.00638c34
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 7
call fcn.00638c34
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 0x19
call fcn.00638c34
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 0x16
call fcn.00638c34
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 0x17
call fcn.00638c34
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 0x18
call fcn.00638c34
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, dword [0x67ae64]
call fcn.0040b898
jmp case.0x638ec5.0
lea edx, [ebp - 0x24c]
mov al, 0xf
call fcn.00638e84
mov edx, dword [ebp - 0x24c]
lea eax, [ebp - 4]
mov ecx, 0x63a498
call fcn.0040c224
jmp case.0x638ec5.0
push 0
lea eax, [ebp - 0x250]
push eax
mov ecx, 0x63a4f8
mov edx, 0x63a360
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 4]
call fcn.00638c78
jmp case.0x638ec5.0
push 0
lea eax, [ebp - 0x258]
push eax
mov ecx, 0x63a514
mov edx, 0x63a360
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x258]
lea edx, [ebp - 0x254]
call fcn.00638c78
mov eax, dword [ebp - 0x254]
lea edx, [ebp - 4]
call fcn.0063acc0
jmp case.0x638ec5.0
push 0
lea eax, [ebp - 0x25c]
push eax
mov ecx, 0x63a538
mov edx, 0x63a360
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x25c]
lea edx, [ebp - 4]
call fcn.00638c78
jmp case.0x638ec5.0
push 0
lea eax, [ebp - 0x260]
push eax
mov ecx, 0x63a55c
mov edx, 0x63a360
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x260]
lea edx, [ebp - 4]
call fcn.00638c78
jmp case.0x638ec5.0
push 0
lea eax, [ebp - 0x264]
push eax
mov ecx, 0x63a578
mov edx, 0x63a360
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x264]
lea edx, [ebp - 4]
call fcn.00638c78
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, dword [0x67ae54]
call fcn.0040b898
cmp dword [ebp - 4], 0
jne case.0x638ec5.0
lea edx, [ebp - 4]
mov al, 0x36
call fcn.00638e84
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x4a0]
call fcn.005513f8
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x488]
call fcn.005513f8
jmp case.0x638ec5.0
call fcn.0042b640
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 4]
mov eax, dword [0x6733a8]
call fcn.0042c5f4
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 0x1c
call fcn.00638c34
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, 0x23
call fcn.00638c34
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov al, 0x3c
call fcn.00638e84
jmp case.0x638ec5.0
xor eax, eax
push ebp
push 0x6397ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515134]
call fcn.00516280
mov dword [ebp - 0x10], eax
cmp byte [0x67ae18], 1
jne 0x639794
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x63979e
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516368
xor ecx, ecx
mov edx, 0x63a59c
mov eax, dword [ebp - 0x10]
call fcn.005164c4
test al, al
je 0x6397e7
mov edx, 0x63a62c
mov eax, dword [ebp - 0x10]
call fcn.00517424
test al, al
je 0x6397df
lea ecx, [ebp - 4]
mov edx, 0x63a62c
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
mov eax, dword [ebp - 0x10]
call fcn.00516338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x638ec5.0
mov eax, dword [ebp - 0x10]
call fcn.00409670
pop eax
jmp eax
lea edx, [ebp - 0x268]
mov al, 0x16
call fcn.00638e84
mov eax, dword [ebp - 0x268]
lea edx, [ebp - 4]
call fcn.00429180
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x4a8]
call fcn.005513f8
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x478]
call fcn.005513f8
jmp case.0x638ec5.0
xor eax, eax
push ebp
push 0x63988b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x63a65c
mov edx, 0x63a670
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp case.0x638ec5.0
xor eax, eax
push ebp
push 0x6398cf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x63a688
mov edx, 0x63a670
mov eax, dword [0x67ae10]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, dword [0x67ae44]
call fcn.0040b898
jmp case.0x638ec5.0
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
lea edx, [ebp - 4]
call fcn.00427cb8
jmp case.0x638ec5.0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x63a69c
mov edx, 0x63a360
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610ffc
jmp case.0x638ec5.0
xor eax, eax
push ebp
push 0x6399e8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515134]
call fcn.00516280
mov dword [ebp - 0x10], eax
cmp byte [0x67ae18], 1
jne 0x63996b
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x639975
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516368
xor ecx, ecx
mov edx, 0x63a280
mov eax, dword [ebp - 0x10]
call fcn.005164c4
test al, al
je 0x6399d0
mov edx, 0x63a6b4
mov eax, dword [ebp - 0x10]
call fcn.00517424
test al, al
je 0x6399b8
lea ecx, [ebp - 4]
mov edx, 0x63a6b4
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
jmp 0x6399c8
lea ecx, [ebp - 4]
mov edx, 0x63a2e0
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
mov eax, dword [ebp - 0x10]
call fcn.00516338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x638ec5.0
mov eax, dword [ebp - 0x10]
call fcn.00409670
pop eax
jmp eax
lea edx, [ebp - 0x26c]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x450]
call fcn.005513f8
cmp dword [ebp - 0x26c], 0
je 0x639a99
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x639a92
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x450]
call fcn.005513f8
lea edx, [ebp - 0x270]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x450]
call fcn.005513f8
mov eax, dword [ebp - 0x270]
mov ecx, 1
mov edx, eax
mov eax, 0x63a6e0
call fcn.0040c4f0
mov ebx, eax
lea eax, [ebp - 4]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040c394
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x638ec5.0
lea eax, [ebp - 8]
call fcn.0040b460
pop eax
jmp eax
lea eax, [ebp - 4]
mov edx, 0x63a6f0
call fcn.0040b898
jmp case.0x638ec5.0
push 0xff
lea eax, [ebp - 0x22a]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea edx, [ebp - 4]
lea eax, [ebp - 0x22a]
call fcn.004297f0
jmp case.0x638ec5.0
xor eax, eax
push ebp
push 0x639b7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515134]
call fcn.00516280
mov dword [ebp - 0x10], eax
cmp byte [0x67ae18], 1
jne 0x639b01
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x639b0b
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516368
xor ecx, ecx
mov edx, 0x63a280
mov eax, dword [ebp - 0x10]
call fcn.005164c4
test al, al
je 0x639b66
mov edx, 0x63a704
mov eax, dword [ebp - 0x10]
call fcn.00517424
test al, al
je 0x639b4e
lea ecx, [ebp - 4]
mov edx, 0x63a704
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
jmp 0x639b5e
lea ecx, [ebp - 4]
mov edx, 0x63a2e0
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
mov eax, dword [ebp - 0x10]
call fcn.00516338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x638ec5.0
mov eax, dword [ebp - 0x10]
call fcn.00409670
pop eax
jmp eax
lea edx, [ebp - 0x274]
mov eax, 0x28
call fcn.00638c34
mov eax, dword [ebp - 0x274]
lea edx, [ebp - 4]
call fcn.004292a4
jmp case.0x638ec5.0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x63a73c
mov edx, 0x63a360
mov eax, dword [0x67ae0c]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp case.0x638ec5.0
xor eax, eax
push ebp
push 0x639c64
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515134]
call fcn.00516280
mov dword [ebp - 0x10], eax
cmp byte [0x67ae18], 1
jne 0x639bf9
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x639c03
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00516368
xor ecx, ecx
mov edx, 0x63a3b4
mov eax, dword [ebp - 0x10]
call fcn.005164c4
test al, al
je 0x639c4c
mov edx, 0x63a754
mov eax, dword [ebp - 0x10]
call fcn.00517424
test al, al
je 0x639c44
lea ecx, [ebp - 4]
mov edx, 0x63a754
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
mov eax, dword [ebp - 0x10]
call fcn.00516338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x638ec5.0
mov eax, dword [ebp - 0x10]
call fcn.00409670
pop eax
jmp eax
xor eax, eax
push ebp
push 0x639d08
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515134]
call fcn.00516280
mov dword [ebp - 0x10], eax
cmp byte [0x67ae18], 1
jne 0x639c9d
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x639ca7
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00516368
xor ecx, ecx
mov edx, 0x63a3b4
mov eax, dword [ebp - 0x10]
call fcn.005164c4
test al, al
je 0x639cf0
mov edx, 0x63a778
mov eax, dword [ebp - 0x10]
call fcn.00517424
test al, al
je 0x639ce8
lea ecx, [ebp - 4]
mov edx, 0x63a778
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
mov eax, dword [ebp - 0x10]
call fcn.00516338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x638ec5.0
mov eax, dword [ebp - 0x10]
call fcn.00409670
pop eax
jmp eax
xor eax, eax
push ebp
push 0x639dac
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515134]
call fcn.00516280
mov dword [ebp - 0x10], eax
cmp byte [0x67ae18], 1
jne 0x639d41
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x639d4b
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516368
xor ecx, ecx
mov edx, 0x63a59c
mov eax, dword [ebp - 0x10]
call fcn.005164c4
test al, al
je 0x639d94
mov edx, 0x63a798
mov eax, dword [ebp - 0x10]
call fcn.00517424
test al, al
je 0x639d8c
lea ecx, [ebp - 4]
mov edx, 0x63a798
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
mov eax, dword [ebp - 0x10]
call fcn.00516338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x638ec5.0
mov eax, dword [ebp - 0x10]
call fcn.00409670
pop eax
jmp eax
xor eax, eax
push ebp
push 0x639e50
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515134]
call fcn.00516280
mov dword [ebp - 0x10], eax
cmp byte [0x67ae18], 1
jne 0x639de5
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x639def
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516368
xor ecx, ecx
mov edx, 0x63a59c
mov eax, dword [ebp - 0x10]
call fcn.005164c4
test al, al
je 0x639e38
mov edx, 0x63a7c4
mov eax, dword [ebp - 0x10]
call fcn.00517424
test al, al
je 0x639e30
lea ecx, [ebp - 4]
mov edx, 0x63a7c4
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
mov eax, dword [ebp - 0x10]
call fcn.00516338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x638ec5.0
mov eax, dword [ebp - 0x10]
call fcn.00409670
pop eax
jmp eax
xor eax, eax
push ebp
push 0x639ef4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515134]
call fcn.00516280
mov dword [ebp - 0x10], eax
cmp byte [0x67ae18], 0
je 0x639e89
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x639e93
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516368
xor ecx, ecx
mov edx, 0x63a59c
mov eax, dword [ebp - 0x10]
call fcn.005164c4
test al, al
je 0x639edc
mov edx, 0x63a7e8
mov eax, dword [ebp - 0x10]
call fcn.00517424
test al, al
je 0x639ed4
lea ecx, [ebp - 4]
mov edx, 0x63a7e8
mov eax, dword [ebp - 0x10]
call fcn.00516e8c
mov eax, dword [ebp - 0x10]
call fcn.00516338
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x638ec5.0
mov eax, dword [ebp - 0x10]
call fcn.00409670
pop eax
jmp eax
call fcn.0042b640
fstp qword [ebp - 0x20]
wait
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea ecx, [ebp - 4]
mov edx, dword [0x6733a8]
mov eax, 0x63a818
call fcn.0042c65c
jmp case.0x638ec5.0
lea edx, [ebp - 0x278]
mov eax, dword [0x6732d4]
mov eax, dword [eax]
call fcn.00610ffc
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 4]
call fcn.004292a4
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, dword [0x67ae4c]
call fcn.0040b898
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, dword [0x67ae58]
call fcn.0040b898
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, dword [0x67ae5c]
call fcn.0040b898
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, dword [0x67ae40]
call fcn.0040b898
jmp case.0x638ec5.0
lea eax, [ebp - 4]
call fcn.00644080
jmp case.0x638ec5.0
lea eax, [ebp - 4]
call fcn.00638740
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, dword [0x67ae6c]
call fcn.0040b898
jmp case.0x638ec5.0
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x4c0]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x639fe9
lea eax, [ebp - 4]
mov edx, 0x63a838
call fcn.0040b898
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, 0x63a848
call fcn.0040b898
jmp case.0x638ec5.0
cmp byte [0x67ae22], 0
je 0x63a016
lea eax, [ebp - 4]
mov edx, 0x63a838
call fcn.0040b898
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, 0x63a848
call fcn.0040b898
jmp case.0x638ec5.0
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x4ec]
mov edx, dword [eax]
call dword [edx + 0x150]
inc eax
jle 0x63a068
mov eax, dword [0x67add4]
mov ebx, dword [eax + 0x4ec]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x150]
mov edx, eax
lea ecx, [ebp - 4]
mov eax, dword [ebx + 0x2ec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp case.0x638ec5.0
lea eax, [ebp - 4]
call fcn.0040b460
jmp case.0x638ec5.0
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x4ec]
mov edx, dword [eax]
call dword [edx + 0x150]
lea edx, [ebp - 4]
call fcn.00427cb8
jmp case.0x638ec5.0
cmp byte [0x67ae1b], 0
je 0x63a0b0
lea eax, [ebp - 4]
mov edx, 0x63a838
call fcn.0040b898
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, 0x63a848
call fcn.0040b898
jmp case.0x638ec5.0
cmp byte [0x67ae1e], 0
je 0x63a0dd
lea eax, [ebp - 4]
mov edx, 0x63a838
call fcn.0040b898
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, 0x63a848
call fcn.0040b898
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x6721e8]
call fcn.00427cb8
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x6721ec]
call fcn.00427cb8
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x6721f0]
call fcn.00427cb8
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x6721f4]
call fcn.00427cb8
jmp case.0x638ec5.0
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x4c0]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x63a160
lea eax, [ebp - 4]
mov edx, 0x63a838
call fcn.0040b898
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, 0x63a848
call fcn.0040b898
jmp case.0x638ec5.0
cmp byte [0x67ae25], 0
je 0x63a18d
lea eax, [ebp - 4]
mov edx, 0x63a838
call fcn.0040b898
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, 0x63a848
call fcn.0040b898
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x498]
call fcn.005513f8
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x4a8]
call fcn.005513f8
jmp case.0x638ec5.0
lea edx, [ebp - 4]
mov eax, dword [0x67add4]
mov eax, dword [eax + 0x488]
call fcn.005513f8
jmp case.0x638ec5.0
cmp byte [0x67ae22], 0
je 0x63a1f3
lea eax, [ebp - 4]
mov edx, 0x63a858
call fcn.0040b898
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, 0x63a86c
call fcn.0040b898
jmp case.0x638ec5.0
lea eax, [ebp - 4]
mov edx, dword [0x67ae7c]
call fcn.0040b898
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00431198
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63a26a
lea eax, [ebp - 0x278]
mov edx, 2
call fcn.0040b4c0
lea eax, [ebp - 0x270]
mov edx, 2
call fcn.0040b4c0
lea eax, [ebp - 0x268]
mov edx, 0xf
call fcn.0040b4c0
lea eax, [ebp - 4]
call fcn.0040b460
pop eax
jmp eax