Function at 0x644b10
Capabilities:
Get common file path
Identify system language via api
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4f
push 0
push 0
dec ecx
jne 0x644b18
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x645ef3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040b464
mov eax, dword [ebp - 0xc]
call fcn.0040b464
movzx eax, bl
cmp eax, 0x53
ja case.0x644b51.0
jmp dword [eax*4 + 0x644b58]
xor eax, eax
push ebp
push 0x644d45
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x68a220], 0
je 0x644cda
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x644ce4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x645f10
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x644d2d
mov edx, 0x645f70
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x644d25
lea ecx, [ebp - 4]
mov edx, 0x645f70
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644b51.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
xor eax, eax
push ebp
push 0x644de9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x68a220], 0
je 0x644d7e
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x644d88
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x645f10
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x644dd1
mov edx, 0x645f9c
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x644dc9
lea ecx, [ebp - 4]
mov edx, 0x645f9c
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644b51.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
push 0x104
lea eax, [ebp - 0x22a]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
lea edx, [ebp - 4]
lea eax, [ebp - 0x22a]
call fcn.004298e8
jmp case.0x644b51.0
push 0x104
lea eax, [ebp - 0x22a]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea edx, [ebp - 4]
lea eax, [ebp - 0x22a]
call fcn.004298e8
jmp case.0x644b51.0
lea eax, [ebp - 0x22a]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
test eax, eax
je case.0x644b51.0
lea edx, [ebp - 4]
lea eax, [ebp - 0x22a]
call fcn.004298e8
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 0x14
call fcn.006448c4
jmp case.0x644b51.0
push 1
mov ecx, 0x645fc8
mov edx, 0x645ff0
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
setg al
and al, byte [0x68a225]
je 0x644eb8
mov eax, 0x646008
call fcn.00643738
test al, al
je 0x644eb8
lea edx, [ebp - 4]
mov eax, 0x2e
call fcn.006448c4
jmp case.0x644b51.0
cmp dword [0x68a268], 0
je 0x644ecf
mov eax, 0x646024
call fcn.00643738
test al, al
je 0x644ee1
lea edx, [ebp - 4]
mov eax, 5
call fcn.006448c4
jmp case.0x644b51.0
movzx eax, byte [0x646034]
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x230]
mov al, 0x36
call fcn.00644b10
mov eax, dword [ebp - 0x230]
push eax
lea edx, [ebp - 0x234]
mov eax, 5
call fcn.006448c4
mov eax, dword [ebp - 0x234]
mov ecx, dword [0x68a268]
pop edx
call fcn.00431694
jmp case.0x644b51.0
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x238]
mov al, 3
call fcn.00644b10
mov eax, dword [ebp - 0x238]
mov ecx, 2
mov edx, 1
call fcn.0040c3d0
jmp case.0x644b51.0
lea edx, [ebp - 0x23c]
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.0061111c
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 4]
call fcn.00429260
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x450]
call fcn.00551518
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 9
call fcn.006448c4
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 6
call fcn.006448c4
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 0x1f
call fcn.006448c4
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 0x15
call fcn.006448c4
jmp case.0x644b51.0
push 1
mov ecx, 0x645fc8
mov edx, 0x645ff0
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
dec eax
setg al
and al, byte [0x68a225]
je 0x64501a
mov eax, 0x646008
call fcn.00643738
test al, al
je 0x64501a
lea edx, [ebp - 4]
mov eax, 0x23
call fcn.006448c4
jmp case.0x644b51.0
cmp dword [0x68a268], 0
je 0x645031
mov eax, 0x646024
call fcn.00643738
test al, al
je 0x645043
lea edx, [ebp - 4]
mov eax, 0x1a
call fcn.006448c4
jmp case.0x644b51.0
movzx eax, byte [0x646034]
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x240]
mov al, 0x36
call fcn.00644b10
mov eax, dword [ebp - 0x240]
push eax
lea edx, [ebp - 0x244]
mov eax, 0x1a
call fcn.006448c4
mov eax, dword [ebp - 0x244]
mov ecx, dword [0x68a268]
pop edx
call fcn.00431694
jmp case.0x644b51.0
xor eax, eax
push ebp
push 0x64514a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x68a220], 0
je 0x6450bc
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x6450c6
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x646044
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x645132
mov edx, 0x6460d4
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645109
lea ecx, [ebp - 4]
mov edx, 0x6460d4
mov eax, dword [ebp - 0x10]
call fcn.00516fac
jmp 0x64512a
mov edx, 0x646100
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x64512a
lea ecx, [ebp - 4]
mov edx, 0x646100
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644b51.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
lea edx, [ebp - 0x248]
mov al, 0x12
call fcn.00644b10
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 4]
call fcn.00429260
jmp case.0x644b51.0
lea edx, [ebp - 4]
xor eax, eax
call fcn.006448c4
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 0xb
call fcn.006448c4
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 2
call fcn.006448c4
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 7
call fcn.006448c4
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 0x19
call fcn.006448c4
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 0x16
call fcn.006448c4
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 0x17
call fcn.006448c4
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 0x18
call fcn.006448c4
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, dword [0x68a26c]
call fcn.0040b89c
jmp case.0x644b51.0
lea edx, [ebp - 0x24c]
mov al, 0xf
call fcn.00644b10
mov edx, dword [ebp - 0x24c]
lea eax, [ebp - 4]
mov ecx, 0x646128
call fcn.0040c260
jmp case.0x644b51.0
push 0
lea eax, [ebp - 0x250]
push eax
mov ecx, 0x646188
mov edx, 0x645ff0
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x250]
lea edx, [ebp - 4]
call fcn.00644908
jmp case.0x644b51.0
push 0
lea eax, [ebp - 0x258]
push eax
mov ecx, 0x6461a4
mov edx, 0x645ff0
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x258]
lea edx, [ebp - 0x254]
call fcn.00644908
mov eax, dword [ebp - 0x254]
lea edx, [ebp - 4]
call fcn.00646978
jmp case.0x644b51.0
push 0
lea eax, [ebp - 0x25c]
push eax
mov ecx, 0x6461c8
mov edx, 0x645ff0
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x25c]
lea edx, [ebp - 4]
call fcn.00644908
jmp case.0x644b51.0
push 0
lea eax, [ebp - 0x260]
push eax
mov ecx, 0x6461ec
mov edx, 0x645ff0
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x260]
lea edx, [ebp - 4]
call fcn.00644908
jmp case.0x644b51.0
push 0
lea eax, [ebp - 0x264]
push eax
mov ecx, 0x646208
mov edx, 0x645ff0
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x264]
lea edx, [ebp - 4]
call fcn.00644908
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x498]
call fcn.00551518
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x4a4]
call fcn.00551518
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x488]
call fcn.00551518
jmp case.0x644b51.0
call fcn.0042b738
fstp qword [ebp - 0x18]
wait
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea edx, [ebp - 4]
mov eax, dword [0x682510]
call fcn.0042c6ec
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 0x1c
call fcn.006448c4
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, 0x23
call fcn.006448c4
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov al, 0x3c
call fcn.00644b10
jmp case.0x644b51.0
xor eax, eax
push ebp
push 0x645470
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x68a220], 1
jne 0x645405
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x64540f
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x64622c
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x645458
mov edx, 0x6462bc
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645450
lea ecx, [ebp - 4]
mov edx, 0x6462bc
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644b51.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
lea edx, [ebp - 0x268]
mov al, 0x16
call fcn.00644b10
mov eax, dword [ebp - 0x268]
lea edx, [ebp - 4]
call fcn.00429260
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x4a4]
call fcn.00551518
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x478]
call fcn.00551518
jmp case.0x644b51.0
xor eax, eax
push ebp
push 0x6454fc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x6462ec
mov edx, 0x646300
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp case.0x644b51.0
xor eax, eax
push ebp
push 0x645540
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x646318
mov edx, 0x646300
mov eax, dword [0x68a218]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, dword [0x68a250]
call fcn.0040b89c
jmp case.0x644b51.0
push 0
mov ecx, 0x64632c
mov edx, 0x645ff0
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 0x10]
sub eax, 1
jb 0x64558a
je 0x64559f
dec eax
je 0x6455b4
dec eax
je 0x6455c9
jmp case.0x644b51.0
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
lea edx, [ebp - 4]
call fcn.00427d98
jmp case.0x644b51.0
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
lea edx, [ebp - 4]
call fcn.00427d98
jmp case.0x644b51.0
call sub.kernel32.dll_GetSystemDefaultUILanguage
movzx eax, ax
lea edx, [ebp - 4]
call fcn.00427d98
jmp case.0x644b51.0
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
lea edx, [ebp - 4]
call fcn.00427d98
jmp case.0x644b51.0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x646354
mov edx, 0x645ff0
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.0061111c
jmp case.0x644b51.0
xor eax, eax
push ebp
push 0x6456c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x68a220], 1
jne 0x645643
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x64564d
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x645f10
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x6456a8
mov edx, 0x64636c
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645690
lea ecx, [ebp - 4]
mov edx, 0x64636c
mov eax, dword [ebp - 0x10]
call fcn.00516fac
jmp 0x6456a0
lea ecx, [ebp - 4]
mov edx, 0x645f70
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644b51.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
lea edx, [ebp - 0x26c]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x450]
call fcn.00551518
cmp dword [ebp - 0x26c], 0
je 0x645771
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x64576a
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 8]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x450]
call fcn.00551518
lea edx, [ebp - 0x270]
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x450]
call fcn.00551518
mov eax, dword [ebp - 0x270]
mov ecx, 1
mov edx, eax
mov eax, 0x646398
call fcn.0040c52c
mov ebx, eax
lea eax, [ebp - 4]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040c3d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644b51.0
lea eax, [ebp - 8]
call fcn.0040b464
pop eax
jmp eax
lea eax, [ebp - 4]
mov edx, 0x6463a8
call fcn.0040b89c
jmp case.0x644b51.0
push 0xff
lea eax, [ebp - 0x22a]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
lea edx, [ebp - 4]
lea eax, [ebp - 0x22a]
call fcn.004298e8
jmp case.0x644b51.0
xor eax, eax
push ebp
push 0x645856
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x68a220], 1
jne 0x6457d9
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x6457e3
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x645f10
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x64583e
mov edx, 0x6463bc
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645826
lea ecx, [ebp - 4]
mov edx, 0x6463bc
mov eax, dword [ebp - 0x10]
call fcn.00516fac
jmp 0x645836
lea ecx, [ebp - 4]
mov edx, 0x645f70
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644b51.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
lea edx, [ebp - 0x274]
mov eax, 0x28
call fcn.006448c4
mov eax, dword [ebp - 0x274]
lea edx, [ebp - 4]
call fcn.00429384
jmp case.0x644b51.0
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x6463f4
mov edx, 0x645ff0
mov eax, dword [0x68a214]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp case.0x644b51.0
xor eax, eax
push ebp
push 0x64593c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x68a220], 1
jne 0x6458d1
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x6458db
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x646044
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x645924
mov edx, 0x64640c
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x64591c
lea ecx, [ebp - 4]
mov edx, 0x64640c
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644b51.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
xor eax, eax
push ebp
push 0x6459e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x68a220], 1
jne 0x645975
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x64597f
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000001
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x646044
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x6459c8
mov edx, 0x646430
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x6459c0
lea ecx, [ebp - 4]
mov edx, 0x646430
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644b51.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
xor eax, eax
push ebp
push 0x645a84
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x68a220], 1
jne 0x645a19
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x645a23
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x64622c
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x645a6c
mov edx, 0x646450
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645a64
lea ecx, [ebp - 4]
mov edx, 0x646450
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644b51.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
xor eax, eax
push ebp
push 0x645b28
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x68a220], 1
jne 0x645abd
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x645ac7
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x64622c
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x645b10
mov edx, 0x64647c
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645b08
lea ecx, [ebp - 4]
mov edx, 0x64647c
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644b51.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
xor eax, eax
push ebp
push 0x645bcc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x515254]
call fcn.005163a0
mov dword [ebp - 0x10], eax
cmp byte [0x68a220], 0
je 0x645b61
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20119
jmp 0x645b6b
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0x20019
mov edx, 0x80000002
mov eax, dword [ebp - 0x10]
call fcn.00516488
xor ecx, ecx
mov edx, 0x64622c
mov eax, dword [ebp - 0x10]
call fcn.005165e4
test al, al
je 0x645bb4
mov edx, 0x6464a0
mov eax, dword [ebp - 0x10]
call fcn.00517544
test al, al
je 0x645bac
lea ecx, [ebp - 4]
mov edx, 0x6464a0
mov eax, dword [ebp - 0x10]
call fcn.00516fac
mov eax, dword [ebp - 0x10]
call fcn.00516458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push case.0x644b51.0
mov eax, dword [ebp - 0x10]
call fcn.00409674
pop eax
jmp eax
call fcn.0042b738
fstp qword [ebp - 0x20]
wait
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
lea ecx, [ebp - 4]
mov edx, dword [0x682510]
mov eax, 0x6464d0
call fcn.0042c754
jmp case.0x644b51.0
lea edx, [ebp - 0x278]
mov eax, dword [0x682434]
mov eax, dword [eax]
call fcn.0061111c
mov eax, dword [ebp - 0x278]
lea edx, [ebp - 4]
call fcn.00429384
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, dword [0x68a258]
call fcn.0040b89c
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, dword [0x68a260]
call fcn.0040b89c
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, dword [0x68a264]
call fcn.0040b89c
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, dword [0x68a24c]
call fcn.0040b89c
jmp case.0x644b51.0
lea eax, [ebp - 4]
call fcn.006502e0
jmp case.0x644b51.0
lea eax, [ebp - 4]
call fcn.006443e4
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, dword [0x68a274]
call fcn.0040b89c
jmp case.0x644b51.0
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x4bc]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x645cc1
lea eax, [ebp - 4]
mov edx, 0x6464f0
call fcn.0040b89c
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, 0x646500
call fcn.0040b89c
jmp case.0x644b51.0
cmp byte [0x68a22c], 0
je 0x645cee
lea eax, [ebp - 4]
mov edx, 0x6464f0
call fcn.0040b89c
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, 0x646500
call fcn.0040b89c
jmp case.0x644b51.0
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x4e8]
mov edx, dword [eax]
call dword [edx + 0x150]
inc eax
jle 0x645d40
mov eax, dword [0x68a1e0]
mov ebx, dword [eax + 0x4e8]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x150]
mov edx, eax
lea ecx, [ebp - 4]
mov eax, dword [ebx + 0x2ec]
mov ebx, dword [eax]
call dword [ebx + 0xc]
jmp case.0x644b51.0
lea eax, [ebp - 4]
call fcn.0040b464
jmp case.0x644b51.0
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x4e8]
mov edx, dword [eax]
call dword [edx + 0x150]
lea edx, [ebp - 4]
call fcn.00427d98
jmp case.0x644b51.0
cmp byte [0x68a223], 0
je 0x645d88
lea eax, [ebp - 4]
mov edx, 0x6464f0
call fcn.0040b89c
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, 0x646500
call fcn.0040b89c
jmp case.0x644b51.0
cmp byte [0x68a225], 0
je 0x645db5
lea eax, [ebp - 4]
mov edx, 0x6464f0
call fcn.0040b89c
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, 0x646500
call fcn.0040b89c
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, dword [0x681350]
call fcn.00427d98
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, dword [0x681354]
call fcn.00427d98
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, dword [0x681358]
call fcn.00427d98
jmp case.0x644b51.0
lea edx, [ebp - 4]
mov eax, dword [0x68135c]
call fcn.00427d98
jmp case.0x644b51.0
mov eax, dword [0x68a1e0]
mov eax, dword [eax + 0x4bc]
mov edx, dword [eax]
call dword [edx + 0x150]
test al, al
je 0x645e35
lea eax, [ebp - 4]
mov edx, 0x6464f0
call fcn.0040b89c
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, 0x646500
call fcn.0040b89c
jmp case.0x644b51.0
cmp byte [0x68a22f], 0
je 0x645e5c
lea eax, [ebp - 4]
mov edx, 0x6464f0
call fcn.0040b89c
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, 0x646500
call fcn.0040b89c
jmp case.0x644b51.0
cmp byte [0x68a22c], 0
je 0x645e83
lea eax, [ebp - 4]
mov edx, 0x646510
call fcn.0040b89c
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, 0x646524
call fcn.0040b89c
jmp case.0x644b51.0
lea eax, [ebp - 4]
mov edx, dword [0x68a284]
call fcn.0040b89c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00431290
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x645efa
lea eax, [ebp - 0x278]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x270]
mov edx, 2
call fcn.0040b4c4
lea eax, [ebp - 0x268]
mov edx, 0xf
call fcn.0040b4c4
lea eax, [ebp - 4]
call fcn.0040b464
pop eax
jmp eax