Function at 0x63f7cc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1e
push 0
push 0
dec ecx
jne 0x63f7d4
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x63fb3a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dx, 8
mov eax, dword [ebx + 0x320]
call fcn.0054d27c
lea edx, [ebp - 0x10]
mov eax, 3
call fcn.0059ef38
lea eax, [ebp - 0x10]
call fcn.00512cfc
cmp eax, 8
jle 0x63f81a
mov eax, 8
mov edx, eax
mov eax, dword [ebx + 0x320]
call fcn.0054d320
lea edx, [ebp - 0x20]
mov eax, 4
call fcn.0059ef38
lea eax, [ebp - 0x20]
call fcn.00512cfc
mov edx, eax
mov eax, dword [ebx + 0x36c]
call fcn.0054d320
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00594840
mov edx, dword [ebp - 0x24]
mov eax, dword [ebx + 0x324]
call fcn.00568684
lea edx, [ebp - 0x34]
mov eax, 0x10
call fcn.0059ef38
lea eax, [ebp - 0x34]
call fcn.00512cfc
mov edx, eax
mov eax, dword [ebx + 0x380]
call fcn.0054d320
mov ecx, 0x80000001
mov edx, 0x63fb54
mov eax, 0x63fb68
call fcn.00591b24
mov edx, eax
mov eax, dword [ebx + 0x388]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea edx, [ebp - 0x44]
mov eax, 8
call fcn.0059ef38
lea eax, [ebp - 0x44]
call fcn.00514104
mov edx, eax
mov eax, dword [ebx + 0x390]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea edx, [ebp - 0x54]
mov eax, 9
call fcn.0059ef38
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
xor edx, edx
mov cl, 1
call fcn.005164c0
lea edx, [ebp - 0x64]
pop eax
call fcn.00518b6c
sete dl
mov eax, dword [ebx + 0x330]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebx + 0x330]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov edx, eax
xor dl, 1
mov eax, dword [ebx + 0x334]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea edx, [ebp - 0x74]
mov eax, 0xa
call fcn.0059ef38
lea eax, [ebp - 0x74]
call fcn.0051464c
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebx + 0x338]
call fcn.005544fc
lea edx, [ebp - 0x84]
mov eax, 0x14
call fcn.0059ef38
lea eax, [ebp - 0x84]
call fcn.00514104
mov edx, eax
mov eax, dword [ebx + 0x348]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea edx, [ebp - 0x94]
mov eax, 0x15
call fcn.0059ef38
lea eax, [ebp - 0x94]
call fcn.00514104
mov edx, eax
mov eax, dword [ebx + 0x34c]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea edx, [ebp - 0xa4]
mov eax, 0x16
call fcn.0059ef38
lea eax, [ebp - 0xa4]
call fcn.00514104
mov edx, eax
mov eax, dword [ebx + 0x350]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea edx, [ebp - 0xb8]
mov eax, 0x19
call fcn.0059ef38
lea edx, [ebp - 0xb8]
lea eax, [ebp - 0xa8]
call fcn.0051565c
mov edx, dword [ebp - 0xa8]
mov eax, dword [ebx + 0x374]
call fcn.00568684
lea edx, [ebp - 0xc8]
mov eax, 0xc
call fcn.0059ef38
lea eax, [ebp - 0xc8]
call fcn.00514104
mov edx, eax
mov eax, dword [ebx + 0x35c]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebx + 0x35c]
mov edx, dword [eax]
call dword [edx + 0xc8]
mov edx, eax
xor dl, 1
mov eax, dword [ebx + 0x360]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea edx, [ebp - 0xdc]
mov eax, 0xb
call fcn.0059ef38
lea edx, [ebp - 0xdc]
lea eax, [ebp - 0xcc]
call fcn.0051565c
mov edx, dword [ebp - 0xcc]
mov eax, dword [ebx + 0x354]
call fcn.00568684
lea edx, [ebp - 0xf0]
mov eax, 0x2b
call fcn.0059ef38
lea edx, [ebp - 0xf0]
lea eax, [ebp - 0xe0]
call fcn.0051565c
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebx + 0x340]
call fcn.00568684
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63fb44
lea eax, [ebp - 0xf0]
call fcn.00511ff0
lea eax, [ebp - 0xe0]
call fcn.00504b1c
lea eax, [ebp - 0xdc]
call fcn.00511ff0
lea eax, [ebp - 0xcc]
call fcn.00504b1c
lea eax, [ebp - 0xc8]
mov edx, dword [0x501100]
mov ecx, 2
call fcn.005057ac
lea eax, [ebp - 0xa8]
call fcn.00504b1c
lea eax, [ebp - 0xa4]
mov edx, dword [0x501100]
mov ecx, 8
call fcn.005057ac
lea eax, [ebp - 0x24]
call fcn.00504b1c
lea eax, [ebp - 0x20]
mov edx, dword [0x501100]
mov ecx, 2
call fcn.005057ac
ret