Function at 0x497990
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get keyboard layout
Get system information on windows
Identify system language via api
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x4da2c5
push eax
mov eax, 0x27c8
mov dword fs:[0], esp
call fcn.004a7790
push ebx
push esi
mov dword [ebp - 0x10], 0
mov ebx, ecx
mov esi, dword [ebp + 8]
push edi
push str.System_Info_n_________________________________________n
push dword [esi]
call fcn.004aa979
push 0
call fcn.0049e2e0
push eax
call fcn.00494840
add esp, 0x10
mov ecx, ebx
push eax
call fcn.004952a0
push eax
push str.OS_Platform_______________s__s_n
push dword [esi]
call fcn.004aa979
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0x1bc], ax
lea eax, [ebp - 0x1ba]
push eax
call fcn.004a4860
add esp, 0x1c
mov dword [ebp + 8], 0xc8
lea ecx, [ebp - 0x2c]
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00491710
cmp dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
je 0x497af1
push 0
push 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1bc]
push eax
push 0x4e7f88
lea ecx, [ebp - 0x28]
call fcn.004a1110
test eax, eax
je 0x497a72
lea eax, [ebp - 0x1bc]
push eax
push str.OS_Product_Name___________s_n
push dword [esi]
call fcn.004aa979
add esp, 0xc
push 0
push 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1bc]
push eax
push str.CSDVersion
lea ecx, [ebp - 0x28]
call fcn.004a1110
test eax, eax
je 0x497aa8
lea eax, [ebp - 0x1bc]
push eax
push str.OS_Service_Pack___________s_n
push dword [esi]
call fcn.004aa979
add esp, 0xc
push 0
push 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1bc]
push eax
push str.CurrentVersion
lea ecx, [ebp - 0x28]
call fcn.004a1110
test eax, eax
je 0x497af1
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
call fcn.0049e2e0
push dword [ebp - 0x10]
lea eax, [ebp - 0x1bc]
push eax
push str.OS_Build_Version__________s._d_n
push dword [esi]
call fcn.004aa979
add esp, 0x14
push 0
call fcn.0049e5b0
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00492410
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 1
jb 0x497b11
mov eax, dword [eax]
push eax
push 0
call fcn.0049e2e0
add esp, 4
push eax
push str.OS_GetOS_Reg_Settings_____d__s_n
push dword [esi]
call fcn.004aa979
add esp, 0x10
cmp dword [ebp - 0x30], 8
jb 0x497b3d
push dword [ebp - 0x44]
call fcn.004a46e7
add esp, 4
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00491a30
lea eax, [ebp - 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edi, dword [ebp - 0xf4]
mov ecx, ebx
push edi
call fcn.004953e0
push eax
movzx eax, di
push eax
push str.Processor_Architecture___0x_x___s_n
push dword [esi]
call fcn.004aa979
add esp, 0x10
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x497bad
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x70]
push eax
push str.Screen_Resolution_________d_by__d_n
push dword [esi]
call fcn.004aa979
add esp, 0x10
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp + 8], eax
test eax, eax
je 0x497bea
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x5a
push eax
call edi
push eax
push 0x58
push dword [ebp + 8]
call edi
push eax
push str.System_DPI_Settings_______d_by__d_n
push dword [esi]
call fcn.004aa979
add esp, 0x10
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx edi, ax
push edi
call fcn.0049f9c0
push eax
push edi
push str.OS_Install_______________0x_x___s_n
push dword [esi]
call fcn.004aa979
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx edi, ax
push edi
call fcn.0049f9c0
push eax
push edi
push str.Current_Display_Language_0x_x___s_n
push dword [esi]
call fcn.004aa979
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx edi, ax
push edi
call fcn.0049f9c0
push eax
push edi
push str.System_Default_Locale____0x_x___s_n
push dword [esi]
call fcn.004aa979
add esp, 0x14
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
movzx edi, ax
push edi
call fcn.0049f9c0
push eax
push edi
push str.Keyboard_Layout_Language_0x_x___s_n
push dword [esi]
call fcn.004aa979
add esp, 0x14
mov ecx, ebx
push dword [esi]
call fcn.004942b0
cmp dword [ebx], 0
mov dword [ebp - 0x14], 0xffffffff
je 0x497cd0
mov eax, dword [ebx]
lea edx, [ebp - 0x14]
push edx
push 0
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jne 0x497cd0
push dword [ebp - 0x14]
push str._nDevice__i_n_________________________________________n
push dword [esi]
call fcn.004aa979
add esp, 0xc
mov ecx, ebx
push 0
push dword [ebp - 0x14]
call fcn.00495c50
mov edi, eax
push edi
push 0x4df884
push dword [esi]
call fcn.004aa979
push edi
call fcn.004a6088
add esp, 0x10
cmp dword [ebx], 0
jne 0x497c81
push str._nProgram_Files_n_________________________________________n
push dword [esi]
call fcn.004aa979
add esp, 8
lea ecx, [ebp - 0xd0]
call fcn.004917a0
push 0
push 0
push 0
push str.SoftwareSynapticsSynTPInstall
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0xd0]
mov dword [ebp - 4], 2
mov dword [ebp - 0x48], 0x2000
call fcn.004948e0
test eax, eax
je 0x497d56
push 0
push 0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x27d4]
push eax
push str.ProgDir
lea ecx, [ebp - 0xcc]
call fcn.004a1110
test eax, eax
je 0x497d56
push 1
push 0x4e1288
push 0x4db8b8
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push eax
push dword [esi]
call fcn.00494ea0
push str._nSystem_Files_n_________________________________________n
push dword [esi]
call fcn.004aa979
push str.SystemRoot
call fcn.004abafa
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x497d9d
push str.WinDir
call fcn.004abafa
mov edi, eax
add esp, 4
test edi, edi
jne 0x497d9d
mov edi, str.C:WINDOWS
push edi
push str.Cannot_get_environment_variable_for_SYSTEMROOT__assume__s_n
push dword [esi]
call fcn.004aa979
add esp, 0xc
push 0
call fcn.0049e2e0
add esp, 4
mov ecx, ebx
push 1
push str.SynTPCo.
cmp eax, 5
jl 0x497e12
push str.System32
push edi
push dword [esi]
call fcn.00494ea0
push 1
push str.SxSSynTPCo.
push str.System32
push edi
push dword [esi]
mov ecx, ebx
call fcn.00494ea0
push 1
push str.SynTPAPI.
push str.System32
push edi
push dword [esi]
mov ecx, ebx
call fcn.00494ea0
push 1
push str.SynTPCOM.
push str.System32
push edi
push dword [esi]
mov ecx, ebx
call fcn.00494ea0
push 1
push str.SynCom.
push str.System32
jmp 0x497e57
push str.System
push edi
push dword [esi]
call fcn.00494ea0
push 1
push str.SynTPAPI.
push str.System
push edi
push dword [esi]
mov ecx, ebx
call fcn.00494ea0
push 1
push str.SynTPCOM.
push str.System
push edi
push dword [esi]
mov ecx, ebx
call fcn.00494ea0
push 1
push str.SynCom.
push str.System
push edi
push dword [esi]
mov ecx, ebx
call fcn.00494ea0
push 1
push str.SynTP.sys
push str.System32Drivers
push edi
push dword [esi]
mov ecx, ebx
call fcn.00494ea0
push 1
push str.SynRMIHID.sys
push str.System32Drivers
push edi
push dword [esi]
mov ecx, ebx
call fcn.00494ea0
push 1
push str.smb_driver_.sys
push str.System32Drivers
push edi
push dword [esi]
mov ecx, ebx
call fcn.00494ea0
push 1
push str.i8042prt.sys
push str.System32Drivers
push edi
push dword [esi]
mov ecx, ebx
call fcn.00494ea0
lea eax, [ebp - 0x27d4]
push 0x2000
push eax
call fcn.00493730
add esp, 8
test eax, eax
je 0x497f18
push str._nx64_System_Files_n_________________________________________n
push dword [esi]
call fcn.004aa979
add esp, 8
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push 1
push str..
push str.SynTPCOM.
push eax
push dword [esi]
call fcn.00494ea0
push 1
push str..
push str.SynCOM.
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push eax
push dword [esi]
call fcn.00494ea0
push str._nSynaptics_Files_found_in_PATH_n_________________________________________n
push dword [esi]
call fcn.004aa979
push str.PATH
mov dword [ebp - 0xa8], str.SynTP.sys
mov dword [ebp - 0xa4], 0x4db9cc
mov dword [ebp - 0xa0], str.SynTPCOM.dll
mov dword [ebp - 0x9c], str.SynTPCpl.dll
mov dword [ebp - 0x98], 0x4eb168
mov dword [ebp - 0x94], 0x4eb184
mov dword [ebp - 0x90], str.SynTPFcs.dll
mov dword [ebp - 0x8c], str.SynTPLpr.exe
mov dword [ebp - 0x88], str.SynCOM.dll
mov dword [ebp - 0x84], str.SynCtrl.dll
mov dword [ebp - 0x80], str.SynISDLL.dll
mov dword [ebp - 0x7c], str.SynTPCo.dll
mov dword [ebp - 0x78], str.SxSSynTPCo.dll
mov dword [ebp - 0x74], 0
call fcn.004abafa
lea edx, [ebp - 0x27d4]
add esp, 0xc
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x497fc0
lea eax, [ebp - 0x27d4]
push 0x4eb26c
push eax
call fcn.004ab99d
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
je 0x498030
jmp 0x497ff0
xor edi, edi
mov ecx, str.SynTP.sys
push 0
push ecx
push 0x4db8b8
push eax
push dword [esi]
mov ecx, ebx
call fcn.00494ea0
mov eax, dword [ebp + 8]
lea edi, [edi + 1]
mov ecx, dword [ebp + edi*4 - 0xa8]
test ecx, ecx
jne 0x497ff7
push 0x4eb26c
push 0
call fcn.004ab99d
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
jne 0x497ff0
push str._nEnviroment_Info_n_________________________________________n
push dword [esi]
call fcn.004aa979
add esp, 8
mov ecx, ebx
push dword [esi]
call fcn.00494c10
push str._nRegistry_Info_n_________________________________________n
push dword [esi]
call fcn.004aa979
add esp, 8
mov dword [ebp + 8], reloc.OLEAUT32.dll_SysReAllocString
xor eax, eax
push 0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x10], esp
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x4db8b8
mov word [ecx], ax
call fcn.00405410
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0xb0], esp
xor eax, eax
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x4db8b8
mov word [ecx], ax
call fcn.00405410
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0xb8], esp
xor eax, eax
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x4db8b8
mov word [ecx], ax
call fcn.00405410
sub esp, 0x18
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0xb4], esp
xor eax, eax
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x4db8b8
mov word [ecx], ax
call fcn.00405410
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
xor eax, eax
push 0x27
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push str.SYSTEMCurrentControlSetServicesSynTP
mov word [ecx], ax
call fcn.00405410
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
call fcn.0049e920
add esp, 0x7c
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 7
mov dword [ebp - 0x10], 1
jb 0x498158
mov eax, dword [eax]
push eax
lea eax, [ebp + 8]
mov ecx, ebx
push eax
push esi
call fcn.00495180
test eax, eax
je 0x4982b5
push 0
push str.SYSTEMCurrentControlSetEnumACPI
lea eax, [ebp + 8]
mov dword [ebp + 8], reloc.OLEAUT32.dll_SysReAllocString
push eax
push esi
mov ecx, ebx
call fcn.00495180
test eax, eax
je 0x4982b5
push 0
push str.SYSTEMCurrentControlSetEnumHID
lea eax, [ebp + 8]
mov dword [ebp + 8], reloc.OLEAUT32.dll_SysReAllocString
push eax
push esi
mov ecx, ebx
call fcn.00495180
test eax, eax
je 0x4982b5
push 0
push str.SYSTEMCurrentControlSetEnumSERENUM
lea eax, [ebp + 8]
mov dword [ebp + 8], reloc.OLEAUT32.dll_SysReAllocString
push eax
push esi
mov ecx, ebx
call fcn.00495180
test eax, eax
je 0x4982b5
push 0
push str.SOFTWARESynaptics
lea eax, [ebp + 8]
mov dword [ebp + 8], reloc.OLEAUT32.dll_SysReAllocString
push eax
push esi
mov ecx, ebx
call fcn.00495180
test eax, eax
je 0x4982b5
push 0
push str.SOFTWARESynaptics
lea eax, [ebp + 8]
mov dword [ebp + 8], SysStringLen
push eax
push esi
mov ecx, ebx
call fcn.00495180
test eax, eax
je 0x4982b5
push 0
push str.Control_PanelDesktop
lea eax, [ebp + 8]
mov dword [ebp + 8], SysStringLen
push eax
push esi
mov ecx, ebx
call fcn.00495180
test eax, eax
je 0x4982b5
push 0
push str.Control_PanelMouse
lea eax, [ebp + 8]
mov dword [ebp + 8], SysStringLen
push eax
push esi
mov ecx, ebx
call fcn.00495180
test eax, eax
je 0x4982b5
push 0
push str..DEFAULTControl_PanelMouse
lea eax, [ebp + 8]
mov dword [ebp + 8], SysStringLen
push eax
push esi
mov ecx, ebx
call fcn.00495180
test eax, eax
je 0x4982b5
push 0
push str.CLSID2F603045_309F_11CF_9774_0020AFD0CFF6InProcServer32
lea eax, [ebp + 8]
mov dword [ebp + 8], SysStringLen
push eax
push esi
mov ecx, ebx
call fcn.00495180
test eax, eax
je 0x4982b5
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea eax, [ebp + 8]
mov dword [ebp + 8], reloc.OLEAUT32.dll_SysReAllocString
push eax
push esi
mov ecx, ebx
call fcn.00495180
mov byte [ebp + 0xb], 0
test eax, eax
jne 0x4982b9
mov byte [ebp + 0xb], 1
cmp dword [ebp - 0x18], 8
mov dword [ebp - 4], 2
jb 0x4982d1
push dword [ebp - 0x2c]
call fcn.004a46e7
add esp, 4
cmp byte [ebp + 0xb], 0
jne 0x4986f3
push str._nSetupAPI_Log_Info_n_________________________________________n
push dword [esi]
call fcn.004aa979
mov edi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
add esp, 8
cmp dword [ebx + 0x450], 0
je 0x498368
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7d4], ax
lea eax, [ebp - 0x7d2]
push eax
call fcn.004a4860
add esp, 0xc
lea eax, [ebp - 0x7d4]
push 0x104
push eax
call edi
push 0
call fcn.0049e2e0
add esp, 4
cmp eax, 7
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0x27d4]
jne 0x498348
push str._sSetupAPI.log
jmp 0x49834d
push str._sinf_setupapi.dev.log
push eax
call fcn.004a6894
add esp, 0xc
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push eax
push dword [esi]
call fcn.00494c80
jmp 0x498377
push str._not_included__n
push dword [esi]
call fcn.004aa979
add esp, 8
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x5cc], ax
lea eax, [ebp - 0x5ca]
push eax
call fcn.004a4860
add esp, 0xc
lea eax, [ebp - 0x5cc]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x498479
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp word [ebp - 0x5cc], ax
jne 0x4983d3
xor ecx, ecx
jmp 0x4983ef
lea ecx, [ebp - 0x5cc]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4983e0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x5cc]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405410
push str.SynapticsSynReflashSynReflash.log
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004069f0
add esp, 0xc
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 8
jb 0x49842d
push dword [ebp - 0x2c]
call fcn.004a46e7
add esp, 4
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x498468
push str._nSynReflash_Log_Info_n_________________________________________n
push dword [esi]
call fcn.004aa979
add esp, 8
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
mov ecx, ebx
cmovae eax, dword [ebp - 0x44]
push eax
push dword [esi]
call fcn.00494c80
cmp dword [ebp - 0x30], 8
jb 0x498479
push dword [ebp - 0x44]
call fcn.004a46e7
add esp, 4
push 0x4e34f4
push dword [esi]
call fcn.004aa979
add esp, 8
lea eax, [ebp - 0x3c4]
push 0x104
push eax
call edi
lea edi, [ebp - 0x3c4]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x4984a0
mov eax, dword [0x4dbeb4]
mov ecx, ebx
mov dword [edi], eax
call fcn.00492950
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x27d4]
push str._sControl.KTL
push eax
call fcn.004a6894
add esp, 0xc
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push eax
push dword [esi]
call fcn.004926b0
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x27d4]
push str._sPacket.KTL
push eax
call fcn.004a6894
add esp, 0xc
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push eax
push dword [esi]
call fcn.004926b0
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x27d4]
push str._sI8042.KTL
push eax
call fcn.004a6894
add esp, 0xc
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push eax
push dword [esi]
call fcn.004926b0
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x27d4]
push str._sNGIControl.KTL
push eax
call fcn.004a6894
add esp, 0xc
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push eax
push dword [esi]
call fcn.004926b0
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x27d4]
push str._sNGIPacket.KTL
push eax
call fcn.004a6894
add esp, 0xc
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push eax
push dword [esi]
call fcn.004926b0
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x27d4]
push str._sUsbControl.KTL
push eax
call fcn.004a6894
add esp, 0xc
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push eax
push dword [esi]
call fcn.004926b0
lea eax, [ebp - 0x3c4]
push eax
push str._sUsbPacket.KTL
lea eax, [ebp - 0x27d4]
push eax
call fcn.004a6894
add esp, 0xc
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push eax
push dword [esi]
call fcn.004926b0
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x27d4]
push str._sSentOSPackets.KTL
push eax
call fcn.004a6894
add esp, 0xc
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push eax
push dword [esi]
call fcn.004926b0
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x27d4]
push str._sProcessedPackets.KTL
push eax
call fcn.004a6894
add esp, 0xc
lea eax, [ebp - 0x27d4]
mov ecx, ebx
push eax
push dword [esi]
call fcn.004926b0
lea eax, [ebp - 0x44]
push eax
call fcn.0049ded0
push str.SynapticsSynTP_
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 9
push eax
call fcn.004069f0
push str.Enhancement.KTL
push eax
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0xa
push eax
call fcn.004069f0
add esp, 0x1c
cmp dword [ebp - 0x18], 8
jb 0x498680
push dword [ebp - 0x2c]
call fcn.004a46e7
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 7
cmp dword [ebp - 0x30], 8
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
jb 0x4986a5
push dword [ebp - 0x44]
call fcn.004a46e7
add esp, 4
cmp dword [ebp - 0x4c], 8
lea eax, [ebp - 0x60]
mov ecx, ebx
cmovae eax, dword [ebp - 0x60]
push eax
push dword [esi]
call fcn.004926b0
cmp dword [ebp - 0x4c], 8
lea eax, [ebp - 0x60]
cmovae eax, dword [ebp - 0x60]
push eax
call fcn.004abc15
add esp, 4
cmp dword [ebp - 0x4c], 8
jb 0x4986df
push dword [ebp - 0x60]
call fcn.004a46e7
add esp, 4
xor eax, eax
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x50], 0
mov word [ebp - 0x60], ax
lea ecx, [ebp - 0xd0]
mov dword [ebp - 4], 0xffffffff
call fcn.00491a30
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4