Function at 0x498113
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x288
push ebx
fldz
push esi
fstp qword [ebp - 0x19c]
push edi
push 0x26
xor eax, eax
pop ecx
lea edi, [ebp - 0x194]
mov byte [ebp + 0x5b], 1
rep stosd dword es:[edi], eax
xor ebx, ebx
mov esi, 0x4d8d1c
push dword [ebp + 0x78]
lea ecx, [ebp - 0x70]
mov byte [ebp + 0x37], bl
call fcn.0044cf2d
mov eax, dword [ebp - 0x70]
mov dword [ebp + 0x60], eax
add eax, 0xc
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x48], eax
lea eax, [ebp + 0x48]
push eax
call fcn.00405676
mov eax, dword [ebp + 0x48]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.0043dcd9
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2a
pop ecx
pop ecx
lea ecx, [ebp + 0xf]
sete byte [ebp + 0x67]
call fcn.004131bd
push 6
push dword [ebp - 0x20]
push str.__free
call fcn.0043f0c4
add esp, 0xc
test al, al
jne 0x49968b
lea ecx, [ebp + 0x78]
call fcn.00495bb8
push ebx
lea ecx, [ebp + 0xf]
call fcn.004131c0
lea ecx, [ebp + 0xf]
call fcn.004131b1
neg eax
sbb eax, eax
inc eax
cmp dword [0x4d6840], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp + 0x24], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x8c], ebx
jge 0x498273
mov eax, dword [0x4d807c]
cmp eax, ebx
mov dword [0x4d6840], ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x44], ebx
je 0x49824f
lea ecx, [ebp + 0x44]
push ecx
lea ecx, [ebp + 0x54]
push ecx
call eax
cmp dword [ebp + 0x44], ebx
jbe 0x49824f
mov eax, dword [ebp + 0x54]
cmp eax, 0x202
jb 0x49821b
mov dword [0x4d6840], 0x38
jmp 0x49824f
cmp eax, 0x184
jb 0x49822e
mov dword [0x4d6840], 8
jmp 0x49824f
cmp eax, 0x160
jb 0x498241
mov dword [0x4d6840], 2
jmp 0x49824f
cmp eax, ebx
jbe 0x49824f
mov dword [0x4d6840], 1
push dword [0x4d807c]
push dword [0x4d6840]
push dword [ebp + 0x44]
push dword [ebp + 0x54]
push str.DBG:_IMD:_0x_X_0x_X_0x_X__0x_p_r_n
push 0x4d80e0
call fcn.00410bfe
add esp, 0x18
push 3
push dword [ebp - 0x20]
push 0x4c56ec
call fcn.0043f0c4
add esp, 0xc
test al, al
je 0x498290
mov dword [ebp + 0x24], 0xfff00000
push 5
lea eax, [ebp - 0x20]
push eax
push str.__ins
mov byte [ebp + 0x6f], bl
call fcn.004460ea
add esp, 0xc
test al, al
je 0x4982b0
mov byte [ebp + 0x6f], 5
jmp 0x4982cb
push 6
lea eax, [ebp - 0x20]
push eax
push str.__fins
call fcn.004460ea
add esp, 0xc
test al, al
je 0x4982cb
mov byte [ebp + 0x6f], 6
push 0x3e8
lea ecx, [ebp - 0x24]
call fcn.004441bf
lea ecx, [ebp + 0x18]
call fcn.004441a1
lea ecx, [ebp - 0xa8]
call fcn.004441a1
lea ecx, [ebp + 0x5c]
call fcn.004441a1
lea ecx, [ebp - 0x1c]
mov dword [ebp + 0x14], ebx
call fcn.004441a1
lea ecx, [ebp + 4]
call fcn.004441a1
lea ecx, [ebp + 0x50]
call fcn.004441a1
lea ecx, [ebp - 0xc]
call fcn.004441a1
lea ecx, [ebp - 0x3c]
call fcn.004441a1
lea ecx, [ebp + 0x3c]
call fcn.004441a1
lea ecx, [ebp - 0x28]
call fcn.004441a1
lea ecx, [ebp + 0x28]
call fcn.004441a1
or eax, 0xffffffff
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov eax, 0x4bca2c
push 0xc8
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x54], eax
call fcn.004441bf
cmp byte [ebp + 0x67], bl
mov eax, dword [ebp + 0x48]
mov cx, word [eax]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0xd8], eax
mov word [ebp - 0x7c], cx
mov dword [ebp + 0x30], eax
je 0x4984be
add dword [ebp + 0x68], 2
mov word [eax], bx
mov eax, dword [ebp + 0x68]
mov edx, eax
jmp 0x4983b3
cmp cx, 0x2a
je 0x4983bb
inc eax
inc eax
mov dword [ebp + 0x68], eax
mov cx, word [eax]
cmp cx, bx
jne 0x4983a8
sub eax, edx
sar eax, 1
push eax
push edx
lea ecx, [ebp + 0x18]
call fcn.004442c5
mov eax, dword [ebp + 0x18]
cmp word [eax], bx
je 0x4983de
push 0x3e8
lea ecx, [ebp - 0x24]
call fcn.004441e6
cmp word [ebp - 0x7c], bx
mov eax, dword [ebp + 0x48]
mov dword [ebp + 0x30], eax
je 0x4983f0
add eax, 2
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x30]
push eax
call fcn.0043dcd9
pop ecx
mov edi, 0x4bca2c
push 4
lea eax, [ebp + 0x30]
push eax
push str._mem
call fcn.0044615f
add esp, 0xc
test al, al
jne 0x49842d
push 2
lea eax, [ebp + 0x30]
push eax
push 0x4c1ac4
call fcn.0044615f
add esp, 0xc
test al, al
je 0x498432
mov dword [ebp + 0x44], edi
jmp 0x4983ff
push 3
lea eax, [ebp + 0x30]
push eax
push 0x4c5c94
call fcn.0044615f
add esp, 0xc
test al, al
je 0x498452
mov dword [ebp + 0x44], 0x4c9674
jmp 0x4983ff
push 4
lea eax, [ebp + 0x30]
push eax
push str._map
call fcn.0044615f
add esp, 0xc
test al, al
je 0x498475
mov dword [ebp - 0xe0], 1
jmp 0x4983ff
push 4
lea eax, [ebp + 0x30]
push eax
push str._exe
call fcn.0044615f
add esp, 0xc
test al, al
je 0x498498
mov dword [ebp + 0x24], 1
jmp 0x4983ff
push 5
lea eax, [ebp + 0x30]
push eax
push str._nexe
call fcn.0044615f
add esp, 0xc
test al, al
je 0x4984bb
mov dword [ebp + 0x24], 0xfff00000
jmp 0x4983ff
mov edi, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x7c]
push 0x4c964c
push 0x4c8b38
call fcn.004438ac
mov eax, dword [ebp + 0x18]
cmp word [eax], bx
push 0xffffffffffffffff
lea ecx, [ebp + 0x14]
push 0xffffffffffffffff
je 0x498503
push 0x4c9648
call fcn.0044425c
push dword [ebp + 0x18]
lea ecx, [ebp + 0x14]
call fcn.0044420d
push str.Imdisk
lea ecx, [ebp + 0x14]
call fcn.0044420d
jmp 0x49850d
push str._Imdisk
call fcn.0044425c
push 9
push edi
push str.__version
call fcn.0043f0c4
push 2
push edi
push 0x4c9618
mov byte [ebp + 0x66], al
call fcn.0043f0c4
push 2
push edi
push 0x4c9614
mov byte [ebp + 0xe], al
call fcn.0043f0c4
push 3
push edi
push 0x4c56ec
mov byte [ebp + 0x13], al
call fcn.0043f0c4
add esp, 0x30
cmp byte [ebp + 0x66], bl
jne 0x498564
cmp byte [ebp + 0xe], bl
jne 0x498564
cmp byte [ebp + 0x13], bl
jne 0x498564
cmp al, bl
jne 0x498564
mov cl, 1
jmp 0x498566
xor cl, cl
cmp dword [ebp - 0x18], ebx
jne 0x49857d
mov eax, dword [0x4d6840]
cmp eax, ebx
jle 0x49857d
push 2
pop edi
cmp eax, edi
jge 0x498589
jmp 0x498580
push 2
pop edi
cmp cl, bl
jne 0x498593
cmp byte [ebp + 0x6f], bl
jne 0x498593
cmp byte [ebp + 0x6f], 6
jl 0x498718
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x4c960c
jne 0x4985e9
lea ecx, [ebp - 0x74]
call fcn.004441a1
mov eax, 0x4c9604
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xe8]
push eax
push edi
call fcn.00425054
mov eax, dword [ebp - 0x74]
add esp, 0xc
cmp word [eax], bx
je 0x4985e1
cmp word [eax + 2], bx
je 0x4985e1
mov dword [ebp - 0x10], 0x4c95fc
lea ecx, [ebp - 0x74]
call fcn.0043dd41
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub dword [0x4d8d78], 1
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4d8d78], ebx
jle 0x498620
push esi
call edi
mov ecx, dword [ebp + 0x7c]
push ebx
push ebx
push 1
call fcn.00415bb5
jmp 0x498600
push 0xffffffffffffffff
lea ecx, [ebp + 0xf]
call fcn.004131c0
push esi
call edi
movsx ax, byte [ebp + 0x6f]
push 0xffffffffffffffff
lea ecx, [ebp + 0xf]
mov word [ebp - 0xbe], 0x20
mov word [ebp - 0xbc], bx
add eax, 0x30
mov word [ebp - 0xc0], ax
call fcn.004131c0
push str.28:INDATA
lea ecx, [ebp + 8]
call fcn.0044cf2d
cmp dword [ebp - 0x18], ebx
mov eax, 0x4c95fc
jne 0x498672
mov eax, 0x4c960c
push eax
lea ecx, [ebp + 8]
call fcn.0044420d
push dword [ebp - 0x10]
lea ecx, [ebp + 8]
call fcn.0044420d
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp + 8]
call fcn.0044420d
push dword [ebp + 0x48]
lea ecx, [ebp + 8]
call fcn.0044420d
push dword [ebp + 8]
push str.Install_IMD__s__r_n
push 0x4d80e0
call fcn.00410bfe
mov ecx, dword [ebp + 0x7c]
add esp, 0xc
push dword [ebp + 8]
call fcn.0042300e
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x4d8d78], 1
push esi
mov dword [0x4d6840], 0xffffffc0
call edi
push ebx
lea ecx, [ebp + 0xf]
call fcn.004131c0
lea ecx, [ebp + 0xf]
call fcn.004131b1
neg eax
sbb eax, eax
inc eax
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0x18], ebx
jne 0x49870a
mov dword [0x4d6840], 0x38
push esi
call edi
lea ecx, [ebp + 8]
call fcn.0043dd41
push 2
pop edi
cmp byte [ebp + 0x67], bl
je 0x498fb9
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x4c], eax
jmp 0x49874c
push edi
lea eax, [ebp - 0x4c]
push eax
push 0x4c1ac4
call fcn.004460ea
add esp, 0xc
test al, al
jne 0x498753
lea eax, [ebp - 0x4c]
push eax
call fcn.00408ddd
mov eax, dword [ebp - 0x4c]
pop ecx
cmp word [eax], bx
jne 0x498729
jmp 0x498759
mov eax, dword [ebp - 0x4c]
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2a
jne 0x498fa7
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
cmp word [eax], 0x40
mov byte [ebp + 0x67], bl
jne 0x498788
add dword [ebp + 0x68], edi
mov byte [ebp + 0x67], 1
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044908a
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
pop ecx
je 0x4987a2
add dword [ebp + 0x68], edi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044908a
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
pop ecx
je 0x4987bc
add dword [ebp + 0x68], edi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044908a
mov edi, dword [ebp + 0x68]
cmp word [edi], bx
pop ecx
pop ecx
je 0x4987d8
inc edi
inc edi
mov dword [ebp + 0x68], edi
mov al, byte [ebp - 0x48]
and al, 1
mov byte [ebp + 0x6f], al
push 0x2a
lea eax, [ebp + 0x68]
call fcn.00405636
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp + 0x28]
call fcn.004442c5
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
je 0x498808
add dword [ebp + 0x68], 2
mov edi, dword [ebp + 0x68]
push 0x2a
lea eax, [ebp + 0x68]
call fcn.00405636
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp + 0x3c]
call fcn.004442c5
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
je 0x498833
add dword [ebp + 0x68], 2
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044908a
mov edi, dword [ebp + 0x68]
cmp word [edi], bx
pop ecx
pop ecx
je 0x49884f
inc edi
inc edi
mov dword [ebp + 0x68], edi
push 0x2a
lea eax, [ebp + 0x68]
call fcn.00405636
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.004442c5
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044908a
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
pop ecx
je 0x498886
add dword [ebp + 0x68], 2
cmp byte [ebp + 0x67], bl
mov edx, dword [ebp - 0x64]
mov edi, dword [ebp - 0x60]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], ecx
je 0x4988cb
add eax, edx
adc ecx, edi
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], ecx
cmp dword [ebp - 0x58], ebx
jl 0x4988ed
jg 0x4988d7
cmp dword [ebp - 0x5c], ebx
jbe 0x4988ed
cmp dword [ebp - 0x34], ebx
jg 0x4988ed
jl 0x4988e3
cmp dword [ebp - 0x38], ebx
ja 0x4988ed
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], ebx
push 0x318
lea ecx, [ebp - 0x2c]
call fcn.004441bf
mov eax, dword [ebp - 0x2c]
lea esi, [eax + 0x6a]
mov dword [ebp - 8], eax
lea eax, [esi + 0x6a]
lea edi, [eax + 0x6a]
push ebx
mov word [edi], bx
push 0x200
mov word [eax], bx
push dword [ebp - 0x60]
lea ecx, [edi + 0x6a]
push dword [ebp - 0x64]
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0xcc], edi
mov dword [ebp - 4], ecx
call fcn.004aa100
push edx
push eax
push dword [ebp - 8]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
call fcn.00497e07
add esp, 0xc
push ebx
push 0x200
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
call fcn.004aa100
push edx
push eax
push esi
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], edx
call fcn.00497e07
add esp, 0xc
mov word [edi], bx
cmp dword [ebp - 0x58], ebx
jl 0x498985
jg 0x498976
cmp dword [ebp - 0x5c], ebx
jbe 0x498985
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push edi
call fcn.00497e07
add esp, 0xc
mov ecx, dword [ebp + 0x48]
xor eax, eax
cmp word [ebp - 0x7c], bx
setne al
lea eax, [ecx + eax*2]
mov dword [ebp + 0x38], eax
lea eax, [ebp + 0x38]
push eax
call fcn.0043dcd9
push 4
push dword [ebp + 0x38]
mov dword [ebp - 0x78], ebx
push str.__w:
call fcn.0043f11b
add esp, 0x10
test al, al
je 0x4989cc
add dword [ebp + 0x38], 8
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.004504ce
pop ecx
pop ecx
push 0xffffffffffffffff
lea eax, [ebp + 0x38]
push eax
push 0x4c95b4
call fcn.004460ea
add esp, 0xc
cmp dword [0x4d6840], 1
jl 0x4989f4
cmp dword [ebp + 0x24], ebx
jne 0x4989f4
mov dword [ebp + 0x24], 0xfff00000
mov eax, dword [ebp + 0x38]
mov edi, 0x4bca2c
mov byte [ebp + 0x66], bl
mov byte [ebp + 0x67], bl
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x80], edi
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x2c], ebx
jmp 0x498a7f
push 2
lea eax, [ebp + 0x4c]
push eax
push 0x4c5dac
call fcn.004460ea
add esp, 0xc
test al, al
je 0x498a30
mov dword [ebp + 0x2c], 1
jmp 0x498a7c
cmp dword [ebp + 0x2c], ebx
je 0x498a6f
push 2
lea eax, [ebp + 0x4c]
push eax
push 0x4c95b0
call fcn.004460ea
add esp, 0xc
test al, al
je 0x498a52
mov byte [ebp + 0x66], 1
jmp 0x498a7c
push 3
lea eax, [ebp + 0x4c]
push eax
push 0x4c95ac
call fcn.004460ea
add esp, 0xc
test al, al
je 0x498a6f
mov byte [ebp + 0x67], 1
jmp 0x498a7c
lea eax, [ebp + 0x4c]
push eax
call fcn.00408ddd
pop ecx
mov dword [ebp + 0x2c], ebx
mov eax, dword [ebp + 0x4c]
cmp word [eax], bx
jne 0x498a10
mov eax, dword [0x4d6840]
test al, 0x10
je 0x498a99
cmp byte [ebp + 0x67], bl
jne 0x498a99
mov dword [ebp - 0x10], str._o_par
mov dword [ebp + 0x4c], eax
and dword [ebp + 0x4c], 0x20
je 0x498aa9
mov dword [ebp - 0x80], str._o_shared
cmp dword [ebp + 0x4c], ebx
je 0x498ab1
mov byte [ebp + 0x5b], bl
mov ecx, dword [ebp - 0x48]
mov eax, ecx
and eax, 0x200
or eax, ebx
jne 0x498adb
cmp dword [ebp + 0x4c], ebx
jne 0x498adb
cmp byte [ebp + 0x6f], bl
je 0x498ade
and ecx, 0x100
mov eax, ecx
or eax, ebx
je 0x498ade
mov byte [ebp + 0x5b], 1
jmp 0x498ade
mov byte [ebp + 0x5b], bl
cmp dword [0x4d6840], 8
jl 0x498bef
cmp byte [ebp + 0x6f], bl
je 0x498af9
cmp byte [ebp + 0x5b], bl
jne 0x498bef
cmp byte [ebp + 0x6f], bl
mov dword [ebp + 0x2c], edi
jne 0x498b0f
cmp byte [ebp + 0x66], bl
jne 0x498b18
mov dword [ebp + 0x2c], str._o_ro
jmp 0x498b18
cmp dword [ebp + 0x4c], ebx
jne 0x498b18
mov byte [ebp + 0x37], 1
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp + 0x48]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + edi + 0x800]
push eax
lea ecx, [ebp + 0x5c]
call fcn.004441e6
push dword [ebp + 0x28]
push esi
push dword [ebp - 8]
push dword [ebp - 0x80]
push dword [ebp - 0x10]
push dword [ebp + 0x2c]
push str.imdisk__a___s__s__s___b__sb__s__sb__f__s
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp + 0x38]
add esp, 0x20
mov dword [ebp + 0x20], eax
cmp word [eax], bx
je 0x498bdb
push 2
lea eax, [ebp + 0x20]
push eax
push 0x4c9520
call fcn.0043f073
add esp, 0xc
test al, al
jne 0x498ba1
push 2
lea eax, [ebp + 0x20]
push eax
push 0x4c9518
call fcn.0043f073
add esp, 0xc
test al, al
jne 0x498ba1
lea eax, [ebp + 0x20]
push eax
call fcn.00408ddd
jmp 0x498bcf
mov ecx, dword [ebp + 0x20]
xor eax, eax
jmp 0x498bbe
call fcn.0040f4c7
test al, al
jne 0x498bc6
mov word [ecx], 0x20
mov ecx, dword [ebp + 0x20]
inc ecx
inc ecx
mov dword [ebp + 0x20], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x498ba8
lea eax, [ebp + 0x20]
push eax
call fcn.0043dcd9
mov eax, dword [ebp + 0x20]
cmp word [eax], bx
pop ecx
jne 0x498b68
mov eax, dword [ebp + 0x38]
push eax
lea ecx, [ebp + 0x5c]
call fcn.0044420d
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x60], eax
jmp 0x498f87
cmp byte [ebp + 0x6f], bl
je 0x498c22
push ebx
push 0xa0000080
push 3
push ebx
push 7
push 0xc0000000
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x4996c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x4c], edi
jmp 0x498c29
mov dword [ebp + 0x4c], 0x4c9510
cmp dword [ebp - 0x34], ebx
jl 0x498c47
jg 0x498c35
cmp dword [ebp - 0x38], ebx
jbe 0x498c47
push dword [ebp - 0x34]
lea eax, [esi + 0x6a]
push dword [ebp - 0x38]
push eax
call fcn.00497e07
add esp, 0xc
push 0x5c
push ebx
push dword [ebp + 0x28]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
jne 0x498c5e
mov esi, dword [ebp + 0x28]
jmp 0x498c60
inc esi
inc esi
mov eax, dword [ebp + 0x3c]
cmp word [eax], bx
jne 0x498c97
push 0x800
lea ecx, [ebp + 0x3c]
call fcn.004441e6
mov edi, dword [ebp + 0x3c]
call fcn.00440360
push eax
push dword [ebp - 0xa0]
push dword [ebp - 8]
push esi
push str._s_s_s__u
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push dword [ebp + 0x3c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov eax, 0x400
cmp esi, eax
jle 0x498cb7
mov esi, eax
mov eax, dword [ebp + 0x3c]
mov word [eax + 0x800], bx
push str.Global_
lea ecx, [ebp - 0x14]
call fcn.0044cff1
push dword [ebp + 0x3c]
lea ecx, [ebp - 0x14]
call fcn.0044420d
push str._devio_Ack
lea ecx, [ebp - 0x14]
call fcn.0044420d
mov eax, dword [ebp - 4]
mov word [eax], bx
mov eax, dword [ebp - 0x48]
and eax, 0x30
or eax, ebx
mov word [ebp - 0x1d8], bx
jne 0x498d0a
cmp byte [ebp + 0x6f], bl
je 0x498dc2
mov eax, dword [ebp - 0x48]
and eax, 0x40
or eax, ebx
jne 0x498dc2
mov edi, dword [ebp - 4]
push 0x10
push str.__kill:
push edi
call fcn.00413fe3
add esp, 0xc
push 0x104
add edi, 0x27e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 4]
push 0x104
add eax, 0xe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [ebp + 0x54]
cmp word [edi], 0x22
mov dword [ebp - 0x84], eax
mov dword [ebp + 0x2c], edi
jne 0x498d76
add dword [ebp + 0x54], 2
jmp 0x498d6c
cmp ax, 0x22
je 0x498d83
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x498d64
jmp 0x498d83
lea eax, [ebp + 0x2c]
push eax
call fcn.00405676
mov edi, dword [ebp + 0x2c]
pop ecx
mov ax, word [edi]
mov word [ebp + 0x2c], ax
mov word [edi], bx
mov eax, dword [ebp - 0x48]
and eax, 0x20
or eax, ebx
mov eax, str._LOAD_25_poweroff
jne 0x498da1
mov eax, str._RAMD_ImdiskV__D__m__s_
push dword [ebp + 0x54]
mov ecx, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 4]
lea eax, [eax + ecx*2]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ax, word [ebp + 0x2c]
add esp, 0xc
mov word [edi], ax
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
mov cl, 1
call fcn.004aa3f0
and eax, 3
je 0x498dea
push eax
lea eax, [ebp - 0x1d8]
push str._nrc:_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push ebx
mov edi, 0x200
push edi
push dword [ebp - 0xac]
push dword [ebp - 0xb0]
call fcn.004aa100
push edx
push eax
push dword [ebp - 8]
call fcn.00497e07
add esp, 0xc
push ebx
push edi
push dword [ebp - 0xb4]
push dword [ebp - 0xb8]
call fcn.004aa100
mov edi, dword [ebp - 0xa0]
push edx
push eax
push edi
call fcn.00497e07
mov ecx, dword [ebp + 0x7c]
add esp, 0xc
push 0x4c07c4
push str.__ImdMapPid
call fcn.004438ac
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp + 0x28]
mov dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, dword [ebp - 0x84]
lea ecx, [ebp - 0x30]
lea eax, [eax + esi + 0x940]
push eax
call fcn.004441bf
push str.Global_
lea ecx, [ebp - 0x40]
call fcn.0044cf2d
push dword [ebp + 0x3c]
lea ecx, [ebp - 0x40]
call fcn.0044420d
push dword [ebp - 0x40]
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
cmp eax, ebx
jne 0x4996d5
lea ecx, [ebp - 0x40]
call fcn.0043dd41
push dword [ebp - 0xcc]
lea eax, [edi + 0x6a]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x1d8]
push edi
push dword [ebp + 0x28]
push dword [ebp + 0x3c]
push dword [ebp + 0x4c]
push eax
push dword [ebp - 0x28]
push dword [ebp - 4]
push dword [ebp + 0x44]
push str.EXEC___pid:__ImdMapPid____exe:_s10INDATA___nfb___MyName0____s__w:60000__s__s__s_shm:_s___s__s__s__s__s
push dword [ebp - 0x30]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
add esi, 0x800
push esi
lea ecx, [ebp + 0x5c]
call fcn.004441e6
mov eax, dword [ebp - 8]
mov word [eax], bx
mov word [edi], bx
push dword [ebp + 0x3c]
push dword [ebp - 0x80]
push dword [ebp - 0x10]
push 0x4bca2c
push str.imdisk__a__t_proxy__s__s__s__o_shm__f__s
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push dword [ebp + 0x38]
lea ecx, [ebp + 0x5c]
call fcn.0044420d
push dword [ebp - 0x14]
mov eax, dword [ebp + 0x5c]
push ebx
push ebx
push ebx
mov dword [ebp + 0x60], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp + 0x7c]
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
mov esi, eax
call fcn.0043362f
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
jne 0x4996fe
push 0x32
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x498f63
cmp dword [ebp - 0x78], ebx
jle 0x498f7f
mov ecx, dword [ebp + 0x7c]
push ebx
push ebx
push dword [ebp - 0x78]
call fcn.00415bb5
lea ecx, [ebp - 0x30]
call fcn.0043dd41
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x48], eax
lea ecx, [ebp - 0x2c]
mov word [eax], bx
mov dword [ebp - 0xe0], 1
call fcn.0043dd41
mov esi, 0x4d8d1c
mov ax, word [ebp - 0x7c]
mov ecx, dword [ebp - 0xd8]
mov word [ecx], ax
jmp 0x499434
push 4
lea eax, [ebp + 0x48]
push eax
push str._exe
call fcn.004460ea
add esp, 0xc
test al, al
je 0x498fd7
mov dword [ebp + 0x24], 1
push 5
lea eax, [ebp + 0x48]
push eax
push str._nexe
call fcn.004460ea
add esp, 0xc
test al, al
je 0x498ff5
mov dword [ebp + 0x24], 0xfff00000
push 6
lea eax, [ebp + 0x48]
push eax
push str._nexe1
call fcn.004460ea
add esp, 0xc
test al, al
je 0x49901d
mov dword [ebp + 0x24], 0xfff00000
mov dword [ebp - 0x8c], 1
push 0x2c
pop esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00446f11
mov eax, dword [ebp - 0x1c]
mov word [eax], bx
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x4990ea
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x4990ea
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x4990ea
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x4990ea
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x4990ea
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00446f11
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x4990ea
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.004470c7
add esp, 0xc
push 6
lea ecx, [ebp + 0x50]
mov byte [ebp + 0x66], bl
call fcn.004441e6
mov eax, dword [ebp + 0x50]
mov word [eax + 2], 0x3a
mov eax, dword [ebp + 0x50]
mov word [eax + 4], bx
mov eax, dword [ebp + 0x50]
cmp word [eax], bx
je 0x499186
push eax
call fcn.004a96f0
test eax, eax
pop ecx
je 0x49917e
mov eax, dword [ebp + 0x50]
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xfc], str.imdisk
mov dword [ebp - 0xf8], 0x4c9604
mov dword [ebp - 0xf4], 0x4c92e8
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], ebx
call fcn.004441a1
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xfc]
push eax
push 4
call fcn.00425054
add esp, 0xc
neg eax
sbb al, al
inc al
lea ecx, [ebp - 0xa4]
mov byte [ebp + 0x66], al
call fcn.0043dd41
mov eax, dword [ebp + 0x50]
cmp word [eax], bx
jne 0x49919f
push 0x4c14cc
lea ecx, [ebp + 0x50]
call fcn.0044cf95
mov eax, dword [ebp + 0x50]
cmp word [eax], bx
je 0x49971f
push 0x3c
lea ecx, [ebp]
call fcn.004441bf
mov eax, dword [ebp - 0x1c]
or esi, 0xffffffff
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp + 0x40], eax
cmp word [eax], bx
mov edi, esi
je 0x499717
lea eax, [ebp + 0x40]
push eax
call fcn.0043dcd9
mov eax, dword [ebp + 0x40]
mov ax, word [eax]
or ax, 0x20
cmp ax, 0x70
pop ecx
jne 0x499203
lea eax, [ebp - 0x9c]
jmp 0x49921d
cmp ax, 0x6c
jne 0x499211
lea eax, [ebp - 0x94]
jmp 0x49921d
cmp ax, 0x68
jne 0x499235
lea eax, [ebp - 0xc8]
add dword [ebp + 0x40], 2
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.00450423
mov eax, dword [ebp + 0x40]
cmp word [eax], bx
pop ecx
pop ecx
jne 0x4991e1
cmp dword [ebp - 0x98], ebx
jl 0x499277
jg 0x499247
cmp dword [ebp - 0x9c], ebx
jbe 0x499277
push 1
call fcn.00414dd2
pop ecx
push dword [ebp - 0x98]
push dword [ebp - 0x9c]
push edx
push eax
call fcn.004aa1b0
push ebx
push 0x64
push edx
push eax
call fcn.004aa100
mov cl, 0x14
call fcn.004aa3f0
mov edi, eax
mov esi, edx
cmp esi, dword [ebp - 0x90]
jg 0x499295
jl 0x499289
cmp edi, dword [ebp - 0x94]
jae 0x499295
mov edi, dword [ebp - 0x94]
mov esi, dword [ebp - 0x90]
mov ecx, dword [ebp - 0xc4]
cmp ecx, ebx
jl 0x4992c7
mov eax, dword [ebp - 0xc8]
jg 0x4992ab
cmp eax, ebx
jbe 0x4992c7
cmp esi, ecx
jl 0x4992b9
jg 0x4992b5
cmp edi, eax
jbe 0x4992b9
mov edi, eax
mov esi, ecx
cmp esi, ebx
jg 0x4992d9
jl 0x4992c3
cmp edi, ebx
ja 0x4992c7
mov edi, eax
mov esi, ecx
cmp esi, ebx
jl 0x499717
jg 0x4992d9
cmp edi, ebx
jb 0x499717
mov eax, dword [ebp + 0x50]
cmp word [eax], bx
je 0x499717
cmp esi, ebx
jg 0x4992f4
jl 0x4992ef
cmp edi, ebx
ja 0x4992f4
xor edi, edi
inc edi
xor esi, esi
push esi
push edi
push dword [ebp]
call fcn.00497e21
add esp, 0xc
push 0x4c92e0
lea ecx, [ebp]
call fcn.0044420d
cmp byte [ebp + 0x66], bl
mov eax, str.imdisk___e
jne 0x49931d
mov eax, str.imdisk___a
push eax
lea ecx, [ebp + 0x5c]
call fcn.0044cf95
mov eax, dword [ebp - 0xd4]
and eax, 1
xor ecx, ecx
or eax, ecx
je 0x499342
push str.__o_awe
lea ecx, [ebp + 0x5c]
call fcn.0044420d
mov eax, dword [ebp]
cmp word [eax], bx
je 0x499362
push str.___s
lea ecx, [ebp + 0x5c]
call fcn.0044420d
push dword [ebp]
lea ecx, [ebp + 0x5c]
call fcn.0044420d
mov eax, dword [ebp + 0x50]
cmp word [eax], bx
je 0x499382
push 0x4c9284
lea ecx, [ebp + 0x5c]
call fcn.0044420d
push dword [ebp + 0x50]
lea ecx, [ebp + 0x5c]
call fcn.0044420d
mov eax, dword [ebp + 4]
cmp word [eax], bx
jne 0x499396
mov eax, dword [ebp - 0xc]
cmp word [eax], bx
je 0x499421
push str.___p__
lea ecx, [ebp + 0x5c]
call fcn.0044420d
mov eax, dword [ebp + 4]
cmp word [eax], bx
je 0x4993c3
push str.__FS:
lea ecx, [ebp + 0x5c]
call fcn.0044420d
push dword [ebp + 4]
lea ecx, [ebp + 0x5c]
call fcn.0044420d
mov eax, dword [ebp - 0xc]
cmp word [eax], bx
je 0x4993e3
push str.__V:
lea ecx, [ebp + 0x5c]
call fcn.0044420d
push dword [ebp - 0xc]
lea ecx, [ebp + 0x5c]
call fcn.0044420d
push dword [ebp + 4]
push str.NTFS
call fcn.0043f15a
test al, al
pop ecx
pop ecx
je 0x499414
mov eax, dword [ebp - 0x3c]
mov ax, word [eax]
cmp ax, bx
je 0x499414
cmp ax, 0x30
je 0x499414
push 0x4c5874
lea ecx, [ebp + 0x5c]
call fcn.0044420d
push str.___Q__Y__X__
lea ecx, [ebp + 0x5c]
call fcn.0044420d
mov eax, dword [ebp + 0x5c]
lea ecx, [ebp]
mov dword [ebp + 0x60], eax
call fcn.0043dd41
mov esi, 0x4d8d1c
lea eax, [ebp + 0x48]
push eax
call fcn.0043dcd9
push 4
push dword [ebp + 0x48]
push str._gui
call fcn.0043f0c4
add esp, 0x10
test al, al
jne 0x499726
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x44]
push eax
sub edi, 0xc8
call fcn.00405676
pop ecx
push dword [ebp + 0x44]
lea ecx, [ebp - 0x54]
call fcn.0044cff1
mov eax, dword [ebp - 0x54]
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x54], eax
jmp 0x4994dd
push 6
lea eax, [ebp + 0x54]
push eax
push str.__nbrd
call fcn.0044615f
add esp, 0xc
test al, al
jne 0x4994da
push 6
lea eax, [ebp + 0x54]
push eax
push 0x4bd904
call fcn.0044615f
add esp, 0xc
test al, al
jne 0x4994da
push 2
lea eax, [ebp + 0x54]
push eax
push 0x4c1aac
call fcn.0044615f
add esp, 0xc
test al, al
jne 0x4994da
lea eax, [ebp + 0x54]
push eax
call fcn.00408ddd
pop ecx
mov eax, dword [ebp + 0x54]
cmp word [eax], bx
jne 0x49948b
cmp dword [ebp - 0x18], ebx
jne 0x4995ef
cmp dword [ebp + 0x24], ebx
jg 0x4995ef
push ebx
push dword [ebp + 0x60]
lea ecx, [ebp - 0x19c]
call fcn.0044fcef
cmp dword [ebp - 0x164], 1
jle 0x49973d
mov eax, dword [ebp - 0x160]
mov dword [eax], str.imdisk
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x160]
push dword [ebp - 0x164]
call fcn.00425054
add esp, 0xc
cmp byte [ebp + 0x37], bl
mov dword [ebp + 0x1c], eax
mov dword [ebp - 0x88], ebx
jle 0x499645
cmp eax, 3
jne 0x499645
cmp dword [ebp - 0x8c], ebx
jne 0x499645
lea ecx, [ebp - 0x14]
mov byte [ebp + 0x5b], 1
call fcn.0043dd41
lea ecx, [ebp - 0x54]
call fcn.0043dd41
lea ecx, [ebp + 0x28]
call fcn.0043dd41
lea ecx, [ebp - 0x28]
call fcn.0043dd41
lea ecx, [ebp + 0x3c]
call fcn.0043dd41
lea ecx, [ebp - 0x3c]
call fcn.0043dd41
lea ecx, [ebp - 0xc]
call fcn.0043dd41
lea ecx, [ebp + 0x50]
call fcn.0043dd41
lea ecx, [ebp + 4]
call fcn.0043dd41
lea ecx, [ebp - 0x1c]
call fcn.0043dd41
lea ecx, [ebp + 0x14]
call fcn.0043dd41
lea ecx, [ebp + 0x5c]
call fcn.0043dd41
lea ecx, [ebp - 0xa8]
call fcn.0043dd41
lea ecx, [ebp + 0x18]
call fcn.0043dd41
lea ecx, [ebp - 0x24]
call fcn.0043dd41
lea ecx, [ebp + 0x78]
call fcn.00495bdb
lea ecx, [ebp - 0x70]
call fcn.0043dd41
jmp 0x498141
cmp dword [ebp - 0x8c], ebx
jne 0x499645
push dword [ebp + 0x14]
lea ecx, [ebp - 0x50]
call fcn.0044cf2d
push dword [ebp + 0x44]
lea ecx, [ebp - 0x50]
call fcn.0044420d
mov eax, dword [ebp + 0x18]
cmp word [eax], bx
mov ecx, dword [ebp + 0x7c]
mov dword [ebp - 0x88], 1
je 0x499632
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x50]
push ecx
push ebx
call fcn.0040a2d5
jmp 0x49963a
push dword [ebp - 0x50]
call fcn.00402eb2
lea ecx, [ebp - 0x50]
mov dword [ebp + 0x1c], eax
call fcn.0043dd41
mov ecx, dword [ebp - 0xe0]
xor eax, eax
or ecx, eax
je 0x499744
cmp dword [ebp + 0x1c], 3
jne 0x499744
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1388
jae 0x499744
mov ecx, dword [ebp + 0x7c]
push ebx
push ebx
push 0xc8
call fcn.00415bb5
mov esi, 0x4d8d1c
jmp 0x4994e2
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4d8d78], ebx
jle 0x4996b1
push esi
call edi
mov ecx, dword [ebp + 0x7c]
push ebx
push ebx
push 1
call fcn.00415bb5
jmp 0x499691
push 0xffffffffffffffff
lea ecx, [ebp + 0xf]
call fcn.004131c0
push esi
call edi
jmp 0x499818
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x4996d0
xor eax, eax
inc eax
mov dword [ebp + 0x1c], eax
jmp 0x49970d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.0043dd41
lea ecx, [ebp - 0x30]
call fcn.0043dd41
lea ecx, [ebp - 0x2c]
call fcn.0043dd41
mov ebx, 0xb7
jmp 0x499795
lea ecx, [ebp - 0x30]
mov dword [ebp + 0x1c], 1
call fcn.0043dd41
lea ecx, [ebp - 0x2c]
call fcn.0043dd41
jmp 0x499744
lea ecx, [ebp]
call fcn.0043dd41
mov ebx, 0x80070057
jmp 0x499795
mov ecx, dword [ebp + 0x7c]
push 0xffffffffffffff9c
push 0x4bca2c
push ebx
push str.imdisk.cpl_
call fcn.0045906e
jmp 0x499795
mov dword [ebp + 0x1c], 0x80070057
mov eax, dword [ebp - 0x15c]
cmp eax, ebx
je 0x49975f
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x78], eax
mov dword [ebp - 0x15c], ebx
call fcn.0043dd41
mov edx, dword [ebp + 0x18]
cmp word [edx], bx
je 0x499792
cmp dword [ebp - 0x88], ebx
jne 0x499792
mov ecx, dword [ebp - 0x24]
mov word [ebp - 0x218], bx
cmp word [ecx], 0x2a
lea eax, [ebp - 0x218]
jne 0x499788
lea eax, [ecx + 2]
mov ecx, dword [ebp + 0x7c]
push eax
push edx
call fcn.004438ac
mov ebx, dword [ebp + 0x1c]
lea ecx, [ebp - 0x14]
call fcn.0043dd41
lea ecx, [ebp - 0x54]
call fcn.0043dd41
lea ecx, [ebp + 0x28]
call fcn.0043dd41
lea ecx, [ebp - 0x28]
call fcn.0043dd41
lea ecx, [ebp + 0x3c]
call fcn.0043dd41
lea ecx, [ebp - 0x3c]
call fcn.0043dd41
lea ecx, [ebp - 0xc]
call fcn.0043dd41
lea ecx, [ebp + 0x50]
call fcn.0043dd41
lea ecx, [ebp + 4]
call fcn.0043dd41
lea ecx, [ebp - 0x1c]
call fcn.0043dd41
lea ecx, [ebp + 0x14]
call fcn.0043dd41
lea ecx, [ebp + 0x5c]
call fcn.0043dd41
lea ecx, [ebp - 0xa8]
call fcn.0043dd41
lea ecx, [ebp + 0x18]
call fcn.0043dd41
lea ecx, [ebp - 0x24]
call fcn.0043dd41
lea ecx, [ebp + 0x78]
call fcn.00495bdb
lea ecx, [ebp - 0x70]
call fcn.0043dd41
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x70
leave
ret