Function at 0x4755aa
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x288
push ebx
fldz
push esi
fstp qword [ebp - 0x19c]
push edi
push 0x26
xor eax, eax
pop ecx
lea edi, [ebp - 0x194]
mov byte [ebp + 0x5b], 1
rep stosd dword es:[edi], eax
xor ebx, ebx
mov esi, 0x4ad684
push dword [ebp + 0x78]
lea ecx, [ebp - 0x8c]
mov byte [ebp + 0x37], bl
call fcn.004403c3
mov eax, dword [ebp - 0x8c]
mov dword [ebp + 0x60], eax
add eax, 0xc
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x48], eax
lea eax, [ebp + 0x48]
push eax
call fcn.00404579
mov eax, dword [ebp + 0x48]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.00430961
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2a
pop ecx
pop ecx
lea ecx, [ebp + 0x14]
sete byte [ebp + 0x67]
call fcn.0040f2f9
push 6
push dword [ebp - 0x20]
push str.__free
call fcn.00431867
add esp, 0xc
test al, al
jne 0x476b29
lea ecx, [ebp + 0x78]
call fcn.004739db
push ebx
lea ecx, [ebp + 0x14]
call fcn.0040f2fc
lea ecx, [ebp + 0x14]
call fcn.0040f2ed
neg eax
sbb eax, eax
inc eax
cmp dword [0x4ab7d0], ebx
mov dword [ebp], eax
mov dword [ebp + 0x28], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x90], ebx
jge 0x47570d
mov eax, dword [0x4acef4]
cmp eax, ebx
mov dword [0x4ab7d0], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], ebx
je 0x4756e9
lea ecx, [ebp + 0x54]
push ecx
lea ecx, [ebp + 0x50]
push ecx
call eax
cmp dword [ebp + 0x54], ebx
jbe 0x4756e9
mov eax, dword [ebp + 0x50]
cmp eax, 0x202
jb 0x4756b5
mov dword [0x4ab7d0], 0x38
jmp 0x4756e9
cmp eax, 0x184
jb 0x4756c8
mov dword [0x4ab7d0], 8
jmp 0x4756e9
cmp eax, 0x160
jb 0x4756db
mov dword [0x4ab7d0], 2
jmp 0x4756e9
cmp eax, ebx
jbe 0x4756e9
mov dword [0x4ab7d0], 1
push dword [0x4acef4]
push dword [0x4ab7d0]
push dword [ebp + 0x54]
push dword [ebp + 0x50]
push str.DBG:_IMD:_0x_X_0x_X_0x_X__0x_p_r_n
push 0x4acf10
call fcn.0040cde2
add esp, 0x18
push 3
push dword [ebp - 0x20]
push 0x49ba9c
call fcn.00431867
add esp, 0xc
test al, al
je 0x47572a
mov dword [ebp + 0x28], 0xfff00000
push 5
lea eax, [ebp - 0x20]
push eax
push str.__ins
mov byte [ebp + 0x6f], bl
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x47574a
mov byte [ebp + 0x6f], 5
jmp 0x475765
push 6
lea eax, [ebp - 0x20]
push eax
push str.__fins
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x475765
mov byte [ebp + 0x6f], 6
push 0x3e8
lea ecx, [ebp - 0x2c]
call fcn.00435d80
lea ecx, [ebp + 0x20]
call fcn.00435d62
lea ecx, [ebp - 0xb0]
call fcn.00435d62
lea ecx, [ebp + 0x5c]
call fcn.00435d62
lea ecx, [ebp - 4]
mov dword [ebp + 8], ebx
call fcn.00435d62
lea ecx, [ebp + 0x18]
call fcn.00435d62
lea ecx, [ebp + 0x4c]
call fcn.00435d62
lea ecx, [ebp - 0x1c]
call fcn.00435d62
lea ecx, [ebp - 0x4c]
call fcn.00435d62
lea ecx, [ebp + 0x44]
call fcn.00435d62
lea ecx, [ebp - 0x24]
call fcn.00435d62
lea ecx, [ebp + 0x30]
call fcn.00435d62
or eax, 0xffffffff
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov eax, 0x4949a4
push 0xc8
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x54], eax
mov dword [ebp - 0x30], eax
call fcn.00435d80
cmp byte [ebp + 0x67], bl
mov eax, dword [ebp + 0x48]
mov cx, word [eax]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0xd8], eax
mov word [ebp - 0x88], cx
mov dword [ebp + 0x38], eax
je 0x47595e
add dword [ebp + 0x68], 2
mov word [eax], bx
mov eax, dword [ebp + 0x68]
mov edx, eax
jmp 0x475850
cmp cx, 0x2a
je 0x475858
inc eax
inc eax
mov dword [ebp + 0x68], eax
mov cx, word [eax]
cmp cx, bx
jne 0x475845
sub eax, edx
sar eax, 1
push eax
push edx
lea ecx, [ebp + 0x20]
call fcn.00435e88
mov eax, dword [ebp + 0x20]
cmp word [eax], bx
je 0x47587b
push 0x3e8
lea ecx, [ebp - 0x2c]
call fcn.00435da9
cmp word [ebp - 0x88], bx
mov eax, dword [ebp + 0x48]
mov dword [ebp + 0x38], eax
je 0x475890
add eax, 2
mov dword [ebp + 0x38], eax
lea eax, [ebp + 0x38]
push eax
call fcn.00430961
pop ecx
mov edi, 0x4949a4
push 4
lea eax, [ebp + 0x38]
push eax
push str._mem
call fcn.00437b13
add esp, 0xc
test al, al
jne 0x4758cd
push 2
lea eax, [ebp + 0x38]
push eax
push 0x4972a8
call fcn.00437b13
add esp, 0xc
test al, al
je 0x4758d2
mov dword [ebp + 0x54], edi
jmp 0x47589f
push 3
lea eax, [ebp + 0x38]
push eax
push 0x49c04c
call fcn.00437b13
add esp, 0xc
test al, al
je 0x4758f2
mov dword [ebp + 0x54], 0x49e8d4
jmp 0x47589f
push 4
lea eax, [ebp + 0x38]
push eax
push str._map
call fcn.00437b13
add esp, 0xc
test al, al
je 0x475915
mov dword [ebp - 0xe0], 1
jmp 0x47589f
push 4
lea eax, [ebp + 0x38]
push eax
push str._exe
call fcn.00437b13
add esp, 0xc
test al, al
je 0x475938
mov dword [ebp + 0x28], 1
jmp 0x47589f
push 5
lea eax, [ebp + 0x38]
push eax
push str._nexe
call fcn.00437b13
add esp, 0xc
test al, al
je 0x47595b
mov dword [ebp + 0x28], 0xfff00000
jmp 0x47589f
mov edi, dword [ebp + 0x38]
mov ecx, dword [ebp + 0x7c]
push 0x49e8ac
push 0x49df00
call fcn.00435749
mov eax, dword [ebp + 0x20]
cmp word [eax], bx
push 0xffffffffffffffff
lea ecx, [ebp + 8]
push 0xffffffffffffffff
je 0x4759a3
push 0x49e8a8
call fcn.00435e1f
push dword [ebp + 0x20]
lea ecx, [ebp + 8]
call fcn.00435dd0
push str.Imdisk
lea ecx, [ebp + 8]
call fcn.00435dd0
jmp 0x4759ad
push str._Imdisk
call fcn.00435e1f
push 9
push edi
push str.__version
call fcn.00431867
push 2
push edi
push 0x49e878
mov byte [ebp + 0x66], al
call fcn.00431867
push 2
push edi
push 0x49e874
mov byte [ebp + 7], al
call fcn.00431867
push 3
push edi
push 0x49ba9c
mov byte [ebp + 0xf], al
call fcn.00431867
add esp, 0x30
cmp byte [ebp + 0x66], bl
jne 0x475a04
cmp byte [ebp + 7], bl
jne 0x475a04
cmp byte [ebp + 0xf], bl
jne 0x475a04
cmp al, bl
jne 0x475a04
mov cl, 1
jmp 0x475a06
xor cl, cl
cmp dword [ebp], ebx
jne 0x475a1d
mov eax, dword [0x4ab7d0]
cmp eax, ebx
jle 0x475a1d
push 2
pop edi
cmp eax, edi
jge 0x475a29
jmp 0x475a20
push 2
pop edi
cmp cl, bl
jne 0x475a33
cmp byte [ebp + 0x6f], bl
jne 0x475a33
cmp byte [ebp + 0x6f], 6
jl 0x475bb7
cmp dword [ebp], ebx
mov dword [ebp - 0x18], 0x49e86c
jne 0x475a89
lea ecx, [ebp - 0x7c]
call fcn.00435d62
mov eax, 0x49e864
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0xe8]
push eax
push edi
call fcn.004227fd
mov eax, dword [ebp - 0x7c]
add esp, 0xc
cmp word [eax], bx
je 0x475a81
cmp word [eax + 2], bx
je 0x475a81
mov dword [ebp - 0x18], 0x49e85c
lea ecx, [ebp - 0x7c]
call fcn.0043092f
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov edi, dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
sub dword [0x4ada98], 1
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [0x4ada98], ebx
jle 0x475abf
push esi
call edi
mov ecx, dword [ebp + 0x7c]
push ebx
push 1
call fcn.0040d358
jmp 0x475aa0
push 0xffffffffffffffff
lea ecx, [ebp + 0x14]
call fcn.0040f2fc
push esi
call edi
movsx ax, byte [ebp + 0x6f]
push 0xffffffffffffffff
lea ecx, [ebp + 0x14]
mov word [ebp - 0xc2], 0x20
mov word [ebp - 0xc0], bx
add eax, 0x30
mov word [ebp - 0xc4], ax
call fcn.0040f2fc
push str.28:INDATA
lea ecx, [ebp + 0x10]
call fcn.004403c3
cmp dword [ebp], ebx
mov eax, 0x49e85c
jne 0x475b11
mov eax, 0x49e86c
push eax
lea ecx, [ebp + 0x10]
call fcn.00435dd0
push dword [ebp - 0x18]
lea ecx, [ebp + 0x10]
call fcn.00435dd0
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp + 0x10]
call fcn.00435dd0
push dword [ebp + 0x48]
lea ecx, [ebp + 0x10]
call fcn.00435dd0
push dword [ebp + 0x10]
push str.Install_IMD__s__r_n
push 0x4acf10
call fcn.0040cde2
mov ecx, dword [ebp + 0x7c]
add esp, 0xc
push dword [ebp + 0x10]
call fcn.00428650
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
add dword [0x4ada98], 1
push esi
mov dword [0x4ab7d0], 0xffffffc0
call edi
push ebx
lea ecx, [ebp + 0x14]
call fcn.0040f2fc
lea ecx, [ebp + 0x14]
call fcn.0040f2ed
neg eax
sbb eax, eax
inc eax
push esi
mov dword [ebp], eax
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [ebp], ebx
jne 0x475ba9
mov dword [0x4ab7d0], 0x38
push esi
call edi
lea ecx, [ebp + 0x10]
call fcn.0043092f
push 2
pop edi
cmp byte [ebp + 0x67], bl
je 0x47645c
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x58], eax
jmp 0x475beb
push edi
lea eax, [ebp - 0x58]
push eax
push 0x4972a8
call fcn.00437ad0
add esp, 0xc
test al, al
jne 0x475bf2
lea eax, [ebp - 0x58]
push eax
call fcn.0040459d
mov eax, dword [ebp - 0x58]
pop ecx
cmp word [eax], bx
jne 0x475bc8
jmp 0x475bf8
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2a
jne 0x476447
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
cmp word [eax], 0x40
mov byte [ebp + 0x67], bl
jne 0x475c27
add dword [ebp + 0x68], edi
mov byte [ebp + 0x67], 1
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0043aabb
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
pop ecx
je 0x475c41
add dword [ebp + 0x68], edi
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0043aabb
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
pop ecx
je 0x475c5b
add dword [ebp + 0x68], edi
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0043aabb
mov edi, dword [ebp + 0x68]
cmp word [edi], bx
pop ecx
pop ecx
je 0x475c77
inc edi
inc edi
mov dword [ebp + 0x68], edi
mov al, byte [ebp - 0x54]
and al, 1
mov byte [ebp + 0x6f], al
push 0x2a
lea eax, [ebp + 0x68]
call fcn.004754d0
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp + 0x30]
call fcn.00435e88
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
je 0x475ca7
add dword [ebp + 0x68], 2
mov edi, dword [ebp + 0x68]
push 0x2a
lea eax, [ebp + 0x68]
call fcn.004754d0
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp + 0x44]
call fcn.00435e88
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
je 0x475cd2
add dword [ebp + 0x68], 2
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0043aabb
mov edi, dword [ebp + 0x68]
cmp word [edi], bx
pop ecx
pop ecx
je 0x475cee
inc edi
inc edi
mov dword [ebp + 0x68], edi
push 0x2a
lea eax, [ebp + 0x68]
call fcn.004754d0
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x24]
call fcn.00435e88
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0043aabb
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
pop ecx
je 0x475d25
add dword [ebp + 0x68], 2
cmp byte [ebp + 0x67], bl
mov edx, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], ecx
je 0x475d6a
add eax, edx
adc ecx, edi
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], ecx
cmp dword [ebp - 0x5c], ebx
jl 0x475d8c
jg 0x475d76
cmp dword [ebp - 0x60], ebx
jbe 0x475d8c
cmp dword [ebp - 0x38], ebx
jg 0x475d8c
jl 0x475d82
cmp dword [ebp - 0x3c], ebx
ja 0x475d8c
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], ebx
push 0x318
lea ecx, [ebp - 0x34]
call fcn.00435d80
mov eax, dword [ebp - 0x34]
lea esi, [eax + 0x6a]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x6a]
push ebx
lea edi, [eax + 0x6a]
mov word [edi], bx
push 0x200
mov word [eax], bx
push dword [ebp - 0x64]
lea ecx, [edi + 0x6a]
push dword [ebp - 0x68]
mov dword [ebp + 0x50], esi
mov dword [ebp - 8], ecx
call fcn.0047fdd0
push edx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
call fcn.004752d0
add esp, 0xc
push ebx
push 0x200
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
call fcn.0047fdd0
push edx
push eax
push esi
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], edx
call fcn.004752d0
add esp, 0xc
mov word [edi], bx
cmp dword [ebp - 0x5c], ebx
jl 0x475e1b
jg 0x475e0c
cmp dword [ebp - 0x60], ebx
jbe 0x475e1b
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push edi
call fcn.004752d0
add esp, 0xc
mov ecx, dword [ebp + 0x48]
xor eax, eax
cmp word [ebp - 0x88], bx
setne al
lea eax, [ecx + eax*2]
mov dword [ebp + 0x3c], eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00430961
push 4
push dword [ebp + 0x3c]
mov dword [ebp - 0x80], ebx
push str.__w:
call fcn.004318b1
add esp, 0x10
test al, al
je 0x475e65
add dword [ebp + 0x3c], 8
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00438b8e
pop ecx
pop ecx
push 0xffffffffffffffff
lea eax, [ebp + 0x3c]
push eax
push 0x49e814
call fcn.00437ad0
add esp, 0xc
cmp dword [0x4ab7d0], 1
jl 0x475e8d
cmp dword [ebp + 0x28], ebx
jne 0x475e8d
mov dword [ebp + 0x28], 0xfff00000
mov eax, dword [ebp + 0x3c]
mov edx, 0x4949a4
mov dword [ebp + 0x2c], eax
xor edi, edi
cmp word [eax], bx
mov byte [ebp + 0x66], bl
mov byte [ebp + 0x67], bl
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x84], edx
je 0x475f21
push 2
lea eax, [ebp + 0x2c]
push eax
push 0x49c258
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x475eca
xor edi, edi
inc edi
jmp 0x475f14
cmp edi, ebx
je 0x475f08
push 2
lea eax, [ebp + 0x2c]
push eax
push 0x49e810
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x475eeb
mov byte [ebp + 0x66], 1
jmp 0x475f14
push 3
lea eax, [ebp + 0x2c]
push eax
push 0x49e80c
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x475f08
mov byte [ebp + 0x67], 1
jmp 0x475f14
lea eax, [ebp + 0x2c]
push eax
call fcn.0040459d
pop ecx
xor edi, edi
mov eax, dword [ebp + 0x2c]
cmp word [eax], bx
jne 0x475eae
mov edx, 0x4949a4
mov eax, dword [0x4ab7d0]
test al, 0x10
je 0x475f36
cmp byte [ebp + 0x67], bl
jne 0x475f36
mov dword [ebp - 0x18], str._o_par
mov edi, eax
and edi, 0x20
je 0x475f47
mov dword [ebp - 0x84], str._o_shared
cmp edi, ebx
je 0x475f4e
mov byte [ebp + 0x5b], bl
mov ecx, dword [ebp - 0x54]
mov eax, ecx
and eax, 0x200
or eax, ebx
jne 0x475f77
cmp edi, ebx
jne 0x475f77
cmp byte [ebp + 0x6f], bl
je 0x475f7a
and ecx, 0x100
mov eax, ecx
or eax, ebx
je 0x475f7a
mov byte [ebp + 0x5b], 1
jmp 0x475f7a
mov byte [ebp + 0x5b], bl
cmp dword [0x4ab7d0], 8
jl 0x476090
cmp byte [ebp + 0x6f], bl
je 0x475f95
cmp byte [ebp + 0x5b], bl
jne 0x476090
cmp byte [ebp + 0x6f], bl
mov dword [ebp + 0x54], edx
jne 0x475fab
cmp byte [ebp + 0x66], bl
jne 0x475fb3
mov dword [ebp + 0x54], str._o_ro
jmp 0x475fb3
cmp edi, ebx
jne 0x475fb3
mov byte [ebp + 0x37], 1
push dword [ebp + 0x48]
mov edi, dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [eax + esi + 0x800]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00435da9
push dword [ebp + 0x30]
push dword [ebp + 0x50]
push dword [ebp - 0x10]
push dword [ebp - 0x84]
push dword [ebp - 0x18]
push dword [ebp + 0x54]
push str.imdisk__a___s__s__s___b__sb__s__sb__f__s
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp + 0x3c]
add esp, 0x20
mov dword [ebp + 0x24], eax
cmp word [eax], bx
je 0x47607c
push 2
lea eax, [ebp + 0x24]
push eax
push 0x49dec4
call fcn.00437b13
add esp, 0xc
test al, al
jne 0x476042
push 2
lea eax, [ebp + 0x24]
push eax
push 0x49744c
call fcn.00437b13
add esp, 0xc
test al, al
jne 0x476042
lea eax, [ebp + 0x24]
push eax
call fcn.0040459d
jmp 0x476070
mov ecx, dword [ebp + 0x24]
xor eax, eax
jmp 0x47605f
call fcn.0040bc38
test al, al
jne 0x476067
mov word [ecx], 0x20
mov ecx, dword [ebp + 0x24]
inc ecx
inc ecx
mov dword [ebp + 0x24], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x476049
lea eax, [ebp + 0x24]
push eax
call fcn.00430961
mov eax, dword [ebp + 0x24]
cmp word [eax], bx
pop ecx
jne 0x476009
mov eax, dword [ebp + 0x3c]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x60], eax
jmp 0x476427
cmp byte [ebp + 0x6f], bl
je 0x4760ca
push ebx
push 0xa0000080
push 3
push ebx
push 7
push 0xc0000000
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
je 0x476b60
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0xac], 0x4949a4
jmp 0x4760d4
mov dword [ebp - 0xac], 0x49e780
cmp dword [ebp - 0x38], ebx
jl 0x4760f2
jg 0x4760e0
cmp dword [ebp - 0x3c], ebx
jbe 0x4760f2
push dword [ebp - 0x38]
lea eax, [esi + 0x6a]
push dword [ebp - 0x3c]
push eax
call fcn.004752d0
add esp, 0xc
push 0x5c
push ebx
push dword [ebp + 0x30]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
jne 0x476109
mov esi, dword [ebp + 0x30]
jmp 0x47610b
inc esi
inc esi
mov eax, dword [ebp + 0x44]
cmp word [eax], bx
jne 0x47613f
push 0x800
lea ecx, [ebp + 0x44]
call fcn.00435da9
mov edi, dword [ebp + 0x44]
call fcn.00432a01
push eax
push dword [ebp + 0x50]
push dword [ebp - 0x10]
push esi
push str._s_s_s__u
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push dword [ebp + 0x44]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, eax
mov eax, 0x400
cmp esi, eax
jle 0x47615f
mov esi, eax
mov eax, dword [ebp + 0x44]
mov word [eax + 0x800], bx
push str.Global_
lea ecx, [ebp - 0xc]
call fcn.00440487
push dword [ebp + 0x44]
lea ecx, [ebp - 0xc]
call fcn.00435dd0
push str._devio_Ack
lea ecx, [ebp - 0xc]
call fcn.00435dd0
mov eax, dword [ebp - 8]
mov word [eax], bx
mov eax, dword [ebp - 0x54]
and eax, 0x30
or eax, ebx
mov word [ebp - 0x1d8], bx
jne 0x4761b2
cmp byte [ebp + 0x6f], bl
je 0x476264
mov eax, dword [ebp - 0x54]
and eax, 0x40
or eax, ebx
jne 0x476264
mov edi, dword [ebp - 8]
push 0x10
push str.__kill:
push edi
call fcn.004102e0
add esp, 0xc
push 0x104
add edi, 0x27e
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov eax, dword [ebp - 8]
push 0x104
add eax, 0xe
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameW]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edi, dword [ebp - 0x30]
cmp word [edi], 0x22
mov dword [ebp - 0x74], eax
mov dword [ebp + 0x2c], edi
jne 0x47621b
add dword [ebp - 0x30], 2
jmp 0x476211
cmp ax, 0x22
je 0x476228
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x476209
jmp 0x476228
lea eax, [ebp + 0x2c]
push eax
call fcn.00404579
mov edi, dword [ebp + 0x2c]
pop ecx
mov ax, word [edi]
mov word [ebp + 0x2c], ax
mov word [edi], bx
mov eax, dword [ebp - 0x54]
and eax, 0x20
or eax, ebx
mov eax, str._LOAD_25_poweroff
jne 0x476246
mov eax, str._RAMD_ImdiskV__D__m__s_
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 8]
lea eax, [eax + ecx*2]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ax, word [ebp + 0x2c]
add esp, 0xc
mov word [edi], ax
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
mov cl, 1
call fcn.00480180
and eax, 3
je 0x47628c
push eax
lea eax, [ebp - 0x1d8]
push str._nrc:_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push ebx
mov edi, 0x200
push edi
push dword [ebp - 0xb8]
push dword [ebp - 0xbc]
call fcn.0047fdd0
push edx
push eax
push dword [ebp - 0x10]
call fcn.004752d0
add esp, 0xc
push ebx
push edi
push dword [ebp - 0xa4]
push dword [ebp - 0xa8]
call fcn.0047fdd0
push edx
push eax
push dword [ebp + 0x50]
call fcn.004752d0
mov ecx, dword [ebp + 0x7c]
add esp, 0xc
push 0x497a68
push str.__ImdMapPid
call fcn.00435749
push dword [ebp + 0x30]
mov edi, dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
push edi
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x28]
lea eax, [eax + esi + 0x940]
push eax
call fcn.00435d80
push str.Global_
lea ecx, [ebp - 0x48]
call fcn.004403c3
push dword [ebp + 0x44]
lea ecx, [ebp - 0x48]
call fcn.00435dd0
push dword [ebp - 0x48]
push ebx
push 2
call dword [sym.imp.KERNEL32.DLL_OpenFileMappingW]
cmp eax, ebx
jne 0x476b72
lea ecx, [ebp - 0x48]
call fcn.0043092f
mov edx, dword [ebp + 0x50]
lea eax, [edx + 0x6a]
lea ecx, [eax + 0x6a]
push ecx
push eax
push dword [ebp - 0x10]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push edx
push dword [ebp + 0x30]
lea eax, [ebp - 0x1d8]
push dword [ebp + 0x44]
push dword [ebp - 0xac]
push eax
push dword [ebp - 0x24]
push dword [ebp - 8]
push dword [ebp + 0x54]
push str.EXEC___pid:__ImdMapPid____exe:_s10INDATA___nfb___MyName0____s__w:60000__s__s__s_shm:_s___s__s__s__s__s
push dword [ebp - 0x28]
call edi
add esp, 0x34
add esi, 0x800
push esi
lea ecx, [ebp + 0x5c]
call fcn.00435da9
mov eax, dword [ebp - 0x10]
mov word [eax], bx
mov eax, dword [ebp + 0x50]
mov word [eax], bx
push dword [ebp + 0x44]
push dword [ebp - 0x84]
push dword [ebp - 0x18]
push 0x4949a4
push str.imdisk__a__t_proxy__s__s__s__o_shm__f__s
push dword [ebp + 0x5c]
call edi
add esp, 0x18
push dword [ebp + 0x3c]
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
push dword [ebp - 0xc]
mov eax, dword [ebp + 0x5c]
push ebx
push ebx
push ebx
mov dword [ebp + 0x60], eax
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
mov ecx, dword [ebp + 0x7c]
push ebx
push ebx
push ebx
push dword [ebp - 0x28]
mov esi, eax
call fcn.00426546
push 0xea60
push esi
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp edi, ebx
jne 0x476b9b
push 0x32
pop esi
push ebx
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec esi
jne 0x476404
cmp dword [ebp - 0x80], ebx
jle 0x47641f
mov ecx, dword [ebp + 0x7c]
push ebx
push dword [ebp - 0x80]
call fcn.0040d358
lea ecx, [ebp - 0x28]
call fcn.0043092f
mov eax, dword [ebp + 0x3c]
mov dword [ebp + 0x48], eax
lea ecx, [ebp - 0x34]
mov word [eax], bx
mov dword [ebp - 0xe0], 1
call fcn.0043092f
mov esi, 0x4ad684
mov ax, word [ebp - 0x88]
mov ecx, dword [ebp - 0xd8]
mov word [ecx], ax
jmp 0x4768d7
push 4
lea eax, [ebp + 0x48]
push eax
push str._exe
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x47647a
mov dword [ebp + 0x28], 1
push 5
lea eax, [ebp + 0x48]
push eax
push str._nexe
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x476498
mov dword [ebp + 0x28], 0xfff00000
push 6
lea eax, [ebp + 0x48]
push eax
push str._nexe1
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x4764c0
mov dword [ebp + 0x28], 0xfff00000
mov dword [ebp - 0x90], 1
push 0x2c
pop esi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.004386e6
mov eax, dword [ebp - 4]
mov word [eax], bx
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x47658d
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.004386e6
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x47658d
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.004386e6
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x47658d
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.004386e6
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x47658d
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.004386e6
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x47658d
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.004386e6
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x47658d
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.0043889c
add esp, 0xc
push 6
lea ecx, [ebp + 0x4c]
mov byte [ebp + 0x66], bl
call fcn.00435da9
mov eax, dword [ebp + 0x4c]
mov word [eax + 2], 0x3a
mov eax, dword [ebp + 0x4c]
mov word [eax + 4], bx
mov eax, dword [ebp + 0x4c]
cmp word [eax], bx
je 0x476629
push eax
call fcn.0047f62b
test eax, eax
pop ecx
je 0x476621
mov eax, dword [ebp + 0x4c]
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xfc], str.imdisk
mov dword [ebp - 0xf8], 0x49e864
mov dword [ebp - 0xf4], 0x49e558
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], ebx
call fcn.00435d62
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xfc]
push eax
push 4
call fcn.004227fd
add esp, 0xc
neg eax
sbb al, al
inc al
lea ecx, [ebp - 0xb4]
mov byte [ebp + 0x66], al
call fcn.0043092f
mov eax, dword [ebp + 0x4c]
cmp word [eax], bx
jne 0x476642
push 0x4986d8
lea ecx, [ebp + 0x4c]
call fcn.0044042b
mov eax, dword [ebp + 0x4c]
cmp word [eax], bx
je 0x476bbc
push 0x3c
lea ecx, [ebp - 0x14]
call fcn.00435d80
mov eax, dword [ebp - 4]
or esi, 0xffffffff
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp + 0x40], eax
cmp word [eax], bx
mov edi, esi
je 0x476bb4
lea eax, [ebp + 0x40]
push eax
call fcn.00430961
mov eax, dword [ebp + 0x40]
mov ax, word [eax]
or ax, 0x20
cmp ax, 0x70
pop ecx
jne 0x4766a6
lea eax, [ebp - 0x98]
jmp 0x4766c0
cmp ax, 0x6c
jne 0x4766b4
lea eax, [ebp - 0xa0]
jmp 0x4766c0
cmp ax, 0x68
jne 0x4766d8
lea eax, [ebp - 0xcc]
add dword [ebp + 0x40], 2
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.00438b6a
mov eax, dword [ebp + 0x40]
cmp word [eax], bx
pop ecx
pop ecx
jne 0x476684
cmp dword [ebp - 0x94], ebx
jl 0x47671a
jg 0x4766ea
cmp dword [ebp - 0x98], ebx
jbe 0x47671a
push 1
call fcn.0041094e
pop ecx
push dword [ebp - 0x94]
push dword [ebp - 0x98]
push edx
push eax
call fcn.0047fe80
push ebx
push 0x64
push edx
push eax
call fcn.0047fdd0
mov cl, 0x14
call fcn.00480180
mov edi, eax
mov esi, edx
cmp esi, dword [ebp - 0x9c]
jg 0x476738
jl 0x47672c
cmp edi, dword [ebp - 0xa0]
jae 0x476738
mov edi, dword [ebp - 0xa0]
mov esi, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xc8]
cmp ecx, ebx
jl 0x47676a
mov eax, dword [ebp - 0xcc]
jg 0x47674e
cmp eax, ebx
jbe 0x47676a
cmp esi, ecx
jl 0x47675c
jg 0x476758
cmp edi, eax
jbe 0x47675c
mov edi, eax
mov esi, ecx
cmp esi, ebx
jg 0x47677c
jl 0x476766
cmp edi, ebx
ja 0x47676a
mov edi, eax
mov esi, ecx
cmp esi, ebx
jl 0x476bb4
jg 0x47677c
cmp edi, ebx
jb 0x476bb4
mov eax, dword [ebp + 0x4c]
cmp word [eax], bx
je 0x476bb4
cmp esi, ebx
jg 0x476797
jl 0x476792
cmp edi, ebx
ja 0x476797
xor edi, edi
inc edi
xor esi, esi
push esi
push edi
push dword [ebp - 0x14]
call fcn.004752ea
add esp, 0xc
push 0x49e550
lea ecx, [ebp - 0x14]
call fcn.00435dd0
cmp byte [ebp + 0x66], bl
mov eax, str.imdisk___e
jne 0x4767c0
mov eax, str.imdisk___a
push eax
lea ecx, [ebp + 0x5c]
call fcn.0044042b
mov eax, dword [ebp - 0xd4]
and eax, 1
xor ecx, ecx
or eax, ecx
je 0x4767e5
push str.__o_awe
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
mov eax, dword [ebp - 0x14]
cmp word [eax], bx
je 0x476805
push str.___s
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
push dword [ebp - 0x14]
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
mov eax, dword [ebp + 0x4c]
cmp word [eax], bx
je 0x476825
push str.___m
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
push dword [ebp + 0x4c]
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
mov eax, dword [ebp + 0x18]
cmp word [eax], bx
jne 0x476839
mov eax, dword [ebp - 0x1c]
cmp word [eax], bx
je 0x4768c4
push str.___p__
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
mov eax, dword [ebp + 0x18]
cmp word [eax], bx
je 0x476866
push str.__FS:
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
push dword [ebp + 0x18]
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
mov eax, dword [ebp - 0x1c]
cmp word [eax], bx
je 0x476886
push str.__V:
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
push dword [ebp - 0x1c]
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
push dword [ebp + 0x18]
push str.NTFS
call fcn.004318e1
test al, al
pop ecx
pop ecx
je 0x4768b7
mov eax, dword [ebp - 0x4c]
mov ax, word [eax]
cmp ax, bx
je 0x4768b7
cmp ax, 0x30
je 0x4768b7
push 0x49be38
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
push str.___Q__Y__X__
lea ecx, [ebp + 0x5c]
call fcn.00435dd0
mov eax, dword [ebp + 0x5c]
lea ecx, [ebp - 0x14]
mov dword [ebp + 0x60], eax
call fcn.0043092f
mov esi, 0x4ad684
lea eax, [ebp + 0x48]
push eax
call fcn.00430961
push 4
push dword [ebp + 0x48]
push str._gui
call fcn.00431867
add esp, 0x10
test al, al
jne 0x476bc3
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov edi, eax
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x54], eax
lea eax, [ebp + 0x54]
push eax
sub edi, 0xc8
call fcn.00404579
pop ecx
push dword [ebp + 0x54]
lea ecx, [ebp - 0x40]
call fcn.00440487
mov eax, dword [ebp - 0x40]
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x50], eax
jmp 0x476980
push 6
lea eax, [ebp + 0x50]
push eax
push str.__nbrd
call fcn.00437b13
add esp, 0xc
test al, al
jne 0x47697d
push 6
lea eax, [ebp + 0x50]
push eax
push 0x4950a0
call fcn.00437b13
add esp, 0xc
test al, al
jne 0x47697d
push 2
lea eax, [ebp + 0x50]
push eax
push 0x49729c
call fcn.00437b13
add esp, 0xc
test al, al
jne 0x47697d
lea eax, [ebp + 0x50]
push eax
call fcn.0040459d
pop ecx
mov eax, dword [ebp + 0x50]
cmp word [eax], bx
jne 0x47692e
cmp dword [ebp], ebx
jne 0x476a92
cmp dword [ebp + 0x28], ebx
jg 0x476a92
push ebx
push dword [ebp + 0x60]
lea ecx, [ebp - 0x19c]
call fcn.00443839
cmp dword [ebp - 0x164], 1
jle 0x476bda
mov eax, dword [ebp - 0x160]
mov dword [eax], str.imdisk
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x160]
push dword [ebp - 0x164]
call fcn.004227fd
add esp, 0xc
cmp byte [ebp + 0x37], bl
mov dword [ebp + 0x1c], eax
mov dword [ebp - 0x78], ebx
jle 0x476ae4
cmp eax, 3
jne 0x476ae4
cmp dword [ebp - 0x90], ebx
jne 0x476ae4
lea ecx, [ebp - 0xc]
mov byte [ebp + 0x5b], 1
call fcn.0043092f
lea ecx, [ebp - 0x40]
call fcn.0043092f
lea ecx, [ebp + 0x30]
call fcn.0043092f
lea ecx, [ebp - 0x24]
call fcn.0043092f
lea ecx, [ebp + 0x44]
call fcn.0043092f
lea ecx, [ebp - 0x4c]
call fcn.0043092f
lea ecx, [ebp - 0x1c]
call fcn.0043092f
lea ecx, [ebp + 0x4c]
call fcn.0043092f
lea ecx, [ebp + 0x18]
call fcn.0043092f
lea ecx, [ebp - 4]
call fcn.0043092f
lea ecx, [ebp + 8]
call fcn.0043092f
lea ecx, [ebp + 0x5c]
call fcn.0043092f
lea ecx, [ebp - 0xb0]
call fcn.0043092f
lea ecx, [ebp + 0x20]
call fcn.0043092f
lea ecx, [ebp - 0x2c]
call fcn.0043092f
lea ecx, [ebp + 0x78]
call fcn.004739fe
lea ecx, [ebp - 0x8c]
call fcn.0043092f
jmp 0x4755d8
cmp dword [ebp - 0x90], ebx
jne 0x476ae4
push dword [ebp + 8]
lea ecx, [ebp - 0x44]
call fcn.004403c3
push dword [ebp + 0x54]
lea ecx, [ebp - 0x44]
call fcn.00435dd0
mov eax, dword [ebp + 0x20]
cmp word [eax], bx
mov ecx, dword [ebp + 0x7c]
mov dword [ebp - 0x78], 1
je 0x476ad1
push ebx
push ebx
push ebx
push dword [ebp - 0x44]
push ecx
push ebx
call fcn.004072ee
jmp 0x476ad9
push dword [ebp - 0x44]
call fcn.00402c2f
lea ecx, [ebp - 0x44]
mov dword [ebp + 0x1c], eax
call fcn.0043092f
mov ecx, dword [ebp - 0xe0]
xor eax, eax
or ecx, eax
je 0x476be1
cmp dword [ebp + 0x1c], 3
jne 0x476be1
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, edi
cmp eax, 0x1388
jae 0x476be1
mov ecx, dword [ebp + 0x7c]
push ebx
push 0xc8
call fcn.0040d358
mov esi, 0x4ad684
jmp 0x476985
mov edi, dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [0x4ada98], ebx
jle 0x476b4e
push esi
call edi
mov ecx, dword [ebp + 0x7c]
push ebx
push 1
call fcn.0040d358
jmp 0x476b2f
push 0xffffffffffffffff
lea ecx, [ebp + 0x14]
call fcn.0040f2fc
push esi
call edi
jmp 0x476cb2
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, ebx
jne 0x476b6d
xor eax, eax
inc eax
mov dword [ebp + 0x1c], eax
jmp 0x476baa
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x48]
call fcn.0043092f
lea ecx, [ebp - 0x28]
call fcn.0043092f
lea ecx, [ebp - 0x34]
call fcn.0043092f
mov ebx, 0xb7
jmp 0x476c2f
lea ecx, [ebp - 0x28]
mov dword [ebp + 0x1c], 1
call fcn.0043092f
lea ecx, [ebp - 0x34]
call fcn.0043092f
jmp 0x476be1
lea ecx, [ebp - 0x14]
call fcn.0043092f
mov ebx, 0x80070057
jmp 0x476c2f
mov ecx, dword [ebp + 0x7c]
push 0xffffffffffffff9c
push 0x4949a4
push ebx
push str.imdisk.cpl_
call fcn.0044ceaa
jmp 0x476c2f
mov dword [ebp + 0x1c], 0x80070057
mov eax, dword [ebp - 0x15c]
cmp eax, ebx
je 0x476bfc
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x78], eax
mov dword [ebp - 0x15c], ebx
call fcn.0043092f
mov edx, dword [ebp + 0x20]
cmp word [edx], bx
je 0x476c2c
cmp dword [ebp - 0x78], ebx
jne 0x476c2c
mov ecx, dword [ebp - 0x2c]
mov word [ebp - 0x218], bx
cmp word [ecx], 0x2a
lea eax, [ebp - 0x218]
jne 0x476c22
lea eax, [ecx + 2]
mov ecx, dword [ebp + 0x7c]
push eax
push edx
call fcn.00435749
mov ebx, dword [ebp + 0x1c]
lea ecx, [ebp - 0xc]
call fcn.0043092f
lea ecx, [ebp - 0x40]
call fcn.0043092f
lea ecx, [ebp + 0x30]
call fcn.0043092f
lea ecx, [ebp - 0x24]
call fcn.0043092f
lea ecx, [ebp + 0x44]
call fcn.0043092f
lea ecx, [ebp - 0x4c]
call fcn.0043092f
lea ecx, [ebp - 0x1c]
call fcn.0043092f
lea ecx, [ebp + 0x4c]
call fcn.0043092f
lea ecx, [ebp + 0x18]
call fcn.0043092f
lea ecx, [ebp - 4]
call fcn.0043092f
lea ecx, [ebp + 8]
call fcn.0043092f
lea ecx, [ebp + 0x5c]
call fcn.0043092f
lea ecx, [ebp - 0xb0]
call fcn.0043092f
lea ecx, [ebp + 0x20]
call fcn.0043092f
lea ecx, [ebp - 0x2c]
call fcn.0043092f
lea ecx, [ebp + 0x78]
call fcn.004739fe
lea ecx, [ebp - 0x8c]
call fcn.0043092f
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x70
leave
ret