Function at 0x484e04
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
lea edi, [ebp - 0x38]
xor eax, eax
push ebp
push 0x485941
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [0x4198f8]
call fcn.00405888
cmp byte [0x5b6bd8], 0
je 0x484e60
cmp byte [0x5b6be4], 0
jne 0x484e6d
cmp dword [0x5b6bdc], 0
jle 0x4858ef
push 0x5be9c8
call sub.kernel32.dll_GetSystemTime_1
cmp byte [0x5b654c], 0
je 0x484efa
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x164]
mov edx, 0x5b64e4
call fcn.00403ebc
mov eax, dword [ebp - 0x164]
push eax
lea eax, [ebp - 0x168]
mov edx, 0x5b6518
call fcn.00403ebc
mov eax, dword [ebp - 0x168]
push eax
lea eax, [ebp - 0x16c]
mov edx, 0x5b654c
call fcn.00403ebc
mov eax, dword [ebp - 0x16c]
pop edx
pop ecx
call fcn.0047b560
mov edx, dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov ecx, 0xff
call fcn.00403ef4
lea edx, [ebp - 0x15c]
mov eax, 0x5b654c
mov cl, 0x4b
call fcn.00402af4
lea eax, [ebp - 0x164]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.0041aa98
mov ecx, dword [ebp - 0x164]
lea eax, [ebp - 0x160]
mov edx, 0x485958
call fcn.00403f64
mov eax, dword [ebp - 0x160]
call fcn.004040dc
push eax
push 0x14
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x484fec
push 0
push 0
push 0
push 0xf001f
push esi
call sub.kernel32.dll_MapViewOfFile
mov dword [0x5b6c34], eax
mov eax, dword [0x5b6c34]
mov dword [eax + 0xc], 1
push 0
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov edx, dword [0x5b6c34]
mov dword [edx], eax
push 0
push 0
push 0
call sub.kernel32.dll_CreateMutexA
mov edx, dword [0x5b6c34]
mov dword [edx + 4], eax
mov eax, dword [0x5b6c34]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [0x5b6c34]
mov dword [eax + 0x10], esi
lea eax, [ebp - 0xc]
call fcn.004784a4
cmp dword [ebp - 0xc], 0
je 0x484fde
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [0x5b64b4], eax
push 0
push 0
push 0
mov ecx, 0x485978
xor edx, edx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00479050
jmp 0x485036
mov eax, dword [0x5bc2dc]
mov eax, dword [eax]
mov dword [0x5b64b4], eax
jmp 0x485036
test esi, esi
je 0x48501c
push 0
push 0
push 0
push 0xf001f
push esi
call sub.kernel32.dll_MapViewOfFile
mov dword [0x5b6c34], eax
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x5b6c34]
add eax, 0xc
push eax
call sub.kernel32.dll_InterlockedIncrement_1
jmp 0x485036
push 0
push 0x485984
push 0x485990
push 0
call sub.user32.dll_MessageBoxA_1
push 0
call sub.kernel32.dll_ExitProcess_1
cmp dword [0x5b6c34], 0
jne 0x485059
push 0
push 0x485984
push 0x4859a0
push 0
call sub.user32.dll_MessageBoxA_1
push 0
call sub.kernel32.dll_ExitProcess_1
cmp dword [0x5b64b4], 0
jne 0x485071
mov eax, dword [0x5b6c34]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [0x5b64b4], eax
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6be0
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6bd0
call fcn.00484dfc
cmp byte [0x5b6bd8], 0
je 0x4858ae
cmp byte [0x5b6be4], 0
je 0x4858ae
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6be8
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6bec
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6bf0
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6bf4
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6bf8
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6bfc
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6c00
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6c04
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6c08
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6c0c
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6c10
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6c14
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6c18
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6c1c
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6c20
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6c24
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6c28
call fcn.00484dfc
mov edx, dword [0x5bbdf4]
mov edx, dword [edx]
mov eax, 0x5b6c2c
call fcn.00484dfc
test bl, bl
jne 0x485209
push 0
call sub.kernel32.dll_GetModuleHandleA_1
mov edx, dword [0x5bbdf4]
cmp eax, dword [edx]
sete bl
cmp dword [0x5b6c24], 0
je 0x485228
cmp dword [0x5b6be8], 0
je 0x485228
cmp dword [0x5b6bf0], 0
jne 0x48547c
test bl, bl
je 0x48547c
push 0x4859d0
call sub.kernel32.dll_GetModuleHandleA_1
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x14], eax
cmp dword [0x5b6c24], 0
jne 0x48540e
test esi, esi
je 0x48540e
push 0x4859dc
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x5b6bf8], eax
mov eax, dword [0x5b6bf8]
cmp byte [eax], 0xe9
je 0x485405
push 0x485a0c
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x5b6bfc], eax
push 0x485a3c
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x5b6c00], eax
push 0x485a60
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x5b6c14], eax
push 0x485a74
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x5b6c18], eax
push 0x485a90
push esi
call sub.kernel32.dll_GetProcAddress
mov dword [0x5b6c2c], eax
push 0x485aac
push esi
call sub.kernel32.dll_GetProcAddress
mov edx, edi
call fcn.00420d10
mov byte [ebp - 1], 1
jmp 0x4853f2
mov esi, dword [edi + 8]
test esi, esi
je 0x4853d5
cmp byte [edi + 7], 0
je 0x4853d5
cmp dword [edi + 0x14], 4
jne 0x4853d5
cmp byte [ebp - 1], 0
je 0x485373
mov byte [ebp - 1], 0
lea edx, [ebp - 0x5c]
mov eax, esi
call fcn.00420d10
jmp 0x485363
cmp word [ebp - 0x5a], 0xc7
jne 0x485343
cmp byte [ebp - 0x58], 0x40
jne 0x485343
mov eax, dword [ebp - 0x3c]
sub eax, 5
cmp byte [eax], 4
jne 0x485343
mov eax, dword [ebp - 0x3c]
sub eax, 4
mov eax, dword [eax]
mov dword [0x5b6c24], eax
jmp 0x4853d5
lea edx, [ebp - 0x190]
mov eax, dword [ebp - 0x3c]
call fcn.00420d10
push edi
lea esi, [ebp - 0x190]
lea edi, [ebp - 0x5c]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
cmp byte [ebp - 0x5c], 0
je 0x4853d5
cmp word [ebp - 0x5a], 0xc3
jne 0x485318
jmp 0x4853d5
mov dword [0x5b6c1c], esi
mov edx, edi
mov eax, dword [0x5b6c1c]
call fcn.00420d10
jmp 0x4853c6
mov eax, dword [edi + 8]
test eax, eax
je 0x4853a9
cmp word [edi + 2], 0xe8
jne 0x4853a9
cmp byte [edi + 7], 0
je 0x4853a9
cmp dword [edi + 0x14], 4
jne 0x4853a9
mov dword [0x5b6c20], eax
jmp 0x48540e
lea edx, [ebp - 0x190]
mov eax, dword [edi + 0x20]
call fcn.00420d10
push edi
lea esi, [ebp - 0x190]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
cmp byte [edi], 0
je 0x48540e
cmp word [edi + 2], 0xc3
jne 0x485387
jmp 0x48540e
lea edx, [ebp - 0x190]
mov eax, dword [edi + 0x20]
call fcn.00420d10
push edi
lea esi, [ebp - 0x190]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
cmp byte [edi], 0
je 0x48540e
cmp word [edi + 2], 0xc3
jne 0x4852e3
jmp 0x48540e
xor ebx, ebx
xor eax, eax
mov dword [0x5b6bf8], eax
test bl, bl
je 0x48547c
cmp dword [0x5b6be8], 0
jne 0x485447
cmp dword [ebp - 0x10], 0
je 0x485447
push 0x485ac4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x5b6be8], eax
push 0x485b00
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x5b6bec], eax
cmp dword [0x5b6bf0], 0
jne 0x48547c
cmp dword [ebp - 0x14], 0
je 0x48547c
push 0x485b3c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x5b6bf0], eax
push 0x485b78
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [0x5b6bf4], eax
mov eax, dword [0x5bbbe8]
mov dword [0x5b6d08], eax
cmp dword [0x5b6c24], 0
je 0x48549e
mov edx, 0x483fb8
mov eax, dword [0x5b6c24]
call fcn.00483350
cmp dword [0x5b6be8], 0
je 0x4854b6
mov edx, 0x4833f4
mov eax, dword [0x5b6be8]
call fcn.00483350
cmp dword [0x5b6bec], 0
je 0x4854ce
mov edx, 0x4833d0
mov eax, dword [0x5b6bec]
call fcn.00483350
cmp dword [0x5b6bf0], 0
je 0x4854e6
mov edx, 0x4833f4
mov eax, dword [0x5b6bf0]
call fcn.00483350
cmp dword [0x5b6bf4], 0
je 0x4854fe
mov edx, 0x4833d0
mov eax, dword [0x5b6bf4]
call fcn.00483350
cmp dword [0x5b6bf8], 0
je 0x485516
mov edx, 0x4833a8
mov eax, dword [0x5b6bf8]
call fcn.00483350
cmp dword [0x5b6c08], 0
je 0x48552e
mov edx, 0x483430
mov eax, dword [0x5b6c08]
call fcn.00483350
cmp dword [0x5b6c0c], 0
je 0x485546
mov edx, 0x483450
mov eax, dword [0x5b6c0c]
call fcn.00483350
cmp dword [0x5b6c10], 0
je 0x485556
mov byte [0x5b6bc8], 1
cmp dword [0x5b6bfc], 0
je 0x4855cf
cmp dword [0x5b6c00], 0
je 0x4855cf
mov edx, edi
mov eax, dword [0x5b6bfc]
call fcn.00420d10
jmp 0x4855c0
mov eax, dword [edi + 8]
test eax, eax
je 0x4855a3
cmp eax, dword [0x5b6c00]
jne 0x4855a3
cmp dword [edi + 0x14], 4
jne 0x4855cf
cmp byte [edi + 7], 0
je 0x4855cf
mov edx, 0x483afc
sub edx, dword [edi + 0x20]
mov eax, dword [edi + 0xc]
call fcn.00483384
jmp 0x4855cf
lea edx, [ebp - 0x190]
mov eax, dword [edi + 0x20]
call fcn.00420d10
push edi
lea esi, [ebp - 0x190]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
mov ax, word [edi + 2]
add eax, 0xffffff3e
sub ax, 2
jae 0x485576
cmp dword [0x5b6c14], 0
je 0x48574d
lea edx, [ebp - 0x190]
mov eax, sub.user32.dll_MessageBoxA_1
call fcn.00420d10
mov eax, dword [ebp - 0x188]
call fcn.004231b0
mov dword [ebp - 8], eax
mov byte [ebp - 1], 0
xor ebx, ebx
mov edx, edi
mov eax, dword [0x5b6c14]
call fcn.00420d10
jmp 0x4856d3
cmp dword [edi + 8], 0
je 0x4856b6
mov esi, dword [edi + 8]
cmp esi, dword [0x5b6c18]
jne 0x485656
cmp byte [ebp - 1], 0
jne 0x485656
cmp dword [edi + 0x14], 4
jne 0x485648
cmp byte [edi + 7], 0
je 0x485648
mov edx, 0x4839fc
sub edx, dword [edi + 0x20]
mov eax, dword [edi + 0xc]
call fcn.00483384
test bl, bl
jne 0x4856e6
mov byte [ebp - 1], 1
jmp 0x4856b6
test bl, bl
jne 0x4856b6
lea edx, [ebp - 0x190]
mov eax, esi
call fcn.00420d10
mov esi, dword [ebp - 0x188]
test esi, esi
je 0x4856b6
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
je 0x48568d
cmp esi, 0x80000000
jbe 0x48568d
cmp byte [esi], 0x68
jne 0x48568d
inc esi
mov esi, dword [esi]
cmp esi, dword [ebp - 8]
jne 0x4856b6
cmp dword [edi + 0x14], 4
jne 0x4856ae
cmp byte [edi + 7], 0
je 0x4856ae
mov edx, 0x483a78
sub edx, dword [edi + 0x20]
mov eax, dword [edi + 0xc]
call fcn.00483384
cmp byte [ebp - 1], 0
jne 0x4856e6
mov bl, 1
lea edx, [ebp - 0x190]
mov eax, dword [edi + 0x20]
call fcn.00420d10
push edi
lea esi, [ebp - 0x190]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
mov ax, word [edi + 2]
add eax, 0xffffff3e
sub ax, 2
jae 0x485611
mov edx, edi
mov eax, dword [0x5b6c14]
call fcn.00420d10
jmp 0x48573e
mov eax, dword [edi + 8]
test eax, eax
je 0x485721
cmp eax, dword [0x5b6c20]
jne 0x485721
cmp dword [edi + 0x14], 4
jne 0x48574d
cmp byte [edi + 7], 0
je 0x48574d
mov edx, 0x483b50
sub edx, dword [edi + 0x20]
mov eax, dword [edi + 0xc]
call fcn.00483384
jmp 0x48574d
lea edx, [ebp - 0x190]
mov eax, dword [edi + 0x20]
call fcn.00420d10
push edi
lea esi, [ebp - 0x190]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
mov ax, word [edi + 2]
add eax, 0xffffff3e
sub ax, 2
jae 0x4856f4
mov ebx, dword [0x5b6c1c]
test ebx, ebx
je 0x4857c0
cmp dword [0x5b6c20], 0
je 0x4857c0
mov edx, edi
mov eax, ebx
call fcn.00420d10
jmp 0x4857b1
mov eax, dword [edi + 8]
cmp eax, dword [0x5b6c20]
jne 0x485794
cmp dword [edi + 0x14], 4
jne 0x4857c0
cmp byte [edi + 7], 0
je 0x4857c0
mov edx, 0x483b50
sub edx, dword [edi + 0x20]
mov eax, dword [edi + 0xc]
call fcn.00483384
jmp 0x4857c0
lea edx, [ebp - 0x190]
mov eax, dword [edi + 0x20]
call fcn.00420d10
push edi
lea esi, [ebp - 0x190]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
mov ax, word [edi + 2]
add eax, 0xffffff3e
sub ax, 2
jae 0x48576b
mov ebx, dword [0x5b6c20]
test ebx, ebx
je 0x48582a
mov edx, edi
mov eax, ebx
call fcn.00420d10
jmp 0x48581b
mov eax, dword [edi + 8]
cmp eax, dword [0x5b6c20]
jne 0x4857fe
cmp dword [edi + 0x14], 4
jne 0x48582a
cmp byte [edi + 7], 0
je 0x48582a
mov edx, 0x483b50
sub edx, dword [edi + 0x20]
mov eax, dword [edi + 0xc]
call fcn.00483384
jmp 0x48582a
lea edx, [ebp - 0x190]
mov eax, dword [edi + 0x20]
call fcn.00420d10
push edi
lea esi, [ebp - 0x190]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
mov ax, word [edi + 2]
add eax, 0xffffff3e
sub ax, 2
jae 0x4857d5
cmp dword [0x5b6c2c], 0
je 0x4858ae
mov edx, edi
mov eax, fcn.00402fb8
call fcn.00420d10
mov eax, dword [edi + 8]
test eax, eax
je 0x48584a
mov esi, eax
jmp 0x48584f
mov esi, fcn.00402fb8
mov edx, edi
mov eax, dword [0x5b6c2c]
call fcn.00420d10
jmp 0x48589f
cmp esi, dword [edi + 8]
jne 0x485880
cmp dword [edi + 0x14], 4
jne 0x4858ae
cmp byte [edi + 7], 0
je 0x4858ae
mov edx, 0x484220
sub edx, dword [edi + 0x20]
mov eax, dword [edi + 0xc]
call fcn.00483384
jmp 0x4858ae
lea edx, [ebp - 0x190]
mov eax, dword [edi + 0x20]
call fcn.00420d10
push esi
push edi
lea esi, [ebp - 0x190]
mov ecx, 9
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov ax, word [edi + 2]
add eax, 0xffffff3e
sub ax, 2
jae 0x48585d
cmp byte [0x5b6bd8], 0
jne 0x4858c0
cmp dword [0x5b6bdc], 0
jle 0x4858d8
call fcn.0047ee7c
call fcn.0047a2b4
cmp byte [0x5b6bd8], 0
je 0x4858d8
call fcn.00484904
cmp dword [0x5b6bdc], 0
jle 0x4858e6
call fcn.0047a8a4
mov eax, 0x483768
test eax, eax
jmp 0x485915
lea eax, [ebp - 0xc]
call fcn.004784a4
cmp dword [ebp - 0xc], 0
je 0x485909
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [0x5b64b4], eax
jmp 0x485915
mov eax, dword [0x5bc2dc]
mov eax, dword [eax]
mov dword [0x5b64b4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x485948
lea eax, [ebp - 0x16c]
mov edx, 4
call fcn.00403cc0
lea eax, [ebp - 0xc]
mov edx, dword [0x4198f8]
call fcn.00405888
ret