Function at 0x492dac
Capabilities:
Accept command line arguments
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb3
push 0
push 0
dec ecx
jne 0x492db4
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x494098
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x3a0], 0
jne 0x492e08
mov dl, 1
mov eax, dword [0x46ad94]
call fcn.00474ec0
mov ebx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x3a0
mov edx, ebx
test edx, edx
je 0x492e03
sub edx, 0xffffffc0
call fcn.0040d52c
mov eax, esi
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x3a0]
call fcn.0040d52c
mov eax, dword [ebp - 0x1c]
cmp byte [eax + 0x3c4], 0
je 0x493f68
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3a0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x493f68
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x3a0]
call fcn.0040d52c
lea eax, [ebp - 0x49c]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x3a0]
mov ecx, 0x4940ac
call fcn.0040d558
mov eax, dword [ebp - 0x49c]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x492fd8
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4a4]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x424]
mov cx, 0x30
mov edx, 4
call fcn.00414dec
push dword [ebp - 0x4a4]
push 0x4940c8
lea eax, [ebp - 0x4a8]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x426]
mov cx, 0x30
mov edx, 2
call fcn.00414dec
push dword [ebp - 0x4a8]
push 0x4940c8
lea eax, [ebp - 0x4ac]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x42a]
mov cx, 0x30
mov edx, 2
call fcn.00414dec
push dword [ebp - 0x4ac]
push 0x4940d8
lea eax, [ebp - 0x4b0]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x42c]
mov cx, 0x30
mov edx, 2
call fcn.00414dec
push dword [ebp - 0x4b0]
push 0x4940ec
lea eax, [ebp - 0x4b4]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x42e]
mov cx, 0x30
mov edx, 2
call fcn.00414dec
push dword [ebp - 0x4b4]
push 0x4940ec
lea eax, [ebp - 0x4b8]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x430]
mov cx, 0x30
mov edx, 2
call fcn.00414dec
push dword [ebp - 0x4b8]
push 0x4940d8
lea eax, [ebp - 0x4bc]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x432]
mov cx, 0x30
mov edx, 1
call fcn.00414dec
push dword [ebp - 0x4bc]
push 0x4940fc
lea eax, [ebp - 0x4a0]
mov edx, 0xe
call fcn.0040ac38
mov edx, dword [ebp - 0x4a0]
mov eax, 0x494110
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x492fe2
xor eax, eax
push ebp
push 0x493017
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4c0]
call fcn.0045f5a0
mov edx, dword [ebp - 0x4c0]
mov eax, 0x494130
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493021
xor eax, eax
push ebp
push 0x493056
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4c4]
call fcn.004915f8
mov edx, dword [ebp - 0x4c4]
mov eax, 0x494158
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493060
xor eax, eax
push ebp
push 0x4930ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x104
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4930a6
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x236]
push eax
call sub.advapi32.dll_GetUserNameW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x236]
mov ecx, 0x105
call fcn.0040aa00
jmp 0x4930d0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x236]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x236]
mov dword [ebp - 0x4c8], edx
mov edx, dword [ebp - 0x4c8]
call fcn.0040aa1c
call fcn.00491534
test al, al
je 0x4930e6
lea eax, [ebp - 0x10]
mov edx, 0x494184
call fcn.0040ab58
push ebp
mov edx, dword [ebp - 0x10]
mov eax, 0x4941a4
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493109
xor eax, eax
push ebp
push 0x4931ee
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x493132
lea eax, [ebp - 0x10]
mov edx, 0x4941c4
call fcn.00409d3c
jmp 0x49313a
lea eax, [ebp - 0x10]
call fcn.00409914
lea eax, [ebp - 0x14]
push eax
push 0x4941d8
push dword [ebp - 0x10]
push 0x49421c
lea eax, [ebp - 0x4cc]
mov edx, 3
call fcn.0040ac38
mov edx, dword [ebp - 0x4cc]
mov ecx, 0x494248
mov eax, 0x80000002
call fcn.0045f654
lea eax, [ebp - 0x4d0]
push eax
push 0x4941d8
push dword [ebp - 0x10]
push 0x49421c
lea eax, [ebp - 0x4d4]
mov edx, 3
call fcn.0040ac38
mov edx, dword [ebp - 0x4d4]
mov ecx, 0x494284
mov eax, 0x80000002
call fcn.0045f654
mov edx, dword [ebp - 0x4d0]
lea eax, [ebp - 0x10]
call fcn.00409d3c
cmp dword [ebp - 0x14], 0
je 0x4931d5
push dword [ebp - 0x10]
push 0x4942b0
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040ac38
push ebp
mov edx, dword [ebp - 0x10]
mov eax, 0x4942c4
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4931f8
xor eax, eax
push ebp
push 0x49322d
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4d8]
call fcn.004919ac
mov edx, dword [ebp - 0x4d8]
mov eax, 0x4942f4
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493237
xor eax, eax
push ebp
push 0x49326c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4dc]
call fcn.00491a64
mov edx, dword [ebp - 0x4dc]
mov eax, 0x494324
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493276
xor eax, eax
push ebp
push 0x4932ab
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4e0]
call fcn.00491b34
mov edx, dword [ebp - 0x4e0]
mov eax, 0x494350
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4932b5
xor eax, eax
push ebp
push 0x4932ea
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4e4]
call fcn.00491b8c
mov edx, dword [ebp - 0x4e4]
mov eax, 0x49437c
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4932f4
xor eax, eax
push ebp
push 0x493381
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00491ca0
cmp dword [ebp - 0x10], 0
je 0x493377
call fcn.00491da4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jne 0x49332f
push ebp
mov edx, dword [ebp - 0x10]
mov eax, 0x4943a8
call fcn.00492d08
pop ecx
jmp 0x493377
push ebp
lea eax, [ebp - 0x4ec]
push eax
mov cx, 0x30
mov edx, 1
mov eax, dword [ebp - 0x24]
call fcn.00414cf0
push dword [ebp - 0x4ec]
push 0x4943c8
push dword [ebp - 0x10]
lea eax, [ebp - 0x4e8]
mov edx, 3
call fcn.0040ac38
mov edx, dword [ebp - 0x4e8]
mov eax, 0x4943dc
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49338b
xor eax, eax
push ebp
push 0x4933c0
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4f0]
call fcn.00491ed8
mov edx, dword [ebp - 0x4f0]
mov eax, 0x494400
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4933ca
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
je 0x493415
xor eax, eax
push ebp
push 0x49340b
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4f4]
call fcn.0049206c
mov edx, dword [ebp - 0x4f4]
mov eax, 0x49442c
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493415
xor eax, eax
push ebp
push 0x493555
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x494450
push 0x494478
call sub.kernel32.dll_GetModuleHandleW_2
push eax
call fcn.00411010
mov dword [ebp - 8], eax
push 0x104
lea eax, [ebp - 0x236]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0045edb8
mov ebx, dword [0x768edc]
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
call ebx
mov ebx, eax
mov esi, dword [0x768edc]
mov esi, dword [esi]
lea eax, [ebp - 0x236]
movzx eax, byte [eax]
call esi
cmp bl, al
je 0x49350d
push ebp
push ebp
lea eax, [ebp - 0x500]
lea edx, [ebp - 0x236]
movzx edx, byte [edx]
mov ecx, 0
call fcn.0040a090
mov eax, dword [ebp - 0x500]
lea edx, [ebp - 0x4fc]
call fcn.00492b74
pop ecx
push dword [ebp - 0x4fc]
push 0x4944a0
push ebp
lea eax, [ebp - 0x508]
mov edx, dword [ebp - 0x10]
movzx edx, byte [edx]
mov ecx, 0
call fcn.0040a090
mov eax, dword [ebp - 0x508]
lea edx, [ebp - 0x504]
call fcn.00492b74
pop ecx
push dword [ebp - 0x504]
lea eax, [ebp - 0x4f8]
mov edx, 3
call fcn.0040ac38
mov edx, dword [ebp - 0x4f8]
mov eax, 0x4944b0
call fcn.00492d08
pop ecx
jmp 0x49354b
push ebp
push ebp
lea eax, [ebp - 0x510]
lea edx, [ebp - 0x236]
movzx edx, byte [edx]
mov ecx, 0
call fcn.0040a090
mov eax, dword [ebp - 0x510]
lea edx, [ebp - 0x50c]
call fcn.00492b74
pop ecx
mov edx, dword [ebp - 0x50c]
mov eax, 0x4944b0
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49355f
xor eax, eax
push ebp
push 0x493594
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x514]
call fcn.00492138
mov edx, dword [ebp - 0x514]
mov eax, 0x4944dc
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49359e
xor eax, eax
push ebp
push 0x4935e2
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x518]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cx, 0x30
mov edx, 1
call fcn.00414e7c
mov edx, dword [ebp - 0x518]
mov eax, 0x494504
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4935ec
xor eax, eax
push ebp
push 0x493621
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x51c]
call fcn.0049231c
mov edx, dword [ebp - 0x51c]
mov eax, 0x494528
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49362b
xor eax, eax
push ebp
push 0x493660
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x520]
call fcn.00492340
mov edx, dword [ebp - 0x520]
mov eax, 0x494558
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49366a
xor eax, eax
push ebp
push 0x493700
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x7634dc], 0
je 0x4936f6
call fcn.00406ac8
test eax, eax
jle 0x4936f6
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4936bc
push ebp
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 0x524]
call fcn.0040a9ac
mov edx, dword [ebp - 0x524]
mov eax, 0x49458c
call fcn.00492d08
pop ecx
jmp 0x4936f6
push ebp
call sub.kernel32.dll_GetCommandLineA
mov edx, eax
lea eax, [ebp - 0x52c]
mov ecx, 0
call fcn.0040a0a0
mov edx, dword [ebp - 0x52c]
lea eax, [ebp - 0x528]
call fcn.0040aa1c
mov edx, dword [ebp - 0x528]
mov eax, 0x49458c
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49370a
xor eax, eax
push ebp
push 0x493752
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea edx, [ebp - 0x534]
xor eax, eax
call fcn.0045edb8
mov eax, dword [ebp - 0x534]
lea edx, [ebp - 0x530]
call fcn.004162cc
mov edx, dword [ebp - 0x530]
mov eax, 0x4945b4
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49375c
xor eax, eax
push ebp
push 0x4937b6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_GetModuleHandleW_2
cmp eax, dword [0x7635d4]
je 0x4937ac
push ebp
lea edx, [ebp - 0x53c]
mov eax, dword [0x7635d4]
call fcn.0045edb8
mov eax, dword [ebp - 0x53c]
lea edx, [ebp - 0x538]
call fcn.004162cc
mov edx, dword [ebp - 0x538]
mov eax, 0x4945d8
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4937c0
xor edx, edx
push ebp
push 0x493a34
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x7635e0], 0
je 0x4937e3
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0045edb8
jmp 0x4937f0
lea edx, [ebp - 0x10]
mov eax, dword [0x7635d4]
call fcn.0045edb8
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x493813
lea eax, [ebp - 0x488]
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040a944
push eax
call sub.kernel32.dll_FindFirstFileW_1
jmp 0x49383e
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x540]
mov edx, dword [ebp - 0x10]
mov ecx, 0
call fcn.0040a554
mov eax, dword [ebp - 0x540]
call fcn.0040a3a8
push eax
call sub.kernel32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x493a2a
push eax
call sub.kernel32.dll_FindClose_1
xor eax, eax
push ebp
push 0x4939b6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x474]
lea eax, [ebp - 0x474]
call fcn.00410e18
lea edx, [ebp - 0x498]
lea eax, [ebp - 0x474]
call fcn.00410e28
cmp byte [0x7635e0], 0
jne 0x493895
push 0
call sub.kernel32.dll_GetModuleHandleW_2
cmp eax, dword [0x7635d4]
jne 0x4938a4
lea eax, [ebp - 0x14]
mov edx, 0x494604
call fcn.00409d3c
jmp 0x4938b1
lea eax, [ebp - 0x14]
mov edx, 0x49461c
call fcn.00409d3c
push ebp
lea eax, [ebp - 0x548]
push eax
movzx eax, word [ebp - 0x498]
mov cx, 0x30
mov edx, 4
call fcn.00414dec
push dword [ebp - 0x548]
push 0x4940c8
lea eax, [ebp - 0x54c]
push eax
movzx eax, word [ebp - 0x496]
mov cx, 0x30
mov edx, 2
call fcn.00414dec
push dword [ebp - 0x54c]
push 0x4940c8
lea eax, [ebp - 0x550]
push eax
movzx eax, word [ebp - 0x492]
mov cx, 0x30
mov edx, 2
call fcn.00414dec
push dword [ebp - 0x550]
push 0x4944a0
lea eax, [ebp - 0x554]
push eax
movzx eax, word [ebp - 0x490]
mov cx, 0x30
mov edx, 2
call fcn.00414dec
push dword [ebp - 0x554]
push 0x4940ec
lea eax, [ebp - 0x558]
push eax
movzx eax, word [ebp - 0x48e]
mov cx, 0x30
mov edx, 2
call fcn.00414dec
push dword [ebp - 0x558]
push 0x494638
lea eax, [ebp - 0x544]
mov edx, 0xa
call fcn.0040ac38
mov eax, dword [ebp - 0x544]
push eax
lea eax, [ebp - 0x55c]
mov ecx, 0x49464c
mov edx, dword [ebp - 0x14]
call fcn.0040abb0
mov eax, dword [ebp - 0x55c]
pop edx
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4939c0
lea edx, [ebp - 0x560]
mov eax, dword [ebp - 0x1c]
call fcn.004714f0
cmp dword [ebp - 0x560], 0
jne 0x493a0a
lea edx, [ebp - 0x564]
mov eax, dword [ebp - 0x10]
call fcn.00419c70
mov edx, dword [ebp - 0x564]
lea eax, [ebp - 0x10]
call fcn.00409d3c
cmp dword [ebp - 0x10], 0
je 0x493a2a
push ebp
mov edx, dword [ebp - 0x10]
mov eax, 0x494670
call fcn.00492d08
pop ecx
jmp 0x493a2a
push ebp
lea edx, [ebp - 0x568]
mov eax, dword [ebp - 0x1c]
call fcn.004714f0
mov edx, dword [ebp - 0x568]
mov eax, 0x494670
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493a3e
xor eax, eax
push ebp
push 0x493a9b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x494680
call sub.kernel32.dll_GetModuleHandleW_2
mov ebx, eax
test ebx, ebx
je 0x493a91
lea edx, [ebp - 0x56c]
mov eax, ebx
call fcn.0045edb8
mov eax, dword [ebp - 0x56c]
mov ebx, dword [0x768b7c]
mov ebx, dword [ebx]
lea edx, [ebp - 0x10]
call ebx
cmp dword [ebp - 0x10], 0
je 0x493a91
push ebp
mov edx, dword [ebp - 0x10]
mov eax, 0x4946a4
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493aa5
xor eax, eax
push ebp
push 0x493b5d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x493aff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x7635d4]
call fcn.0041aab4
cmp byte [eax + 0x1a], 2
je 0x493ae4
push ebp
mov edx, 0x4946c8
mov eax, 0x4946e4
call fcn.00492d08
pop ecx
jmp 0x493af5
push ebp
mov edx, 0x49470c
mov eax, 0x4946e4
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493b1a
push ebp
lea eax, [ebp - 0x574]
mov edx, dword [0x7634cc]
mov ecx, 0
call fcn.0040a0a0
mov edx, dword [ebp - 0x574]
lea eax, [ebp - 0x570]
call fcn.0040aa1c
mov edx, dword [ebp - 0x570]
mov eax, 0x494730
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493b67
lea ecx, [ebp - 0x14]
mov edx, 0x494760
mov eax, dword [ebp - 0x1c]
call fcn.004738c4
mov ebx, dword [0x768e40]
mov ebx, dword [ebx]
mov dl, 0x7c
mov eax, dword [ebp - 0x14]
call ebx
test eax, eax
jle 0x493d40
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 1
xor eax, eax
push ebp
push 0x493d2a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov ebx, dword [0x768f24]
mov ebx, dword [ebx]
mov cl, 0x7c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
call ebx
mov eax, dword [0x76f148]
call fcn.0040bc90
mov ebx, eax
test ebx, ebx
jl 0x493d20
inc ebx
mov dword [ebp - 0x28], 0
mov esi, dword [ebp - 0x28]
mov eax, esi
add esi, esi
add esi, esi
add esi, esi
sub esi, eax
mov eax, dword [0x76f148]
mov eax, dword [eax + esi*4]
mov edi, dword [0x76897c]
mov edi, dword [edi]
mov edx, dword [ebp - 0x10]
call edi
test al, al
je 0x493d16
mov eax, dword [0x76f148]
cmp byte [eax + esi*4 + 0x18], 0
jne 0x493d20
mov eax, dword [0x76f148]
cmp dword [eax + esi*4 + 8], 0
je 0x493c5a
push ebp
mov eax, dword [0x76f148]
mov ebx, dword [eax + esi*4 + 8]
lea eax, [ebp - 0x57c]
call ebx
mov edx, dword [ebp - 0x57c]
lea eax, [ebp - 0x578]
call fcn.0040aa1c
mov edx, dword [ebp - 0x578]
mov eax, dword [0x76f148]
mov eax, dword [eax + esi*4]
call fcn.00492d08
pop ecx
jmp 0x493d20
mov eax, dword [0x76f148]
cmp dword [eax + esi*4 + 0xc], 0
je 0x493c91
push ebp
mov eax, dword [0x76f148]
mov ebx, dword [eax + esi*4 + 0xc]
lea eax, [ebp - 0x580]
call ebx
mov edx, dword [ebp - 0x580]
mov eax, dword [0x76f148]
mov eax, dword [eax + esi*4]
call fcn.00492d08
pop ecx
jmp 0x493d20
mov eax, dword [0x76f148]
cmp dword [eax + esi*4 + 0x10], 0
je 0x493ce2
push ebp
mov eax, dword [0x76f148]
mov ebx, dword [eax + esi*4 + 0x10]
lea edx, [ebp - 0x588]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x493cb9
sub eax, 0xfffffbc0
call ebx
mov edx, dword [ebp - 0x588]
lea eax, [ebp - 0x584]
call fcn.0040aa1c
mov edx, dword [ebp - 0x584]
mov eax, dword [0x76f148]
mov eax, dword [eax + esi*4]
call fcn.00492d08
pop ecx
jmp 0x493d20
push ebp
mov eax, dword [0x76f148]
mov ebx, dword [eax + esi*4 + 0x14]
lea edx, [ebp - 0x58c]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x493cfe
sub eax, 0xfffffbc0
call ebx
mov edx, dword [ebp - 0x58c]
mov eax, dword [0x76f148]
mov eax, dword [eax + esi*4]
call fcn.00492d08
pop ecx
jmp 0x493d20
inc dword [ebp - 0x28]
dec ebx
jne 0x493bd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493d34
inc dword [ebp - 0x24]
dec dword [ebp - 0x2c]
jne 0x493b98
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0x28], eax
xor eax, eax
push ebp
push 0x493d70
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov edx, 0x494774
mov eax, 0x4947b0
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493d7a
xor eax, eax
push ebp
push 0x493dd2
push dword fs:[eax]
mov dword fs:[eax], esp
add dword [0x763f48], 1
adc dword [0x763f4c], 0
push ebp
push dword [0x763f4c]
push dword [0x763f48]
lea ecx, [ebp - 0x590]
mov dx, 0x30
mov eax, 1
call fcn.00414e38
mov edx, dword [ebp - 0x590]
mov eax, 0x4947d8
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493ddc
xor eax, eax
push ebp
push 0x493ecf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
cmp byte [eax + 0x4f], 1
je 0x493ea5
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call fcn.00492948
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.004928a8
push ebp
mov edx, dword [ebp - 0x14]
mov eax, 0x494808
call fcn.00492d08
pop ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
call fcn.0040ace8
je 0x493ec5
lea edx, [ebp - 0x594]
mov eax, dword [ebp - 0x10]
call fcn.00461fac
mov edx, dword [ebp - 0x594]
lea eax, [ebp - 0x10]
call fcn.00409d3c
push 0
mov ebx, dword [0x768c40]
mov ebx, dword [ebx]
lea eax, [ebp - 0x10]
mov ecx, 0x4944a0
mov edx, 0x494834
call ebx
push 0
mov ebx, dword [0x768c40]
mov ebx, dword [ebx]
lea eax, [ebp - 0x10]
mov ecx, 0x4944a0
mov edx, 0x494844
call ebx
push 1
mov ebx, dword [0x768c40]
mov ebx, dword [ebx]
lea eax, [ebp - 0x10]
mov ecx, 0x4944a0
mov edx, 0x494854
call ebx
push ebp
mov edx, dword [ebp - 0x10]
mov eax, 0x494868
call fcn.00492d08
pop ecx
jmp 0x493ec5
push ebp
lea edx, [ebp - 0x598]
mov eax, dword [ebp - 0x1c]
call fcn.00471564
mov edx, dword [ebp - 0x598]
mov eax, 0x494868
call fcn.00492d08
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493ed9
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
push ebp
push 0x493f56
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x493f25
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
mov ecx, dword [eax + edx*8 + 4]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
mov edx, dword [eax + edx*8]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0x28]
inc dword [ebp - 0x24]
dec dword [ebp - 0x2c]
jne 0x493f02
lea eax, [ebp - 0x59c]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x3a0]
mov ecx, 0x4940ac
call fcn.0040d558
mov eax, dword [ebp - 0x59c]
mov edx, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x493f60
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4940a2
lea eax, [ebp - 0x59c]
call fcn.0040d514
lea eax, [ebp - 0x598]
mov edx, 4
call fcn.00409974
lea eax, [ebp - 0x588]
call fcn.00409938
lea eax, [ebp - 0x584]
mov edx, 2
call fcn.00409974
lea eax, [ebp - 0x57c]
call fcn.00409938
lea eax, [ebp - 0x578]
call fcn.00409914
lea eax, [ebp - 0x574]
call fcn.00409938
lea eax, [ebp - 0x570]
mov edx, 0xc
call fcn.00409974
lea eax, [ebp - 0x540]
call fcn.00409938
lea eax, [ebp - 0x53c]
mov edx, 4
call fcn.00409974
lea eax, [ebp - 0x52c]
call fcn.00409938
lea eax, [ebp - 0x528]
mov edx, 6
call fcn.00409974
lea eax, [ebp - 0x510]
call fcn.00409938
lea eax, [ebp - 0x50c]
call fcn.00409914
lea eax, [ebp - 0x508]
call fcn.00409938
lea eax, [ebp - 0x504]
call fcn.00409914
lea eax, [ebp - 0x500]
call fcn.00409938
lea eax, [ebp - 0x4fc]
mov edx, 0xd
call fcn.00409974
lea eax, [ebp - 0x4c4]
mov edx, 0xa
call fcn.00409974
lea eax, [ebp - 0x49c]
call fcn.0040d514
lea eax, [ebp - 0x18]
call fcn.0040d514
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409974
lea eax, [ebp - 4]
mov edx, dword [0x492b3c]
call fcn.0040bfc8
ret