Function at 0x494750
Capabilities:
Get common file path

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004954f0
test al, al
je 0x4954a6
mov ecx, esi
call fcn.004954c0
test al, al
jne 0x4954a6
lea ebx, [esi + 0xbbc]
mov ecx, ebx
call fcn.0048dab0
xor ebp, ebp
test al, al
jne 0x4947f3
lea edi, [esi + 0xab4]
push edi
push ebp
push 0x4d83ac
push 0x4da7ac
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
push 1
push 1
push edi
mov ecx, ebx
call fcn.0048d8d0
test al, al
jne 0x4947bc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret 8
mov ecx, esi
mov byte [esi + 0x1bdc], 1
call fcn.00498c50
test al, al
je 0x4947f3
push 0x28
call fcn.004a2a14
mov dword [esi + 0x1cbc], eax
mov dword [eax + 0x20], ebp
mov eax, dword [esi + 0x1cbc]
add esp, 4
mov dword [eax + 0x24], ebp
mov ecx, dword [esi + 0x1cbc]
mov byte [ecx], 0
mov ecx, esi
call fcn.00498c50
test al, al
je 0x494d87
mov eax, dword [esp + 0x30]
xor edi, edi
cmp eax, ebp
mov dword [esp + 0x18], edi
jle 0x494b6f
mov edx, dword [esp + 0x2c]
mov ebx, dword [esi + 0x1cb4]
inc ebx
mov al, byte [edi + edx]
mov edx, dword [esi + 0xab0]
mov ecx, ebx
mov byte [esp + 0x10], al
cmp ecx, edx
mov dword [esi + 0x1cb4], ebx
jg 0x494b6f
cmp al, 0x2b
jne 0x494846
mov al, 0x20
mov byte [esp + 0x10], al
mov cl, byte [esi + 0x1cb8]
test cl, cl
je 0x4948e1
cmp al, 0x26
je 0x494b5e
cmp al, 0x3d
je 0x4948ab
mov ecx, dword [esi + 0x1cc0]
cmp ecx, 0x1e
jae 0x494b5e
cmp ecx, 0x1d
jae 0x49488f
mov edx, dword [esi + 0x1cbc]
mov byte [edx + ecx], al
mov eax, dword [esi + 0x1cc0]
inc eax
mov dword [esi + 0x1cc0], eax
jmp 0x494b5e
mov eax, dword [esi + 0x1cbc]
mov byte [eax + ecx], 0
mov eax, dword [esi + 0x1cc0]
inc eax
mov dword [esi + 0x1cc0], eax
jmp 0x494b5e
mov eax, dword [esi + 0x1cc0]
cmp eax, 0x1e
jae 0x4948c0
mov ecx, dword [esi + 0x1cbc]
mov byte [ecx + eax], 0
mov edx, dword [esi + 0x1cbc]
push ebp
push edx
mov ecx, esi
mov dword [esi + 0x1cc0], ebp
mov byte [esi + 0x1cb8], 0
call fcn.00498ea0
jmp 0x494b5e
mov ecx, dword [esi + 0x1cc4]
cmp ecx, ebp
je 0x49494d
cmp ecx, 1
jne 0x494905
mov byte [esi + 0x1cc8], al
mov dword [esi + 0x1cc4], 2
jmp 0x494b5e
mov eax, dword [esp + 0x10]
mov cl, byte [esi + 0x1cc8]
push eax
push ecx
call fcn.00487040
mov byte [esp + 0x18], al
mov eax, dword [esi + 0x1cbc]
mov edx, dword [esp + 0x18]
mov dword [esi + 0x1cc4], ebp
mov ecx, dword [eax + 0x24]
add esp, 8
inc ecx
mov dword [eax + 0x24], ecx
push edx
lea ecx, [esi + 0xbbc]
call fcn.0048d9d0
test al, al
je 0x4947b0
jmp 0x494b5e
cmp al, 0x25
jne 0x494960
mov dword [esi + 0x1cc4], 1
jmp 0x494b5e
cmp al, 0x26
jne 0x494b39
mov eax, dword [esi + 0x1cd4]
mov ecx, dword [esi + 0x1cd8]
lea edi, [esi + 0x1ccc]
sub ecx, eax
sar ecx, 2
cmp ecx, 1
lea ebx, [esi + 0x1cbc]
mov ebp, eax
jae 0x494a62
mov edx, dword [edi + 4]
test edx, edx
je 0x4949a3
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
ja 0x4949a8
mov ecx, 1
test edx, edx
jne 0x4949b0
xor eax, eax
jmp 0x4949b5
sub eax, edx
sar eax, 2
add eax, ecx
test eax, eax
mov dword [esp + 0x20], eax
jge 0x4949c1
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.004a2a14
mov dword [esp + 0x20], eax
mov ebx, eax
mov eax, dword [edi + 4]
add esp, 4
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x494a02
mov eax, dword [esp + 0x14]
push eax
push ebx
call fcn.00416a60
mov eax, dword [esp + 0x1c]
add esp, 8
add eax, 4
add ebx, 4
cmp eax, ebp
mov dword [esp + 0x14], eax
jne 0x4949e2
lea eax, [esi + 0x1cbc]
mov ecx, edi
push eax
push 1
push ebx
call fcn.00416a30
mov ecx, dword [edi + 8]
add ebx, 4
push ebx
push ecx
push ebp
mov ecx, edi
call fcn.00491680
mov edx, dword [edi + 8]
mov eax, dword [edi + 4]
push edx
push eax
mov ecx, edi
call fcn.00443ee0
mov ecx, dword [edi + 4]
push ecx
call fcn.004a2a3d
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
add esp, 4
mov ecx, edi
lea eax, [ebx + edx*4]
mov dword [edi + 0xc], eax
call fcn.004137b0
lea ecx, [ebx + eax*4 + 4]
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
jmp 0x494af0
mov ecx, eax
sub ecx, ebp
sar ecx, 2
cmp ecx, 1
jae 0x494aab
lea edx, [ebp + 4]
mov ecx, edi
push edx
push eax
push ebp
call fcn.00491680
mov eax, dword [edi + 8]
mov edx, 1
mov ecx, eax
push ebx
sub ecx, ebp
sar ecx, 2
sub edx, ecx
mov ecx, edi
push edx
push eax
call fcn.00416a30
mov eax, dword [edi + 8]
cmp ebp, eax
je 0x494aec
mov ecx, dword [ebx]
mov dword [ebp], ecx
add ebp, 4
cmp ebp, eax
jne 0x494a9d
jmp 0x494aec
lea ecx, [eax - 4]
push eax
push eax
mov dword [esp + 0x2c], ecx
push ecx
mov ecx, edi
call fcn.00491680
mov ecx, dword [edi + 8]
lea eax, [ecx - 4]
cmp ebp, eax
je 0x494ad5
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, ebp
mov dword [ecx], edx
jne 0x494ac6
lea eax, [ebp + 4]
cmp ebp, eax
je 0x494aec
mov ecx, dword [esi + 0x1cbc]
mov dword [ebp], ecx
add ebp, 4
cmp ebp, eax
jne 0x494adc
add dword [edi + 8], 4
push 0x28
call fcn.004a2a14
add esp, 4
lea ecx, [esi + 0xbbc]
mov dword [esi + 0x1cbc], eax
call fcn.0048db40
mov edx, dword [esi + 0x1cbc]
mov edi, dword [esp + 0x18]
xor ebp, ebp
mov dword [edx + 0x20], eax
mov eax, dword [esi + 0x1cbc]
mov dword [eax + 0x24], 0
mov ecx, dword [esi + 0x1cbc]
mov byte [ecx], 0
mov byte [esi + 0x1cb8], 1
jmp 0x494b5e
mov eax, dword [esi + 0x1cbc]
mov edx, dword [esp + 0x10]
push edx
mov ecx, dword [eax + 0x24]
inc ecx
mov dword [eax + 0x24], ecx
lea ecx, [esi + 0xbbc]
call fcn.0048d9d0
test al, al
je 0x4947b0
mov eax, dword [esp + 0x30]
inc edi
cmp edi, eax
mov dword [esp + 0x18], edi
jl 0x494814
mov eax, dword [esi + 0x1cb4]
mov ecx, dword [esi + 0xab0]
cmp eax, ecx
jl 0x4954a6
lea ecx, [esi + 0xbbc]
call fcn.0048d910
mov eax, dword [esi + 0x1cbc]
lea ebx, [esi + 0x1cbc]
cmp eax, ebp
je 0x49549f
mov cl, byte [esi + 0x1cb8]
test cl, cl
jne 0x494d69
mov eax, dword [esi + 0x1cd4]
mov ecx, dword [esi + 0x1cd8]
lea edi, [esi + 0x1ccc]
sub ecx, eax
sar ecx, 2
cmp ecx, 1
mov ebp, eax
jae 0x494cbd
mov edx, dword [edi + 4]
test edx, edx
je 0x494be5
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
ja 0x494bea
mov ecx, 1
test edx, edx
jne 0x494bf2
xor eax, eax
jmp 0x494bf7
sub eax, edx
sar eax, 2
add eax, ecx
test eax, eax
mov dword [esp + 0x20], eax
jge 0x494c03
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.004a2a14
mov ebx, dword [edi + 4]
add esp, 4
cmp ebx, ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
je 0x494c42
mov eax, dword [esp + 0x30]
push ebx
push eax
call fcn.00416a60
mov edx, dword [esp + 0x38]
add ebx, 4
add esp, 8
add edx, 4
cmp ebx, ebp
mov dword [esp + 0x30], edx
jne 0x494c22
mov ebx, dword [esp + 0x30]
lea eax, [esi + 0x1cbc]
push eax
push ebx
call fcn.00416a60
mov ecx, dword [edi + 8]
add esp, 8
add ebx, 4
push ebx
push ecx
push ebp
mov ecx, edi
call fcn.00491680
mov edx, dword [edi + 8]
mov eax, dword [edi + 4]
push edx
push eax
mov ecx, edi
call fcn.00443ee0
mov ecx, dword [edi + 4]
push ecx
call fcn.004a2a3d
mov ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
add esp, 4
mov ecx, edi
lea eax, [ebx + edx*4]
mov dword [edi + 0xc], eax
call fcn.004137b0
lea ecx, [ebx + eax*4 + 4]
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [esi + 0x1cbc], 0
mov byte [esi + 0x2104], 1
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 8
mov edx, eax
sub edx, ebp
sar edx, 2
cmp edx, 1
jae 0x494d06
lea ecx, [ebp + 4]
push ecx
push eax
push ebp
mov ecx, edi
call fcn.00491680
mov eax, dword [edi + 8]
mov ecx, 1
mov edx, eax
push ebx
sub edx, ebp
sar edx, 2
sub ecx, edx
push ecx
push eax
mov ecx, edi
call fcn.00416a30
mov eax, dword [edi + 8]
cmp ebp, eax
je 0x494d43
mov edx, dword [ebx]
mov dword [ebp], edx
add ebp, 4
cmp ebp, eax
jne 0x494cf8
jmp 0x494d43
push eax
push eax
add eax, 0xfffffffc
mov ecx, edi
push eax
call fcn.00491680
mov ecx, dword [edi + 8]
lea eax, [ecx - 4]
cmp ebp, eax
je 0x494d2c
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, ebp
mov dword [ecx], edx
jne 0x494d1d
lea eax, [ebp + 4]
cmp ebp, eax
je 0x494d43
mov ecx, dword [esi + 0x1cbc]
mov dword [ebp], ecx
add ebp, 4
cmp ebp, eax
jne 0x494d33
mov eax, dword [edi + 8]
add eax, 4
mov dword [edi + 8], eax
mov dword [esi + 0x1cbc], 0
mov byte [esi + 0x2104], 1
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 8
push eax
call fcn.004a2a3d
add esp, 4
mov byte [esi + 0x2104], 1
mov dword [ebx], ebp
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
mov ecx, esi
call fcn.00498c60
test al, al
je 0x495456
mov eax, dword [esp + 0x30]
xor ebx, ebx
cmp eax, ebp
mov dword [esp + 0x1c], ebx
jle 0x49522f
mov edx, dword [esp + 0x2c]
mov edi, dword [esi + 0x1cb4]
inc edi
mov cl, byte [ebx + edx]
mov edx, dword [esi + 0xab0]
mov eax, edi
mov byte [esp + 0x18], cl
cmp eax, edx
mov dword [esi + 0x1cb4], edi
jg 0x49522f
mov al, byte [esi + 0x20fc]
test al, al
jne 0x495217
mov al, byte [esi + 0x2104]
test al, al
jne 0x495217
mov al, byte [esi + 0x1cdc]
test al, al
je 0x494f0c
cmp dword [esi + 0x20e8], ebp
jne 0x494e3e
push 0x12c
call fcn.004a2a14
mov dword [esi + 0x20e8], eax
mov dword [eax + 0x124], ebp
mov eax, dword [esi + 0x20e8]
add esp, 4
mov dword [eax + 0x128], ebp
mov ecx, dword [esi + 0x20e8]
mov byte [ecx], 0
mov edx, dword [esi + 0x20e8]
mov cl, byte [esp + 0x18]
mov byte [edx + 0x1e], 0
cmp cl, 0xd
jne 0x494ee0
mov eax, dword [esi + 0x20e4]
mov byte [esi + 0x20fc], 1
cmp eax, ebp
jne 0x494e64
mov byte [esi + 0x1cdc], 0
jmp 0x49521e
mov byte [eax + esi + 0x1ce4], 0
mov al, byte [esi + 0x20fd]
test al, al
mov eax, dword [esi + 0x20e4]
je 0x494e96
lea ecx, [esi + 0x1ce4]
push eax
push ecx
mov ecx, esi
call fcn.00495850
mov dword [esi + 0x20e4], ebp
jmp 0x49521e
cmp eax, 0x15
jle 0x494ed5
push 0x15
push str.Content_Disposition:
lea edx, [esi + 0x1ce4]
push 0x15
push edx
call fcn.00485920
add esp, 0x10
test al, al
je 0x494ed5
mov eax, dword [esi + 0x20e4]
lea ecx, [esi + 0x1cf9]
sub eax, 0x15
mov dword [esi + 0x2100], ebp
push eax
push ecx
mov ecx, esi
call fcn.00495850
mov dword [esi + 0x20e4], ebp
jmp 0x49521e
mov edx, dword [esi + 0x20e4]
mov byte [esi + edx + 0x1ce4], cl
mov edx, dword [esi + 0x20e4]
inc edx
mov eax, edx
mov dword [esi + 0x20e4], edx
cmp eax, 0x400
jae 0x4952a5
jmp 0x49521e
mov eax, dword [esi + 0x1ce0]
mov edx, dword [esi + 0x1c44]
cmp eax, edx
jl 0x49518e
mov eax, dword [esi + 0x20e8]
lea ebx, [esi + 0x20e8]
test eax, eax
je 0x49513b
mov ecx, dword [eax + 0x128]
cmp ecx, 2
jb 0x4950ef
add ecx, 0xfffffffe
lea ebp, [esi + 0x20ec]
mov dword [eax + 0x128], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov edi, eax
sar ecx, 2
cmp ecx, 1
jae 0x49505d
mov edx, dword [ebp + 4]
test edx, edx
je 0x494f7b
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
ja 0x494f80
mov ecx, 1
test edx, edx
jne 0x494f88
xor eax, eax
jmp 0x494f8d
sub eax, edx
sar eax, 2
add eax, ecx
test eax, eax
mov dword [esp + 0x24], eax
jge 0x494f99
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.004a2a14
mov ebx, dword [ebp + 4]
add esp, 4
cmp ebx, edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], eax
je 0x494fd8
mov eax, dword [esp + 0x10]
push ebx
push eax
call fcn.00416a60
mov edx, dword [esp + 0x18]
add ebx, 4
add esp, 8
add edx, 4
cmp ebx, edi
mov dword [esp + 0x10], edx
jne 0x494fb8
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0x20e8]
push eax
push ecx
call fcn.00416a60
mov ebx, dword [ebp + 8]
add esp, 8
cmp edi, ebx
je 0x49501e
mov edx, dword [esp + 0x10]
add edx, 4
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
push edi
push eax
call fcn.00416a60
mov ecx, dword [esp + 0x1c]
add edi, 4
add esp, 8
add ecx, 4
cmp edi, ebx
mov dword [esp + 0x14], ecx
jne 0x494ffe
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 4]
push ecx
push edx
mov ecx, ebp
call fcn.00443ee0
mov eax, dword [ebp + 4]
push eax
call fcn.004a2a3d
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esp, 4
lea edx, [edi + ecx*4]
mov ecx, ebp
mov dword [ebp + 0xc], edx
call fcn.004137b0
lea eax, [edi + eax*4 + 4]
mov dword [ebp + 4], edi
mov dword [ebp + 8], eax
jmp 0x4950f8
mov ecx, eax
sub ecx, edi
sar ecx, 2
cmp ecx, 1
jae 0x4950a9
lea ecx, [edi + 4]
push ecx
push eax
push edi
mov ecx, ebp
call fcn.00491680
mov eax, dword [ebp + 8]
mov ecx, 1
mov edx, eax
push ebx
sub edx, edi
sar edx, 2
sub ecx, edx
push ecx
push eax
mov ecx, ebp
call fcn.00416a30
mov eax, dword [ebp + 8]
cmp edi, eax
je 0x4950a3
mov edx, dword [ebx]
mov dword [edi], edx
add edi, 4
cmp edi, eax
jne 0x495098
add dword [ebp + 8], 4
jmp 0x4950f8
lea ecx, [eax - 4]
push eax
push eax
mov dword [esp + 0x2c], ecx
push ecx
mov ecx, ebp
call fcn.00491680
mov ecx, dword [ebp + 8]
lea eax, [ecx - 4]
cmp edi, eax
je 0x4950d3
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, edi
mov dword [ecx], edx
jne 0x4950c4
lea eax, [edi + 4]
cmp edi, eax
je 0x4950e9
mov ecx, dword [esi + 0x20e8]
mov dword [edi], ecx
add edi, 4
cmp edi, eax
jne 0x4950da
add dword [ebp + 8], 4
jmp 0x4950f8
push eax
call fcn.004a2a3d
add esp, 4
push 0x12c
call fcn.004a2a14
lea ebx, [esi + 0x20e8]
add esp, 4
lea ecx, [esi + 0xbbc]
mov dword [ebx], eax
call fcn.0048db40
mov edx, dword [ebx]
mov dword [edx + 0x124], eax
mov eax, dword [ebx]
mov dword [eax + 0x128], 0
mov ecx, dword [ebx]
mov byte [ecx], 0
mov edx, dword [ebx]
mov cl, byte [esp + 0x18]
mov byte [edx + 0x1e], 0
cmp cl, 0xd
jne 0x495161
mov byte [esi + 0x1cdc], 1
mov dword [esi + 0x20e4], 0
mov byte [esi + 0x20fd], 0
mov byte [esi + 0x20fc], 1
jmp 0x495179
mov eax, dword [ebx]
push eax
call fcn.004a2a3d
add esp, 4
mov dword [ebx], 0
mov byte [esi + 0x2104], 1
mov ebx, dword [esp + 0x1c]
mov dword [esi + 0x1ce0], 0
xor ebp, ebp
jmp 0x49521e
cmp cl, byte [eax + esi + 0x1bdd]
jne 0x4951a0
inc eax
mov dword [esi + 0x1ce0], eax
jmp 0x49521e
cmp dword [esi + 0x20e8], ebp
je 0x49521e
cmp eax, ebp
jle 0x4951f1
xor edi, edi
cmp eax, ebp
jle 0x4951eb
mov cl, byte [esi + edi + 0x1bdd]
push ecx
lea ecx, [esi + 0xbbc]
call fcn.0048d9d0
test al, al
je 0x4947b0
mov eax, dword [esi + 0x20e8]
mov edx, dword [eax + 0x128]
inc edx
inc edi
mov dword [eax + 0x128], edx
mov eax, dword [esi + 0x1ce0]
cmp edi, eax
jl 0x4951b2
mov dword [esi + 0x1ce0], ebp
mov edx, dword [esp + 0x18]
lea ecx, [esi + 0xbbc]
push edx
call fcn.0048d9d0
test al, al
je 0x4947b0
mov eax, dword [esi + 0x20e8]
inc dword [eax + 0x128]
jmp 0x49521e
mov byte [esi + 0x20fc], 0
mov eax, dword [esp + 0x30]
inc ebx
cmp ebx, eax
mov dword [esp + 0x1c], ebx
jl 0x494da8
mov eax, dword [esi + 0x1cb4]
mov ecx, dword [esi + 0xab0]
cmp eax, ecx
jl 0x4954a6
mov eax, dword [esi + 0x20e8]
cmp eax, ebp
je 0x49544e
mov ecx, dword [eax + 0x128]
cmp ecx, 2
jb 0x49543b
add ecx, 0xfffffffe
lea ebp, [esi + 0x20ec]
mov dword [eax + 0x128], ecx
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub ecx, ebx
mov edi, ebx
sar ecx, 2
cmp ecx, 1
jae 0x495395
mov ecx, dword [ebp + 4]
test ecx, ecx
je 0x495298
mov eax, ebx
sub eax, ecx
sar eax, 2
cmp eax, 1
ja 0x49529d
mov eax, 1
test ecx, ecx
jne 0x4952b8
xor ebx, ebx
jmp 0x4952bd
dec eax
pop edi
mov dword [esi + 0x20e4], eax
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret 8
sub ebx, ecx
sar ebx, 2
add eax, ebx
test eax, eax
mov dword [esp + 0x24], eax
jge 0x4952c9
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.004a2a14
mov dword [esp + 0x30], eax
mov ebx, eax
mov eax, dword [ebp + 4]
add esp, 4
cmp eax, edi
mov dword [esp + 0x30], eax
je 0x49530a
mov eax, dword [esp + 0x30]
push eax
push ebx
call fcn.00416a60
mov eax, dword [esp + 0x38]
add esp, 8
add eax, 4
add ebx, 4
cmp eax, edi
mov dword [esp + 0x30], eax
jne 0x4952ea
lea eax, [esi + 0x20e8]
push eax
push ebx
call fcn.00416a60
lea eax, [ebx + 4]
mov ebx, dword [ebp + 8]
add esp, 8
cmp edi, ebx
je 0x495348
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x30]
push edi
push ecx
call fcn.00416a60
mov ecx, dword [esp + 0x38]
add edi, 4
add esp, 8
add ecx, 4
cmp edi, ebx
mov dword [esp + 0x30], ecx
jne 0x495328
mov eax, dword [ebp + 4]
push eax
mov dword [esp + 0x34], eax
call fcn.004a2a3d
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
add esp, 4
lea ecx, [edx + eax*4]
mov dword [ebp + 0xc], ecx
mov ecx, dword [ebp + 4]
test ecx, ecx
jne 0x49537e
xor eax, eax
mov dword [ebp + 4], edx
lea eax, [edx + eax*4 + 4]
mov dword [ebp + 8], eax
jmp 0x495444
mov eax, dword [ebp + 8]
mov dword [ebp + 4], edx
sub eax, ecx
sar eax, 2
lea eax, [edx + eax*4 + 4]
mov dword [ebp + 8], eax
jmp 0x495444
mov ecx, ebx
sub ecx, edi
sar ecx, 2
cmp ecx, 1
jae 0x4953f9
cmp edi, ebx
mov eax, edi
je 0x4953c0
lea ecx, [eax + 4]
push eax
push ecx
mov dword [esp + 0x38], ecx
call fcn.00416a60
mov eax, dword [esp + 0x38]
add esp, 8
cmp eax, ebx
jne 0x4953a7
mov eax, dword [ebp + 8]
mov ecx, 1
mov edx, eax
lea ebx, [esi + 0x20e8]
sub edx, edi
push ebx
sar edx, 2
sub ecx, edx
push ecx
push eax
mov ecx, ebp
call fcn.00416a30
mov eax, dword [ebp + 8]
cmp edi, eax
je 0x4953f3
mov edx, dword [ebx]
mov dword [edi], edx
add edi, 4
cmp edi, eax
jne 0x4953e8
add dword [ebp + 8], 4
jmp 0x495444
push ebx
push ebx
add ebx, 0xfffffffc
mov ecx, ebp
push ebx
call fcn.00491680
mov ecx, dword [ebp + 8]
lea eax, [ecx - 4]
cmp edi, eax
je 0x49541f
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, edi
mov dword [ecx], edx
jne 0x495410
lea eax, [edi + 4]
cmp edi, eax
je 0x495435
mov ecx, dword [esi + 0x20e8]
mov dword [edi], ecx
add edi, 4
cmp edi, eax
jne 0x495426
add dword [ebp + 8], 4
jmp 0x495444
push eax
call fcn.004a2a3d
add esp, 4
mov dword [esi + 0x20e8], 0
lea ecx, [esi + 0xbbc]
jmp 0x49549a
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push edi
push edx
mov ecx, ebx
call fcn.0048db50
test al, al
jne 0x49547e
mov ecx, ebx
call fcn.0048d910
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret 8
mov edx, dword [esi + 0x1cb4]
mov ecx, dword [esi + 0xab0]
add edx, edi
mov eax, edx
mov dword [esi + 0x1cb4], edx
cmp eax, ecx
jl 0x4954a6
mov ecx, ebx
call fcn.0048d910
mov byte [esi + 0x2104], 1
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x18
ret 8