Function at 0x49732c
Capabilities:
Authenticate hmac
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4d
push 0
push 0
dec ecx
jne 0x497334
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404de8
xor eax, eax
push ebp
push 0x498c9d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004049d0
mov eax, dword [ebp - 8]
call fcn.00404bf8
cmp eax, 3
jl 0x498c06
mov eax, dword [0x4b89f8]
cmp dword [eax], 0xa
jl 0x498c06
mov eax, dword [ebp - 8]
cmp byte [eax], 0x2a
jne 0x4973ba
mov eax, dword [0x4b89f8]
mov dword [eax], 0x15
mov eax, dword [ebp - 8]
call fcn.00404bf8
cmp eax, 4
jl 0x498c06
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00404e98
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5b
jne 0x49752f
mov eax, dword [ebp - 8]
mov al, byte [eax + 1]
cmp al, 0x22
je 0x4973d4
cmp al, 0x26
jne 0x49741e
lea eax, [ebp - 8]
mov ecx, 2
mov edx, 1
call fcn.00404e98
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.004090cc
test al, al
je 0x497404
mov edx, dword [ebp - 0x18]
mov eax, dword [0x4ba0d8]
call fcn.00453c50
jmp 0x497411
mov edx, dword [ebp - 8]
mov eax, dword [0x4ba0d8]
call fcn.004544a0
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x22
je 0x498c06
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xd8]
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax + 0x48]
mov eax, dword [ebx + 0x2fc]
call fcn.00453c2c
mov eax, dword [0x4ba140]
mov edx, 0x498cb8
call fcn.00404d44
jne 0x49748f
mov edx, 0x62
mov eax, dword [ebx + 0x2f8]
call fcn.0044cb70
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x498cc4
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x498cf4
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4974c2
cmp byte [0x4ba15a], 0
jne 0x4974b2
mov edx, dword [0x4ba140]
mov eax, 0x498d0c
call fcn.00404f3c
dec eax
jne 0x4974b2
mov byte [0x4ba15a], 1
xor edx, edx
mov eax, ebx
call fcn.0049904c
mov byte [0x4ba159], 1
push 1
mov eax, dword [ebx + 0x2f8]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x2d
je 0x498c06
mov dl, 1
mov eax, ebx
call fcn.0049904c
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x2a
jne 0x4974ff
mov eax, dword [0x4b89f8]
mov dword [eax], 0x18
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00404e98
mov eax, dword [ebp - 8]
call fcn.00404bf8
cmp eax, 5
jl 0x498c06
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x498c06
mov eax, dword [ebp - 8]
cmp byte [eax], 0x7b
jne 0x497e50
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00404e98
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004049d0
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x31
jne 0x497676
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, 1
call fcn.00404e98
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
sub al, 0x30
je 0x49758c
dec al
je 0x497609
jmp 0x498c06
mov eax, dword [0x4b89f8]
mov dword [eax], 0x10
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xd8]
mov edx, 0x62
mov eax, dword [ebx + 0x2f8]
call fcn.0044cb70
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x498d18
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x498d58
mov ecx, dword [eax]
call dword [ecx + 0x38]
xor edx, edx
mov eax, dword [ebx + 0x2f8]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push 1
mov eax, dword [ebx + 0x2f8]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
jmp 0x498c06
lea ecx, [ebp - 0x1f8]
mov esi, dword [ebx + 0x2fc]
mov eax, dword [esi + 0x23c]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1f8]
mov eax, esi
call fcn.004544a0
push 0
mov eax, dword [0x4ba0d8]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
push 0xbc
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4b8a34]
cmp byte [eax], 1
je 0x498c06
mov ecx, dword [0x4b89c4]
mov eax, dword [0x4b8c5c]
mov eax, dword [eax]
mov edx, dword [0x49649c]
call fcn.00474cb0
jmp 0x498c06
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x32
jne 0x497896
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, 1
call fcn.00404e98
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
sub al, 0x30
je 0x4976b2
dec al
je 0x497748
dec al
je 0x49782f
jmp 0x49787e
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xd8]
mov edx, 0x62
mov eax, dword [ebx + 0x2f8]
call fcn.0044cb70
cmp dword [0x4ba154], 0
jne 0x4976f1
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x498d74
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x497707
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x498dc4
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x498e18
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xc8]
test eax, eax
jle 0x49787e
xor edx, edx
mov eax, dword [ebx + 0x2f8]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
jmp 0x49787e
mov eax, dword [0x4b8bc4]
cmp dword [eax], 1
jne 0x49776a
mov eax, dword [0x4b8bc4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4ba0dc]
call fcn.004715e4
jmp 0x498c06
mov eax, dword [0x4ba154]
call fcn.00404bf8
mov edi, eax
test edi, edi
jle 0x4977ce
mov esi, 1
mov eax, dword [0x4ba154]
cmp byte [eax + esi - 1], 0x5e
jne 0x4977ca
push 5
lea eax, [ebp - 0x1fc]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [0x4ba154]
call fcn.00404e58
mov eax, dword [ebp - 0x1fc]
call fcn.00409078
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x4ba154
mov ecx, esi
mov edx, 1
call fcn.00404e98
jmp 0x4977ce
inc esi
dec edi
jne 0x49777f
mov eax, dword [0x4b8c38]
cmp dword [eax], 0
jle 0x497802
push 0x13
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x48]
push eax
mov eax, dword [ebx + 0x44]
push eax
mov eax, dword [ebx + 0x40]
push eax
push 1
mov eax, dword [0x4b8c38]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [0x4b8c38]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x4b8c38]
cmp dword [eax], 0
jne 0x49787e
cmp dword [0x4ba154], 0
jne 0x49787e
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov ecx, 0x498d74
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0x20]
jmp 0x49787e
xor edx, edx
mov eax, ebx
call fcn.0049904c
mov eax, dword [0x4b8bc4]
cmp dword [eax], 0
je 0x49784b
mov eax, dword [0x4b8bc4]
xor edx, edx
mov dword [eax], edx
push 0
push 0x82
push 0x160
mov eax, dword [ebx + 0x2fc]
call fcn.0045aca0
push eax
call sub.user32.dll_SendMessageA
mov dl, 1
mov eax, ebx
call fcn.0049904c
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.004544a0
push 1
mov eax, dword [ebx + 0x2f8]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
jmp 0x498c06
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x33
jne 0x497a00
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, 1
call fcn.00404e98
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
sub al, 0x30
je 0x4978da
dec al
je 0x49796e
dec al
je 0x4979a0
dec al
je 0x4979d2
jmp 0x4979e8
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xd8]
mov edx, 0x62
mov eax, dword [ebx + 0x2f8]
call fcn.0044cb70
mov eax, dword [0x4b89d4]
cmp byte [eax], 0
jne 0x49791a
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x498cc4
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x497930
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x498e34
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x498e64
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xc8]
test eax, eax
jle 0x4979e8
xor edx, edx
mov eax, dword [ebx + 0x2f8]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
jmp 0x4979e8
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov ecx, 0x498e34
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0x20]
mov edx, 0x498e80
mov eax, dword [ebx + 0x2fc]
call fcn.004544a0
mov eax, dword [0x4b89d4]
mov byte [eax], 1
jmp 0x4979e8
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov ecx, 0x498cc4
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0x20]
mov edx, 0x498e9c
mov eax, dword [ebx + 0x2fc]
call fcn.004544a0
mov eax, dword [0x4b89d4]
mov byte [eax], 0
jmp 0x4979e8
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.004544a0
xor edx, edx
mov eax, ebx
call fcn.0049904c
push 1
mov eax, dword [ebx + 0x2f8]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
jmp 0x498c06
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x34
jne 0x497a6e
mov eax, 0x4ba15c
call fcn.00404938
mov eax, 0x4ba160
call fcn.00404938
mov eax, dword [ebx + 0x2fc]
mov edx, dword [eax]
call dword [edx + 0xd8]
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xd8]
mov edx, 0x118
mov eax, dword [ebx + 0x2fc]
call fcn.00453c2c
push 0
mov eax, dword [ebx + 0x2f8]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
mov byte [0x4ba158], 0
mov eax, ebx
call fcn.00497290
jmp 0x498c06
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x35
jne 0x497b11
lea edx, [ebp - 0x200]
mov eax, dword [ebx + 0x2fc]
call fcn.00454470
cmp dword [ebp - 0x200], 0
je 0x497aff
cmp byte [0x4ba15a], 1
jne 0x497aff
lea ecx, [ebp - 0x204]
mov esi, dword [ebx + 0x2fc]
mov eax, dword [esi + 0x23c]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x204]
mov eax, esi
call fcn.004544a0
push 0
mov eax, dword [0x4ba0d8]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4b8bb8]
inc word [eax]
xor ecx, ecx
mov dl, 1
mov eax, dword [0x48f7c8]
call fcn.0046d434
mov edx, dword [0x4b8d00]
mov dword [edx], eax
mov eax, dword [0x4b8d00]
mov eax, dword [eax]
call fcn.0047178c
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, 1
call fcn.00404e98
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x36
jne 0x497b79
lea edx, [ebp - 0x208]
mov eax, dword [ebx + 0x2fc]
call fcn.00454470
cmp dword [ebp - 0x208], 0
jne 0x497b44
mov eax, ebx
call fcn.00497290
mov eax, dword [0x4b8cec]
mov byte [eax], 0
jmp 0x497b79
mov eax, dword [0x4b8bb8]
cmp word [eax], 0
jbe 0x497b64
mov edx, 0x498eb8
mov eax, dword [ebx + 0x2fc]
call fcn.004544a0
jmp 0x498c06
lea eax, [ebp - 0xc]
mov ecx, 0xfffffed4
or edx, 0xffffffff
call fcn.00479b5c
call fcn.004047c4
lea eax, [ebp - 8]
mov edx, 0x498ed0
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.00404bf8
dec eax
jle 0x497cae
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
cmp al, 0x37
je 0x497ba6
cmp al, 0x38
jne 0x497cae
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, 1
call fcn.00404e98
mov edx, dword [ebp - 0xc]
mov eax, 0x498ee0
call fcn.00404f3c
test eax, eax
jle 0x497bfc
mov edx, dword [ebp - 0xc]
mov eax, 0x498ee0
call fcn.00404f3c
cmp eax, 4
jge 0x497bfc
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x498ee0
call fcn.00404f3c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404e58
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.004090cc
test al, al
je 0x497cae
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x23c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, dword [ebp - 0x1c]
jl 0x497c2c
cmp dword [ebp - 0x1c], 1
jge 0x497c4d
xor edx, edx
mov eax, ebx
call fcn.0049904c
push 1
mov eax, dword [ebx + 0x2f8]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
jmp 0x498c06
lea ecx, [ebp - 0xc]
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc]
call fcn.00404bf8
cmp eax, 2
jl 0x498c06
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x7c
je 0x498c06
mov eax, dword [ebp - 0xc]
cmp byte [eax + 1], 0x7c
je 0x497c9c
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, 0x498eec
call fcn.00404c44
jmp 0x497cae
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, 1
call fcn.00404e98
mov eax, dword [ebp - 0xc]
call fcn.00404bf8
dec eax
jle 0x497e50
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x7c
jne 0x497e50
mov eax, dword [ebx + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xd8]
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, 1
call fcn.00404e98
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x38
jne 0x497d03
mov edx, 0x31
mov eax, dword [ebx + 0x2f8]
call fcn.0044cb70
jmp 0x497d13
mov edx, 0x62
mov eax, dword [ebx + 0x2f8]
call fcn.0044cb70
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.00404bf8
mov edi, eax
test edi, edi
jle 0x497e1d
mov edx, dword [ebp - 8]
mov eax, 0x498ef8
call fcn.00404f3c
test eax, eax
jle 0x497e16
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x498ef8
call fcn.00404f3c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404e58
mov edx, dword [ebp - 8]
mov eax, 0x498ef8
call fcn.00404f3c
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00404e98
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, dword [ebp - 8]
mov eax, 0x498f04
call fcn.00404f3c
test eax, eax
jle 0x497dd2
mov dword [ebp - 0x18], 1
mov edx, dword [ebp - 8]
mov eax, 0x498f04
call fcn.00404f3c
mov ecx, eax
inc ecx
lea eax, [ebp - 8]
mov edx, 1
call fcn.00404e98
jmp 0x497e16
cmp dword [ebp - 0x18], 0
jne 0x497e16
mov eax, dword [ebx + 0x2f8]
call fcn.0044cb2c
cmp eax, 0x31
jne 0x497dfe
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x498f10
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x2f8]
mov eax, dword [eax + 0x218]
mov edx, 0x498f28
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x497e1d
dec edi
jne 0x497d35
xor edx, edx
mov eax, dword [ebx + 0x2f8]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
push 1
mov eax, dword [ebx + 0x2f8]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, 0x498eec
call fcn.00404c44
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x498582
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov esi, 0xff
mov edx, dword [ebp - 8]
mov eax, 0x498f3c
call fcn.00404f3c
test eax, eax
jle 0x4984aa
mov edx, dword [ebp - 8]
mov eax, 0x498f3c
call fcn.00404f3c
mov ecx, eax
lea eax, [ebp - 8]
mov edx, 1
call fcn.00404e98
mov eax, dword [ebp - 8]
call fcn.00404bf8
test eax, eax
jle 0x497edb
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x2d
je 0x497eb5
cmp al, 0x5e
jne 0x497edb
cmp al, 0x5e
jne 0x497ec2
mov dword [ebp - 0x1c], 0xfffffff5
jmp 0x497ec9
mov dword [ebp - 0x1c], 0xffffffea
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00404e98
mov eax, dword [ebp - 8]
call fcn.00404bf8
test eax, eax
jle 0x497f0e
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5e
jne 0x497f0e
cmp dword [ebp - 0x1c], 0xffffffea
je 0x497efc
mov dword [ebp - 0x1c], 0xffffffdf
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00404e98
mov edx, dword [ebp - 8]
mov eax, 0x498f3c
call fcn.00404f3c
test eax, eax
jle 0x497f62
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 8]
mov eax, 0x498f3c
call fcn.00404f3c
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404e58
mov edx, dword [ebp - 8]
mov eax, 0x498f3c
call fcn.00404f3c
mov ecx, eax
dec ecx
lea eax, [ebp - 8]
mov edx, 1
call fcn.00404e98
inc dword [ebp - 0x14]
jmp 0x497f75
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004049d0
xor eax, eax
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
call fcn.00404bf8
cmp eax, 2
jle 0x4984a4
mov eax, dword [ebp - 0x10]
cmp byte [eax + 2], 0x3a
jne 0x497f99
lea eax, [ebp - 0xc]
call fcn.00404938
jmp 0x497fb9
lea edx, [ebp - 0x20c]
mov eax, dword [0x4b8c5c]
mov eax, dword [eax]
call fcn.00475340
mov eax, dword [ebp - 0x20c]
lea edx, [ebp - 0xc]
call fcn.004096bc
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
cmp eax, 0x26
jg 0x497fe4
je 0x497ff9
sub eax, 0x21
je 0x49844a
sub eax, 3
je 0x4982ba
dec eax
je 0x49816e
jmp 0x4984a4
sub eax, 0x3f
je 0x49846e
dec eax
je 0x4983f4
jmp 0x4984a4
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404e98
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.004090cc
test al, al
je 0x4984a4
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx]
call fcn.00404b20
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404e98
cmp dword [ebp - 0x18], 0
jle 0x498082
mov eax, dword [ebp - 0xc]
mov edx, 0x498f48
call fcn.00404d44
jne 0x498066
push 0
push 0
push 0x10
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_PostMessageA
jmp 0x4984a4
mov eax, dword [ebp - 0xc]
call fcn.00409078
push eax
mov eax, dword [ebp - 0x10]
call fcn.00409078
push eax
call sub.user32.dll_ShowWindow
jmp 0x4984a4
lea edx, [ebp - 0xc]
mov eax, dword [0x4b89f8]
mov eax, dword [eax]
call fcn.00408f3c
cmp byte [0x4ba148], 1
jne 0x4980e2
mov eax, dword [0x4ba0d8]
mov eax, dword [eax + 0x304]
cmp dword [eax + 0x40], 0
jne 0x4980b8
lea eax, [ebp - 0xc]
mov edx, 0x498f54
call fcn.004049d0
push 0
push 0
push 0x157
mov eax, dword [ebx + 0x2fc]
call fcn.0045aca0
push eax
call sub.user32.dll_SendMessageA
dec eax
jne 0x4980e2
lea eax, [ebp - 0xc]
mov edx, 0x498f60
call fcn.004049d0
mov eax, dword [0x4b8bc4]
cmp dword [eax], 0
je 0x4980f9
lea eax, [ebp - 0xc]
mov edx, 0x498f6c
call fcn.004049d0
cmp byte [0x4ba148], 0
jne 0x498112
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x498f78
call fcn.00404c44
mov eax, dword [ebp - 8]
call fcn.00404bf8
test eax, eax
jle 0x498131
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5e
jne 0x498131
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004049d0
mov eax, dword [ebp - 0x18]
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
call fcn.00404df8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
call fcn.00404bf8
inc eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x4a
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_SendMessageA
jmp 0x4984a4
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404e98
cmp dword [ebp - 0x14], 0
jne 0x4981ac
push 1
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404df8
push eax
push 0x498f7c
push 0
mov eax, ebx
call fcn.0045aca0
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4984a4
cmp dword [ebp - 0x14], 1
jne 0x4981f5
mov dword [ebp - 0x14], 0x80
lea eax, [ebp - 0x210]
call fcn.00479a10
lea eax, [ebp - 0x210]
mov edx, 0x498f90
call fcn.00404c00
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 0x1f4]
call fcn.00402f44
lea eax, [ebp - 0x1f4]
call fcn.00402ce0
call fcn.00402894
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.004090cc
test al, al
je 0x49829d
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x23c]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [ebp - 0x18]
jle 0x49829d
cmp dword [ebp - 0x18], 0
jge 0x49823c
cmp dword [ebp - 0x14], 0
jle 0x498231
mov dword [ebp - 0x14], 0x200
mov eax, dword [ebp - 0x18]
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x18]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 8]
mov eax, 0x498fa4
call fcn.00404f3c
test eax, eax
jle 0x498288
mov edx, dword [ebp - 8]
mov eax, 0x498fa4
call fcn.00404f3c
mov ecx, eax
sub ecx, 2
lea eax, [ebp - 8]
mov edx, 1
call fcn.00404e98
jmp 0x4984a4
lea eax, [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, 0x498fb4
call fcn.00404c44
jmp 0x4984a4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x1f4]
call fcn.00405014
call fcn.004035c0
call fcn.00402894
jmp 0x4984a4
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404e98
mov edx, dword [ebp - 0x10]
mov eax, 0x498fc8
call fcn.00404f3c
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x4983a6
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.00404e58
lea edx, [ebp - 0x218]
mov eax, dword [0x4b8c5c]
mov eax, dword [eax]
call fcn.00475340
mov eax, dword [ebp - 0x218]
lea edx, [ebp - 0x214]
call fcn.004096bc
lea eax, [ebp - 0x214]
mov edx, dword [ebp - 0xc]
call fcn.00404c00
mov eax, dword [ebp - 0x214]
call fcn.00409444
test al, al
je 0x49836f
lea edx, [ebp - 0x220]
mov eax, dword [0x4b8c5c]
mov eax, dword [eax]
call fcn.00475340
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.004096bc
mov edx, dword [ebp - 0x21c]
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
call fcn.00404c44
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov edx, 1
call fcn.00404e98
push 5
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404df8
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404df8
push eax
push 0x498fcc
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4984a4
lea eax, [ebp - 0x224]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00404c44
mov eax, dword [ebp - 0x224]
call fcn.00409444
test al, al
je 0x4983d4
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00404c44
push 5
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404df8
push eax
push 0x498fcc
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x4984a4
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404e98
push 5
push dword [ebp - 0x10]
push 0x498fdc
lea edx, [ebp - 0x22c]
mov eax, dword [ebx + 0x2fc]
call fcn.00454470
push dword [ebp - 0x22c]
lea eax, [ebp - 0x228]
mov edx, 3
call fcn.00404cb8
mov eax, dword [ebp - 0x228]
call fcn.00404df8
push eax
call sub.kernel32.dll_WinExec
jmp 0x4984a4
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404e98
push 5
mov eax, dword [ebp - 0x10]
call fcn.00404df8
push eax
call sub.kernel32.dll_WinExec
jmp 0x4984a4
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404e98
push 5
lea eax, [ebp - 0x230]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00404c44
mov eax, dword [ebp - 0x230]
call fcn.00404df8
push eax
call sub.kernel32.dll_WinExec
cmp dword [ebp - 0x14], 1
jl 0x4984b1
dec esi
jne 0x497e6b
cmp dword [ebp - 0x14], 0xffffff9c
jge 0x49852e
lea eax, [ebp - 0x1f4]
call fcn.0040300c
call fcn.00402894
cmp dword [ebp - 0x14], 0xfffffec0
jge 0x498500
push 5
lea eax, [ebp - 0x234]
call fcn.00479a10
lea eax, [ebp - 0x234]
mov edx, 0x498f90
call fcn.00404c00
mov eax, dword [ebp - 0x234]
call fcn.00404df8
push eax
call sub.kernel32.dll_WinExec
jmp 0x49852e
push 0
lea eax, [ebp - 0x238]
call fcn.00479a10
lea eax, [ebp - 0x238]
mov edx, 0x498f90
call fcn.00404c00
mov eax, dword [ebp - 0x238]
call fcn.00404df8
push eax
call sub.kernel32.dll_WinExec
cmp dword [ebp - 0x1c], 0
jne 0x498543
lea eax, [ebp - 8]
mov edx, 0x498fe8
call fcn.004049d0
jmp 0x498582
cmp dword [ebp - 0x18], 8
jge 0x498556
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.004544a0
cmp dword [ebp - 0x1c], 0xffffffdf
jne 0x49856b
lea eax, [ebp - 8]
mov edx, 0x498ff4
call fcn.004049d0
jmp 0x498582
cmp dword [ebp - 0x1c], 0xffffffea
jne 0x498c06
lea eax, [ebp - 8]
mov edx, 0x499000
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x26
jne 0x498596
mov eax, ebx
call fcn.00497290
jmp 0x498c06
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5e
jne 0x4986dd
mov eax, dword [ebp - 8]
call fcn.00404bf8
cmp eax, 2
jle 0x4986dd
mov edx, 0xffffff38
mov eax, dword [ebx + 0x304]
call fcn.00453be0
mov eax, dword [ebp - 8]
cmp byte [eax + 2], 0x26
jne 0x4985e0
mov byte [0x4ba158], 0
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x26
je 0x498c06
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.00453be0
mov byte [0x4ba148], 1
mov eax, dword [0x4b8cec]
mov byte [eax], 1
push 1
mov eax, dword [ebx + 0x2fc]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
push 1
mov eax, dword [0x4ba0d8]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
push 0x13
mov eax, dword [ebx + 0x4c]
push eax
mov eax, dword [ebx + 0x48]
push eax
mov eax, dword [ebx + 0x44]
push eax
mov eax, dword [ebx + 0x40]
push eax
push 0xffffffffffffffff
mov eax, dword [0x4ba0d8]
call fcn.0045aca0
push eax
call sub.user32.dll_SetWindowPos
or edx, 0xffffffff
mov eax, dword [ebx + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.004544a0
mov eax, dword [ebx + 0x2fc]
call fcn.0045aca0
push eax
call sub.user32.dll_SetForegroundWindow
cmp byte [0x4ba158], 1
jne 0x4986b2
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x5e
jne 0x4986b2
mov eax, dword [ebp - 8]
cmp byte [eax + 2], 0x7c
jne 0x4986a3
lea eax, [ebp - 8]
mov ecx, 2
mov edx, 1
call fcn.00404e98
jmp 0x4986dd
lea eax, [ebp - 8]
mov edx, 0x49900c
call fcn.004049d0
jmp 0x4986dd
mov eax, dword [ebx + 0x2fc]
cmp dword [eax + 0x48], 0xbc
jge 0x498c06
push 1
mov eax, dword [ebx + 0x2f8]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
jmp 0x498c06
mov eax, dword [ebp - 8]
cmp byte [eax], 0x7c
jne 0x498a06
mov eax, dword [ebp - 8]
call fcn.00404bf8
cmp eax, 2
jle 0x498a06
mov esi, 0xa
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00404e98
cmp byte [0x4ba158], 0
jne 0x498726
mov byte [0x4ba158], 1
mov eax, dword [ebp - 8]
cmp byte [eax], 0x23
jne 0x498794
lea eax, [ebp - 0x23c]
mov edx, dword [ebp - 8]
mov dl, byte [edx + 1]
call fcn.00404b20
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x1c]
call fcn.004090cc
test al, al
je 0x498780
mov eax, dword [ebx + 0x304]
call fcn.00433b60
mov ecx, 5
mov edx, 5
call fcn.004270fc
push eax
mov eax, dword [ebx + 0x304]
call fcn.00433b60
mov eax, dword [eax + 0x14]
pop edx
call fcn.00426920
lea eax, [ebp - 8]
mov ecx, 2
mov edx, 1
call fcn.00404e98
jmp 0x4987b9
push 0x81
push 0x79
push 5
push 5
mov eax, dword [ebx + 0x304]
call fcn.00433b60
mov ecx, 1
mov edx, 1
call fcn.00426e48
mov dword [ebp - 0x14], 9
mov edx, dword [ebp - 8]
mov eax, 0x499018
call fcn.00404f3c
test eax, eax
jle 0x4988c3
mov edx, dword [ebp - 8]
mov eax, 0x499018
call fcn.00404f3c
mov dword [ebp - 0x18], eax
cmp byte [0x4ba148], 1
jne 0x498877
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
cmp byte [eax + edx - 2], 0x40
jne 0x498877
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0x18]
sub ecx, 2
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404e58
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.00479de4
mov dword [ebp - 0x24c], eax
mov byte [ebp - 0x248], 0
lea edx, [ebp - 0x24c]
xor ecx, ecx
mov eax, 0x499024
call fcn.0040a050
mov edx, dword [ebp - 0x244]
pop eax
call fcn.00404c00
mov eax, dword [ebp - 0x240]
push eax
mov eax, dword [ebx + 0x304]
call fcn.00433b60
mov ecx, esi
mov edx, 5
call fcn.00426f00
jmp 0x4988ad
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x18]
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404e58
mov eax, dword [ebp - 0x250]
push eax
mov eax, dword [ebx + 0x304]
call fcn.00433b60
mov ecx, esi
mov edx, 5
call fcn.00426f00
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edx, 1
call fcn.00404e98
add esi, 0x12
sub esi, dword [ebp - 0x1c]
dec dword [ebp - 0x14]
jne 0x4987c0
cmp esi, 0xa
jne 0x4989b9
lea edx, [ebp - 0x254]
mov eax, dword [ebp - 8]
call fcn.00408bf4
mov edx, dword [ebp - 0x254]
mov eax, 0x499034
call fcn.00404f3c
test eax, eax
jle 0x4989b9
mov eax, dword [ebp - 8]
call fcn.00409444
test al, al
je 0x498920
mov eax, dword [ebx + 0x304]
mov eax, dword [eax + 0x168]
mov edx, dword [ebp - 8]
call fcn.004291dc
jmp 0x4989b9
lea eax, [ebp - 0xc]
mov ecx, 0x64
xor edx, edx
call fcn.00479b5c
mov eax, dword [ebp - 0xc]
call fcn.00404bf8
cmp eax, 0x401
jge 0x498951
mov edx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x2fc]
call fcn.004544a0
jmp 0x498c06
mov dl, 1
mov eax, dword [0x417ad8]
call fcn.00403af4
mov esi, eax
mov eax, dword [ebp - 0xc]
call fcn.00404bf8
mov edx, eax
sar edx, 1
jns 0x498970
adc edx, 0
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 4]
mov eax, esi
mov edx, dword [eax]
call dword [edx]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404df8
mov edx, dword [esi + 4]
pop ecx
call fcn.00421e5c
xor ecx, ecx
xor edx, edx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebx + 0x304]
mov eax, dword [eax + 0x168]
call fcn.004290fc
mov edx, esi
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, esi
call fcn.00403b24
xor edx, edx
mov eax, dword [ebx + 0x304]
call fcn.00453be0
mov edx, 0xffffff38
mov eax, dword [ebx + 0x2fc]
call fcn.00453be0
push 0
mov eax, dword [ebx + 0x2f8]
call fcn.0045aca0
push eax
call sub.user32.dll_ShowWindow
push 1
mov eax, dword [ebx + 0x304]
call fcn.00433b60
call fcn.00427170
push eax
call sub.user32.dll_ShowWindow
jmp 0x498c06
mov eax, dword [ebp - 8]
call fcn.00404bf8
cmp eax, 3
jl 0x498c06
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
mov dl, byte [edx]
call fcn.00404b20
lea eax, [ebp - 0x25c]
mov edx, dword [ebp - 8]
mov dl, byte [edx]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x25c]
lea eax, [ebp - 0x260]
call fcn.00403094
lea eax, [ebp - 0x264]
mov edx, dword [ebp - 8]
mov dl, byte [edx + 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x264]
lea eax, [ebp - 0x260]
mov cl, 2
call fcn.00403064
lea edx, [ebp - 0x260]
lea eax, [ebp - 0x258]
call fcn.00404b9c
mov eax, dword [ebp - 0x258]
lea edx, [ebp - 0x1c]
call fcn.004090cc
test al, al
je 0x498b40
lea eax, [ebp - 8]
mov ecx, 2
mov edx, 1
call fcn.00404e98
mov eax, dword [ebp - 0x1c]
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x23c]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp eax, dword [ebp - 0x1c]
jle 0x498ade
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x23c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0x20]
jmp 0x498af2
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 0x10]
mov edx, 0x498f78
call fcn.00404d44
jne 0x498b0e
xor edx, edx
mov eax, dword [ebx + 0x2fc]
call fcn.004544a0
mov eax, dword [ebp - 0x10]
mov edx, 0x498f48
call fcn.00404d44
je 0x498c06
mov eax, dword [ebp - 0x10]
mov edx, 0x498f78
call fcn.00404d44
je 0x498c06
mov eax, ebx
call fcn.00497290
jmp 0x498c06
lea eax, [ebp - 0x268]
mov edx, dword [ebp - 8]
mov dl, byte [edx]
call fcn.00404b20
mov eax, dword [ebp - 0x268]
lea edx, [ebp - 0x1c]
call fcn.004090cc
test al, al
je 0x498c06
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.00404e98
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 0x1c]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00404bf8
cmp eax, 0x800
jge 0x498bab
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00404c00
jmp 0x498bef
mov edx, dword [ebp - 0x10]
mov eax, 0x499044
call fcn.00404f3c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x498bef
lea eax, [ebp - 0x26c]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404bf8
mov ecx, eax
sub ecx, dword [ebp - 0x14]
inc ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00404e58
mov edx, dword [ebp - 0x26c]
lea eax, [ebp - 8]
call fcn.00404c00
mov eax, dword [ebx + 0x2fc]
mov eax, dword [eax + 0x23c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0x20]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x498ca7
lea eax, [ebp - 0x26c]
mov edx, 2
call fcn.0040495c
lea eax, [ebp - 0x258]
mov edx, 3
call fcn.0040495c
lea eax, [ebp - 0x244]
mov edx, 6
call fcn.0040495c
lea eax, [ebp - 0x22c]
call fcn.00404938
lea eax, [ebp - 0x228]
mov edx, 8
call fcn.0040495c
lea eax, [ebp - 0x208]
call fcn.00404938
lea eax, [ebp - 0x204]
call fcn.00404938
lea eax, [ebp - 0x200]
call fcn.00404938
lea eax, [ebp - 0x1fc]
mov edx, 2
call fcn.0040495c
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.0040495c
ret