Function at 0x49baa2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x288
push ebx
fldz
push esi
fstp qword [ebp - 0x19c]
push edi
push 0x26
xor eax, eax
pop ecx
lea edi, [ebp - 0x194]
mov byte [ebp + 0x5b], 1
rep stosd dword es:[edi], eax
xor ebx, ebx
mov esi, 0x4dcd58
push dword [ebp + 0x78]
lea ecx, [ebp - 0x70]
mov byte [ebp + 0x37], bl
call fcn.0044e66d
mov eax, dword [ebp - 0x70]
mov dword [ebp + 0x60], eax
add eax, 0xc
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x48], eax
lea eax, [ebp + 0x48]
push eax
call fcn.00405b4a
mov eax, dword [ebp + 0x48]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.0043e611
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2a
pop ecx
pop ecx
lea ecx, [ebp + 0xf]
sete byte [ebp + 0x67]
call fcn.004135e3
push 6
push dword [ebp - 0x20]
push str.__free
call fcn.0043fa6d
add esp, 0xc
test al, al
jne 0x49d01a
lea ecx, [ebp + 0x78]
call fcn.00499d8d
push ebx
lea ecx, [ebp + 0xf]
call fcn.004135e6
lea ecx, [ebp + 0xf]
call fcn.004135d7
neg eax
sbb eax, eax
inc eax
cmp dword [0x4da84c], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp + 0x24], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x8c], ebx
jge 0x49bc02
mov eax, dword [0x4dc094]
cmp eax, ebx
mov dword [0x4da84c], ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x44], ebx
je 0x49bbde
lea ecx, [ebp + 0x44]
push ecx
lea ecx, [ebp + 0x54]
push ecx
call eax
cmp dword [ebp + 0x44], ebx
jbe 0x49bbde
mov eax, dword [ebp + 0x54]
cmp eax, 0x202
jb 0x49bbaa
mov dword [0x4da84c], 0x38
jmp 0x49bbde
cmp eax, 0x184
jb 0x49bbbd
mov dword [0x4da84c], 8
jmp 0x49bbde
cmp eax, 0x160
jb 0x49bbd0
mov dword [0x4da84c], 2
jmp 0x49bbde
cmp eax, ebx
jbe 0x49bbde
mov dword [0x4da84c], 1
push dword [0x4dc094]
push dword [0x4da84c]
push dword [ebp + 0x44]
push dword [ebp + 0x54]
push str.DBG:_IMD:_0x_X_0x_X_0x_X__0x_p_r_n
push 0x4dc0f8
call fcn.00411099
add esp, 0x18
push 3
push dword [ebp - 0x20]
push 0x4c997c
call fcn.0043fa6d
add esp, 0xc
test al, al
je 0x49bc1f
mov dword [ebp + 0x24], 0xfff00000
push 5
lea eax, [ebp - 0x20]
push eax
push str.__ins
mov byte [ebp + 0x6f], bl
call fcn.00446de5
add esp, 0xc
test al, al
je 0x49bc3f
mov byte [ebp + 0x6f], 5
jmp 0x49bc5a
push 6
lea eax, [ebp - 0x20]
push eax
push str.__fins
call fcn.00446de5
add esp, 0xc
test al, al
je 0x49bc5a
mov byte [ebp + 0x6f], 6
push 0x3e8
lea ecx, [ebp - 0x24]
call fcn.00444e50
lea ecx, [ebp + 0x18]
call fcn.00444e32
lea ecx, [ebp - 0xa8]
call fcn.00444e32
lea ecx, [ebp + 0x5c]
call fcn.00444e32
lea ecx, [ebp - 0x1c]
mov dword [ebp + 0x14], ebx
call fcn.00444e32
lea ecx, [ebp + 4]
call fcn.00444e32
lea ecx, [ebp + 0x50]
call fcn.00444e32
lea ecx, [ebp - 0xc]
call fcn.00444e32
lea ecx, [ebp - 0x3c]
call fcn.00444e32
lea ecx, [ebp + 0x3c]
call fcn.00444e32
lea ecx, [ebp - 0x28]
call fcn.00444e32
lea ecx, [ebp + 0x28]
call fcn.00444e32
or eax, 0xffffffff
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov eax, 0x4c0a1c
push 0xc8
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x54], eax
call fcn.00444e50
cmp byte [ebp + 0x67], bl
mov eax, dword [ebp + 0x48]
mov cx, word [eax]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0xd8], eax
mov word [ebp - 0x7c], cx
mov dword [ebp + 0x30], eax
je 0x49be4d
add dword [ebp + 0x68], 2
mov word [eax], bx
mov eax, dword [ebp + 0x68]
mov edx, eax
jmp 0x49bd42
cmp cx, 0x2a
je 0x49bd4a
inc eax
inc eax
mov dword [ebp + 0x68], eax
mov cx, word [eax]
cmp cx, bx
jne 0x49bd37
sub eax, edx
sar eax, 1
push eax
push edx
lea ecx, [ebp + 0x18]
call fcn.00444f56
mov eax, dword [ebp + 0x18]
cmp word [eax], bx
je 0x49bd6d
push 0x3e8
lea ecx, [ebp - 0x24]
call fcn.00444e77
cmp word [ebp - 0x7c], bx
mov eax, dword [ebp + 0x48]
mov dword [ebp + 0x30], eax
je 0x49bd7f
add eax, 2
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x30]
push eax
call fcn.0043e611
pop ecx
mov edi, 0x4c0a1c
push 4
lea eax, [ebp + 0x30]
push eax
push str._mem
call fcn.00446e5a
add esp, 0xc
test al, al
jne 0x49bdbc
push 2
lea eax, [ebp + 0x30]
push eax
push 0x4c5b8c
call fcn.00446e5a
add esp, 0xc
test al, al
je 0x49bdc1
mov dword [ebp + 0x44], edi
jmp 0x49bd8e
push 3
lea eax, [ebp + 0x30]
push eax
push 0x4c9f18
call fcn.00446e5a
add esp, 0xc
test al, al
je 0x49bde1
mov dword [ebp + 0x44], 0x4cda1c
jmp 0x49bd8e
push 4
lea eax, [ebp + 0x30]
push eax
push str._map
call fcn.00446e5a
add esp, 0xc
test al, al
je 0x49be04
mov dword [ebp - 0xe0], 1
jmp 0x49bd8e
push 4
lea eax, [ebp + 0x30]
push eax
push str._exe
call fcn.00446e5a
add esp, 0xc
test al, al
je 0x49be27
mov dword [ebp + 0x24], 1
jmp 0x49bd8e
push 5
lea eax, [ebp + 0x30]
push eax
push str._nexe
call fcn.00446e5a
add esp, 0xc
test al, al
je 0x49be4a
mov dword [ebp + 0x24], 0xfff00000
jmp 0x49bd8e
mov edi, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x7c]
push 0x4cd9f4
push 0x4ccf7c
call fcn.0044451e
mov eax, dword [ebp + 0x18]
cmp word [eax], bx
push 0xffffffffffffffff
lea ecx, [ebp + 0x14]
push 0xffffffffffffffff
je 0x49be92
push 0x4cd9f0
call fcn.00444eed
push dword [ebp + 0x18]
lea ecx, [ebp + 0x14]
call fcn.00444e9e
push str.Imdisk
lea ecx, [ebp + 0x14]
call fcn.00444e9e
jmp 0x49be9c
push str._Imdisk
call fcn.00444eed
push 9
push edi
push str.__version
call fcn.0043fa6d
push 2
push edi
push 0x4cd9c0
mov byte [ebp + 0x66], al
call fcn.0043fa6d
push 2
push edi
push 0x4cd9bc
mov byte [ebp + 0xe], al
call fcn.0043fa6d
push 3
push edi
push 0x4c997c
mov byte [ebp + 0x13], al
call fcn.0043fa6d
add esp, 0x30
cmp byte [ebp + 0x66], bl
jne 0x49bef3
cmp byte [ebp + 0xe], bl
jne 0x49bef3
cmp byte [ebp + 0x13], bl
jne 0x49bef3
cmp al, bl
jne 0x49bef3
mov cl, 1
jmp 0x49bef5
xor cl, cl
cmp dword [ebp - 0x18], ebx
jne 0x49bf0c
mov eax, dword [0x4da84c]
cmp eax, ebx
jle 0x49bf0c
push 2
pop edi
cmp eax, edi
jge 0x49bf18
jmp 0x49bf0f
push 2
pop edi
cmp cl, bl
jne 0x49bf22
cmp byte [ebp + 0x6f], bl
jne 0x49bf22
cmp byte [ebp + 0x6f], 6
jl 0x49c0a7
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x4cd9b4
jne 0x49bf78
lea ecx, [ebp - 0x74]
call fcn.00444e32
mov eax, 0x4cd9ac
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xe8]
push eax
push edi
call fcn.004254f5
mov eax, dword [ebp - 0x74]
add esp, 0xc
cmp word [eax], bx
je 0x49bf70
cmp word [eax + 2], bx
je 0x49bf70
mov dword [ebp - 0x10], 0x4cd9a4
lea ecx, [ebp - 0x74]
call fcn.0043e679
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub dword [0x4dcdb0], 1
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4dcdb0], ebx
jle 0x49bfaf
push esi
call edi
mov ecx, dword [ebp + 0x7c]
push ebx
push ebx
push 1
call fcn.00415ff0
jmp 0x49bf8f
push 0xffffffffffffffff
lea ecx, [ebp + 0xf]
call fcn.004135e6
push esi
call edi
movsx ax, byte [ebp + 0x6f]
push 0xffffffffffffffff
lea ecx, [ebp + 0xf]
mov word [ebp - 0xbe], 0x20
mov word [ebp - 0xbc], bx
add eax, 0x30
mov word [ebp - 0xc0], ax
call fcn.004135e6
push str.28:INDATA
lea ecx, [ebp + 8]
call fcn.0044e66d
cmp dword [ebp - 0x18], ebx
mov eax, 0x4cd9a4
jne 0x49c001
mov eax, 0x4cd9b4
push eax
lea ecx, [ebp + 8]
call fcn.00444e9e
push dword [ebp - 0x10]
lea ecx, [ebp + 8]
call fcn.00444e9e
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp + 8]
call fcn.00444e9e
push dword [ebp + 0x48]
lea ecx, [ebp + 8]
call fcn.00444e9e
push dword [ebp + 8]
push str.Install_IMD__s__r_n
push 0x4dc0f8
call fcn.00411099
mov ecx, dword [ebp + 0x7c]
add esp, 0xc
push dword [ebp + 8]
call fcn.004221d9
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [0x4dcdb0], 1
push esi
mov dword [0x4da84c], 0xffffffc0
call edi
push ebx
lea ecx, [ebp + 0xf]
call fcn.004135e6
lea ecx, [ebp + 0xf]
call fcn.004135d7
neg eax
sbb eax, eax
inc eax
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp - 0x18], ebx
jne 0x49c099
mov dword [0x4da84c], 0x38
push esi
call edi
lea ecx, [ebp + 8]
call fcn.0043e679
push 2
pop edi
cmp byte [ebp + 0x67], bl
je 0x49c948
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x4c], eax
jmp 0x49c0db
push edi
lea eax, [ebp - 0x4c]
push eax
push 0x4c5b8c
call fcn.00446de5
add esp, 0xc
test al, al
jne 0x49c0e2
lea eax, [ebp - 0x4c]
push eax
call fcn.00405b6e
mov eax, dword [ebp - 0x4c]
pop ecx
cmp word [eax], bx
jne 0x49c0b8
jmp 0x49c0e8
mov eax, dword [ebp - 0x4c]
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x68]
cmp word [eax], 0x2a
jne 0x49c936
add dword [ebp + 0x68], edi
mov eax, dword [ebp + 0x68]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
cmp word [eax], 0x40
mov byte [ebp + 0x67], bl
jne 0x49c117
add dword [ebp + 0x68], edi
mov byte [ebp + 0x67], 1
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044a751
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
pop ecx
je 0x49c131
add dword [ebp + 0x68], edi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044a751
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
pop ecx
je 0x49c14b
add dword [ebp + 0x68], edi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044a751
mov edi, dword [ebp + 0x68]
cmp word [edi], bx
pop ecx
pop ecx
je 0x49c167
inc edi
inc edi
mov dword [ebp + 0x68], edi
mov al, byte [ebp - 0x48]
and al, 1
mov byte [ebp + 0x6f], al
push 0x2a
lea eax, [ebp + 0x68]
call fcn.00405b85
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp + 0x28]
call fcn.00444f56
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
je 0x49c197
add dword [ebp + 0x68], 2
mov edi, dword [ebp + 0x68]
push 0x2a
lea eax, [ebp + 0x68]
call fcn.00405b85
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp + 0x3c]
call fcn.00444f56
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
je 0x49c1c2
add dword [ebp + 0x68], 2
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044a751
mov edi, dword [ebp + 0x68]
cmp word [edi], bx
pop ecx
pop ecx
je 0x49c1de
inc edi
inc edi
mov dword [ebp + 0x68], edi
push 0x2a
lea eax, [ebp + 0x68]
call fcn.00405b85
mov eax, dword [ebp + 0x68]
pop ecx
sub eax, edi
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00444f56
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044a751
mov eax, dword [ebp + 0x68]
cmp word [eax], bx
pop ecx
pop ecx
je 0x49c215
add dword [ebp + 0x68], 2
cmp byte [ebp + 0x67], bl
mov edx, dword [ebp - 0x64]
mov edi, dword [ebp - 0x60]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], ecx
je 0x49c25a
add eax, edx
adc ecx, edi
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], ecx
cmp dword [ebp - 0x58], ebx
jl 0x49c27c
jg 0x49c266
cmp dword [ebp - 0x5c], ebx
jbe 0x49c27c
cmp dword [ebp - 0x34], ebx
jg 0x49c27c
jl 0x49c272
cmp dword [ebp - 0x38], ebx
ja 0x49c27c
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], ebx
push 0x318
lea ecx, [ebp - 0x2c]
call fcn.00444e50
mov eax, dword [ebp - 0x2c]
lea esi, [eax + 0x6a]
mov dword [ebp - 8], eax
lea eax, [esi + 0x6a]
lea edi, [eax + 0x6a]
push ebx
mov word [edi], bx
push 0x200
mov word [eax], bx
push dword [ebp - 0x60]
lea ecx, [edi + 0x6a]
push dword [ebp - 0x64]
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0xcc], edi
mov dword [ebp - 4], ecx
call fcn.004adb00
push edx
push eax
push dword [ebp - 8]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
call fcn.0049b796
add esp, 0xc
push ebx
push 0x200
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
call fcn.004adb00
push edx
push eax
push esi
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], edx
call fcn.0049b796
add esp, 0xc
mov word [edi], bx
cmp dword [ebp - 0x58], ebx
jl 0x49c314
jg 0x49c305
cmp dword [ebp - 0x5c], ebx
jbe 0x49c314
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push edi
call fcn.0049b796
add esp, 0xc
mov ecx, dword [ebp + 0x48]
xor eax, eax
cmp word [ebp - 0x7c], bx
setne al
lea eax, [ecx + eax*2]
mov dword [ebp + 0x38], eax
lea eax, [ebp + 0x38]
push eax
call fcn.0043e611
push 4
push dword [ebp + 0x38]
mov dword [ebp - 0x78], ebx
push str.__w:
call fcn.0043fac4
add esp, 0x10
test al, al
je 0x49c35b
add dword [ebp + 0x38], 8
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.00451cdf
pop ecx
pop ecx
push 0xffffffffffffffff
lea eax, [ebp + 0x38]
push eax
push 0x4cd95c
call fcn.00446de5
add esp, 0xc
cmp dword [0x4da84c], 1
jl 0x49c383
cmp dword [ebp + 0x24], ebx
jne 0x49c383
mov dword [ebp + 0x24], 0xfff00000
mov eax, dword [ebp + 0x38]
mov edi, 0x4c0a1c
mov byte [ebp + 0x66], bl
mov byte [ebp + 0x67], bl
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x80], edi
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x2c], ebx
jmp 0x49c40e
push 2
lea eax, [ebp + 0x4c]
push eax
push 0x4ca030
call fcn.00446de5
add esp, 0xc
test al, al
je 0x49c3bf
mov dword [ebp + 0x2c], 1
jmp 0x49c40b
cmp dword [ebp + 0x2c], ebx
je 0x49c3fe
push 2
lea eax, [ebp + 0x4c]
push eax
push 0x4cd958
call fcn.00446de5
add esp, 0xc
test al, al
je 0x49c3e1
mov byte [ebp + 0x66], 1
jmp 0x49c40b
push 3
lea eax, [ebp + 0x4c]
push eax
push 0x4cd954
call fcn.00446de5
add esp, 0xc
test al, al
je 0x49c3fe
mov byte [ebp + 0x67], 1
jmp 0x49c40b
lea eax, [ebp + 0x4c]
push eax
call fcn.00405b6e
pop ecx
mov dword [ebp + 0x2c], ebx
mov eax, dword [ebp + 0x4c]
cmp word [eax], bx
jne 0x49c39f
mov eax, dword [0x4da84c]
test al, 0x10
je 0x49c428
cmp byte [ebp + 0x67], bl
jne 0x49c428
mov dword [ebp - 0x10], str._o_par
mov dword [ebp + 0x4c], eax
and dword [ebp + 0x4c], 0x20
je 0x49c438
mov dword [ebp - 0x80], str._o_shared
cmp dword [ebp + 0x4c], ebx
je 0x49c440
mov byte [ebp + 0x5b], bl
mov ecx, dword [ebp - 0x48]
mov eax, ecx
and eax, 0x200
or eax, ebx
jne 0x49c46a
cmp dword [ebp + 0x4c], ebx
jne 0x49c46a
cmp byte [ebp + 0x6f], bl
je 0x49c46d
and ecx, 0x100
mov eax, ecx
or eax, ebx
je 0x49c46d
mov byte [ebp + 0x5b], 1
jmp 0x49c46d
mov byte [ebp + 0x5b], bl
cmp dword [0x4da84c], 8
jl 0x49c57e
cmp byte [ebp + 0x6f], bl
je 0x49c488
cmp byte [ebp + 0x5b], bl
jne 0x49c57e
cmp byte [ebp + 0x6f], bl
mov dword [ebp + 0x2c], edi
jne 0x49c49e
cmp byte [ebp + 0x66], bl
jne 0x49c4a7
mov dword [ebp + 0x2c], str._o_ro
jmp 0x49c4a7
cmp dword [ebp + 0x4c], ebx
jne 0x49c4a7
mov byte [ebp + 0x37], 1
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp + 0x48]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + edi + 0x800]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00444e77
push dword [ebp + 0x28]
push esi
push dword [ebp - 8]
push dword [ebp - 0x80]
push dword [ebp - 0x10]
push dword [ebp + 0x2c]
push str.imdisk__a___s__s__s___b__sb__s__sb__f__s
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp + 0x38]
add esp, 0x20
mov dword [ebp + 0x20], eax
cmp word [eax], bx
je 0x49c56a
push 2
lea eax, [ebp + 0x20]
push eax
push 0x4cd8c8
call fcn.0043fa1c
add esp, 0xc
test al, al
jne 0x49c530
push 2
lea eax, [ebp + 0x20]
push eax
push 0x4cd8c0
call fcn.0043fa1c
add esp, 0xc
test al, al
jne 0x49c530
lea eax, [ebp + 0x20]
push eax
call fcn.00405b6e
jmp 0x49c55e
mov ecx, dword [ebp + 0x20]
xor eax, eax
jmp 0x49c54d
call fcn.0040f8eb
test al, al
jne 0x49c555
mov word [ecx], 0x20
mov ecx, dword [ebp + 0x20]
inc ecx
inc ecx
mov dword [ebp + 0x20], ecx
mov ax, word [ecx]
cmp ax, bx
jne 0x49c537
lea eax, [ebp + 0x20]
push eax
call fcn.0043e611
mov eax, dword [ebp + 0x20]
cmp word [eax], bx
pop ecx
jne 0x49c4f7
mov eax, dword [ebp + 0x38]
push eax
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
mov eax, dword [ebp + 0x5c]
mov dword [ebp + 0x60], eax
jmp 0x49c916
cmp byte [ebp + 0x6f], bl
je 0x49c5b1
push ebx
push 0xa0000080
push 3
push ebx
push 7
push 0xc0000000
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x49d052
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp + 0x4c], edi
jmp 0x49c5b8
mov dword [ebp + 0x4c], 0x4cd8b8
cmp dword [ebp - 0x34], ebx
jl 0x49c5d6
jg 0x49c5c4
cmp dword [ebp - 0x38], ebx
jbe 0x49c5d6
push dword [ebp - 0x34]
lea eax, [esi + 0x6a]
push dword [ebp - 0x38]
push eax
call fcn.0049b796
add esp, 0xc
push 0x5c
push ebx
push dword [ebp + 0x28]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
jne 0x49c5ed
mov esi, dword [ebp + 0x28]
jmp 0x49c5ef
inc esi
inc esi
mov eax, dword [ebp + 0x3c]
cmp word [eax], bx
jne 0x49c626
push 0x800
lea ecx, [ebp + 0x3c]
call fcn.00444e77
mov edi, dword [ebp + 0x3c]
call fcn.00440d8b
push eax
push dword [ebp - 0xa0]
push dword [ebp - 8]
push esi
push str._s_s_s__u
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push dword [ebp + 0x3c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov eax, 0x400
cmp esi, eax
jle 0x49c646
mov esi, eax
mov eax, dword [ebp + 0x3c]
mov word [eax + 0x800], bx
push str.Global_
lea ecx, [ebp - 0x14]
call fcn.0044e731
push dword [ebp + 0x3c]
lea ecx, [ebp - 0x14]
call fcn.00444e9e
push str._devio_Ack
lea ecx, [ebp - 0x14]
call fcn.00444e9e
mov eax, dword [ebp - 4]
mov word [eax], bx
mov eax, dword [ebp - 0x48]
and eax, 0x30
or eax, ebx
mov word [ebp - 0x1d8], bx
jne 0x49c699
cmp byte [ebp + 0x6f], bl
je 0x49c751
mov eax, dword [ebp - 0x48]
and eax, 0x40
or eax, ebx
jne 0x49c751
mov edi, dword [ebp - 4]
push 0x10
push str.__kill:
push edi
call fcn.00414409
add esp, 0xc
push 0x104
add edi, 0x27e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 4]
push 0x104
add eax, 0xe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [ebp + 0x54]
cmp word [edi], 0x22
mov dword [ebp - 0x84], eax
mov dword [ebp + 0x2c], edi
jne 0x49c705
add dword [ebp + 0x54], 2
jmp 0x49c6fb
cmp ax, 0x22
je 0x49c712
inc edi
inc edi
mov ax, word [edi]
cmp ax, bx
jne 0x49c6f3
jmp 0x49c712
lea eax, [ebp + 0x2c]
push eax
call fcn.00405b4a
mov edi, dword [ebp + 0x2c]
pop ecx
mov ax, word [edi]
mov word [ebp + 0x2c], ax
mov word [edi], bx
mov eax, dword [ebp - 0x48]
and eax, 0x20
or eax, ebx
mov eax, str._LOAD_25_poweroff
jne 0x49c730
mov eax, str._RAMD_ImdiskV__D__m__s_
push dword [ebp + 0x54]
mov ecx, dword [ebp - 0x84]
push eax
mov eax, dword [ebp - 4]
lea eax, [eax + ecx*2]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ax, word [ebp + 0x2c]
add esp, 0xc
mov word [edi], ax
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x44]
mov cl, 1
call fcn.004addf0
and eax, 3
je 0x49c779
push eax
lea eax, [ebp - 0x1d8]
push str._nrc:_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push ebx
mov edi, 0x200
push edi
push dword [ebp - 0xac]
push dword [ebp - 0xb0]
call fcn.004adb00
push edx
push eax
push dword [ebp - 8]
call fcn.0049b796
add esp, 0xc
push ebx
push edi
push dword [ebp - 0xb4]
push dword [ebp - 0xb8]
call fcn.004adb00
mov edi, dword [ebp - 0xa0]
push edx
push eax
push edi
call fcn.0049b796
mov ecx, dword [ebp + 0x7c]
add esp, 0xc
push 0x4c4840
push str.__ImdMapPid
call fcn.0044451e
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp + 0x28]
mov dword [ebp - 0x84], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, dword [ebp - 0x84]
lea ecx, [ebp - 0x30]
lea eax, [eax + esi + 0x940]
push eax
call fcn.00444e50
push str.Global_
lea ecx, [ebp - 0x40]
call fcn.0044e66d
push dword [ebp + 0x3c]
lea ecx, [ebp - 0x40]
call fcn.00444e9e
push dword [ebp - 0x40]
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
cmp eax, ebx
jne 0x49d064
lea ecx, [ebp - 0x40]
call fcn.0043e679
push dword [ebp - 0xcc]
lea eax, [edi + 0x6a]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x1d8]
push edi
push dword [ebp + 0x28]
push dword [ebp + 0x3c]
push dword [ebp + 0x4c]
push eax
push dword [ebp - 0x28]
push dword [ebp - 4]
push dword [ebp + 0x44]
push str.EXEC___pid:__ImdMapPid____exe:_s10INDATA___nfb___MyName0____s__w:60000__s__s__s_shm:_s___s__s__s__s__s
push dword [ebp - 0x30]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x34
add esi, 0x800
push esi
lea ecx, [ebp + 0x5c]
call fcn.00444e77
mov eax, dword [ebp - 8]
mov word [eax], bx
mov word [edi], bx
push dword [ebp + 0x3c]
push dword [ebp - 0x80]
push dword [ebp - 0x10]
push 0x4c0a1c
push str.imdisk__a__t_proxy__s__s__s__o_shm__f__s
push dword [ebp + 0x5c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push dword [ebp + 0x38]
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
push dword [ebp - 0x14]
mov eax, dword [ebp + 0x5c]
push ebx
push ebx
push ebx
mov dword [ebp + 0x60], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp + 0x7c]
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
mov esi, eax
call fcn.00433f41
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
jne 0x49d08d
push 0x32
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
dec esi
jne 0x49c8f2
cmp dword [ebp - 0x78], ebx
jle 0x49c90e
mov ecx, dword [ebp + 0x7c]
push ebx
push ebx
push dword [ebp - 0x78]
call fcn.00415ff0
lea ecx, [ebp - 0x30]
call fcn.0043e679
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x48], eax
lea ecx, [ebp - 0x2c]
mov word [eax], bx
mov dword [ebp - 0xe0], 1
call fcn.0043e679
mov esi, 0x4dcd58
mov ax, word [ebp - 0x7c]
mov ecx, dword [ebp - 0xd8]
mov word [ecx], ax
jmp 0x49cdc3
push 4
lea eax, [ebp + 0x48]
push eax
push str._exe
call fcn.00446de5
add esp, 0xc
test al, al
je 0x49c966
mov dword [ebp + 0x24], 1
push 5
lea eax, [ebp + 0x48]
push eax
push str._nexe
call fcn.00446de5
add esp, 0xc
test al, al
je 0x49c984
mov dword [ebp + 0x24], 0xfff00000
push 6
lea eax, [ebp + 0x48]
push eax
push str._nexe1
call fcn.00446de5
add esp, 0xc
test al, al
je 0x49c9ac
mov dword [ebp + 0x24], 0xfff00000
mov dword [ebp - 0x8c], 1
push 0x2c
pop esi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00447c46
mov eax, dword [ebp - 0x1c]
mov word [eax], bx
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x49ca79
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x49ca79
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x49ca79
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x49ca79
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x49ca79
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00447c46
mov eax, dword [ebp + 0x60]
add esp, 0xc
cmp word [eax], bx
je 0x49ca79
add dword [ebp + 0x60], edi
push esi
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.00447e43
add esp, 0xc
push 6
lea ecx, [ebp + 0x50]
mov byte [ebp + 0x66], bl
call fcn.00444e77
mov eax, dword [ebp + 0x50]
mov word [eax + 2], 0x3a
mov eax, dword [ebp + 0x50]
mov word [eax + 4], bx
mov eax, dword [ebp + 0x50]
cmp word [eax], bx
je 0x49cb15
push eax
call fcn.004ad0f1
test eax, eax
pop ecx
je 0x49cb0d
mov eax, dword [ebp + 0x50]
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xfc], str.imdisk
mov dword [ebp - 0xf8], 0x4cd9ac
mov dword [ebp - 0xf4], 0x4cd68c
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], ebx
call fcn.00444e32
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xfc]
push eax
push 4
call fcn.004254f5
add esp, 0xc
neg eax
sbb al, al
inc al
lea ecx, [ebp - 0xa4]
mov byte [ebp + 0x66], al
call fcn.0043e679
mov eax, dword [ebp + 0x50]
cmp word [eax], bx
jne 0x49cb2e
push 0x4c5594
lea ecx, [ebp + 0x50]
call fcn.0044e6d5
mov eax, dword [ebp + 0x50]
cmp word [eax], bx
je 0x49d0ae
push 0x3c
lea ecx, [ebp]
call fcn.00444e50
mov eax, dword [ebp - 0x1c]
or esi, 0xffffffff
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp + 0x40], eax
cmp word [eax], bx
mov edi, esi
je 0x49d0a6
lea eax, [ebp + 0x40]
push eax
call fcn.0043e611
mov eax, dword [ebp + 0x40]
mov ax, word [eax]
or ax, 0x20
cmp ax, 0x70
pop ecx
jne 0x49cb92
lea eax, [ebp - 0x9c]
jmp 0x49cbac
cmp ax, 0x6c
jne 0x49cba0
lea eax, [ebp - 0x94]
jmp 0x49cbac
cmp ax, 0x68
jne 0x49cbc4
lea eax, [ebp - 0xc8]
add dword [ebp + 0x40], 2
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.00451c34
mov eax, dword [ebp + 0x40]
cmp word [eax], bx
pop ecx
pop ecx
jne 0x49cb70
cmp dword [ebp - 0x98], ebx
jl 0x49cc06
jg 0x49cbd6
cmp dword [ebp - 0x9c], ebx
jbe 0x49cc06
push 1
call fcn.00415219
pop ecx
push dword [ebp - 0x98]
push dword [ebp - 0x9c]
push edx
push eax
call fcn.004adbb0
push ebx
push 0x64
push edx
push eax
call fcn.004adb00
mov cl, 0x14
call fcn.004addf0
mov edi, eax
mov esi, edx
cmp esi, dword [ebp - 0x90]
jg 0x49cc24
jl 0x49cc18
cmp edi, dword [ebp - 0x94]
jae 0x49cc24
mov edi, dword [ebp - 0x94]
mov esi, dword [ebp - 0x90]
mov ecx, dword [ebp - 0xc4]
cmp ecx, ebx
jl 0x49cc56
mov eax, dword [ebp - 0xc8]
jg 0x49cc3a
cmp eax, ebx
jbe 0x49cc56
cmp esi, ecx
jl 0x49cc48
jg 0x49cc44
cmp edi, eax
jbe 0x49cc48
mov edi, eax
mov esi, ecx
cmp esi, ebx
jg 0x49cc68
jl 0x49cc52
cmp edi, ebx
ja 0x49cc56
mov edi, eax
mov esi, ecx
cmp esi, ebx
jl 0x49d0a6
jg 0x49cc68
cmp edi, ebx
jb 0x49d0a6
mov eax, dword [ebp + 0x50]
cmp word [eax], bx
je 0x49d0a6
cmp esi, ebx
jg 0x49cc83
jl 0x49cc7e
cmp edi, ebx
ja 0x49cc83
xor edi, edi
inc edi
xor esi, esi
push esi
push edi
push dword [ebp]
call fcn.0049b7b0
add esp, 0xc
push 0x4cd684
lea ecx, [ebp]
call fcn.00444e9e
cmp byte [ebp + 0x66], bl
mov eax, str.imdisk___e
jne 0x49ccac
mov eax, str.imdisk___a
push eax
lea ecx, [ebp + 0x5c]
call fcn.0044e6d5
mov eax, dword [ebp - 0xd4]
and eax, 1
xor ecx, ecx
or eax, ecx
je 0x49ccd1
push str.__o_awe
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
mov eax, dword [ebp]
cmp word [eax], bx
je 0x49ccf1
push str.___s
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
push dword [ebp]
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
mov eax, dword [ebp + 0x50]
cmp word [eax], bx
je 0x49cd11
push str.___m
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
push dword [ebp + 0x50]
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
mov eax, dword [ebp + 4]
cmp word [eax], bx
jne 0x49cd25
mov eax, dword [ebp - 0xc]
cmp word [eax], bx
je 0x49cdb0
push str.___p__
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
mov eax, dword [ebp + 4]
cmp word [eax], bx
je 0x49cd52
push str.__FS:
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
push dword [ebp + 4]
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
mov eax, dword [ebp - 0xc]
cmp word [eax], bx
je 0x49cd72
push str.__V:
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
push dword [ebp - 0xc]
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
push dword [ebp + 4]
push 0x4c9b0c
call fcn.0043fb03
test al, al
pop ecx
pop ecx
je 0x49cda3
mov eax, dword [ebp - 0x3c]
mov ax, word [eax]
cmp ax, bx
je 0x49cda3
cmp ax, 0x30
je 0x49cda3
push 0x4c9b04
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
push str.___Q__Y__X__
lea ecx, [ebp + 0x5c]
call fcn.00444e9e
mov eax, dword [ebp + 0x5c]
lea ecx, [ebp]
mov dword [ebp + 0x60], eax
call fcn.0043e679
mov esi, 0x4dcd58
lea eax, [ebp + 0x48]
push eax
call fcn.0043e611
push 4
push dword [ebp + 0x48]
push 0x4c5bd4
call fcn.0043fa6d
add esp, 0x10
test al, al
jne 0x49d0b5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x44], eax
lea eax, [ebp + 0x44]
push eax
sub edi, 0xc8
call fcn.00405b4a
pop ecx
push dword [ebp + 0x44]
lea ecx, [ebp - 0x54]
call fcn.0044e731
mov eax, dword [ebp - 0x54]
mov dword [ebp + 0x44], eax
mov dword [ebp + 0x54], eax
jmp 0x49ce6c
push 6
lea eax, [ebp + 0x54]
push eax
push str.__nbrd
call fcn.00446e5a
add esp, 0xc
test al, al
jne 0x49ce69
push 6
lea eax, [ebp + 0x54]
push eax
push 0x4c19a4
call fcn.00446e5a
add esp, 0xc
test al, al
jne 0x49ce69
push 2
lea eax, [ebp + 0x54]
push eax
push 0x4c5b74
call fcn.00446e5a
add esp, 0xc
test al, al
jne 0x49ce69
lea eax, [ebp + 0x54]
push eax
call fcn.00405b6e
pop ecx
mov eax, dword [ebp + 0x54]
cmp word [eax], bx
jne 0x49ce1a
cmp dword [ebp - 0x18], ebx
jne 0x49cf7e
cmp dword [ebp + 0x24], ebx
jg 0x49cf7e
push ebx
push dword [ebp + 0x60]
lea ecx, [ebp - 0x19c]
call fcn.00451459
cmp dword [ebp - 0x164], 1
jle 0x49d0cc
mov eax, dword [ebp - 0x160]
mov dword [eax], str.imdisk
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x160]
push dword [ebp - 0x164]
call fcn.004254f5
add esp, 0xc
cmp byte [ebp + 0x37], bl
mov dword [ebp + 0x1c], eax
mov dword [ebp - 0x88], ebx
jle 0x49cfd4
cmp eax, 3
jne 0x49cfd4
cmp dword [ebp - 0x8c], ebx
jne 0x49cfd4
lea ecx, [ebp - 0x14]
mov byte [ebp + 0x5b], 1
call fcn.0043e679
lea ecx, [ebp - 0x54]
call fcn.0043e679
lea ecx, [ebp + 0x28]
call fcn.0043e679
lea ecx, [ebp - 0x28]
call fcn.0043e679
lea ecx, [ebp + 0x3c]
call fcn.0043e679
lea ecx, [ebp - 0x3c]
call fcn.0043e679
lea ecx, [ebp - 0xc]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp - 0x1c]
call fcn.0043e679
lea ecx, [ebp + 0x14]
call fcn.0043e679
lea ecx, [ebp + 0x5c]
call fcn.0043e679
lea ecx, [ebp - 0xa8]
call fcn.0043e679
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp - 0x24]
call fcn.0043e679
lea ecx, [ebp + 0x78]
call fcn.00499db0
lea ecx, [ebp - 0x70]
call fcn.0043e679
jmp 0x49bad0
cmp dword [ebp - 0x8c], ebx
jne 0x49cfd4
push dword [ebp + 0x14]
lea ecx, [ebp - 0x50]
call fcn.0044e66d
push dword [ebp + 0x44]
lea ecx, [ebp - 0x50]
call fcn.00444e9e
mov eax, dword [ebp + 0x18]
cmp word [eax], bx
mov ecx, dword [ebp + 0x7c]
mov dword [ebp - 0x88], 1
je 0x49cfc1
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x50]
push ecx
push ebx
call fcn.0040a810
jmp 0x49cfc9
push dword [ebp - 0x50]
call fcn.00402eac
lea ecx, [ebp - 0x50]
mov dword [ebp + 0x1c], eax
call fcn.0043e679
mov ecx, dword [ebp - 0xe0]
xor eax, eax
or ecx, eax
je 0x49d0d3
cmp dword [ebp + 0x1c], 3
jne 0x49d0d3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1388
jae 0x49d0d3
mov ecx, dword [ebp + 0x7c]
push ebx
push ebx
push 0xc8
call fcn.00415ff0
mov esi, 0x4dcd58
jmp 0x49ce71
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4dcdb0], ebx
jle 0x49d040
push esi
call edi
mov ecx, dword [ebp + 0x7c]
push ebx
push ebx
push 1
call fcn.00415ff0
jmp 0x49d020
push 0xffffffffffffffff
lea ecx, [ebp + 0xf]
call fcn.004135e6
push esi
call edi
jmp 0x49d1a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x49d05f
xor eax, eax
inc eax
mov dword [ebp + 0x1c], eax
jmp 0x49d09c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x40]
call fcn.0043e679
lea ecx, [ebp - 0x30]
call fcn.0043e679
lea ecx, [ebp - 0x2c]
call fcn.0043e679
mov ebx, 0xb7
jmp 0x49d124
lea ecx, [ebp - 0x30]
mov dword [ebp + 0x1c], 1
call fcn.0043e679
lea ecx, [ebp - 0x2c]
call fcn.0043e679
jmp 0x49d0d3
lea ecx, [ebp]
call fcn.0043e679
mov ebx, 0x80070057
jmp 0x49d124
mov ecx, dword [ebp + 0x7c]
push 0xffffffffffffff9c
push 0x4c0a1c
push ebx
push str.imdisk.cpl_
call fcn.0045a3b3
jmp 0x49d124
mov dword [ebp + 0x1c], 0x80070057
mov eax, dword [ebp - 0x15c]
cmp eax, ebx
je 0x49d0ee
lea ecx, [ebp + 0x78]
mov dword [ebp + 0x78], eax
mov dword [ebp - 0x15c], ebx
call fcn.0043e679
mov edx, dword [ebp + 0x18]
cmp word [edx], bx
je 0x49d121
cmp dword [ebp - 0x88], ebx
jne 0x49d121
mov ecx, dword [ebp - 0x24]
mov word [ebp - 0x218], bx
cmp word [ecx], 0x2a
lea eax, [ebp - 0x218]
jne 0x49d117
lea eax, [ecx + 2]
mov ecx, dword [ebp + 0x7c]
push eax
push edx
call fcn.0044451e
mov ebx, dword [ebp + 0x1c]
lea ecx, [ebp - 0x14]
call fcn.0043e679
lea ecx, [ebp - 0x54]
call fcn.0043e679
lea ecx, [ebp + 0x28]
call fcn.0043e679
lea ecx, [ebp - 0x28]
call fcn.0043e679
lea ecx, [ebp + 0x3c]
call fcn.0043e679
lea ecx, [ebp - 0x3c]
call fcn.0043e679
lea ecx, [ebp - 0xc]
call fcn.0043e679
lea ecx, [ebp + 0x50]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp - 0x1c]
call fcn.0043e679
lea ecx, [ebp + 0x14]
call fcn.0043e679
lea ecx, [ebp + 0x5c]
call fcn.0043e679
lea ecx, [ebp - 0xa8]
call fcn.0043e679
lea ecx, [ebp + 0x18]
call fcn.0043e679
lea ecx, [ebp - 0x24]
call fcn.0043e679
lea ecx, [ebp + 0x78]
call fcn.00499db0
lea ecx, [ebp - 0x70]
call fcn.0043e679
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x70
leave
ret