Function at 0x49ce80
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x128
mov word [0x4a494a], 0x40
mov dword [esp + 0x14], 0x18
lea eax, [esp + 0x24]
push ebx
mov dword [esp + 0x14], 0
push esi
push edi
push ebp
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x49cec7
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x128
ret
mov edi, 0x4a12ec
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x34]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x3e80
and ecx, 3
push 0x42
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc_1]
call esi
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock_1]
call edi
mov dword [esp + 0x10], eax
test eax, eax
jne 0x49cf29
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x128
ret
push 0x3e80
push 0x42
call esi
push eax
call edi
mov ebx, eax
test ebx, ebx
jne 0x49cf6f
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x128
ret
lea eax, [esp + 0x34]
push 0
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
mov ebp, eax
jne 0x49d25e
mov dword [esp + 0x14], 0x3e80
lea eax, [esp + 0x14]
push eax
push ebx
push 0x4a1188
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x49d1ad
mov eax, dword [esp + 0x10]
push 0x104
push eax
mov edi, 0x4a12e4
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x34]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
mov esi, eax
je 0x49d063
lea eax, [esp + 0x20]
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 4
jne 0x49d04e
cmp dword [esp + 0x20], 0
jne 0x49d04e
lea eax, [esp + 0x20]
push 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [esp + 0x20], 0x14
jne 0x49d042
push 4
push 0x4a4c28
push esi
call dword [sym.imp.KERNEL32.dll__lread]
jmp 0x49d057
mov dword [0x4a4c28], 0
jmp 0x49d057
mov eax, dword [esp + 0x20]
mov dword [0x4a4c28], eax
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
jmp 0x49d1be
xor eax, eax
mov ax, word [0x4a4b8c]
push eax
call fcn.004a0e60
add esp, 4
call fcn.004a0e70
mov dword [esp + 0x14], eax
xor eax, eax
mov ax, word [0x4a4b8a]
push eax
call fcn.004a0e60
add esp, 4
call fcn.004a0e70
mov dword [esp + 0x18], eax
shl eax, 0x10
or eax, dword [esp + 0x14]
cdq
xor eax, edx
sub eax, edx
mov dword [0x4a4c28], eax
xor eax, eax
mov ax, word [0x4a4b86]
push eax
call fcn.004a0e60
add esp, 4
call fcn.004a0e70
mov dword [esp + 0x14], eax
xor eax, eax
mov ax, word [0x4a4b88]
push eax
call fcn.004a0e60
add esp, 4
call fcn.004a0e70
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x30]
shl eax, 0x10
push ecx
or eax, dword [esp + 0x18]
push 0x4a1188
push SysReAllocString
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cdq
xor eax, edx
sub eax, edx
add dword [0x4a4c28], eax
call ebp
test eax, eax
je 0x49d19e
lea eax, [esp + 0x30]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push eax
push 0x4a1188
push SysReAllocString
call ebp
test eax, eax
je 0x49d178
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x128
ret
push 0xa
mov eax, dword [0x4a4c28]
push ebx
push eax
call fcn.004a0c80
add esp, 0xc
push 0x14
push ebx
push 1
push 0x4a1188
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov eax, dword [esp + 0x30]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebp
jmp 0x49d1be
mov edx, 0x4a12dc
mov ecx, ebx
call fcn.0049fa60
mov dword [0x4a4c28], eax
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
mov edx, dword [0x4a4b78]
mov dword [esp + 0x18], 0x3e80
push ecx
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x49d23d
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
mov eax, 1
pop ebp
or byte [0x4a494a], 8
pop edi
pop esi
pop ebx
add esp, 0x128
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
jmp 0x49d6ec
lea eax, [esp + 0x20]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, 4
mov esi, eax
jne 0x49d338
cmp dword [esp + 0x20], 0
jne 0x49d338
lea eax, [esp + 0x20]
push 4
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [esp + 0x20], 0x14
mov esi, eax
jne 0x49d330
push 4
push 0x4a4c28
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
mov esi, eax
push 4
lea eax, [esp + 0x28]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
add esi, eax
push 8
mov eax, dword [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
add eax, esi
cmp eax, 0x10
je 0x49d329
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x128
ret
mov esi, 4
jmp 0x49d368
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x20]
push 2
push 0
mov dword [0x4a4c28], eax
mov dword [esp + 0x28], 0xa
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
mov dword [esp + 0x24], eax
cmp eax, 4
jb 0x49d368
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
cmp esi, 4
je 0x49d3fb
mov dword [esp + 0x14], 0x3e80
lea eax, [esp + 0x14]
push eax
push ebx
push 0x4a1188
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x49d3ea
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x128
ret
mov edx, 0x4a12d4
mov ecx, ebx
call fcn.0049fa60
mov dword [0x4a4c28], eax
lea eax, [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
mov edx, dword [0x4a4b78]
mov dword [esp + 0x18], 0x3e80
push ecx
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push 0x10
test eax, eax
push ebx
push ebp
je 0x49d53a
call dword [sym.imp.KERNEL32.dll__lread]
mov ecx, dword [esp + 0x20]
sub ecx, 0x14
cmp ecx, 1
sbb ecx, ecx
and ecx, 0x14
add ecx, 0x14
cmp eax, 0x10
mov dword [esp + 0x28], ecx
jne 0x49d495
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x24]
jg 0x49d495
mov eax, dword [ebx + 0xc]
mov ecx, 0xc
mov esi, dword [0x4a4b78]
mov edi, ebx
mov dword [esp + 0x18], eax
repe cmpsb byte [esi], byte es:[edi]
je 0x49d4f3
push 1
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
push 0x10
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
mov ecx, dword [esp + 0x18]
add ecx, eax
add dword [esp + 0x28], ecx
cmp eax, 0x10
je 0x49d44c
or byte [0x4a494a], 8
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x128
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
inc eax
push ebx
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll__lclose]
call ebp
or byte [0x4a494a], 2
jmp 0x49d6f3
call dword [sym.imp.KERNEL32.dll__lread]
mov ecx, dword [esp + 0x20]
sub ecx, 0x14
cmp ecx, 1
sbb ecx, ecx
and ecx, 0x14
add ecx, 0x14
cmp eax, 0x10
mov dword [esp + 0x28], ecx
jne 0x49d6ba
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x24]
jg 0x49d6ba
mov eax, dword [ebx + 0xc]
mov ecx, 0xc
mov esi, dword [0x4a4b78]
mov edi, ebx
mov dword [esp + 0x18], eax
repe cmpsb byte [esi], byte es:[edi]
je 0x49d5ad
push 1
push eax
push ebp
call dword [sym.imp.KERNEL32.dll__llseek]
push 0x10
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
mov ecx, dword [esp + 0x18]
add ecx, eax
add dword [esp + 0x28], ecx
cmp eax, 0x10
je 0x49d55f
jmp 0x49d6ba
or byte [0x4a494a], 1
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x49d618
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x128
ret
mov esi, dword [esp + 0x18]
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
cmp eax, esi
jae 0x49d680
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x128
ret
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov ecx, eax
mov edi, ebx
shr ecx, 2
repe cmpsd dword [esi], dword es:[edi]
jne 0x49d6ba
mov ecx, eax
and ecx, 3
repe cmpsb byte [esi], byte es:[edi]
jne 0x49d6ba
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
push ebp
call dword [sym.imp.KERNEL32.dll__lclose]
test ebx, ebx
je 0x49d6f3
test byte [0x4a494a], 1
jne 0x49d6f3
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
or byte [0x4a494a], 4
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
dec dword [esp + 0x14]
push ecx
mov eax, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], eax
call fcn.0049f770
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
mov ecx, dword [esp + 0x10]
mov edi, 0x4a4950
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
mov esi, dword [esp + 0x1c]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
mov esi, 0x4a49e0
add eax, 0x80
mov dword [esp + 0x2c], eax
mov eax, dword [esi]
test eax, eax
je 0x49d780
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
mov eax, dword [esp + 0x2c]
cmp byte [eax], 0
je 0x49d79d
mov ecx, eax
call fcn.0049fad0
lea ecx, [esp + 0x2c]
mov dword [esi], eax
call fcn.0049f440
jmp 0x49d7a7
mov dword [esi], 0
inc dword [esp + 0x2c]
add esi, 4
cmp esi, 0x4a4a30
jb 0x49d75c
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
test byte [0x4a494a], 1
je 0x49d96a
test ebx, ebx
je 0x49d96a
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
push ecx
mov ecx, ebx
call fcn.0049f770
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
mov ecx, dword [esp + 0x1c]
mov ax, word [ecx + 0x5d]
mov cx, word [0x4a49ad]
cmp ax, cx
jb 0x49d833
mov ax, cx
mov cx, word [0x4a49af]
mov word [0x4a49ad], ax
mov eax, dword [esp + 0x1c]
mov ax, word [eax + 0x5f]
cmp ax, cx
jb 0x49d850
mov ax, cx
mov word [0x4a49af], ax
xor edx, edx
mov dx, word [0x4a49b3]
lea eax, [edx*2 - 0xbc34]
lea ecx, [eax + eax*2]
lea edx, [ecx + ecx*4]
xor ecx, ecx
mov cx, word [0x4a49b1]
lea ebx, [ecx + ecx*8]
lea ecx, [ecx + ebx*8]
lea eax, [ecx + ecx*4]
mov ecx, dword [esp + 0x1c]
add edx, eax
add ecx, 0x61
xor eax, eax
xor esi, esi
mov ax, word [0x4a49b7]
add edx, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], edx
xor edx, edx
mov si, word [eax + 0x63]
mov dx, word [ecx]
add esi, esi
sub edx, 0x7bc
lea eax, [esi + esi*2]
lea esi, [eax + eax*4]
lea ebx, [edx + edx*8]
lea edx, [edx + ebx*8]
mov ebx, dword [esp + 0x1c]
lea eax, [edx + edx*4]
xor edx, edx
mov dx, word [ebx + 0x67]
add esi, eax
add esi, edx
mov dword [esp + 0x18], esi
cmp esi, dword [esp + 0x14]
jge 0x49d8ee
mov edx, 0x4a49b1
mov eax, dword [ecx]
mov dword [edx], eax
mov ebx, dword [ecx + 4]
mov dword [edx + 4], ebx
mov ebp, dword [ecx + 8]
mov dword [edx + 8], ebp
mov eax, dword [ecx + 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x4a49c4]
mov eax, dword [eax + 0x74]
cmp eax, ecx
jb 0x49d901
mov eax, ecx
mov ecx, dword [0x4a49c8]
mov dword [0x4a49c4], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x78]
cmp eax, ecx
jb 0x49d919
mov eax, ecx
mov dword [0x4a49c8], eax
mov eax, dword [esp + 0x1c]
mov ax, word [eax + 0x71]
movsx ecx, ax
shl ecx, 2
lea edx, [ecx + ecx*2]
mov ecx, dword [0x4a4c4c]
lea ebx, [edx + edx*4]
cmp word [ebx + ecx + 0x28], 0
jne 0x49d946
mov word [0x4a49c1], ax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock_1]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle_1]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree_1]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x128
ret