Function at 0x49e4f0
Capabilities:
Accept command line arguments
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb3
push 0
push 0
dec ecx
jne 0x49e4f8
push ecx
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x49f7dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x3a0], 0
jne 0x49e54c
mov dl, 1
mov eax, dword [0x475fac]
call fcn.004800c8
mov ebx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x3a0
mov edx, ebx
test edx, edx
je 0x49e547
sub edx, 0xffffffc0
call fcn.0040d728
mov eax, esi
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x3a0]
call fcn.0040d728
mov eax, dword [ebp - 0x1c]
cmp byte [eax + 0x3c4], 0
je 0x49f6ac
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3a0]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jne 0x49f6ac
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x3a0]
call fcn.0040d728
lea eax, [ebp - 0x49c]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x3a0]
mov ecx, 0x49f7f0
call fcn.0040d754
mov eax, dword [ebp - 0x49c]
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x49e71c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4a4]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x424]
mov cx, 0x30
mov edx, 4
call fcn.00416c88
push dword [ebp - 0x4a4]
push 0x49f80c
lea eax, [ebp - 0x4a8]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x426]
mov cx, 0x30
mov edx, 2
call fcn.00416c88
push dword [ebp - 0x4a8]
push 0x49f80c
lea eax, [ebp - 0x4ac]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x42a]
mov cx, 0x30
mov edx, 2
call fcn.00416c88
push dword [ebp - 0x4ac]
push 0x49f81c
lea eax, [ebp - 0x4b0]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x42c]
mov cx, 0x30
mov edx, 2
call fcn.00416c88
push dword [ebp - 0x4b0]
push 0x49f830
lea eax, [ebp - 0x4b4]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x42e]
mov cx, 0x30
mov edx, 2
call fcn.00416c88
push dword [ebp - 0x4b4]
push 0x49f830
lea eax, [ebp - 0x4b8]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x430]
mov cx, 0x30
mov edx, 2
call fcn.00416c88
push dword [ebp - 0x4b8]
push 0x49f81c
lea eax, [ebp - 0x4bc]
push eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0x432]
mov cx, 0x30
mov edx, 1
call fcn.00416c88
push dword [ebp - 0x4bc]
push 0x49f840
lea eax, [ebp - 0x4a0]
mov edx, 0xe
call fcn.0040aeb0
mov edx, dword [ebp - 0x4a0]
mov eax, 0x49f854
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e726
xor eax, eax
push ebp
push 0x49e75b
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4c0]
call fcn.0046a830
mov edx, dword [ebp - 0x4c0]
mov eax, 0x49f874
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e765
xor eax, eax
push ebp
push 0x49e79a
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4c4]
call fcn.0049cd3c
mov edx, dword [ebp - 0x4c4]
mov eax, 0x49f89c
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e7a4
xor eax, eax
push ebp
push 0x49e843
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x20], 0x104
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x49e7ea
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x236]
push eax
call sub.advapi32.dll_GetUserNameW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x236]
mov ecx, 0x105
call fcn.0040ac78
jmp 0x49e814
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x236]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x236]
mov dword [ebp - 0x4c8], edx
mov edx, dword [ebp - 0x4c8]
call fcn.0040ac94
call fcn.0049cc78
test al, al
je 0x49e82a
lea eax, [ebp - 0x10]
mov edx, 0x49f8c8
call fcn.0040add0
push ebp
mov edx, dword [ebp - 0x10]
mov eax, 0x49f8e8
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e84d
xor eax, eax
push ebp
push 0x49e932
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x49e876
lea eax, [ebp - 0x10]
mov edx, 0x49f908
call fcn.0040a088
jmp 0x49e87e
lea eax, [ebp - 0x10]
call fcn.00409c60
lea eax, [ebp - 0x14]
push eax
push 0x49f91c
push dword [ebp - 0x10]
push 0x49f960
lea eax, [ebp - 0x4cc]
mov edx, 3
call fcn.0040aeb0
mov edx, dword [ebp - 0x4cc]
mov ecx, 0x49f98c
mov eax, 0x80000002
call fcn.0046a8e4
lea eax, [ebp - 0x4d0]
push eax
push 0x49f91c
push dword [ebp - 0x10]
push 0x49f960
lea eax, [ebp - 0x4d4]
mov edx, 3
call fcn.0040aeb0
mov edx, dword [ebp - 0x4d4]
mov ecx, 0x49f9c8
mov eax, 0x80000002
call fcn.0046a8e4
mov edx, dword [ebp - 0x4d0]
lea eax, [ebp - 0x10]
call fcn.0040a088
cmp dword [ebp - 0x14], 0
je 0x49e919
push dword [ebp - 0x10]
push 0x49f9f4
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040aeb0
push ebp
mov edx, dword [ebp - 0x10]
mov eax, 0x49fa08
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e93c
xor eax, eax
push ebp
push 0x49e971
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4d8]
call fcn.0049d0f0
mov edx, dword [ebp - 0x4d8]
mov eax, 0x49fa38
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e97b
xor eax, eax
push ebp
push 0x49e9b0
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4dc]
call fcn.0049d1a8
mov edx, dword [ebp - 0x4dc]
mov eax, 0x49fa68
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e9ba
xor eax, eax
push ebp
push 0x49e9ef
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4e0]
call fcn.0049d278
mov edx, dword [ebp - 0x4e0]
mov eax, 0x49fa94
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49e9f9
xor eax, eax
push ebp
push 0x49ea2e
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4e4]
call fcn.0049d2d0
mov edx, dword [ebp - 0x4e4]
mov eax, 0x49fac0
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49ea38
xor eax, eax
push ebp
push 0x49eac5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0049d3e4
cmp dword [ebp - 0x10], 0
je 0x49eabb
call fcn.0049d4e8
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jne 0x49ea73
push ebp
mov edx, dword [ebp - 0x10]
mov eax, 0x49faec
call fcn.0049e44c
pop ecx
jmp 0x49eabb
push ebp
lea eax, [ebp - 0x4ec]
push eax
mov cx, 0x30
mov edx, 1
mov eax, dword [ebp - 0x24]
call fcn.00416b8c
push dword [ebp - 0x4ec]
push 0x49fb0c
push dword [ebp - 0x10]
lea eax, [ebp - 0x4e8]
mov edx, 3
call fcn.0040aeb0
mov edx, dword [ebp - 0x4e8]
mov eax, 0x49fb20
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49eacf
xor eax, eax
push ebp
push 0x49eb04
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4f0]
call fcn.0049d61c
mov edx, dword [ebp - 0x4f0]
mov eax, 0x49fb44
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49eb0e
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
je 0x49eb59
xor eax, eax
push ebp
push 0x49eb4f
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x4f4]
call fcn.0049d7b0
mov edx, dword [ebp - 0x4f4]
mov eax, 0x49fb70
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49eb59
xor eax, eax
push ebp
push 0x49ec99
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x49fb94
push 0x49fbbc
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00412e30
mov dword [ebp - 8], eax
push 0x104
lea eax, [ebp - 0x236]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0046a048
mov ebx, dword [0x718580]
mov ebx, dword [ebx]
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
call ebx
mov ebx, eax
mov esi, dword [0x718580]
mov esi, dword [esi]
lea eax, [ebp - 0x236]
movzx eax, byte [eax]
call esi
cmp bl, al
je 0x49ec51
push ebp
push ebp
lea eax, [ebp - 0x500]
lea edx, [ebp - 0x236]
movzx edx, byte [edx]
mov ecx, 0
call fcn.0040a398
mov eax, dword [ebp - 0x500]
lea edx, [ebp - 0x4fc]
call fcn.0049e2b8
pop ecx
push dword [ebp - 0x4fc]
push 0x49fbe4
push ebp
lea eax, [ebp - 0x508]
mov edx, dword [ebp - 0x10]
movzx edx, byte [edx]
mov ecx, 0
call fcn.0040a398
mov eax, dword [ebp - 0x508]
lea edx, [ebp - 0x504]
call fcn.0049e2b8
pop ecx
push dword [ebp - 0x504]
lea eax, [ebp - 0x4f8]
mov edx, 3
call fcn.0040aeb0
mov edx, dword [ebp - 0x4f8]
mov eax, 0x49fbf4
call fcn.0049e44c
pop ecx
jmp 0x49ec8f
push ebp
push ebp
lea eax, [ebp - 0x510]
lea edx, [ebp - 0x236]
movzx edx, byte [edx]
mov ecx, 0
call fcn.0040a398
mov eax, dword [ebp - 0x510]
lea edx, [ebp - 0x50c]
call fcn.0049e2b8
pop ecx
mov edx, dword [ebp - 0x50c]
mov eax, 0x49fbf4
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49eca3
xor eax, eax
push ebp
push 0x49ecd8
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x514]
call fcn.0049d87c
mov edx, dword [ebp - 0x514]
mov eax, 0x49fc20
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49ece2
xor eax, eax
push ebp
push 0x49ed26
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x518]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cx, 0x30
mov edx, 1
call fcn.00416d18
mov edx, dword [ebp - 0x518]
mov eax, 0x49fc48
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49ed30
xor eax, eax
push ebp
push 0x49ed65
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x51c]
call fcn.0049da64
mov edx, dword [ebp - 0x51c]
mov eax, 0x49fc6c
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49ed6f
xor eax, eax
push ebp
push 0x49eda4
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x520]
call fcn.0049da88
mov edx, dword [ebp - 0x520]
mov eax, 0x49fc9c
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49edae
xor eax, eax
push ebp
push 0x49ee44
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x70f694], 0
je 0x49ee3a
call fcn.004068a8
test eax, eax
jle 0x49ee3a
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x49ee00
push ebp
call sub.kernel32.dll_GetCommandLineW
mov edx, eax
lea eax, [ebp - 0x524]
call fcn.0040ac24
mov edx, dword [ebp - 0x524]
mov eax, 0x49fcd0
call fcn.0049e44c
pop ecx
jmp 0x49ee3a
push ebp
call sub.kernel32.dll_GetCommandLineA
mov edx, eax
lea eax, [ebp - 0x52c]
mov ecx, 0
call fcn.0040a3a8
mov edx, dword [ebp - 0x52c]
lea eax, [ebp - 0x528]
call fcn.0040ac94
mov edx, dword [ebp - 0x528]
mov eax, 0x49fcd0
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49ee4e
xor eax, eax
push ebp
push 0x49ee96
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea edx, [ebp - 0x534]
xor eax, eax
call fcn.0046a048
mov eax, dword [ebp - 0x534]
lea edx, [ebp - 0x530]
call fcn.00418168
mov edx, dword [ebp - 0x530]
mov eax, 0x49fcf8
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49eea0
xor eax, eax
push ebp
push 0x49eefa
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_GetModuleHandleW
cmp eax, dword [0x70f788]
je 0x49eef0
push ebp
lea edx, [ebp - 0x53c]
mov eax, dword [0x70f788]
call fcn.0046a048
mov eax, dword [ebp - 0x53c]
lea edx, [ebp - 0x538]
call fcn.00418168
mov edx, dword [ebp - 0x538]
mov eax, 0x49fd1c
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49ef04
xor edx, edx
push ebp
push 0x49f178
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x70f798], 0
je 0x49ef27
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0046a048
jmp 0x49ef34
lea edx, [ebp - 0x10]
mov eax, dword [0x70f788]
call fcn.0046a048
call sub.kernel32.dll_GetVersion
test eax, 0x80000000
jne 0x49ef57
lea eax, [ebp - 0x488]
push eax
mov eax, dword [ebp - 0x10]
call fcn.0040abbc
push eax
call sub.kernel32.dll_FindFirstFileW
jmp 0x49ef82
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x540]
mov edx, dword [ebp - 0x10]
mov ecx, 0
call fcn.0040a85c
mov eax, dword [ebp - 0x540]
call fcn.0040a6b0
push eax
call sub.kernel32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x49f16e
push eax
call sub.kernel32.dll_FindClose
xor eax, eax
push ebp
push 0x49f0fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x474]
lea eax, [ebp - 0x474]
call fcn.00412c28
lea edx, [ebp - 0x498]
lea eax, [ebp - 0x474]
call fcn.00412c38
cmp byte [0x70f798], 0
jne 0x49efd9
push 0
call sub.kernel32.dll_GetModuleHandleW
cmp eax, dword [0x70f788]
jne 0x49efe8
lea eax, [ebp - 0x14]
mov edx, 0x49fd48
call fcn.0040a088
jmp 0x49eff5
lea eax, [ebp - 0x14]
mov edx, 0x49fd60
call fcn.0040a088
push ebp
lea eax, [ebp - 0x548]
push eax
movzx eax, word [ebp - 0x498]
mov cx, 0x30
mov edx, 4
call fcn.00416c88
push dword [ebp - 0x548]
push 0x49f80c
lea eax, [ebp - 0x54c]
push eax
movzx eax, word [ebp - 0x496]
mov cx, 0x30
mov edx, 2
call fcn.00416c88
push dword [ebp - 0x54c]
push 0x49f80c
lea eax, [ebp - 0x550]
push eax
movzx eax, word [ebp - 0x492]
mov cx, 0x30
mov edx, 2
call fcn.00416c88
push dword [ebp - 0x550]
push 0x49fbe4
lea eax, [ebp - 0x554]
push eax
movzx eax, word [ebp - 0x490]
mov cx, 0x30
mov edx, 2
call fcn.00416c88
push dword [ebp - 0x554]
push 0x49f830
lea eax, [ebp - 0x558]
push eax
movzx eax, word [ebp - 0x48e]
mov cx, 0x30
mov edx, 2
call fcn.00416c88
push dword [ebp - 0x558]
push 0x49fd7c
lea eax, [ebp - 0x544]
mov edx, 0xa
call fcn.0040aeb0
mov eax, dword [ebp - 0x544]
push eax
lea eax, [ebp - 0x55c]
mov ecx, 0x49fd90
mov edx, dword [ebp - 0x14]
call fcn.0040ae28
mov eax, dword [ebp - 0x55c]
pop edx
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f104
lea edx, [ebp - 0x560]
mov eax, dword [ebp - 0x1c]
call fcn.0047c6f4
cmp dword [ebp - 0x560], 0
jne 0x49f14e
lea edx, [ebp - 0x564]
mov eax, dword [ebp - 0x10]
call fcn.0041bad0
mov edx, dword [ebp - 0x564]
lea eax, [ebp - 0x10]
call fcn.0040a088
cmp dword [ebp - 0x10], 0
je 0x49f16e
push ebp
mov edx, dword [ebp - 0x10]
mov eax, 0x49fdb4
call fcn.0049e44c
pop ecx
jmp 0x49f16e
push ebp
lea edx, [ebp - 0x568]
mov eax, dword [ebp - 0x1c]
call fcn.0047c6f4
mov edx, dword [ebp - 0x568]
mov eax, 0x49fdb4
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f182
xor eax, eax
push ebp
push 0x49f1df
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x49fdc4
call sub.kernel32.dll_GetModuleHandleW
mov ebx, eax
test ebx, ebx
je 0x49f1d5
lea edx, [ebp - 0x56c]
mov eax, ebx
call fcn.0046a048
mov eax, dword [ebp - 0x56c]
mov ebx, dword [0x7181b8]
mov ebx, dword [ebx]
lea edx, [ebp - 0x10]
call ebx
cmp dword [ebp - 0x10], 0
je 0x49f1d5
push ebp
mov edx, dword [ebp - 0x10]
mov eax, 0x49fde8
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f1e9
xor eax, eax
push ebp
push 0x49f2a1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x49f243
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x70f788]
call fcn.0041c914
cmp byte [eax + 0x1a], 2
je 0x49f228
push ebp
mov edx, 0x49fe0c
mov eax, 0x49fe28
call fcn.0049e44c
pop ecx
jmp 0x49f239
push ebp
mov edx, 0x49fe50
mov eax, 0x49fe28
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f25e
push ebp
lea eax, [ebp - 0x574]
mov edx, dword [0x70f684]
mov ecx, 0
call fcn.0040a3a8
mov edx, dword [ebp - 0x574]
lea eax, [ebp - 0x570]
call fcn.0040ac94
mov edx, dword [ebp - 0x570]
mov eax, 0x49fe74
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f2ab
lea ecx, [ebp - 0x14]
mov edx, 0x49fea4
mov eax, dword [ebp - 0x1c]
call fcn.0047eac8
mov ebx, dword [0x7184f0]
mov ebx, dword [ebx]
mov dl, 0x7c
mov eax, dword [ebp - 0x14]
call ebx
test eax, eax
jle 0x49f484
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 1
xor eax, eax
push ebp
push 0x49f46e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov ebx, dword [0x7185c8]
mov ebx, dword [ebx]
mov cl, 0x7c
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
call ebx
mov eax, dword [0x71f170]
call fcn.0040be60
mov ebx, eax
test ebx, ebx
jl 0x49f464
inc ebx
mov dword [ebp - 0x28], 0
mov esi, dword [ebp - 0x28]
mov eax, esi
add esi, esi
add esi, esi
add esi, esi
sub esi, eax
mov eax, dword [0x71f170]
mov eax, dword [eax + esi*4]
mov edi, dword [0x717f94]
mov edi, dword [edi]
mov edx, dword [ebp - 0x10]
call edi
test al, al
je 0x49f45a
mov eax, dword [0x71f170]
cmp byte [eax + esi*4 + 0x18], 0
jne 0x49f464
mov eax, dword [0x71f170]
cmp dword [eax + esi*4 + 8], 0
je 0x49f39e
push ebp
mov eax, dword [0x71f170]
mov ebx, dword [eax + esi*4 + 8]
lea eax, [ebp - 0x57c]
call ebx
mov edx, dword [ebp - 0x57c]
lea eax, [ebp - 0x578]
call fcn.0040ac94
mov edx, dword [ebp - 0x578]
mov eax, dword [0x71f170]
mov eax, dword [eax + esi*4]
call fcn.0049e44c
pop ecx
jmp 0x49f464
mov eax, dword [0x71f170]
cmp dword [eax + esi*4 + 0xc], 0
je 0x49f3d5
push ebp
mov eax, dword [0x71f170]
mov ebx, dword [eax + esi*4 + 0xc]
lea eax, [ebp - 0x580]
call ebx
mov edx, dword [ebp - 0x580]
mov eax, dword [0x71f170]
mov eax, dword [eax + esi*4]
call fcn.0049e44c
pop ecx
jmp 0x49f464
mov eax, dword [0x71f170]
cmp dword [eax + esi*4 + 0x10], 0
je 0x49f426
push ebp
mov eax, dword [0x71f170]
mov ebx, dword [eax + esi*4 + 0x10]
lea edx, [ebp - 0x588]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x49f3fd
sub eax, 0xfffffbc0
call ebx
mov edx, dword [ebp - 0x588]
lea eax, [ebp - 0x584]
call fcn.0040ac94
mov edx, dword [ebp - 0x584]
mov eax, dword [0x71f170]
mov eax, dword [eax + esi*4]
call fcn.0049e44c
pop ecx
jmp 0x49f464
push ebp
mov eax, dword [0x71f170]
mov ebx, dword [eax + esi*4 + 0x14]
lea edx, [ebp - 0x58c]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x49f442
sub eax, 0xfffffbc0
call ebx
mov edx, dword [ebp - 0x58c]
mov eax, dword [0x71f170]
mov eax, dword [eax + esi*4]
call fcn.0049e44c
pop ecx
jmp 0x49f464
inc dword [ebp - 0x28]
dec ebx
jne 0x49f31c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f478
inc dword [ebp - 0x24]
dec dword [ebp - 0x2c]
jne 0x49f2dc
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0x28], eax
xor eax, eax
push ebp
push 0x49f4b4
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov edx, 0x49feb8
mov eax, 0x49fef4
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f4be
xor eax, eax
push ebp
push 0x49f516
push dword fs:[eax]
mov dword fs:[eax], esp
add dword [0x7100f0], 1
adc dword [0x7100f4], 0
push ebp
push dword [0x7100f4]
push dword [0x7100f0]
lea ecx, [ebp - 0x590]
mov dx, 0x30
mov eax, 1
call fcn.00416cd4
mov edx, dword [ebp - 0x590]
mov eax, 0x49ff1c
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f520
xor eax, eax
push ebp
push 0x49f613
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
cmp byte [eax + 0x4f], 1
je 0x49f5e9
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call fcn.0049e08c
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
call fcn.0049dfec
push ebp
mov edx, dword [ebp - 0x14]
mov eax, 0x49ff4c
call fcn.0049e44c
pop ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
call fcn.0040af60
je 0x49f609
lea edx, [ebp - 0x594]
mov eax, dword [ebp - 0x10]
call fcn.0046d1c0
mov edx, dword [ebp - 0x594]
lea eax, [ebp - 0x10]
call fcn.0040a088
push 0
mov ebx, dword [0x71829c]
mov ebx, dword [ebx]
lea eax, [ebp - 0x10]
mov ecx, 0x49fbe4
mov edx, 0x49ff78
call ebx
push 0
mov ebx, dword [0x71829c]
mov ebx, dword [ebx]
lea eax, [ebp - 0x10]
mov ecx, 0x49fbe4
mov edx, 0x49ff88
call ebx
push 1
mov ebx, dword [0x71829c]
mov ebx, dword [ebx]
lea eax, [ebp - 0x10]
mov ecx, 0x49fbe4
mov edx, 0x49ff98
call ebx
push ebp
mov edx, dword [ebp - 0x10]
mov eax, 0x49ffac
call fcn.0049e44c
pop ecx
jmp 0x49f609
push ebp
lea edx, [ebp - 0x598]
mov eax, dword [ebp - 0x1c]
call fcn.0047c768
mov edx, dword [ebp - 0x598]
mov eax, 0x49ffac
call fcn.0049e44c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f61d
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
push ebp
push 0x49f69a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x49f669
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
mov ecx, dword [eax + edx*8 + 4]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x24]
mov edx, dword [eax + edx*8]
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax]
call dword [ebx + 0x28]
inc dword [ebp - 0x24]
dec dword [ebp - 0x2c]
jne 0x49f646
lea eax, [ebp - 0x59c]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x3a0]
mov ecx, 0x49f7f0
call fcn.0040d754
mov eax, dword [ebp - 0x59c]
mov edx, dword [ebp - 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49f6a4
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
call dword [edx + 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f7e6
lea eax, [ebp - 0x59c]
call fcn.0040d710
lea eax, [ebp - 0x598]
mov edx, 4
call fcn.00409cc0
lea eax, [ebp - 0x588]
call fcn.00409c84
lea eax, [ebp - 0x584]
mov edx, 2
call fcn.00409cc0
lea eax, [ebp - 0x57c]
call fcn.00409c84
lea eax, [ebp - 0x578]
call fcn.00409c60
lea eax, [ebp - 0x574]
call fcn.00409c84
lea eax, [ebp - 0x570]
mov edx, 0xc
call fcn.00409cc0
lea eax, [ebp - 0x540]
call fcn.00409c84
lea eax, [ebp - 0x53c]
mov edx, 4
call fcn.00409cc0
lea eax, [ebp - 0x52c]
call fcn.00409c84
lea eax, [ebp - 0x528]
mov edx, 6
call fcn.00409cc0
lea eax, [ebp - 0x510]
call fcn.00409c84
lea eax, [ebp - 0x50c]
call fcn.00409c60
lea eax, [ebp - 0x508]
call fcn.00409c84
lea eax, [ebp - 0x504]
call fcn.00409c60
lea eax, [ebp - 0x500]
call fcn.00409c84
lea eax, [ebp - 0x4fc]
mov edx, 0xd
call fcn.00409cc0
lea eax, [ebp - 0x4c4]
mov edx, 0xa
call fcn.00409cc0
lea eax, [ebp - 0x49c]
call fcn.0040d710
lea eax, [ebp - 0x18]
call fcn.0040d710
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00409cc0
lea eax, [ebp - 4]
mov edx, dword [0x49e280]
call fcn.0040c198
ret