Function at 0x4b97d0
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve function by parsing pe exports
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5662cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x15a94
call fcn.005574a0
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov cx, word [edi + 2]
movzx ecx, cx
add edi, 4
add eax, 0xfffffffc
mov dword [esp + 0x1c], ecx
mov ecx, 0x300
lea ebx, [esp + 0x328]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
call fcn.004bcd60
push eax
mov eax, dword [esp + 0x20]
push eax
push str._tRECV____CD_04X___s_n
call fcn.004d2e60
add esp, 0xc
cmp eax, 0x2031
jg 0x4ba1ab
cmp eax, 0x2031
je 0x4ba163
cmp eax, 0x1ffe
jg 0x4b9f27
je 0x4b9dfb
sub eax, 0x1001
je 0x4b9c44
sub eax, 0x10
je 0x4b98d1
sub eax, 0xe
jne 0x4ba63f
push str.NTF_VIP_IPPORT_n
call fcn.004d2e60
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 6
jne 0x4ba63f
mov byte [esi + 0x7194], 1
mov word [esi + 0x7198], 2
mov edx, dword [edi]
mov dword [esi + 0x719c], edx
mov ax, word [edi + 4]
mov word [esi + 0x719a], ax
xor ecx, ecx
add esi, 0x71a0
mov dword [esi], ecx
mov dword [esi + 4], ecx
jmp 0x4ba63f
push str.RET_LOGIN_n
call fcn.004d2e60
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ecx, 2
jl 0x4ba63f
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x15aac], eax
mov bx, word [edi]
xor edx, edx
mov dword [esp + 0x6d], edx
mov dword [esp + 0x71], edx
mov dword [esp + 0x75], edx
add edi, 2
cmp bx, ax
mov dword [esp + 0x79], edx
mov dword [esp + 0x14], 0x10
mov byte [esp + 0x6c], al
mov dword [esp + 0x7d], edx
mov dword [esp + 0x10], edi
jne 0x4b9bfa
cmp ecx, 0x1e
jl 0x4b9c36
lea ebx, [esi - 0x2c8]
mov dword [esp + 0x1c], ebx
call fcn.004bbd10
add esi, 0x7208
call fcn.004b7000
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esi + 0x718c]
lea eax, [esi - 0x2f0]
call fcn.004bba50
push eax
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
mov ebx, edi
jne 0x4b999d
mov edx, dword [esp + 0x14]
mov ecx, dword [esi - 0x40]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push 4
push ebx
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, dword [esp + 0x18]
add ebx, 4
add esi, 0x71a8
mov edi, ebx
call fcn.004bbfa0
mov edi, dword [esp + 0x18]
push 0x11
lea edx, [esp + 0x90]
push edx
lea eax, [edi + 0x7238]
add ebx, 0xc
call fcn.004b4800
lea esi, [esp + 0x8c]
lea eax, [esp + 0xe0]
call fcn.004b5ae0
lea eax, [edi + 0x71d8]
lea ecx, [esp + 0xe0]
lea esi, [edi + 0x71a8]
push ecx
mov edi, eax
call fcn.004bbfc0
mov edi, ebx
lea esi, [esp + 0x4c]
call fcn.004bb930
mov dx, word [ebx + 8]
add ebx, 8
mov ax, word [ebx + 2]
add ebx, 2
add ebx, 2
cmp ax, 0x1f4
mov word [esp + 0x20], dx
jbe 0x4b9a27
mov eax, 0x1f4
test ax, ax
jbe 0x4b9b21
movzx eax, ax
mov dword [esp + 0x10], eax
jmp 0x4b9a40
mov edi, ebx
lea esi, [esp + 0xa0]
call fcn.004bb8f0
add ebx, 0x10
mov edi, ebx
lea esi, [esp + 0x5c]
call fcn.004bbfa0
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0xa0]
push ecx
lea esi, [esp + 0x60]
add edi, 0x71d8
add ebx, 0xc
call fcn.004bbfc0
cmp byte [ebx], 0
jne 0x4b9a82
inc ebx
jmp 0x4b9ab1
mov edx, ebx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esp + 0x6c], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x70], ecx
mov ecx, dword [edx + 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
mov byte [esp + 0x80], 0
add ebx, 0x14
lea edi, [esp + 0x6c]
lea esi, [esp + 0xb2]
call fcn.004bb910
mov edi, ebx
lea esi, [esp + 0xc8]
call fcn.004bb930
mov ax, word [ebx + 8]
add ebx, 8
mov word [esp + 0xd2], ax
lea eax, [esp + 0xa0]
lea ecx, [esp + 0x38]
add ebx, 2
call fcn.004baa30
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xa0]
add ecx, 0x71b8
call fcn.004ba980
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0xa0]
call fcn.004bbb50
dec dword [esp + 0x10]
jne 0x4b9a40
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 0x71cc]
test eax, eax
jne 0x4b9b82
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push closesocket
push str.CBuddy2_Timer_Receiving_Window
push str.STATIC
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [edi + 0x71cc], eax
je 0x4b9b82
mov esi, dword [sym.imp.USER32.dll_SetWindowLongA]
lea ecx, [edi - 0x2f4]
push ecx
push 0xffffffffffffffeb
push eax
call esi
mov edx, dword [edi + 0x71cc]
push 0x4b5670
push 0xfffffffffffffffc
push edx
call esi
mov eax, dword [edi + 0x71cc]
test eax, eax
je 0x4b9baf
mov ecx, dword [edi + 0x71d0]
test ecx, ecx
jne 0x4b9baf
push 0
push 0xea60
push 0x14d
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [edi + 0x71d0], eax
lea esi, [edi - 0x2f4]
mov byte [edi + 0x7189], 1
mov byte [edi + 0x7194], 0
call fcn.004b9640
mov ecx, dword [edi + 0x71c8]
mov eax, dword [ecx]
lea edx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x24]
push edx
lea edx, [esp + 0x54]
push edx
lea edx, [esp + 0x98]
push edx
push 0
call dword [eax + 0xc]
lea esi, [esp + 0x38]
call fcn.004bab20
jmp 0x4ba63f
add esi, 0xfffffd0c
call fcn.004b9640
mov esi, 0x584f32
lea eax, [esp + 0xd6]
call fcn.004bb950
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x71c8]
mov edx, dword [ecx]
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0xde]
push eax
push esi
push ebx
call dword [edx + 0xc]
lea esi, [esp + 0x38]
call fcn.004bab20
jmp 0x4ba63f
push str.RET_PRECREDENTIAL_n
call fcn.004d2e60
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 4
jne 0x4ba63f
mov esi, dword [esi + 0x7190]
test esi, esi
je 0x4b9c71
push esi
call fcn.005543c2
add esp, 4
mov esi, 0x2dbabe65
call fcn.004bfc60
mov edi, dword [esp + 0x18]
push 0x11
lea ecx, [esp + 0x90]
mov dword [edi + 0x7190], eax
push ecx
lea eax, [edi + 0x7238]
call fcn.004b4800
test al, al
je 0x4ba63f
push 0x15
lea edx, [esp + 0x70]
push edx
lea eax, [edi + 0x74bc]
call fcn.004b4800
test al, al
je 0x4ba63f
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
lea eax, [esp + 0xe920]
push eax
mov eax, dword [edi + 0x7190]
push edx
push 0x57ac3c
push eax
lea eax, [esp + 0x7c]
lea esi, [esp + 0x9c]
call fcn.004bfc90
add esp, 0x10
test al, al
je 0x4ba63f
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [edi + 0x718c]
lea edx, [esp + 0x20]
push edx
lea eax, [edi - 0x2f0]
mov dword [esp + 0x28], 0x10
call fcn.004bba70
test al, al
je 0x4b9de2
mov eax, dword [edi - 0x40]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4b9de2
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x630], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x62c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x634], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x63c], ecx
mov dword [esp + 0x638], eax
mov ax, word [esp + 0x26]
push 0x715a
lea ecx, [esp + 0xe944]
mov dword [esp + 0x644], edx
mov edx, dword [edi + 0x7190]
push ecx
mov word [esp + 0x64c], ax
push edx
mov eax, 0x24
lea ecx, [esp + 0x634]
mov dword [esp + 0x634], 0x19
call fcn.004bff60
add esp, 0xc
test al, al
je 0x4ba63f
push 0x50
push 0x1010
add edi, 0xfffffd0c
push edi
lea ecx, [esp + 0xe92c]
call fcn.004ba720
jmp 0x4ba63f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CBuddy2::OnMsg_on_RET_PRECREDENTIAL___getsockname___failed_with__d_n
call fcn.004d2e60
add esp, 8
jmp 0x4ba63f
push str.NTF_NOTICE_n
call fcn.004d2e60
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 4
jl 0x4ba63f
xor ebx, ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x15aac], 1
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov byte [esp + 0x15aac], 2
mov ax, word [edi]
add edi, 2
cmp ax, 0xa
ja 0x4b9f10
cmp ax, bx
jbe 0x4b9f00
movzx eax, ax
mov dword [esp + 0x1c], eax
jmp 0x4b9e64
mov edi, dword [esp + 0x10]
mov al, byte [edi]
movzx edx, al
inc edi
mov dword [esp + 0x10], edi
mov ecx, edx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x228]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [eax + edx]
add eax, edx
mov byte [esp + edx + 0x228], bl
movzx edx, cl
inc eax
mov ecx, edx
mov ebx, ecx
shr ecx, 2
mov esi, eax
lea edi, [esp + 0x128]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, edx
lea ecx, [esp + 0x228]
mov dword [esp + 0x10], eax
xor ebx, ebx
push ecx
lea eax, [esp + 0x60]
mov byte [esp + edx + 0x12c], bl
call fcn.004b9600
lea edx, [esp + 0x128]
push edx
lea eax, [esp + 0x64]
call fcn.004b9600
lea edx, [esp + 0x5c]
lea esi, [esp + 0x38]
call fcn.004baac0
dec dword [esp + 0x1c]
jne 0x4b9e60
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x71c8]
mov eax, dword [ecx]
lea edx, [esp + 0x38]
push edx
call dword [eax + 0x10]
lea edi, [esp + 0x5c]
call fcn.004ba660
lea ebx, [esp + 0x38]
call fcn.004bacc0
jmp 0x4ba63f
sub eax, 0x1fff
je 0x4ba11b
sub eax, 0x11
je 0x4b9fbe
sub eax, 0x11
jne 0x4ba63f
push str.NTF_TUNNEL_PACKET_n
call fcn.004d2e60
add esp, 4
lea esi, [esp + 0x38]
call fcn.004bb8f0
mov ebx, dword [esp + 0x10]
add ebx, 0x10
mov edi, ebx
lea esi, [esp + 0x4c]
call fcn.004bbfa0
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x38]
push eax
add edi, 0x71d8
lea esi, [esp + 0x50]
add ebx, 0xc
call fcn.004bbfc0
movzx ecx, word [ebx + 2]
xor eax, eax
mov ax, word [ebx]
add ebx, 2
push ecx
lea esi, [ebx + 2]
push eax
push 0
call fcn.00553fe2
mov edx, dword [esp + 0x24]
add esp, 4
push eax
add edx, 0xfffffd0c
push edx
mov ecx, esi
lea ebx, [esp + 0x48]
call fcn.004bc8d0
jmp 0x4ba63f
push str.NTF_SAVE_PACKET_n
call fcn.004d2e60
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 0x10
jl 0x4ba63f
mov ecx, dword [esi + 0x7190]
push 0x717a
push edi
push ecx
lea ecx, [esp + 0xe92c]
call fcn.004c0000
add esp, 0xc
test al, al
je 0x4ba63f
mov cx, word [esp + 0xe920]
test cx, cx
lea ebx, [esp + 0xe922]
mov word [esp + 0x628], cx
lea eax, [esp + 0x62a]
jbe 0x4ba0f9
lea edx, [esi + 0x71d8]
movzx ecx, cx
add esi, 0xfffffd0c
mov dword [esp + 0x1c], edx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x10], ecx
jmp 0x4ba044
mov ebx, dword [esp + 0x14]
mov edx, dword [ebx]
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x20], eax
add ebx, 4
mov eax, ebx
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x28], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
mov edx, dword [eax + 0xc]
add ebx, 0x10
mov edi, ebx
lea esi, [esp + 0x4c]
mov dword [esp + 0x30], edx
mov byte [esp + 0x34], 0
call fcn.004bbfa0
lea esi, [esp + 0x24]
lea eax, [esp + 0x104]
add ebx, 0xc
call fcn.004b5ae0
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x104]
push eax
lea esi, [esp + 0x50]
call fcn.004bbfc0
mov eax, dword [ebx]
add ebx, 4
mov dx, word [ebx + 2]
xor ecx, ecx
mov cx, word [ebx]
add ebx, 2
movzx esi, dx
push esi
add ebx, 2
push ecx
mov ecx, dword [esp + 0x64]
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x24], ebx
lea ebx, [esp + 0x34]
call fcn.004bc8d0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add ecx, esi
dec eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
jne 0x4ba040
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x628]
sub eax, edx
push eax
push 0x2011
add esi, 0xfffffd0c
push esi
mov ecx, edx
call fcn.004ba720
jmp 0x4ba63f
push str.NTF_CLOSE_CONNECTION_n
call fcn.004d2e60
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jne 0x4ba63f
lea eax, [esi - 0x2f0]
mov esi, dword [esi + 0x718c]
push eax
call fcn.004b5c30
mov eax, dword [esp + 0x10]
movzx eax, word [eax]
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x71c8]
mov edx, dword [ecx]
push eax
call dword [edx + 8]
jmp 0x4ba63f
push str.RET_SMS_SEND_n
call fcn.004d2e60
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jne 0x4ba63f
cmp dword [esi + 0x7758], 0x10
jb 0x4ba18e
mov eax, dword [esi + 0x7744]
jmp 0x4ba194
lea eax, [esi + 0x7744]
mov ecx, dword [esi + 0x71c8]
mov edx, dword [ecx]
xor esi, esi
mov si, word [edi]
push esi
push eax
call dword [edx + 0x50]
jmp 0x4ba63f
cmp eax, 0x3007
jg 0x4ba3bd
je 0x4ba3ab
sub eax, 0x3001
je 0x4ba27d
sub eax, 2
je 0x4ba1e7
sub eax, 2
jne 0x4ba63f
push str.RET_GROUP_BUDDY_n
call fcn.004d2e60
add esp, 4
jmp 0x4ba63f
push str.RET_REMOVE_BUDDY_n
call fcn.004d2e60
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jl 0x4ba63f
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4ba63f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0xc]
mov edi, dword [esi + 0x71bc]
mov dword [esp + 0x30], eax
cmp edi, dword [esi + 0x71c0]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov byte [esp + 0x34], 0
je 0x4ba63f
push 0x10
lea ecx, [esp + 0x28]
push ecx
push edi
call fcn.005574dd
add esp, 0xc
test eax, eax
je 0x4ba268
mov eax, dword [esi + 0x71c0]
add edi, 0x12
cmp edi, eax
jne 0x4ba242
jmp 0x4ba63f
push edi
add esi, 0x71b8
lea ebx, [esp + 0x60]
call fcn.004baa00
jmp 0x4ba63f
push str.RET_ADD_BUDDY_n
call fcn.004d2e60
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jl 0x4ba63f
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4ba63f
mov edx, edi
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x28], ecx
mov ecx, dword [edx + 0xc]
add edi, 0x10
lea esi, [esp + 0x4c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov byte [esp + 0x34], 0
mov dword [esp + 0x10], edi
call fcn.004bbfa0
mov ebx, edi
lea esi, [esp + 0x24]
lea eax, [esp + 0xf2]
add ebx, 0xc
call fcn.004b5ae0
mov edi, dword [esp + 0x18]
lea edx, [esp + 0xf2]
push edx
add edi, 0x71d8
lea esi, [esp + 0x50]
call fcn.004bbfc0
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dx, word [ebx + 8]
mov dword [esp + 0x4c], eax
lea esi, [esp + 0x24]
lea eax, [esp + 0x8c]
mov dword [esp + 0x50], ecx
mov byte [esp + 0x54], 0
mov word [esp + 0x5c], dx
call fcn.004b5ae0
mov ebx, dword [esp + 0x18]
lea ecx, [ebx + 0x71b8]
lea eax, [esp + 0x8c]
call fcn.004ba980
lea edi, [ebx - 0x2c8]
mov eax, esi
call fcn.004bbb50
mov edi, esi
lea esi, [esp + 0xa0]
call fcn.004bb8f0
lea edi, [esp + 0x4c]
lea esi, [esp + 0xc8]
call fcn.004bb930
mov ax, word [esp + 0x5c]
mov ebx, dword [ebx + 0x71c8]
mov word [esp + 0xd2], ax
lea eax, [esp + 0xa0]
mov byte [esp + 0xc7], 0
mov byte [esp + 0xb2], 0
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x44]
jmp 0x4ba63f
push str.RET_RENAME_GROUP_n
call fcn.004d2e60
add esp, 4
jmp 0x4ba63f
sub eax, 0x3fff
je 0x4ba52e
sub eax, 2
je 0x4ba432
sub eax, 0xfff
jne 0x4ba63f
push str.NTF_NOTICE2_n
call fcn.004d2e60
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ecx, 0xff
jg 0x4ba63f
mov edx, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x128]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x71c8]
mov eax, edx
mov byte [esp + eax + 0x128], 0
mov edx, dword [ecx]
lea eax, [esp + 0x128]
push eax
call dword [edx + 0x14]
jmp 0x4ba63f
push str.RET_SEARCH_n
call fcn.004d2e60
mov edx, dword [esp + 0x18]
add esp, 4
cmp edx, 2
jl 0x4ba63f
xor ecx, ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x15aac], 3
mov ax, word [edi]
add edi, 2
cmp ax, cx
jne 0x4ba510
cmp edx, 4
jl 0x4ba520
mov ax, word [edi]
add edi, 2
cmp ax, cx
mov dword [esp + 0x10], edi
jbe 0x4ba510
movzx ecx, ax
add esi, 0x71d8
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
jmp 0x4ba4a7
mov edi, dword [esp + 0x10]
lea esi, [esp + 0x6c]
call fcn.004bb8f0
mov ebx, dword [esp + 0x10]
add ebx, 0x10
mov edi, ebx
lea esi, [esp + 0x4c]
call fcn.004bbfa0
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x6c]
push edx
lea esi, [esp + 0x50]
add ebx, 0xc
call fcn.004bbfc0
mov edi, ebx
lea esi, [esp + 0x7e]
call fcn.004bb930
mov ax, word [ebx + 8]
add ebx, 8
lea ecx, [esp + 0x6c]
mov word [esp + 0x88], ax
add ebx, 2
push ecx
lea eax, [esp + 0x3c]
mov dword [esp + 0x14], ebx
call fcn.004bab50
dec dword [esp + 0x20]
jne 0x4ba4a3
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x71c8]
mov edx, dword [ecx]
lea eax, [esp + 0x38]
push eax
call dword [edx + 0x4c]
lea esi, [esp + 0x38]
call fcn.004bab20
jmp 0x4ba63f
push str.NTF_USER_STATE_n
call fcn.004d2e60
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jl 0x4ba63f
mov ax, word [edi]
add edi, 2
test ax, ax
jbe 0x4ba63f
movzx ecx, ax
add esi, 0xfffffd38
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
jmp 0x4ba572
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov bl, byte [edi + 0x10]
mov edx, edi
mov eax, dword [edx]
mov ecx, dword [edx + 4]
add edi, 0x10
mov dword [esp + 0x24], eax
mov eax, dword [edx + 8]
test bl, bl
mov dword [esp + 0x2c], eax
setne al
mov dword [esp + 0x28], ecx
mov ecx, dword [edx + 0xc]
inc edi
test al, al
mov dword [esp + 0x30], ecx
mov byte [esp + 0x34], 0
mov byte [esp + 0x9e], al
mov dword [esp + 0x10], edi
je 0x4ba5de
mov eax, dword [edi]
add edi, 4
mov edx, dword [edi + 2]
xor ecx, ecx
mov cx, word [edi]
add edi, 2
add edi, 4
push edx
xor ebx, ebx
mov bx, word [edi]
add edi, 2
push ecx
push eax
mov dword [esp + 0x1c], edi
lea eax, [esp + 0x30]
mov edi, esi
call fcn.004bbae0
jmp 0x4ba60e
lea edx, [esp + 0x24]
push edx
push esi
call fcn.004bbba0
lea esi, [esp + 0x24]
lea eax, [esp + 0x116]
call fcn.004b5ae0
mov eax, dword [esp + 0x18]
add eax, 0x7208
lea edx, [esp + 0x116]
call fcn.004b6480
lea edi, [esp + 0x24]
lea esi, [esp + 0x8c]
call fcn.004bb8f0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x71c8]
mov edx, dword [ecx]
lea eax, [esp + 0x8c]
push eax
call dword [edx + 0x2c]
dec dword [esp + 0x20]
jne 0x4ba56a
mov ecx, dword [esp + 0x15aa4]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8