Function at 0x4b70e0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1c
push 0
push 0
dec ecx
jne 0x4b70e9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x78], ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 0x30], eax
mov ecx, 0xa
lea eax, [ebp - 0x28]
mov edx, dword [0x4010ac]
call fcn.004071ec
xor eax, eax
push ebp
push 0x4b7e9e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4b7ebc
call fcn.004b2f34
lea eax, [ebp - 0xa4]
call fcn.0047f7d8
mov eax, dword [ebp - 0xa4]
call fcn.0040dd74
mov byte [ebp - 0x79], 1
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x7a], 0
xor eax, eax
mov dword [ebp - 0x80], eax
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dl, 1
mov eax, dword [0x4adde0]
call fcn.00404068
mov dword [ebp - 0x3c], eax
xor edx, edx
push ebp
push 0x4b7e31
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x4adde0]
call fcn.00404068
mov dword [ebp - 0x80], eax
mov dl, 1
mov eax, dword [0x4adde0]
call fcn.00404068
mov dword [ebp - 0x44], eax
mov dl, 1
mov eax, dword [0x4adde0]
call fcn.00404068
mov dword [ebp - 0x40], eax
mov dl, 1
mov eax, dword [0x4adde0]
call fcn.00404068
mov dword [ebp - 0x38], eax
mov dl, 1
mov eax, dword [0x4adde0]
call fcn.00404068
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x78], 0
je 0x4b71eb
mov dl, 1
mov eax, dword [0x4adde0]
call fcn.00404068
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x84], eax
mov ecx, eax
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 0x29], 0
je 0x4b75a4
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4b75a4
mov eax, dword [ebp - 0x88]
cmp word [eax + 0x10], 0x80
jne 0x4b7589
xor eax, eax
push ebp
push 0x4b7536
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b708c
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x4b726f
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x80]
call fcn.004b1400
inc eax
jne 0x4b74f7
mov bl, 1
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 8]
test esi, 1
je 0x4b7286
xor ebx, ebx
jmp 0x4b7290
test esi, 2
je 0x4b7290
mov bl, 2
mov dword [ebp - 0xa0], 1
test esi, 8
je 0x4b72ae
mov dword [ebp - 0xa0], 7
jmp 0x4b72d2
test esi, 0x10
je 0x4b72c2
mov dword [ebp - 0xa0], 3
jmp 0x4b72d2
test esi, 0x40
je 0x4b72d2
xor eax, eax
mov dword [ebp - 0xa0], eax
test esi, 4
jne 0x4b73ed
lea eax, [ebp - 0xa8]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4b7f14
call fcn.00406914
mov eax, dword [ebp - 0xa8]
call fcn.004b2f34
cmp dword [ebp - 0x24], 0
je 0x4b7320
lea eax, [ebp - 0xac]
mov ecx, dword [ebp - 0x24]
mov edx, 0x4b7f50
call fcn.00406914
mov eax, dword [ebp - 0xac]
call fcn.004b2f34
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
je 0x4b7349
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
mov edx, dword [ebp - 0x28]
call fcn.004ad944
test al, al
je 0x4b73de
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa0]
push eax
push 0x4b61f4
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
call fcn.004afda8
test al, al
jne 0x4b73ab
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7f90
call fcn.004b31b8
mov byte [ebp - 0x79], 0
jmp 0x4b74e4
cmp bl, 1
jne 0x4b74e4
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7fd4
call fcn.004b31b8
jmp 0x4b74e4
mov eax, 0x4b800c
call fcn.004b2f34
jmp 0x4b74e4
lea eax, [ebp - 0xb8]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4b8054
call fcn.00406914
mov eax, dword [ebp - 0xb8]
call fcn.004b2f34
cmp dword [ebp - 0x24], 0
je 0x4b742f
lea eax, [ebp - 0xbc]
mov ecx, dword [ebp - 0x24]
mov edx, 0x4b809c
call fcn.00406914
mov eax, dword [ebp - 0xbc]
call fcn.004b2f34
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
je 0x4b744b
mov eax, dword [ebp - 0x28]
call fcn.0047ec14
test al, al
je 0x4b74da
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
jne 0x4b7459
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa0]
push eax
push 0x4b61f4
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.004b0074
test al, al
jne 0x4b74ae
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b80e8
call fcn.004b31b8
mov byte [ebp - 0x79], 0
jmp 0x4b74e4
cmp bl, 1
jne 0x4b74e4
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7fd4
call fcn.004b31b8
jmp 0x4b74e4
mov eax, 0x4b812c
call fcn.004b2f34
cmp dword [ebp - 0x1c], 0
je 0x4b752c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x80]
call fcn.004b1308
jmp 0x4b752c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0xc0], 0x11
lea edx, [ebp - 0xcc]
mov ecx, 1
mov eax, 0x4b8188
call fcn.004b31b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b755f
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x30]
call fcn.004b6070
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x4b7597
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4b722a
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4b77d9
mov byte [ebp - 0x89], 0
mov eax, dword [ebp - 0x88]
cmp word [eax + 0x10], 0x82
jne 0x4b778b
mov byte [ebp - 0x89], 1
xor eax, eax
push ebp
push 0x4b7762
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b708c
pop ecx
cmp byte [ebp - 0x29], 0
jne 0x4b760e
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne 0x4b7751
cmp byte [ebp - 0x29], 0
jne 0x4b761a
cmp dword [ebp - 0x24], 0
jne 0x4b761e
xor eax, eax
jmp 0x4b7620
mov al, 1
mov byte [ebp - 0x8a], al
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 8]
test esi, 8
setne bl
test bl, bl
je 0x4b7655
test esi, 0x400
setne dl
mov eax, dword [ebp - 0x28]
call fcn.004b68e4
mov byte [ebp - 0x8b], al
jmp 0x4b765c
mov byte [ebp - 0x8b], 0
test bl, bl
je 0x4b76ae
cmp byte [ebp - 0x8b], 0
je 0x4b7758
cmp byte [ebp - 0x8a], 0
jne 0x4b76ae
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.004ad944
test al, al
je 0x4b76ae
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 2
jne 0x4b76ae
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x4b7758
mov byte [ebp - 0x89], 0
cmp byte [ebp - 0x8a], 0
jne 0x4b7702
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x10
je 0x4b76e1
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.004b69ec
pop ecx
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x40
je 0x4b7702
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.004b6c7c
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 4
je 0x4b773b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0x11
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b81e0
call fcn.004b31b8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.004b0d74
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 0x10
je 0x4b7758
mov eax, dword [ebp - 0x18]
call fcn.004b6e90
jmp 0x4b7758
mov byte [ebp - 0x89], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b778b
cmp byte [ebp - 0x89], 0
je 0x4b77be
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x30]
call fcn.004b6070
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x4b77cc
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4b75bd
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4b7d59
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b708c
pop ecx
xor eax, eax
push ebp
push 0x4b7cfb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x88]
movzx esi, word [eax + 0x10]
movzx eax, si
cmp eax, 0x85
jg 0x4b7878
je 0x4b7ac5
cmp eax, 0x81
jg 0x4b785a
je 0x4b78eb
dec eax
je 0x4b78a9
add eax, 0xfffffff1
sub eax, 2
jb case.0x4b7886.140
sub eax, 0xe
je case.0x4b7886.140
sub eax, 0x60
je case.0x4b7886.140
jmp case.default.0x4b7886
sub eax, 0x82
je 0x4b7994
dec eax
je case.0x4b7886.140
dec eax
je 0x4b7ab2
jmp case.default.0x4b7886
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x4b7886
jmp dword [eax*4 + 0x4b788d]
lea eax, [ebp - 0xd4]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4b821c
call fcn.00406914
mov edx, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd0]
mov al, 0xc2
call fcn.004abea8
mov ecx, dword [ebp - 0xd0]
mov dl, 1
mov eax, dword [0x40ab6c]
call fcn.004119a0
call fcn.00404a74
jmp case.0x4b7886.140
cmp byte [ebp - 0x29], 0
jne 0x4b7901
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne case.0x4b7886.140
mov eax, dword [ebp - 0x88]
mov ebx, dword [eax + 8]
test bl, 4
setne al
push eax
test bl, 8
setne al
push eax
push 0
push 0x4b60f0
push 0x4b60fc
lea eax, [ebp - 0x48]
push eax
test bl, 2
setne cl
test bl, 0x20
setne al
mov edx, dword [ebp - 0x28]
call fcn.004aed78
test al, al
je case.0x4b7886.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 2
je case.0x4b7886.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x10
je case.0x4b7886.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 5
push 0x10
call fcn.0043af14
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0x28]
call fcn.0047e804
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x3c]
call fcn.004b135c
jmp case.0x4b7886.140
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x24]
call fcn.0040649c
cmp byte [ebp - 0x29], 0
jne 0x4b79ab
cmp dword [ebp - 0x74], 0
jne 0x4b79b6
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040649c
cmp byte [ebp - 0x29], 0
jne 0x4b79c8
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne 0x4b7a2f
cmp byte [ebp - 0x29], 0
jne 0x4b79de
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 2
jne case.0x4b7886.140
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.004b6384
pop ecx
test al, al
jne case.0x4b7886.140
mov byte [ebp - 0x79], 0
jmp case.0x4b7886.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 8
je 0x4b7a50
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 4
setne dl
mov eax, dword [ebp - 0x28]
call fcn.004b68e4
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.00406be4
je case.0x4b7886.140
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.004b6384
pop ecx
test al, al
jne case.0x4b7886.140
mov byte [ebp - 0x79], 0
jmp case.0x4b7886.140
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.0047f050
jmp case.0x4b7886.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
je 0x4b7ae4
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0047eef4
test al, al
je case.0x4b7886.140
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0047f09c
jmp case.0x4b7886.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5dd8
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.0047fe78
test eax, eax
je case.0x4b7886.140
sub eax, 2
je case.0x4b7886.140
mov byte [ebp - 0x79], 0
jmp case.0x4b7886.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5dd8
push 0
push 2
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.0047fdb8
test eax, eax
jne case.0x4b7886.140
push 2
push 0x5053a8
push 1
push 0
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4b7ba2
mov byte [ebp - 0x79], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x4b7886.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5dd8
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.0047fffc
test eax, eax
je case.0x4b7886.140
sub eax, 2
je case.0x4b7886.140
sub eax, 0x8f
je case.0x4b7886.140
mov byte [ebp - 0x79], 0
jmp case.0x4b7886.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5dd8
push 0
push 3
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.0047fdb8
test eax, eax
jne case.0x4b7886.140
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x9c]
call fcn.0047fcf8
test al, al
je 0x4b7c73
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
je 0x4b7c73
mov byte [ebp - 0x79], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x4b7886.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x28]
call fcn.004b68e4
jmp case.0x4b7886.140
mov byte [ebp - 0x7a], 1
jmp case.0x4b7886.140
lea eax, [ebp - 0xe0]
push eax
movzx eax, si
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b8248
call fcn.0040e2c8
mov edx, dword [ebp - 0xe0]
lea ecx, [ebp - 0xdc]
mov al, 0xc2
call fcn.004abea8
mov ecx, dword [ebp - 0xdc]
mov dl, 1
mov eax, dword [0x40ab6c]
call fcn.004119a0
call fcn.00404a74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b7d24
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x30]
call fcn.004b6070
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x88], 0
jne 0x4b77f2
cmp byte [ebp - 0x7a], 0
je 0x4b7d6f
push 0
push 0
push 0
push 0x8000000
call fcn.0043af14
mov eax, dword [ebp - 0x30]
test byte [eax + 0x1d], 0x10
je 0x4b7d7d
call fcn.004b1040
cmp dword [ebp - 0x78], 0
je 0x4b7d8d
call dword [ebp - 0x78]
push ebp
call fcn.004b6ff8
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7e3b
mov eax, dword [ebp - 0x48]
call fcn.00404098
mov eax, dword [ebp - 0x34]
call fcn.00404098
mov eax, dword [ebp - 0x38]
call fcn.00404098
mov eax, dword [ebp - 0x3c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4b7e10
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xe4]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.004b13e4
mov eax, dword [ebp - 0xe4]
call fcn.0047ec00
test al, al
je 0x4b7e0c
push 0
lea ecx, [ebp - 0xe8]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.004b13e4
mov eax, dword [ebp - 0xe8]
call fcn.004064d4
push eax
push 0x1005
push 0x1000
call fcn.0043af14
inc ebx
dec esi
jne 0x4b7dc0
mov eax, dword [ebp - 0x40]
call fcn.00404098
mov eax, dword [ebp - 0x44]
call fcn.00404098
mov eax, dword [ebp - 0x80]
call fcn.00404098
mov eax, dword [ebp - 0x3c]
call fcn.00404098
ret