Function at 0x4862b0
Capabilities:
Check os version
Create directory
Create process on windows
Get common file path
Get session user name
Get startup folder
Persist via app paths registry key
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x50afce
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1874
call fcn.004e94b0
mov eax, dword [0x5522c0]
xor eax, esp
mov dword [esp + 0x1870], eax
push ebx
push esi
push edi
mov eax, dword [0x5522c0]
xor eax, esp
push eax
lea eax, [esp + 0x1888]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
add esi, 0xb4
lea eax, [esp + 0x28]
push esi
push eax
mov ebx, 0x5200c8
mov dword [esp + 0x34], esi
call fcn.0045ce40
lea ecx, [esp + 0x5c]
push esi
push ecx
mov ebx, 0x521038
mov dword [esp + 0x18a0], 0
call fcn.0045ce40
lea edx, [esp + 0x4c]
push esi
push edx
mov ebx, str.uninst.exe
mov byte [esp + 0x18a8], 1
call fcn.0045ce40
lea eax, [esp + 0x64]
push esi
push eax
mov ebx, 0x52108c
mov byte [esp + 0x18b0], 2
call fcn.0045ce40
lea ecx, [esp + 0x58]
push esi
push ecx
mov ebx, 0x52105c
mov byte [esp + 0x18b8], 3
call fcn.0045ce40
mov byte [esp + 0x18b8], 4
mov eax, dword [esi]
push 0x5c
push eax
call fcn.004e7a0f
add esp, 0x30
test eax, eax
jne 0x486396
or eax, 0xffffffff
jmp 0x48639a
sub eax, dword [esi]
sar eax, 1
lea ecx, [esp + 0x34]
mov edx, esi
call fcn.0045d980
push 1
push 0x19
lea edx, [esp + 0x474]
push edx
push 0
mov byte [esp + 0x18a0], 5
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x30]
push eax
mov ecx, 0x5258c4
call fcn.004595d0
lea ecx, [esp + 0x58]
push ecx
mov ecx, 0x5258d8
mov byte [esp + 0x1894], 6
call fcn.004595d0
lea edx, [esp + 0x40]
push edx
mov ecx, 0x5258ec
mov byte [esp + 0x1894], 7
call fcn.004595d0
lea eax, [esp + 0x50]
push eax
mov ecx, 0x525904
mov byte [esp + 0x1894], 8
call fcn.004595d0
lea ecx, [esp + 0x24]
push ecx
mov ecx, 0x525918
mov byte [esp + 0x1894], 9
call fcn.004595d0
push 0
mov byte [esp + 0x1894], 0xa
call dword [sym.imp.ole32.dll_CoInitialize]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
push 0
push edx
lea eax, [esp + 0x474]
push eax
xor edx, edx
mov ebx, 0x52592c
call fcn.00493020
test eax, eax
jne 0x48647e
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x1389
call fcn.00473430
mov ecx, dword [esp + 0x1c]
cmp byte [ecx + 0xc8], 0
jne 0x486531
mov edx, dword [0x55ad8c]
cmp byte [edx + 0xb9], 0
je 0x486531
lea eax, [esp + 0x18]
push esi
push eax
mov ebx, 0x52105c
call fcn.0045ce40
add esp, 8
mov byte [esp + 0x1890], 0xc
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x18]
push 0
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x474]
push edx
mov edx, 0x525938
mov ebx, 0x52594c
call fcn.00493020
test eax, eax
jne 0x486504
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138a
call fcn.00473430
jmp 0x486509
call fcn.0048b960
mov byte [esp + 0x1890], 0xa
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486531
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
push 0x1a
lea ecx, [esp + 0x67c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x48656b
lea edi, [esp + 0x674]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x486553
mov ecx, 0x15
mov esi, 0x527cf0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
push str.Baofeng.StormPlayer.WIN7APPID
push esi
lea edx, [esp + 0x67c]
push edx
xor edx, edx
xor ebx, ebx
call fcn.00493020
test eax, eax
jne 0x4865ad
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138b
call fcn.00473430
mov eax, dword [esp + 0x1c]
cmp byte [eax + 0xc8], bl
jne 0x486602
mov ecx, dword [0x55ad8c]
cmp byte [ecx + 0xb9], bl
je 0x486602
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x38]
push 0
push esi
lea edx, [esp + 0x67c]
push edx
xor edx, edx
xor ebx, ebx
call fcn.00493020
test eax, eax
jne 0x486602
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x139c
call fcn.00473430
push 0x104
lea eax, [esp + 0x470]
push 0
push eax
call fcn.004e98c0
add esp, 0xc
push 1
push 0x17
lea ecx, [esp + 0x474]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x470]
call fcn.004595d0
push 5
push 0x525994
lea ebx, [esp + 0x28]
mov byte [esp + 0x1898], 0xd
call fcn.0045b440
mov eax, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push eax
call edi
push 6
push 0x5259a0
call fcn.0045b440
mov ecx, dword [esp + 0x20]
push 0
push ecx
call edi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4866a1
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
push str.Baofeng.StormPlayer.WIN7APPID
push esi
push eax
xor edx, edx
mov ebx, 0x52592c
call fcn.00493020
test eax, eax
jne 0x4866bc
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138c
call fcn.00473430
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4866e0
mov ecx, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
push 0
push esi
push eax
xor edx, edx
mov ebx, 0x5259b0
call fcn.00493020
test eax, eax
jne 0x4866fb
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x139a
call fcn.00473430
mov eax, dword [esp + 0x20]
test eax, eax
je 0x48671f
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
push 0
push esi
push eax
xor edx, edx
mov ebx, 0x5259bc
call fcn.00493020
test eax, eax
jne 0x48673a
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138e
call fcn.00473430
mov eax, dword [esp + 0x20]
test eax, eax
je 0x48675e
mov ecx, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
push 0
push esi
push eax
xor edx, edx
mov ebx, 0x5259d0
call fcn.00493020
test eax, eax
jne 0x486779
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x138d
call fcn.00473430
mov eax, dword [esp + 0x20]
test eax, eax
je 0x48679d
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x38]
push 0
push esi
push eax
xor edx, edx
mov ebx, 0x52594c
call fcn.00493020
test eax, eax
jne 0x4867b8
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x139b
call fcn.00473430
call dword [sym.imp.ole32.dll_CoUninitialize]
lea edx, [esp + 0x5c]
push edx
mov dword [esp + 0x60], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x60], 6
jne 0x486a52
cmp dword [esp + 0x64], 1
jne 0x486a52
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x678]
call fcn.004595d0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
mov ebx, 0x51d5c8
mov byte [esp + 0x1898], 0xe
call fcn.0045ce40
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x20]
push edx
mov ebx, eax
mov byte [esp + 0x18a0], 0xf
call fcn.0045cd90
add esp, 0x10
lea edi, [esp + 0x18]
mov byte [esp + 0x1890], 0x10
call fcn.0045cf20
mov byte [esp + 0x1890], 0xf
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486869
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0xe
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486891
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push 0
push ecx
push str.taskbarpin
push 0
call esi
mov byte [esp + 0x1890], 0xd
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4868d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add eax, 0xfffffff0
cmp byte [ecx + 0xc8], 0
je 0x486975
call fcn.0045d010
add eax, 0x10
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
mov ebx, 0x51d5c8
mov byte [esp + 0x1898], 0x11
call fcn.0045ce40
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ebx, eax
mov byte [esp + 0x18a0], 0x12
call fcn.0045cd90
add esp, 0x10
lea edi, [esp + 0x18]
mov byte [esp + 0x1890], 0x13
call fcn.0045cf20
mov byte [esp + 0x1890], 0x12
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486968
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0x11
jmp 0x4869fa
call fcn.0045d010
add eax, 0x10
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
mov ebx, 0x51d5c8
mov byte [esp + 0x1898], 0x14
call fcn.0045ce40
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ebx, eax
mov byte [esp + 0x18a0], 0x15
call fcn.0045cd90
add esp, 0x10
lea edi, [esp + 0x18]
mov byte [esp + 0x1890], 0x16
call fcn.0045cf20
mov byte [esp + 0x1890], 0x15
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4869f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0x14
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486a1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x18]
push 0
push 0
push 0
push edi
push str.taskbarpin
push 0
call esi
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x1890], 0xd
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486a52
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x28]
push ecx
push 0x51a1b4
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsStormPlayer.exe
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.0045d190
mov esi, dword [esp + 0x24]
add esp, 8
test al, al
jne 0x486a8d
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x138f
call fcn.00473430
push 0x52592c
push str.DisplayName
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer
call fcn.0045d190
add esp, 8
test al, al
jne 0x486abf
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1390
call fcn.00473430
mov edx, dword [esp + 0x3c]
push edx
push str.UninstallString
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer
call fcn.0045d190
add esp, 8
test al, al
jne 0x486af1
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1391
call fcn.00473430
mov eax, dword [esp + 0x28]
push eax
push str.DisplayIcon
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer
call fcn.0045d190
add esp, 8
test al, al
jne 0x486b23
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1392
call fcn.00473430
push str.5.34.0227.1111
push str.DisplayVersion
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer
call fcn.0045d190
add esp, 8
test al, al
jne 0x486b55
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1393
call fcn.00473430
push str.http:__www.Baofeng.com
push str.URLInfoAbout
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer
call fcn.0045d190
add esp, 8
test al, al
jne 0x486b87
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1394
call fcn.00473430
push 0x525ae4
push str.Publisher
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallStormPlayer
call fcn.0045d190
add esp, 8
test al, al
jne 0x486bb9
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1395
call fcn.00473430
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push str.InstallActiveFlag
push str.SoftwareBaofengStormPlayerUserConfig
push SysReAllocString
mov dword [esp + 0x30], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, eax
cmp ebx, 5
jne 0x486cb9
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x18], 0x202
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push str.SoftwareBaofengStormPlayerUserConfig
push str.CURRENT_USER
push str._s_s
lea ecx, [esp + 0x1088]
push 0x800
push ecx
call fcn.004e7a3d
add esp, 0x14
push 0xf003f
lea edx, [esp + 0x60]
push edx
push 2
lea edi, [esp + 0x1088]
call fcn.0045d3f0
test eax, eax
je 0x486cb9
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.InstallActiveFlag
push str.SoftwareBaofengStormPlayerUserConfig
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x268]
push edx
mov ebx, eax
mov dword [esp + 0x1c], 0x202
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push str.SoftwareBaofengStormPlayerUserConfig
push str.CURRENT_USER
push str._s_s
lea eax, [esp + 0x888]
push 0x800
push eax
call fcn.004e7a3d
add esp, 0x14
push 2
lea ecx, [esp + 0x268]
push ecx
push 3
lea edi, [esp + 0x888]
call fcn.0045d3f0
test ebx, ebx
sete al
test al, al
jne 0x486cd9
lea edi, [esi + 0xb8]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1396
call fcn.00473430
cmp dword [esi + 0x14], 0
je 0x486d12
push 1
mov ebx, str.InstallType
mov esi, str.SoftwareBaofengStormPlayerUserConfig
call fcn.0045d120
add esp, 4
test al, al
jne 0x486d12
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1398
call fcn.00473430
push str.URL:_Storm_Download_Protocol
push 0x51a1b4
mov edi, str.StormDL
mov ebx, SysReAllocString
call fcn.0045d190
push 0x51a1b4
push str.URL_Protocol
call fcn.0045d190
mov edx, dword [esp + 0x3c]
push edx
lea eax, [esp + 0x5c]
push eax
mov ebx, 0x5210e0
call fcn.0045ce40
lea ecx, [esp + 0x28]
push 0x51d5f0
push ecx
lea ecx, [esp + 0x68]
mov byte [esp + 0x18b0], 0x17
call fcn.0048d4e0
push eax
lea edx, [esp + 0x50]
push edx
mov ebx, 0x51d5f0
mov byte [esp + 0x18b8], 0x18
call fcn.0045ce40
push eax
lea eax, [esp + 0x70]
push eax
mov ebx, str.__TypeDZone__DZUrl__1___FromWeb
mov byte [esp + 0x18c0], 0x19
call fcn.0045ce40
add esp, 0x30
mov byte [esp + 0x1890], 0x1b
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486dc4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0x1c
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486dec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x44]
push ecx
push 0x51a1b4
mov edi, str.StormDL_shellopencommand
mov ebx, SysReAllocString
call fcn.0045d190
mov edx, dword [esp + 0x24]
add esp, 8
cmp dword [edx + 0x14], 0
jne 0x486e45
push 1
mov ebx, str.AutoRun
mov esi, str.SoftwareBaofengStormPlayerConfigRepairAutoRun
call fcn.0045d120
add esp, 4
test al, al
jne 0x486e45
mov edi, dword [esp + 0x1c]
add edi, 0xb8
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1399
call fcn.00473430
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.FirstHideBox
push str.SoftwareBaofengStormPlayerUserConfig
push SysReAllocString
mov dword [esp + 0x30], 0
call ebx
cmp eax, 5
jne 0x486f43
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x268]
push edx
mov dword [esp + 0x34], 0x202
call esi
push str.SoftwareBaofengStormPlayerUserConfig
push str.CURRENT_USER
push str._s_s
lea eax, [esp + 0x888]
push 0x800
push eax
call fcn.004e7a3d
add esp, 0x14
push 0xf003f
lea ecx, [esp + 0x268]
push ecx
push 2
lea edi, [esp + 0x888]
call fcn.0045d3f0
test eax, eax
je 0x486f43
push 4
lea edx, [esp + 0x1c]
push edx
push 4
push str.FirstHideBox
push str.SoftwareBaofengStormPlayerUserConfig
push SysReAllocString
call ebx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x268]
push ecx
mov dword [esp + 0x18], 0x202
call esi
push str.SoftwareBaofengStormPlayerUserConfig
push str.CURRENT_USER
push str._s_s
lea edx, [esp + 0x888]
push 0x800
push edx
call fcn.004e7a3d
add esp, 0x14
push 2
lea eax, [esp + 0x268]
push eax
push 3
lea edi, [esp + 0x888]
call fcn.0045d3f0
mov byte [esp + 0x1890], 0x17
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486f6b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0xd
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486f93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0xa
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486fbb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 9
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x486fe3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 8
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48700b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 7
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x487033
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 6
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48705b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 5
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x487083
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 4
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4870ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 3
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4870d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 2
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4870fb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 1
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x487123
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1890], 0
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48714b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1890], 0xffffffff
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x487176
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x1888]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1870]
xor ecx, esp
call fcn.004e4be0
mov esp, ebp
pop ebp
ret