Function at 0x4b52d0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x632728
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x6a6040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], 0
mov esi, dword [0x6ac16c]
xor edi, edi
push 0xffffffffffffffff
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], edi
push dword [esi]
mov byte [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
jne 0x4b5330
mov dword [esi + 8], edi
jmp 0x4b5334
test eax, eax
jne 0x4b5345
inc dword [esi + 0xc]
mov edi, 1
inc dword [esi + 8]
inc dword [esi + 4]
mov dword [ebp - 0x20], edi
test edi, edi
jg 0x4b5352
cmp dword [0x6ac6c4], 0
jne 0x4b535d
dec edi
mov ecx, esi
mov dword [ebp - 0x20], edi
call fcn.005e0810
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.0041d9b0
push 0
push ecx
mov edx, 1
lea ecx, [ebp - 0x30]
call fcn.005ca9f0
push ecx
push 0x5c
push 0x2f
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 2
call fcn.005acc00
lea eax, [ebp - 0x1f]
push eax
lea ecx, [ebp - 0x30]
call fcn.005a44c0
mov ecx, dword [ebp - 0x30]
or edi, 0xffffffff
test ecx, ecx
je 0x4b53b5
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b53b5
push ecx
call fcn.005a47b0
lea edx, [ebp - 0x1f]
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x38]
call fcn.005b43d0
add esp, 4
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1f]
test ecx, ecx
je 0x4b53e4
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b53e4
push ecx
call fcn.005a47b0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, eax
test ecx, ecx
jne 0x4b5415
mov esi, dword [0x6aefbc]
test esi, esi
je 0x4b5408
lock inc dword [esi]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x30], esi
jmp 0x4b547d
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x30], esi
jmp 0x4b547d
call fcn.005b4610
cmp eax, 0x3ffffffa
jle 0x4b543b
mov esi, dword [0x6aefbc]
mov eax, esi
mov dword [ebp - 0x28], eax
test esi, esi
je 0x4b5408
lock inc dword [esi]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], eax
jmp 0x4b547d
push 0
add eax, eax
push eax
push ecx
lea ecx, [ebp - 0x1f]
call fcn.005a5770
mov esi, dword [eax]
mov ecx, esi
mov dword [eax], 0
mov edx, dword [ebp - 0x1f]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
test edx, edx
je 0x4b5473
mov eax, edi
lock xadd dword [edx], eax
dec eax
jne 0x4b5473
push ecx
mov ecx, edx
call fcn.005a47b0
mov ecx, esi
mov dword [ebp - 4], 5
mov dword [ebp - 0x30], ecx
push 0
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x34]
call fcn.005b47f0
add esp, 4
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x28], 0
je 0x4b54af
mov ecx, dword [ebp - 0x30]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b54af
push ecx
mov ecx, esi
call fcn.005a47b0
lea eax, [ebp - 0x1f]
push eax
lea ecx, [ebp - 0x34]
call fcn.005af490
mov ecx, dword [ebp - 0x1f]
test ecx, ecx
je 0x4b54d1
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b54d1
push ecx
call fcn.005a47b0
cmp dword [ebp - 0x34], 0
je 0x4b6427
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
call fcn.005af490
mov byte [ebp - 4], 0xc
call fcn.005ae710
push 0
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x20]
call fcn.005b43d0
add esp, 4
mov byte [ebp - 4], 0xd
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x4b5510
mov eax, dword [esi + 4]
jmp 0x4b5512
xor eax, eax
cdq
sub eax, edx
sar eax, 1
test esi, esi
je 0x4b5529
mov ecx, 0xfffd
and word [esi + 0x10], cx
mov ecx, dword [esi + 0xc]
jmp 0x4b552e
mov ecx, 0x651f68
push eax
push ecx
call dword [sym.imp.USER32.dll_CharLowerBuffW]
push 0
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x2c]
call fcn.005b47f0
add esp, 4
test esi, esi
je 0x4b555b
mov eax, edi
lock xadd dword [esi], eax
dec eax
jne 0x4b555b
push ecx
mov ecx, esi
call fcn.005a47b0
mov esi, dword [ebp - 0x2c]
mov edx, str._install
test esi, esi
je 0x4b556c
mov ecx, dword [esi + 0xc]
jmp 0x4b5571
mov ecx, 0x651f68
test esi, esi
je 0x4b557a
mov eax, dword [esi + 4]
jmp 0x4b557c
xor eax, eax
add eax, ecx
mov dword [ebp - 0x30], eax
cmp ecx, eax
jae 0x4b55a2
mov ah, byte [edx]
test ah, ah
je 0x4b5a56
mov al, byte [ecx]
inc edx
inc ecx
cmp al, ah
jne 0x4b5a56
mov eax, dword [ebp - 0x30]
cmp ecx, eax
jb 0x4b5585
jne 0x4b5a56
cmp byte [edx], 0
jne 0x4b5a56
mov edx, str.RRSvc
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1f]
call fcn.004b79f0
mov ecx, dword [0x6ad84c]
mov edx, eax
mov eax, dword [edx]
cmp ecx, eax
je 0x4b55ee
mov dword [0x6ad84c], eax
mov dword [edx], 0
test ecx, ecx
je 0x4b55ee
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b55ee
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x1f]
test ecx, ecx
je 0x4b5604
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5604
push ecx
call fcn.005a47b0
mov edx, str.RusRoute_firewall_service
lea ecx, [ebp - 0x1f]
call fcn.004b79f0
mov ecx, dword [0x6ad850]
mov edx, eax
mov eax, dword [edx]
cmp ecx, eax
je 0x4b563d
mov dword [0x6ad850], eax
mov dword [edx], 0
test ecx, ecx
je 0x4b563d
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b563d
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x1f]
test ecx, ecx
je 0x4b5653
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5653
push ecx
call fcn.005a47b0
mov edx, str.RRSvcEvent.dll
lea ecx, [ebp - 0x1f]
call fcn.004b79f0
mov ecx, dword [0x6ad854]
mov edx, eax
mov eax, dword [edx]
cmp ecx, eax
je 0x4b568c
mov dword [0x6ad854], eax
mov dword [edx], 0
test ecx, ecx
je 0x4b568c
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b568c
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x1f]
test ecx, ecx
je 0x4b56a2
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b56a2
push ecx
call fcn.005a47b0
mov edx, 0x662500
lea ecx, [ebp - 0x1f]
call fcn.004b79f0
mov ecx, dword [0x6ad858]
mov edx, eax
mov eax, dword [edx]
cmp ecx, eax
je 0x4b56db
mov dword [0x6ad858], eax
mov dword [edx], 0
test ecx, ecx
je 0x4b56db
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b56db
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x1f]
test ecx, ecx
je 0x4b56f1
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b56f1
push ecx
call fcn.005a47b0
call fcn.004b3e60
jmp 0x4b59f9
test esi, esi
je 0x4b5a0e
mov eax, edi
lock xadd dword [esi], eax
dec eax
jne 0x4b5a0e
push ecx
mov ecx, esi
call fcn.005a47b0
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4b5a24
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5a24
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x4b5a3a
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5a3a
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x4b5a4e
lock xadd dword [ecx], edi
dec edi
jne 0x4b5a4e
push ecx
call fcn.005a47b0
mov eax, dword [ebp - 0x3c]
jmp 0x4b64d4
mov edx, str._uninstall
test esi, esi
je 0x4b5a64
mov ecx, dword [esi + 0xc]
jmp 0x4b5a69
mov ecx, 0x651f68
test esi, esi
je 0x4b5a72
mov eax, dword [esi + 4]
jmp 0x4b5a74
xor eax, eax
add eax, ecx
mov dword [ebp - 0x18], eax
cmp ecx, eax
jae 0x4b5a9d
nop dword [eax]
mov ah, byte [edx]
test ah, ah
je 0x4b5c3a
mov al, byte [ecx]
inc edx
inc ecx
cmp al, ah
jne 0x4b5c3a
mov eax, dword [ebp - 0x18]
cmp ecx, eax
jb 0x4b5a80
jne 0x4b5c3a
cmp byte [edx], 0
jne 0x4b5c3a
mov edx, str.RRSvc
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad84c]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b5ae8
mov dword [0x6ad84c], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b5ae8
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5ae8
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b5afe
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5afe
push ecx
call fcn.005a47b0
mov edx, str.RusRoute_firewall_service
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad850]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b5b36
mov dword [0x6ad850], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b5b36
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5b36
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b5b4c
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5b4c
push ecx
call fcn.005a47b0
mov edx, str.RRSvcEvent.dll
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad854]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b5b84
mov dword [0x6ad854], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b5b84
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5b84
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b5b9a
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5b9a
push ecx
call fcn.005a47b0
mov edx, 0x662500
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad858]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b5bd2
mov dword [0x6ad858], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b5bd2
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5bd2
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b5be8
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5be8
push ecx
call fcn.005a47b0
call fcn.004b4820
jmp 0x4b59f9
mov edx, str._stop
test esi, esi
je 0x4b5c48
mov ecx, dword [esi + 0xc]
jmp 0x4b5c4d
mov ecx, 0x651f68
test esi, esi
je 0x4b5c56
mov eax, dword [esi + 4]
jmp 0x4b5c58
xor eax, eax
add eax, ecx
mov dword [ebp - 0x18], eax
cmp ecx, eax
jae 0x4b5c7e
mov ah, byte [edx]
test ah, ah
je 0x4b5e91
mov al, byte [ecx]
inc edx
inc ecx
cmp al, ah
jne 0x4b5e91
mov eax, dword [ebp - 0x18]
cmp ecx, eax
jb 0x4b5c61
jne 0x4b5e91
cmp byte [edx], 0
jne 0x4b5e91
mov edx, str.RRSvc
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad84c]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b5cc9
mov dword [0x6ad84c], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b5cc9
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5cc9
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b5cdf
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5cdf
push ecx
call fcn.005a47b0
mov edx, str.RusRoute_firewall_service
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad850]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b5d17
mov dword [0x6ad850], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b5d17
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5d17
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b5d2d
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5d2d
push ecx
call fcn.005a47b0
mov edx, str.RRSvcEvent.dll
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad854]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b5d65
mov dword [0x6ad854], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b5d65
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5d65
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b5d7b
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5d7b
push ecx
call fcn.005a47b0
mov edx, 0x662500
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad858]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b5db3
mov dword [0x6ad858], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b5db3
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5db3
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b5dc9
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5dc9
push ecx
call fcn.005a47b0
call fcn.004b4d20
test esi, esi
je 0x4b5de3
mov eax, edi
lock xadd dword [esi], eax
dec eax
jne 0x4b5de3
push ecx
mov ecx, esi
call fcn.005a47b0
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4b5df9
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5df9
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x4b64be
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b64be
push ecx
call fcn.005a47b0
jmp 0x4b64be
mov edx, str._start
test esi, esi
je 0x4b5e9f
mov ecx, dword [esi + 0xc]
jmp 0x4b5ea4
mov ecx, 0x651f68
test esi, esi
je 0x4b5ead
mov eax, dword [esi + 4]
jmp 0x4b5eaf
xor eax, eax
add eax, ecx
mov dword [ebp - 0x18], eax
cmp ecx, eax
jae 0x4b5edd
nop dword [eax + eax]
mov ah, byte [edx]
test ah, ah
je 0x4b6073
mov al, byte [ecx]
inc edx
inc ecx
cmp al, ah
jne 0x4b6073
mov eax, dword [ebp - 0x18]
cmp ecx, eax
jb 0x4b5ec0
jne 0x4b6073
cmp byte [edx], 0
jne 0x4b6073
mov edx, str.RRSvc
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad84c]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b5f28
mov dword [0x6ad84c], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b5f28
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5f28
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b5f3e
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5f3e
push ecx
call fcn.005a47b0
mov edx, str.RusRoute_firewall_service
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad850]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b5f76
mov dword [0x6ad850], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b5f76
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5f76
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b5f8c
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5f8c
push ecx
call fcn.005a47b0
mov edx, str.RRSvcEvent.dll
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad854]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b5fc4
mov dword [0x6ad854], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b5fc4
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5fc4
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b5fda
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b5fda
push ecx
call fcn.005a47b0
mov edx, 0x662500
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad858]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b6012
mov dword [0x6ad858], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b6012
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b6012
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b6028
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b6028
push ecx
call fcn.005a47b0
call fcn.004b5080
jmp 0x4b5dce
mov edx, str._noservice
test esi, esi
je 0x4b6081
mov ecx, dword [esi + 0xc]
jmp 0x4b6086
mov ecx, 0x651f68
test esi, esi
je 0x4b608f
mov eax, dword [esi + 4]
jmp 0x4b6091
xor eax, eax
add eax, ecx
mov dword [ebp - 0x18], eax
cmp ecx, eax
jae 0x4b60bd
nop word [eax + eax]
mov ah, byte [edx]
test ah, ah
je 0x4b6406
mov al, byte [ecx]
inc edx
inc ecx
cmp al, ah
jne 0x4b6406
mov eax, dword [ebp - 0x18]
cmp ecx, eax
jb 0x4b60a0
jne 0x4b6406
cmp byte [edx], 0
jne 0x4b6406
mov edx, str.RRSvc
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad84c]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b6108
mov dword [0x6ad84c], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b6108
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b6108
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b611e
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b611e
push ecx
call fcn.005a47b0
mov edx, str.RusRoute_firewall_service
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad850]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b6156
mov dword [0x6ad850], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b6156
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b6156
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b616c
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b616c
push ecx
call fcn.005a47b0
mov edx, str.RRSvcEvent.dll
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad854]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b61a4
mov dword [0x6ad854], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b61a4
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b61a4
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b61ba
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b61ba
push ecx
call fcn.005a47b0
mov edx, 0x662500
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad858]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b61f2
mov dword [0x6ad858], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b61f2
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b61f2
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b6208
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b6208
push ecx
call fcn.005a47b0
call fcn.004b4d20
mov dword [ebp - 4], 0xe
jmp 0x4b6238
mov edx, str.RRSvc
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad84c]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b6270
mov dword [0x6ad84c], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b6270
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b6270
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b6286
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b6286
push ecx
call fcn.005a47b0
mov edx, str.RusRoute_firewall_service
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad850]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b62be
mov dword [0x6ad850], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b62be
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b62be
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b62d4
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b62d4
push ecx
call fcn.005a47b0
mov edx, str.RRSvcEvent.dll
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad854]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b630c
mov dword [0x6ad854], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b630c
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b630c
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b6322
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b6322
push ecx
call fcn.005a47b0
mov edx, 0x662500
lea ecx, [ebp - 0x18]
call fcn.004b79f0
mov ecx, dword [0x6ad858]
mov edx, dword [eax]
cmp ecx, edx
je 0x4b635a
mov dword [0x6ad858], edx
mov dword [eax], 0
test ecx, ecx
je 0x4b635a
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b635a
push ecx
call fcn.005a47b0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x4b6370
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b6370
push ecx
call fcn.005a47b0
mov byte [0x6ac56c], 1
call fcn.004b6830
mov eax, dword [0x6a6e7c]
mov ecx, eax
mov dword [ebp - 0x20], ecx
test ecx, ecx
jle 0x4b63bb
mov esi, eax
xor edi, edi
nop
mov eax, dword [0x6a6ed2]
mov ecx, 0x6a6ead
add eax, edi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
call fcn.0042b950
inc edi
cmp edi, esi
jl 0x4b6390
mov esi, dword [ebp - 0x2c]
or edi, 0xffffffff
mov eax, dword [0x6a6e7c]
mov ecx, dword [ebp - 0x20]
add dword [0x6a6ed2], ecx
sub eax, ecx
mov dword [0x6a6e7c], eax
jns 0x4b63d4
mov dword [0x6a6e7c], 0
mov ecx, dword [0x6a6eeb]
mov dword [0x6a6eeb], 0
test ecx, ecx
je 0x4b63f7
mov eax, edi
lock xadd dword [ecx], eax
dec eax
jne 0x4b63f7
push ecx
call fcn.005a47b0
mov dword [0x6a6ee3], 0
jmp 0x4b5dce
test esi, esi
je 0x4b641b
mov eax, edi
lock xadd dword [esi], eax
dec eax
jne 0x4b641b
push ecx
mov ecx, esi
call fcn.005a47b0
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x28]
jmp 0x4b54be
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], str.RRSvc
push eax
mov dword [ebp - 0x50], 0x4b6500
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x4b64be
push 0x10
call fcn.00606edf
mov esi, eax
add esp, 4
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov dword [esi], vtable.XTOOGetLastErrorImp.0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov dword [esi + 0xc], eax
call fcn.005d11f0
push 0x20
push str.StartServiceCtrlDispatcher__:
mov ecx, esi
call fcn.005d02c0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], vtable.XTOOLastError.0
mov byte [ebp - 4], 0x27
mov ecx, esi
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
call eax
push ecx
mov ecx, esp
push eax
call fcn.005a5400
call fcn.004b7430
mov eax, dword [esi]
add esp, 4
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x4b64d2
lock xadd dword [ecx], edi
dec edi
jne 0x4b64d2
push ecx
call fcn.005a47b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00606a47
mov esp, ebp
pop ebp
ret 0x10