Function at 0x4b3a80
Capabilities:
Create service

Disassembly:
push 0xffffffffffffffff
push 0x4d49f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x644
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x4c]
call fcn.0046ceb0
xor ebx, ebx
lea ecx, [esp + 0x90]
mov dword [esp + 0x65c], ebx
call fcn.0046ceb0
mov al, byte [esp + 0x13]
push ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x660], 1
mov byte [esp + 0x18], al
call fcn.00406ad6
mov ecx, dword [0x4d68ec]
mov edx, dword [esp + 0x678]
push ecx
push ebx
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x668], 2
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.0040b3b2
mov eax, dword [esp + 0x664]
mov byte [esp + 0x65c], 3
mov dword [esp + 0x30], ebx
mov eax, dword [eax + 4]
cmp eax, ebx
jne 0x4b3b1f
mov eax, 0x4d68e8
push eax
push str.UTILITY.INF:__CreateService__entered_for__s_n
push 0x503ff0
call fcn.00423100
mov esi, dword [esp + 0x68c]
add esp, 0xc
mov ecx, esi
push ebx
push 0x1391
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0046d3e0
mov ecx, esi
call fcn.0046d9f0
test eax, eax
je 0x4b3b95
push str.UTILITY.INF:_could_not_open_Services_base_key_n
push 0x503ff0
call fcn.00423100
mov eax, dword [esp + 0x2c]
add esp, 8
cmp eax, ebx
mov byte [esp + 0x65c], 1
je 0x4b3b85
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x24], ebx
push 1
lea ecx, [esp + 0x18]
call fcn.00406ad6
jmp 0x4b4727
mov edi, str.system
or ecx, 0xffffffff
xor eax, eax
mov esi, dword [esp + 0x670]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + 8]
push str.system
push ecx
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b3bd0
mov esi, 2
mov ebp, 3
jmp 0x4b3e56
mov edi, str.systemstart
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esi + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.systemstart
push edx
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b3c04
mov esi, 2
mov ebp, 1
jmp 0x4b3e56
mov edi, str.systemauto
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi + 8]
not ecx
dec ecx
push ecx
push str.systemauto
push eax
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b3c35
mov esi, 2
mov ebp, esi
jmp 0x4b3e56
mov edi, str.adapter
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + 8]
push str.adapter
push ecx
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
je 0x4b4081
mov edi, str.kernelauto
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esi + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.kernelauto
push edx
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b3c8f
mov esi, 1
mov ebp, esi
jmp 0x4b3e56
mov edi, str.autoserviceshare
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi + 8]
not ecx
dec ecx
push ecx
push str.autoserviceshare
push eax
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b3cc3
mov esi, 0x20
mov ebp, 2
jmp 0x4b3dc6
mov edi, str.transport
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + 8]
push str.transport
push ecx
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b3cf7
mov esi, 2
mov ebp, 3
jmp 0x4b3e56
mov edi, str.kernel
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esi + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.kernel
push edx
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b3d2b
mov esi, 1
mov ebp, 3
jmp 0x4b3e56
mov edi, str.kernelautostart
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi + 8]
not ecx
dec ecx
push ecx
push str.kernelautostart
push eax
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b3d5f
mov esi, 1
mov ebp, 2
jmp 0x4b3e56
mov edi, str.kerneldisable
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + 8]
push str.kerneldisable
push ecx
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b3d93
mov esi, 1
mov ebp, 4
jmp 0x4b3e56
mov edi, str.service
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esi + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.service
push edx
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b3fd8
mov esi, 0x10
mov ebp, 3
cmp dword [esp + 0x1c], ebx
jne 0x4b3e56
mov al, byte [esp + 0x13]
push ebx
lea ecx, [esp + 0x38]
mov byte [esp + 0x38], al
call fcn.00406ad6
mov edi, str.LocalSystem
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x65c], 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x44], ebx
push ecx
push str.LocalSystem
lea ecx, [esp + 0x3c]
mov dword [esp + 0x50], ebx
call fcn.0040695a
mov ecx, dword [0x4d68ec]
lea edx, [esp + 0x34]
push ecx
push ebx
push edx
lea ecx, [esp + 0x20]
mov byte [esp + 0x668], 5
call fcn.0040b3b2
mov eax, dword [esp + 0x44]
mov byte [esp + 0x65c], 3
cmp eax, ebx
je 0x4b3e4b
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x44], ebx
push 1
lea ecx, [esp + 0x38]
call fcn.00406ad6
lea ecx, [esp + 0xbc]
call fcn.0046ceb0
mov edi, dword [esp + 0x664]
mov ecx, dword [esp + 0x680]
push ebx
push edi
mov byte [esp + 0x664], 6
call fcn.004a8f80
push eax
lea ecx, [esp + 0xc8]
call fcn.0046d070
test eax, eax
je 0x4b4230
mov eax, dword [edi + 4]
cmp eax, ebx
jne 0x4b3ea0
mov eax, 0x4d68e8
push eax
push str.UTILITY.INF:_service_key__s_already_existed_n
push 0x503ff0
call fcn.00423100
add esp, 0xc
lea eax, [esp + 0x2c]
lea ecx, [esp + 0xbc]
push ebx
push eax
push 0xce0
call fcn.0046dab0
cmp dword [esp + 0x2c], 1
jne 0x4b4230
mov cl, byte [esp + 0x13]
push ebx
mov byte [esp + 0x7c], cl
lea ecx, [esp + 0x7c]
call fcn.00406ad6
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dl, byte [esp + 0x13]
push ebx
lea ecx, [esp + 0x38]
mov byte [esp + 0x660], 7
mov byte [esp + 0x38], dl
call fcn.00406ad6
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov eax, dword [0x5041d4]
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
cmp eax, ebx
mov byte [esp + 0x65c], 8
jne 0x4b3f61
push str.m_hInstance___0
lea eax, [esp + 0x248]
push str.ASSERT__s_
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x244]
push ecx
push 0x558
push str..isoutils.h
mov ecx, 0x503ff0
call fcn.00423080
mov eax, dword [0x5041d4]
lea edx, [esp + 0x140]
push 0x104
push edx
push 0x2c1
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
cmp eax, ebx
je 0x4b4098
lea edi, [esp + 0x140]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [esp + 0x7c]
push ebx
call fcn.00406a51
test al, al
je 0x4b40b9
mov edi, dword [esp + 0x7c]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0x140]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x7c]
call fcn.0042bb00
jmp 0x4b40b9
mov edi, str.serviceauto
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi + 8]
not ecx
dec ecx
push ecx
push str.serviceauto
push eax
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b400c
mov esi, 0x10
mov ebp, 2
jmp 0x4b3dc6
mov edi, str.servicedisable
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esi + 8]
push str.servicedisable
push ecx
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b4040
mov esi, 0x10
mov ebp, 4
jmp 0x4b3dc6
mov edi, str.serviceshare
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esi + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.serviceshare
push edx
push ebx
mov ecx, esi
call fcn.00422f89
cmp eax, ebx
jne 0x4b406f
mov esi, 0x20
jmp 0x4b3dc1
push str.UTILITY.INF:__CreateService__Unrecognized_TypeOfService_parameter_n
push 0x503ff0
call fcn.00423100
add esp, 8
mov dword [esp + 0x30], 1
mov esi, 4
mov ebp, 3
jmp 0x4b3e56
push str..UtilityInf.cpp
push 0x231
push str.Message.LoadString_IDS_REBOOT_BEFORE_ADD_
lea eax, [esp + 0x250]
push str.__s____d__in___s_
push eax
call ebp
add esp, 0x14
mov eax, dword [0x5041d4]
test eax, eax
jne 0x4b40f5
push str.m_hInstance___0
lea ecx, [esp + 0x248]
push str.ASSERT__s_
push ecx
call ebp
add esp, 0xc
lea edx, [esp + 0x244]
mov ecx, 0x503ff0
push edx
push 0x558
push str..isoutils.h
call fcn.00423080
mov ecx, dword [0x5041d4]
lea eax, [esp + 0x140]
push 0x104
push eax
push 0xcb
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x4b4162
lea edi, [esp + 0x140]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x38]
push ebp
call fcn.00406a51
test al, al
je 0x4b4183
mov edi, dword [esp + 0x38]
mov ecx, ebp
mov edx, ecx
lea esi, [esp + 0x140]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x38]
call fcn.0042bb00
jmp 0x4b4183
push str..UtilityInf.cpp
push 0x232
push str.Title.LoadString_IDS_MESSAGE_TITLE_SETUP_
lea eax, [esp + 0x250]
push str.__s____d__in___s_
push eax
call ebp
add esp, 0x14
mov eax, dword [esp + 0x7c]
xor esi, esi
cmp eax, esi
jne 0x4b4192
mov eax, 0x4d68e8
push eax
push 0x503ff0
call fcn.00423100
mov eax, dword [esp + 0x4c]
add esp, 8
cmp eax, esi
mov byte [esp + 0x65c], 7
je 0x4b41bd
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x44], esi
push 1
lea ecx, [esp + 0x38]
call fcn.00406ad6
mov eax, dword [esp + 0x88]
mov byte [esp + 0x65c], 6
cmp eax, esi
je 0x4b41eb
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x88], esi
push 1
lea ecx, [esp + 0x7c]
call fcn.00406ad6
lea ecx, [esp + 0xbc]
mov byte [esp + 0x65c], 3
call fcn.0046cf30
mov eax, dword [esp + 0x24]
mov byte [esp + 0x65c], 1
cmp eax, esi
je 0x4b42d6
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x24], esi
jmp 0x4b42d6
mov eax, dword [esp + 0x30]
cmp eax, ebx
mov eax, dword [edi + 4]
je 0x4b43f3
cmp eax, ebx
jne 0x4b4248
mov eax, 0x4d68e8
push eax
push str.UTILITY.INF:__CreateService___s_using_Registry_n
push 0x503ff0
call fcn.00423100
mov ecx, dword [esp + 0x68c]
add esp, 0xc
push ebx
push 1
push edi
call fcn.004a8f80
push eax
lea ecx, [esp + 0x5c]
call fcn.0046d490
lea ecx, [esp + 0x4c]
call fcn.0046d9f0
test eax, eax
je 0x4b4310
mov eax, dword [edi + 4]
cmp eax, ebx
jne 0x4b4292
mov eax, 0x4d68e8
push eax
push str.UTILITY.INF:_could_not_create_service_key__s_n
push 0x503ff0
call fcn.00423100
add esp, 0xc
lea ecx, [esp + 0xbc]
mov byte [esp + 0x65c], 3
call fcn.0046cf30
mov eax, dword [esp + 0x24]
mov byte [esp + 0x65c], 1
cmp eax, ebx
je 0x4b42d6
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x24], ebx
push 1
lea ecx, [esp + 0x18]
call fcn.00406ad6
lea ecx, [esp + 0x90]
mov byte [esp + 0x65c], 0
call fcn.0046cf30
lea ecx, [esp + 0x4c]
mov dword [esp + 0x65c], 0xffffffff
call fcn.0046cf30
xor eax, eax
jmp 0x4b48bb
push esi
push 0x139d
lea ecx, [esp + 0x54]
call fcn.0046e640
push ebp
push 0x138d
lea ecx, [esp + 0x54]
call fcn.0046e640
mov ecx, dword [esp + 0x68c]
push ecx
push 0x13a4
lea ecx, [esp + 0x54]
call fcn.0046e640
cmp esi, 4
jbe 0x4b436b
push ebx
lea edx, [esp + 0x18]
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
call fcn.0040907d
push 0x13a5
lea ecx, [esp + 0x6c]
call fcn.0046e800
mov eax, dword [esp + 0x674]
cmp dword [eax + 8], ebx
je 0x4b4395
push ebx
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.0040907d
push 0x1394
lea ecx, [esp + 0x6c]
call fcn.0046e800
mov eax, dword [esp + 0x66c]
cmp dword [eax + 8], ebx
je 0x4b43c0
push 1
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.0040907d
push 0x138e
lea ecx, [esp + 0x6c]
call fcn.0046e800
mov eax, dword [esp + 0x668]
cmp dword [eax + 8], ebx
je 0x4b45b0
push ebx
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.0040907d
push 0x138f
lea ecx, [esp + 0x6c]
call fcn.0046e800
jmp 0x4b45b0
cmp eax, ebx
jne 0x4b43fc
mov eax, 0x4d68e8
push eax
push str.UTILITY.INF:__CreateService___s_using_CreateService___wrapper_n
push 0x503ff0
call fcn.00423100
add esp, 0xc
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
jne 0x4b4474
lea ecx, [esp + 0xbc]
mov byte [esp + 0x65c], 3
call fcn.0046cf30
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4b444b
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x4b471b
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x4b4712
cmp al, 0xff
je 0x4b4712
dec al
mov byte [ecx], al
jmp 0x4b471b
mov eax, dword [esp + 0x674]
mov eax, dword [eax + 4]
cmp eax, ebx
mov ebx, 0x4d68e8
je 0x4b4489
mov ebx, eax
mov ecx, dword [esp + 0x66c]
mov edx, dword [ecx + 4]
test edx, edx
jne 0x4b449c
mov edx, 0x4d68e8
mov eax, dword [esp + 0x668]
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x4b44af
mov ecx, 0x4d68e8
mov eax, dword [esp + 0x664]
mov eax, dword [eax + 4]
test eax, eax
jne 0x4b44c2
mov eax, 0x4d68e8
push 0
push 0
push 0
push 0
push ebx
push edx
mov edx, dword [esp + 0x6a4]
push edx
push ebp
push esi
push 0xf01ff
push ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
test eax, eax
jne 0x4b4582
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea ecx, [esp + 0xbc]
mov byte [esp + 0x65c], 3
call fcn.0046cf30
mov eax, dword [esp + 0x24]
xor esi, esi
cmp eax, esi
je 0x4b4524
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x24], esi
mov ecx, dword [esp + 0x18]
cmp ecx, esi
je 0x4b4547
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x4b453e
cmp al, 0xff
je 0x4b453e
dec al
mov byte [ecx], al
jmp 0x4b4547
push ecx
call fcn.004be17b
add esp, 4
lea ecx, [esp + 0x90]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov byte [esp + 0x65c], 0
call fcn.0046cf30
lea ecx, [esp + 0x4c]
mov dword [esp + 0x65c], 0xffffffff
call fcn.0046cf30
xor eax, eax
jmp 0x4b48bb
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push edi
call esi
mov eax, dword [esp + 0x664]
mov ecx, dword [esp + 0x680]
push 1
push eax
call fcn.004a8f80
push eax
lea ecx, [esp + 0x58]
call fcn.0046d070
xor ebx, ebx
push ebx
push 1
push 0x1390
lea ecx, [esp + 0x58]
call fcn.004a8f80
mov esi, dword [esp + 0x690]
push eax
mov ecx, esi
call fcn.0046d810
mov ecx, esi
call fcn.0046d9f0
test eax, eax
je 0x4b462d
lea ecx, [esp + 0xbc]
mov byte [esp + 0x65c], 3
call fcn.0046cf30
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4b4604
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x4b471b
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x4b4712
cmp al, 0xff
je 0x4b4712
dec al
mov byte [ecx], al
jmp 0x4b471b
push ebx
push 1
push 0x13ae
lea ecx, [esp + 0x58]
call fcn.004a8f80
mov esi, dword [esp + 0x694]
push eax
mov ecx, esi
call fcn.0046d810
mov ecx, esi
call fcn.0046d9f0
test eax, eax
je 0x4b469f
lea ecx, [esp + 0xbc]
mov byte [esp + 0x65c], 3
call fcn.0046cf30
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4b4681
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x4b471b
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x4b4712
cmp al, 0xff
je 0x4b4712
dec al
mov byte [ecx], al
jmp 0x4b471b
push ebx
push 1
push 0x13af
mov ecx, esi
call fcn.004a8f80
push eax
lea ecx, [esp + 0xa0]
call fcn.0046d810
lea ecx, [esp + 0x90]
call fcn.0046d9f0
test eax, eax
je 0x4b4756
lea ecx, [esp + 0xbc]
mov byte [esp + 0x65c], 3
call fcn.0046cf30
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4b46f8
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x4b471b
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x4b4712
cmp al, 0xff
je 0x4b4712
dec al
mov byte [ecx], al
jmp 0x4b471b
push ecx
call fcn.004be17b
add esp, 4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x90]
mov byte [esp + 0x65c], 0
call fcn.0046cf30
lea ecx, [esp + 0x4c]
mov dword [esp + 0x65c], 0xffffffff
call fcn.0046cf30
xor eax, eax
jmp 0x4b48bb
mov esi, dword [esp + 0x67c]
cmp dword [esi + 8], ebx
je 0x4b4836
lea ecx, [esp + 0x114]
call fcn.0046ceb0
push 0
mov bl, 9
push 0x13b2
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x120]
mov byte [esp + 0x668], bl
call fcn.0046d3e0
test eax, eax
je 0x4b4820
lea ecx, [esp + 0xe8]
call fcn.0046ceb0
mov ecx, dword [esp + 0x664]
push 0
push 1
push ecx
lea ecx, [esp + 0x120]
mov byte [esp + 0x668], 0xa
call fcn.004a8f80
push eax
lea ecx, [esp + 0xf8]
call fcn.0046d490
test eax, eax
je 0x4b480d
push 1
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x48], esp
push esi
call fcn.0040907d
push 0x13b3
lea ecx, [esp + 0x108]
call fcn.0046e800
push 7
push 0x13b4
lea ecx, [esp + 0xf0]
call fcn.0046e640
lea ecx, [esp + 0xe8]
mov byte [esp + 0x65c], bl
call fcn.0046cf30
lea ecx, [esp + 0x114]
mov byte [esp + 0x65c], 6
call fcn.0046cf30
xor ebx, ebx
lea ecx, [esp + 0xbc]
mov byte [esp + 0x65c], 3
call fcn.0046cf30
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4b485f
push eax
call fcn.004be17b
add esp, 4
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x4b4882
mov al, byte [ecx - 1]
dec ecx
test al, al
je 0x4b4879
cmp al, 0xff
je 0x4b4879
dec al
mov byte [ecx], al
jmp 0x4b4882
push ecx
call fcn.004be17b
add esp, 4
lea ecx, [esp + 0x90]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x65c], 0
call fcn.0046cf30
lea ecx, [esp + 0x4c]
mov dword [esp + 0x65c], 0xffffffff
call fcn.0046cf30
mov eax, 1
mov ecx, dword [esp + 0x654]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x650
ret 0x2c