Function at 0x451fe0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x499069
mov eax, dword fs:[0]
push eax
sub esp, 0xe60
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0xe58], eax
push ebx
push esi
push edi
mov eax, dword [0x4bd450]
xor eax, esp
push eax
lea eax, [esp + 0xe70]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0
mov dword [esp + 0x38], ebx
je 0x452037
mov eax, 1
jmp 0x452e41
call fcn.00405860
mov edi, eax
call fcn.004261e0
test eax, eax
je 0x452cc8
call fcn.00405860
push eax
call fcn.00426340
call fcn.00405860
cmp dword [eax + 8], 0
jne 0x452068
xor eax, eax
jmp 0x452e41
call fcn.00405860
cmp byte [eax + 0x354], 0
je 0x452061
push 0x4a7c28
push 0x4aa5cc
call fcn.00405860
mov ecx, eax
add ecx, 0x354
call fcn.00427ed0
test eax, eax
je 0x452061
push 0x4aa5cc
call fcn.00405860
add eax, 0x354
push eax
mov edx, 0x4a5b1c
mov ecx, 0x4aa5d0
lea esi, [esp + 0xc94]
call fcn.00427c30
mov dword [esp + 0xe78], 0
sub esp, 0x1c
mov eax, esi
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.004047c0
mov byte [esp + 0xe94], 1
mov byte [esp + 0xe94], 0
lea esi, [esp + 0xc8c]
call fcn.004267c0
mov byte [esp + 0xe78], 2
cmp dword [esp + 0xc84], 0
mov esi, 4
je 0x452c0c
cmp dword [esp + 0xc88], 0x10
mov edi, dword [esp + 0xc74]
jae 0x452127
lea edi, [esp + 0xc74]
call fcn.00425cf0
mov dword [esp + 0x28], eax
test eax, eax
je 0x452c0c
mov edi, 0x4aa5d4
call fcn.004261b0
test eax, eax
je 0x452bf6
cmp dword [eax + 0xc], 0x20
jne 0x452bf6
mov eax, dword [eax + 8]
mov dword [esp + 0x24], eax
test eax, eax
je 0x452bf6
mov esi, eax
jmp 0x452170
mov edi, 0x4a7cc0
mov eax, esi
call fcn.004261b0
mov dword [esp + 0x18], eax
mov edi, 0x4a7cdc
mov eax, esi
call fcn.004261b0
mov dword [esp + 0x1c], eax
mov edi, 0x4a9acc
mov eax, esi
call fcn.004261b0
mov dword [esp + 0x30], eax
mov edi, 0x4aa5d8
mov eax, esi
call fcn.004261b0
mov dword [esp + 0x2c], eax
mov edi, 0x4aa5dc
mov eax, esi
call fcn.004261b0
mov dword [esp + 0x34], eax
mov edi, 0x4a60cc
mov eax, esi
call fcn.004261b0
cmp dword [esp + 0x18], 0
mov ebx, eax
mov dword [esp + 0x14], ebx
je 0x452be8
mov edi, dword [esp + 0x18]
cmp dword [edi + 0xc], 8
jne 0x452be8
cmp dword [edi + 0x14], 0
je 0x452be8
lea ecx, [esp + 0xd54]
push ecx
call fcn.00452e80
mov byte [esp + 0xe78], 3
mov edx, dword [edi + 0x14]
lea eax, [esp + 0xd58]
mov dword [esp + 0xd54], edx
push eax
mov edx, 0x4a5b20
call fcn.00402910
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xd90], 0
test eax, eax
je 0x4522b7
cmp dword [eax + 0xc], 0x10
jne 0x4522b7
mov edx, dword [eax + 0x10]
test edx, edx
je 0x4522b7
mov eax, edx
lea esi, [eax + 1]
jmp 0x452250
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x452250
sub eax, esi
je 0x4522b7
push 3
lea ecx, [esp + 0xa70]
push edx
lea eax, [esp + 0xa70]
mov dword [esp + 0xa70], ecx
call fcn.00437740
mov byte [esp + 0xe78], 4
lea edx, [esp + 0xd58]
push edx
mov edx, dword [esp + 0xa6c]
call fcn.00402910
mov byte [esp + 0xe78], 3
mov eax, dword [esp + 0xa68]
lea ecx, [esp + 0xa6c]
cmp eax, ecx
je 0x4522b7
push eax
call fcn.00472c50
add esp, 4
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4522d6
cmp dword [eax + 0xc], 8
jne 0x4522d6
cmp dword [eax + 0x14], 0
je 0x4522d6
mov dword [esp + 0xd90], 1
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x452357
cmp dword [eax + 0xc], 0x10
jne 0x452357
mov edx, dword [eax + 0x10]
test edx, edx
je 0x452357
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4522f0
sub eax, esi
je 0x452357
lea eax, [esp + 0x454]
push 3
mov dword [esp + 0x454], eax
push edx
lea eax, [esp + 0x458]
call fcn.00437740
mov byte [esp + 0xe78], 5
mov edx, dword [esp + 0x450]
lea ecx, [esp + 0xd74]
push ecx
call fcn.00402910
mov byte [esp + 0xe78], 3
mov eax, dword [esp + 0x450]
lea edx, [esp + 0x454]
cmp eax, edx
je 0x452357
push eax
call fcn.00472c50
add esp, 4
mov eax, dword [esp + 0x34]
test eax, eax
je 0x452711
cmp dword [eax + 0xc], 0x20
jne 0x452711
mov esi, dword [eax + 8]
test esi, esi
je 0x452711
jmp 0x452380
mov edi, 0x4a7cc4
mov eax, esi
call fcn.004261b0
mov edi, eax
test edi, edi
je 0x452707
cmp dword [edi + 0xc], 8
jne 0x452707
cmp dword [edi + 0x14], 0
je 0x452707
lea eax, [esp + 0xcb4]
push eax
call fcn.00452fb0
mov byte [esp + 0xe78], 6
mov ecx, dword [edi + 0x14]
mov edi, 0x4aa5e0
mov eax, esi
mov dword [esp + 0xcb4], ecx
mov dword [esp + 0xcb8], 0xffffffff
mov dword [esp + 0xcbc], 0
call fcn.004261b0
mov ebx, eax
mov edi, 0x4aa5e4
mov eax, esi
call fcn.004261b0
mov dword [esp + 0x34], eax
mov edi, 0x4aa5e8
mov eax, esi
call fcn.004261b0
mov dword [esp + 0x2c], eax
mov edi, 0x4aa5ec
mov eax, esi
call fcn.004261b0
mov dword [esp + 0x30], eax
mov edi, 0x4aa5f0
mov eax, esi
call fcn.004261b0
mov dword [esp + 0x1c], eax
mov edi, str.vn_2
mov eax, esi
call fcn.004261b0
mov dword [esp + 0x18], eax
mov edi, 0x4aa5fc
mov eax, esi
call fcn.004261b0
mov edi, eax
mov ecx, 8
test ebx, ebx
je 0x452463
cmp dword [ebx + 0xc], ecx
jne 0x452463
mov edx, dword [ebx + 0x14]
mov dword [esp + 0xcb8], edx
mov eax, dword [esp + 0x34]
test eax, eax
je case.default.0x452478
cmp dword [eax + 0xc], ecx
jne case.default.0x452478
mov eax, dword [eax + 0x14]
cmp eax, 3
ja case.default.0x452478
jmp dword [eax*4 + 0x452e68]
mov dword [esp + 0xcbc], 0x80000000
jmp case.default.0x452478
mov dword [esp + 0xcbc], 0x80000001
jmp case.default.0x452478
mov dword [esp + 0xcbc], reloc.OLEAUT32.dll_SysReAllocString
jmp case.default.0x452478
mov dword [esp + 0xcbc], 0x80000003
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xcc0], 0
test eax, eax
je 0x4524da
cmp dword [eax + 0xc], ecx
jne 0x4524da
cmp dword [eax + 0x14], 0
je 0x4524da
mov dword [esp + 0xcc0], 1
mov eax, dword [esp + 0x30]
test eax, eax
je 0x45255b
cmp dword [eax + 0xc], 0x10
jne 0x45255b
mov edx, dword [eax + 0x10]
test edx, edx
je 0x45255b
mov eax, edx
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4524f4
sub eax, ebx
je 0x45255b
lea eax, [esp + 0x864]
push 3
mov dword [esp + 0x864], eax
push edx
lea eax, [esp + 0x868]
call fcn.00437740
mov byte [esp + 0xe78], 7
mov edx, dword [esp + 0x860]
lea ecx, [esp + 0xcc4]
push ecx
call fcn.00402910
mov byte [esp + 0xe78], 6
mov eax, dword [esp + 0x860]
lea edx, [esp + 0x864]
cmp eax, edx
je 0x45255b
push eax
call fcn.00472c50
add esp, 4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4525dc
cmp dword [eax + 0xc], 0x10
jne 0x4525dc
mov edx, dword [eax + 0x10]
test edx, edx
je 0x4525dc
mov eax, edx
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x452575
sub eax, ebx
je 0x4525dc
lea eax, [esp + 0x65c]
push 3
mov dword [esp + 0x65c], eax
push edx
lea eax, [esp + 0x660]
call fcn.00437740
mov byte [esp + 0xe78], 8
mov edx, dword [esp + 0x658]
lea ecx, [esp + 0xce0]
push ecx
call fcn.00402910
mov byte [esp + 0xe78], 6
mov eax, dword [esp + 0x658]
lea edx, [esp + 0x65c]
cmp eax, edx
je 0x4525dc
push eax
call fcn.00472c50
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x45265d
cmp dword [eax + 0xc], 0x10
jne 0x45265d
mov edx, dword [eax + 0x10]
test edx, edx
je 0x45265d
mov eax, edx
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4525f6
sub eax, ebx
je 0x45265d
lea eax, [esp + 0x148]
push 3
mov dword [esp + 0x148], eax
push edx
lea eax, [esp + 0x14c]
call fcn.00437740
mov byte [esp + 0xe78], 9
mov edx, dword [esp + 0x144]
lea ecx, [esp + 0xcfc]
push ecx
call fcn.00402910
mov byte [esp + 0xe78], 6
mov eax, dword [esp + 0x144]
lea edx, [esp + 0x148]
cmp eax, edx
je 0x45265d
push eax
call fcn.00472c50
add esp, 4
test edi, edi
je 0x4526da
cmp dword [edi + 0xc], 0x10
jne 0x4526da
mov edx, dword [edi + 0x10]
test edx, edx
je 0x4526da
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x452673
sub eax, edi
je 0x4526da
lea eax, [esp + 0x350]
push 3
mov dword [esp + 0x350], eax
push edx
lea eax, [esp + 0x354]
call fcn.00437740
mov byte [esp + 0xe78], 0xa
mov edx, dword [esp + 0x34c]
lea ecx, [esp + 0xd18]
push ecx
call fcn.00402910
mov byte [esp + 0xe78], 6
mov eax, dword [esp + 0x34c]
lea edx, [esp + 0x350]
cmp eax, edx
je 0x4526da
push eax
call fcn.00472c50
add esp, 4
lea eax, [esp + 0xcb4]
push eax
lea edi, [esp + 0xd98]
call fcn.00458550
mov byte [esp + 0xe78], 3
lea ecx, [esp + 0xcb4]
push ecx
call fcn.00453030
mov ebx, dword [esp + 0x14]
mov esi, dword [esi]
test esi, esi
jne 0x452380
mov dword [esp + 0xdac], 0
test ebx, ebx
je 0x452bbb
cmp dword [ebx + 0xc], 0x40
jne 0x452bbb
mov edi, 0x4a9a68
mov eax, ebx
call fcn.004261b0
test eax, eax
je 0x452bbb
cmp dword [eax + 0xc], 8
jne 0x452bbb
mov eax, dword [eax + 0x14]
test eax, eax
je 0x452bbb
mov dword [esp + 0xdac], eax
mov edi, 0x4aa600
mov eax, ebx
call fcn.004261b0
mov esi, eax
mov edi, 0x4a601c
mov eax, ebx
call fcn.004261b0
mov dword [esp + 0x14], eax
mov edi, 0x4aa604
mov eax, ebx
call fcn.004261b0
mov dword [esp + 0x34], eax
mov edi, 0x4a7cd8
mov eax, ebx
call fcn.004261b0
mov dword [esp + 0x2c], eax
mov edi, 0x4a9acc
mov eax, ebx
call fcn.004261b0
mov dword [esp + 0x30], eax
mov edi, 0x4aa608
mov eax, ebx
call fcn.004261b0
mov dword [esp + 0x1c], eax
mov edi, 0x4aa60c
mov eax, ebx
call fcn.004261b0
mov dword [esp + 0x18], eax
mov edi, 0x4aa610
mov eax, ebx
call fcn.004261b0
mov dword [esp + 0x3c], eax
mov edi, 0x4aa5e8
mov eax, ebx
call fcn.004261b0
mov dword [esp + 0x20], eax
mov dword [esp + 0xdb0], 0
test esi, esi
je 0x45280f
cmp dword [esi + 0xc], 8
jne 0x45280f
mov esi, dword [esi + 0x14]
test esi, esi
je 0x45280f
mov dword [esp + 0xdb0], esi
mov eax, dword [esp + 0x14]
mov ebx, 0x10
test eax, eax
je 0x452897
cmp dword [eax + 0xc], ebx
jne 0x452897
mov edx, dword [eax + 0x10]
test edx, edx
je 0x452897
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x452830
sub eax, esi
je 0x452897
lea eax, [esp + 0x558]
push 3
mov dword [esp + 0x558], eax
push edx
lea eax, [esp + 0x55c]
call fcn.00437740
mov byte [esp + 0xe78], 0xb
mov edx, dword [esp + 0x554]
lea ecx, [esp + 0xe10]
push ecx
call fcn.00402910
mov byte [esp + 0xe78], 3
mov eax, dword [esp + 0x554]
lea edx, [esp + 0x558]
cmp eax, edx
je 0x452897
push eax
call fcn.00472c50
add esp, 4
mov eax, dword [esp + 0x34]
test eax, eax
je 0x452917
cmp dword [eax + 0xc], ebx
jne 0x452917
mov edx, dword [eax + 0x10]
test edx, edx
je 0x452917
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4528b0
sub eax, esi
je 0x452917
lea eax, [esp + 0x760]
push 3
mov dword [esp + 0x760], eax
push edx
lea eax, [esp + 0x764]
call fcn.00437740
mov byte [esp + 0xe78], 0xc
mov edx, dword [esp + 0x75c]
lea ecx, [esp + 0xe2c]
push ecx
call fcn.00402910
mov byte [esp + 0xe78], 3
mov eax, dword [esp + 0x75c]
lea edx, [esp + 0x760]
cmp eax, edx
je 0x452917
push eax
call fcn.00472c50
add esp, 4
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x452a02
cmp dword [eax + 0xc], 0x20
jne 0x452a02
mov edi, dword [eax + 8]
test edi, edi
je 0x452a02
jmp 0x452940
cmp dword [edi + 0xc], ebx
jne 0x4529f8
mov edx, dword [edi + 0x10]
test edx, edx
je 0x4529f8
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x452960
sub eax, esi
je 0x4529f8
lea eax, [esp + 0x968]
push 3
mov dword [esp + 0x968], eax
push edx
lea eax, [esp + 0x96c]
call fcn.00437740
mov byte [esp + 0xe78], 0xd
mov edx, dword [esp + 0x964]
lea eax, [esp + 0xd38]
call fcn.004028a0
mov byte [esp + 0xe78], 0xf
mov eax, dword [esp + 0x964]
lea ecx, [esp + 0x968]
cmp eax, ecx
je 0x4529ca
push eax
call fcn.00472c50
add esp, 4
lea edx, [esp + 0xd38]
push edx
lea eax, [esp + 0xe4c]
push eax
call fcn.0042b390
mov byte [esp + 0xe78], 3
lea esi, [esp + 0xd38]
call fcn.00428ca0
mov ebx, 0x10
mov edi, dword [edi]
test edi, edi
jne 0x452940
mov eax, dword [esp + 0x30]
test eax, eax
je 0x452a87
cmp dword [eax + 0xc], ebx
jne 0x452a87
mov edx, dword [eax + 0x10]
test edx, edx
je 0x452a87
mov eax, edx
lea esi, [eax + 1]
jmp 0x452a20
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x452a20
sub eax, esi
je 0x452a87
push 3
lea ecx, [esp + 0xb74]
push edx
lea eax, [esp + 0xb74]
mov dword [esp + 0xb74], ecx
call fcn.00437740
mov byte [esp + 0xe78], 0x10
lea edx, [esp + 0xdb4]
push edx
mov edx, dword [esp + 0xb70]
call fcn.00402910
mov byte [esp + 0xe78], 3
mov eax, dword [esp + 0xb6c]
lea ecx, [esp + 0xb70]
cmp eax, ecx
je 0x452a87
push eax
call fcn.00472c50
add esp, 4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x452b07
cmp dword [eax + 0xc], ebx
jne 0x452b07
mov edx, dword [eax + 0x10]
test edx, edx
je 0x452b07
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x452aa0
sub eax, esi
je 0x452b07
lea eax, [esp + 0x24c]
push 3
mov dword [esp + 0x24c], eax
push edx
lea eax, [esp + 0x250]
call fcn.00437740
mov byte [esp + 0xe78], 0x11
mov edx, dword [esp + 0x248]
lea ecx, [esp + 0xdd0]
push ecx
call fcn.00402910
mov byte [esp + 0xe78], 3
mov eax, dword [esp + 0x248]
lea edx, [esp + 0x24c]
cmp eax, edx
je 0x452b07
push eax
call fcn.00472c50
add esp, 4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x452b75
cmp dword [eax + 0xc], ebx
jne 0x452b75
mov edx, dword [eax + 0x10]
test edx, edx
je 0x452b75
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x452b20
sub eax, esi
je 0x452b75
lea eax, [esp + 0x44]
push 3
mov dword [esp + 0x44], eax
push edx
lea eax, [esp + 0x48]
call fcn.00437740
mov byte [esp + 0xe78], 0x12
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0xdec]
push ecx
call fcn.00402910
mov byte [esp + 0xe78], 3
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x44]
cmp eax, edx
je 0x452b75
push eax
call fcn.00472c50
add esp, 4
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xe08], 0
test eax, eax
je 0x452b9f
cmp dword [eax + 0xc], 8
jne 0x452b9f
cmp dword [eax + 0x14], 0
je 0x452b9f
mov dword [esp + 0xe08], 1
mov eax, dword [esp + 0x20]
test eax, eax
je 0x452bbb
cmp dword [eax + 0xc], 8
jne 0x452bbb
mov eax, dword [eax + 0x14]
test eax, eax
je 0x452bbb
mov dword [esp + 0xe0c], eax
mov edi, dword [esp + 0x38]
lea eax, [esp + 0xd54]
push eax
add edi, 0x54
call fcn.00458850
mov byte [esp + 0xe78], 2
lea ecx, [esp + 0xd54]
push ecx
call fcn.00452f00
mov esi, dword [esp + 0x24]
mov esi, dword [esi]
mov dword [esp + 0x24], esi
test esi, esi
jne 0x452170
mov edx, dword [esp + 0x28]
push edx
call fcn.004257c0
mov ebx, dword [esp + 0x3c]
add esp, 4
mov esi, 4
mov ecx, dword [ebx + 0x64]
sub ecx, dword [ebx + 0x60]
mov eax, 0x7a44c6b
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x452c9d
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x20]
push eax
push str.Installed
push str.SYSTEMCurrentControlSetServices360bpsvc
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x452c63
cmp dword [esp + 0x24], eax
jne 0x452c95
push esi
lea ecx, [esp + 0x28]
push ecx
push esi
push str.Installed
push str.SYSTEMCurrentControlSetServices360bpsvc
mov edi, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebx + 0x50], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x452c9a
mov edi, 1
mov dword [ebx + 4], edi
mov byte [esp + 0xe78], 0
lea ecx, [esp + 0xc70]
call fcn.00402f50
mov dword [esp + 0xe78], 0xffffffff
lea ecx, [esp + 0xc8c]
call fcn.00402f50
cmp dword [ebx + 4], 0
jne 0x452e3e
sub esp, 0x1c
mov edx, str.rival
mov eax, esp
mov dword [esp + 0x44], esp
call fcn.004028a0
mov dword [esp + 0xe94], 0x13
mov dword [esp + 0xe94], 0xffffffff
lea edi, [esp + 0xca8]
call fcn.0043aae0
mov dword [esp + 0xe78], 0x14
sub esp, 0x1c
mov edx, str.init
mov eax, esp
xor esi, esi
mov dword [esp + 0x44], esp
call fcn.004028a0
mov byte [esp + 0xe94], 0x15
mov edx, edi
push edx
mov byte [esp + 0xe98], 0x14
mov ecx, esi
call fcn.0043b320
lea eax, [esp + 0xc70]
push eax
call fcn.00405860
push eax
call fcn.00426590
mov bl, 0x16
mov byte [esp + 0xe78], bl
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x44], esp
xor ecx, ecx
push 0xffffffffffffffff
push ecx
lea edx, [esp + 0xc94]
mov dword [eax + 0x18], 7
mov dword [eax + 0x14], esi
push edx
mov word [eax + 4], cx
call fcn.00402a90
mov byte [esp + 0xe94], 0x17
sub esp, 0x1c
mov edx, str.datver
mov eax, esp
mov dword [esp + 0x58], esp
call fcn.004028a0
mov byte [esp + 0xeb0], 0x18
mov byte [esp + 0xeb0], bl
mov ecx, edi
call fcn.0043b220
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x4a5b1c
call fcn.00403370
mov byte [esp + 0xe94], 0x19
mov byte [esp + 0xe94], bl
mov esi, edi
call fcn.0043acf0
mov byte [esp + 0xe78], 0x14
cmp dword [esp + 0xc88], 8
jb 0x452e02
mov eax, dword [esp + 0xc74]
push eax
call fcn.00471eaf
add esp, 4
xor ecx, ecx
mov dword [esp + 0xc88], 7
mov dword [esp + 0xc84], 0
mov word [esp + 0xc74], cx
mov dword [esp + 0xe78], 0xffffffff
lea edx, [esp + 0xc8c]
push edx
call fcn.0043ac50
mov ebx, dword [esp + 0x38]
mov eax, dword [ebx + 4]
mov ecx, dword [esp + 0xe70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe58]
xor ecx, esp
call fcn.00471eba
mov esp, ebp
pop ebp
ret 4