Function at 0x4a1720
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Link many functions at runtime
Persist via windows service
Query or enumerate registry value
Read .ini file
Set registry value
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6a4
mov eax, dword [0x5552b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
push str.wmcHook.Dll
call esi
push str.wmcMemmgr.dll
mov dword [0x5688ac], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.fnIRPAlloc
push eax
mov dword [0x5688a8], eax
call esi
mov dword [0x5662e0], eax
mov eax, dword [0x5688a8]
push str.fnIRPFree
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnIRPAllocSourNet
push ecx
mov dword [0x5662e4], eax
call esi
mov edx, dword [0x5688a8]
push str.fnIRPFreeSourNet
push edx
mov dword [0x5662e8], eax
call esi
mov dword [0x5662ec], eax
mov eax, dword [0x5688a8]
push str.fnIRPSetSourNet
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnIRPCopyTo
push ecx
mov dword [0x5662f0], eax
call esi
mov edx, dword [0x5688a8]
push str.fnIRPAllocDestNet
push edx
mov dword [0x56631c], eax
call esi
mov dword [0x5662f4], eax
mov eax, dword [0x5688a8]
push str.fnIRPFreeDestNet
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnIRPSetDestNet
push ecx
mov dword [0x5662f8], eax
call esi
mov edx, dword [0x5688a8]
push str.fnIRPAppendDestNet
push edx
mov dword [0x5662fc], eax
call esi
mov dword [0x566300], eax
mov eax, dword [0x5688a8]
push str.fnIRPAllocPipe
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnIRPFreePipe
push ecx
mov dword [0x566304], eax
call esi
mov edx, dword [0x5688a8]
push str.fnIRPAllocBuf
push edx
mov dword [0x566308], eax
call esi
mov dword [0x56630c], eax
mov eax, dword [0x5688a8]
push str.fnIRPFreeBuf
push eax
call esi
mov dword [0x566310], eax
push str.fnIRPSetBuf
mov ecx, dword [0x5688a8]
push ecx
call esi
mov edx, dword [0x5688a8]
push str.fnIRPAppendBuf
push edx
mov dword [0x566314], eax
call esi
mov dword [0x566318], eax
mov eax, dword [0x5688a8]
push str.fnObjectAlloc
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnObjectReset
push ecx
mov dword [0x566320], eax
call esi
mov edx, dword [0x5688a8]
push str.fnObjectFree
push edx
mov dword [0x566324], eax
call esi
mov dword [0x566328], eax
mov eax, dword [0x5688a8]
push str.fnObjectCopyTo
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnObjectSetValueByInt
push ecx
mov dword [0x56632c], eax
call esi
mov edx, dword [0x5688a8]
push str.fnObjectGetValueByInt
push edx
mov dword [0x566330], eax
call esi
mov dword [0x566334], eax
mov eax, dword [0x5688a8]
push str.fnObjectModifyValueByInt
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnObjectSetValueByStringW
push ecx
mov dword [0x566338], eax
call esi
mov edx, dword [0x5688a8]
push str.fnObjectAppendValueByStringW
push edx
mov dword [0x56633c], eax
call esi
mov dword [0x566340], eax
mov eax, dword [0x5688a8]
push str.fnObjectGetValueSizeByStringW
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnObjectGetValueByStringW
push ecx
mov dword [0x566344], eax
call esi
mov edx, dword [0x5688a8]
push str.fnObjectSetValueByStringA
push edx
mov dword [0x566348], eax
call esi
mov dword [0x56634c], eax
mov eax, dword [0x5688a8]
push str.fnObjectAppendValueByStringA
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnObjectGetValueSizeByStringA
push ecx
mov dword [0x566350], eax
call esi
mov edx, dword [0x5688a8]
mov dword [0x566354], eax
push str.fnObjectGetValueByStringA
push edx
call esi
mov dword [0x566358], eax
mov eax, dword [0x5688a8]
push str.fnObjectSetValueByByte
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnObjectAppendValueByByte
push ecx
mov dword [0x56635c], eax
call esi
mov edx, dword [0x5688a8]
push str.fnObjectGetValueSizeByByte
push edx
mov dword [0x566360], eax
call esi
mov dword [0x566364], eax
mov eax, dword [0x5688a8]
push str.fnObjectGetValueByByte
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnObjectSetValueByEmpty
push ecx
mov dword [0x566368], eax
call esi
mov edx, dword [0x5688a8]
push str.fnMemoryAllocByStringW
push edx
mov dword [0x56636c], eax
call esi
mov dword [0x566370], eax
mov eax, dword [0x5688a8]
push str.fnMemoryResetByStringW
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnMemoryFreeByStringW
push ecx
mov dword [0x566374], eax
call esi
mov edx, dword [0x5688a8]
push str.fnMemoryAllocByStringA
push edx
mov dword [0x566378], eax
call esi
mov dword [0x56637c], eax
mov eax, dword [0x5688a8]
push str.fnMemoryResetByStringA
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnMemoryFreeByStringA
push ecx
mov dword [0x566380], eax
call esi
mov edx, dword [0x5688a8]
push str.fnMemoryAllocByByte
push edx
mov dword [0x566384], eax
call esi
mov dword [0x566388], eax
mov eax, dword [0x5688a8]
push str.fnMemoryResetByByte
push eax
call esi
mov ecx, dword [0x5688a8]
push str.fnMemoryFreeByByte
push ecx
mov dword [0x56638c], eax
call esi
mov edx, dword [0x5688a8]
push str.fnMemoryNetAlloc
push edx
mov dword [0x566390], eax
call esi
mov dword [0x566394], eax
mov eax, dword [0x5688a8]
push str.fnMemoryNetFree
push eax
call esi
mov dword [0x566398], eax
call fcn.004a1620
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
cmp byte [0x568461], 0
jne 0x4a1afa
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x4a1b00
mov byte [0x568461], 1
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.004a2810
call fcn.004ce8d0
call fcn.004bc1b0
push 0x38
push 0
push 0x566278
call fcn.004e8ba0
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
add esp, 0xc
push 0x400
push 0x565dd8
call edi
push 0x400
push 0x565df0
call edi
push 0x400
push 0x565e08
call edi
push 0x400
push 0x565e20
call edi
push 0x400
push 0x565e38
call edi
push 0x400
push 0x565e50
call edi
push 0x400
push 0x565e68
call edi
push 0x400
push 0x565e80
call edi
push 0x400
push 0x565e98
call edi
push 0x400
push 0x565eb0
call edi
push 0x400
push 0x565ec8
call edi
push 0x400
push 0x565ee0
call edi
push 0x400
push 0x565ef8
call edi
push 0x400
push 0x565f10
call edi
push 0x250
push 0
push 0x565f90
call fcn.004e8ba0
add esp, 0xc
mov esi, 0x568c74
xor ebx, ebx
lea esp, [esp]
xor eax, eax
push 0x400
lea ecx, [esi - 0x18]
push ecx
mov dword [ebx + 0x5688b0], eax
mov dword [ebx + 0x568930], eax
mov dword [ebx + 0x5689b0], eax
call edi
push 0x400
push esi
call edi
push 0x400
lea edx, [esi + 0x18]
push edx
call edi
push 0x400
lea eax, [esi + 0x30]
push eax
call edi
push 0x400
lea ecx, [esi + 0x48]
push ecx
call edi
push 0x400
lea edx, [esi + 0x60]
push edx
call edi
push 0x400
lea eax, [esi + 0x78]
push eax
call edi
push 0x400
lea ecx, [esi + 0x90]
push ecx
call edi
push 0x400
lea edx, [esi + 0xa8]
push edx
call edi
push 0x400
lea eax, [esi + 0xc0]
push eax
call edi
add esi, 0x244
add ebx, 4
cmp esi, 0x56d4f4
jl 0x4a1bf0
push 0x400
push 0x565f30
call edi
push 0x400
push 0x565f48
call edi
push 0x400
push 0x565f60
call edi
push 0x400
push 0x565f78
call edi
push 0x400
push 0x5662b0
call edi
push 0x400
push 0x566260
call edi
push 0x400
push 0x5662c8
call edi
push 0x400
push 0x565dbc
call edi
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
xor esi, esi
push 0x10
call fcn.004e5420
xor ecx, ecx
mov dword [esi*4 + 0x5688b0], eax
add esp, 4
mov dword [eax], ecx
mov dword [eax + 4], ecx
push esi
mov dword [eax + 8], ecx
push str.wmcPipeUser
mov dword [eax + 0xc], ecx
mov ecx, dword [esi*4 + 0x5688b0]
push str._s_i
push ecx
call ebx
push 0x20
call fcn.004e5420
mov dword [esi*4 + 0x568930], eax
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
add esp, 0x14
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
push esi
mov dword [eax + 0x18], ecx
push str.wmcPipeProcess
mov dword [eax + 0x1c], ecx
mov edx, dword [esi*4 + 0x568930]
push str._s_i
push edx
call ebx
push 0x20
call fcn.004e5420
mov dword [esi*4 + 0x5689b0], eax
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
add esp, 0x14
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
push esi
mov dword [eax + 0x18], ecx
push str.wmcPipeService
mov dword [eax + 0x1c], ecx
mov eax, dword [esi*4 + 0x5689b0]
push str._s_i
push eax
call ebx
inc esi
add esp, 0x10
cmp esi, 0x20
jl 0x4a1cf5
cmp byte [0x570388], 0
jne 0x4a1e4f
push 0x568300
mov byte [0x570388], 1
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 0x664]
push edx
push 0x40
mov ecx, 0x4cc550
sub ecx, fcn.004cc3f0
push 5
sub ecx, 5
push fcn.004cc3f0
mov dword [0x5682e0], 0x4cc3f0
mov byte [0x56dad0], 0xe8
mov dword [0x56dad1], ecx
call esi
test eax, eax
je 0x4a1e4f
mov eax, dword [0x5682e0]
mov ecx, dword [eax]
mov dword [0x56dac8], ecx
movzx edx, byte [eax + 4]
mov ecx, dword [0x56dad0]
mov byte [0x56dacc], dl
mov dword [eax], ecx
movzx edx, byte [0x56dad4]
lea ecx, [ebp - 0x664]
push ecx
mov byte [eax + 4], dl
mov edx, dword [ebp - 0x664]
push edx
push 5
push eax
call esi
mov dword [0x565f28], 0x4a1020
mov dword [0x56639c], 0x4a14f0
call fcn.004cdfd0
mov eax, dword [0x56639c]
push 0x400
push 0x568208
mov dword [0x568204], eax
mov dword [0x565dd4], 0x4a4820
call edi
push 0x568200
xor ebx, ebx
push ebx
push str.wmcPipeSystem
push 0x4a43b0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 0x694]
push ecx
mov dword [ebp - 0x694], fcn.0046b930
call fcn.004baef0
add esp, 4
push 0x206
lea eax, [ebp - 0x24e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x250], dx
call fcn.004e8ba0
add esp, 0xc
mov ecx, 0x526df8
mov eax, str.Initial
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4a1f09
cmp dx, bx
je 0x4a1f05
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4a1f09
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4a1ee3
xor eax, eax
jmp 0x4a1f0e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4a1f38
push 0x104
push str.Initial
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push str.Initial
call fcn.004e56ec
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + str.Initial]
mov word [ebp + eax - 0x250], cx
add eax, 2
cmp cx, bx
jne 0x4a1f40
lea eax, [ebp - 0x250]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x4a1f60
mov edx, dword [str.Info_]
mov ecx, dword [0x51f900]
mov dword [eax], edx
mov edx, dword [0x51f904]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [ebp - 0x250]
push eax
call fcn.004e51cd
add esp, 4
cmp eax, 0xffffffff
jne 0x4a1fa9
lea ecx, [ebp - 0x250]
push ecx
call fcn.004e519b
add esp, 4
lea eax, [ebp - 0x250]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x4a1fb2
mov edx, dword [str.PCInfo.opt]
mov ecx, dword [0x51f90c]
mov dword [eax], edx
mov edx, dword [0x51f910]
mov dword [eax + 4], ecx
mov ecx, dword [0x51f914]
mov dword [eax + 8], edx
mov edx, dword [0x51f918]
mov dword [eax + 0xc], ecx
mov cx, word [0x51f91c]
mov dword [eax + 0x10], edx
mov word [eax + 0x14], cx
lea eax, [ebp - 0x250]
call fcn.004b7820
lea edx, [ebp - 0x668]
push edx
mov dword [ebp - 0x668], ebx
call dword [0x5662e0]
mov eax, dword [ebp - 0x668]
mov esi, 2
mov dword [eax + 0x30], esi
mov ecx, dword [ebp - 0x668]
mov dword [ecx + 0x34], 0x202
mov edx, dword [ebp - 0x668]
add esp, 4
push edx
call fcn.0046b930
mov eax, dword [ebp - 0x668]
mov dword [eax + 0x34], 0x102
mov ecx, dword [ebp - 0x668]
add esp, 4
push ecx
call fcn.0046b930
mov edx, dword [ebp - 0x668]
mov dword [edx + 0x60], 0x61a8
mov eax, dword [ebp - 0x668]
lea ecx, [ebp - 0x668]
add esp, 4
push ecx
mov dword [eax + 0x54], 0x1388
call fcn.004bafa0
lea edx, [ebp - 0x668]
add esp, 4
push edx
call dword [0x5662e4]
lea eax, [ebp - 0x688]
add esp, 4
push eax
mov dword [ebp - 0x668], ebx
mov dword [ebp - 0x688], ebx
call dword [0x5662e0]
mov ecx, dword [ebp - 0x688]
mov edi, 1
mov dword [ecx + 0x30], edi
mov edx, dword [ebp - 0x688]
mov dword [edx + 0x34], 0x201
mov eax, dword [ebp - 0x688]
add esp, 4
push eax
call fcn.0046b930
lea ecx, [ebp - 0x688]
add esp, 4
push ecx
call dword [0x5662e4]
lea edx, [ebp - 0x68c]
add esp, 4
push edx
mov dword [ebp - 0x688], ebx
mov dword [ebp - 0x68c], ebx
call dword [0x5662e0]
mov eax, dword [ebp - 0x68c]
mov dword [eax + 0x30], 5
mov ecx, dword [ebp - 0x68c]
lea edx, [ebp - 0x68c]
add esp, 4
push edx
mov dword [ecx + 0x34], 0x501
call fcn.004bafa0
add esp, 4
lea eax, [ebp - 0x68c]
push eax
call dword [0x5662e4]
lea ecx, [ebp - 0x684]
add esp, 4
push ecx
mov dword [ebp - 0x68c], ebx
mov dword [ebp - 0x684], ebx
call dword [0x5662e0]
mov edx, dword [ebp - 0x684]
mov dword [edx + 0x30], esi
mov eax, dword [ebp - 0x684]
mov dword [eax + 0x34], 0xd01
mov ecx, dword [ebp - 0x684]
add esp, 4
push ecx
call fcn.0046b930
lea edx, [ebp - 0x684]
add esp, 4
push edx
call dword [0x5662e4]
lea eax, [ebp - 0x680]
add esp, 4
push eax
mov dword [ebp - 0x684], ebx
mov dword [ebp - 0x680], ebx
call dword [0x5662e0]
mov ecx, dword [ebp - 0x680]
mov dword [ecx + 0x30], esi
mov edx, dword [ebp - 0x680]
mov dword [edx + 0x34], 0x105
mov eax, dword [ebp - 0x680]
mov dword [eax + 0x54], 0x1b7740
mov ecx, dword [ebp - 0x680]
add esp, 4
push ecx
call fcn.0046b930
lea edx, [ebp - 0x680]
add esp, 4
push edx
call dword [0x5662e4]
add esp, 4
lea eax, [ebp - 0x690]
push eax
push 0x2001f
push ebx
push str.SystemCurrentcontrolsetServicesWin_Win
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x680], ebx
mov dword [ebp - 0x690], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a236e
mov eax, 4
lea ecx, [ebp - 0x6a0]
push ecx
mov ecx, dword [ebp - 0x690]
lea edx, [ebp - 0x664]
push edx
mov dword [ebp - 0x69c], eax
mov dword [ebp - 0x6a0], eax
lea eax, [ebp - 0x69c]
push eax
push ebx
push str.InitReceNetwork
push ecx
mov dword [ebp - 0x664], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a2271
cmp dword [ebp - 0x664], ebx
jne 0x4a2271
mov dword [0x562d8c], ebx
push 0x206
lea eax, [ebp - 0x65e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x660], dx
call fcn.004e8ba0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x660]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x660]
push 0x5c
push edx
call fcn.004e56ec
add esp, 8
test eax, eax
je 0x4a22cd
lea eax, [ebp - 0x660]
push 0x5c
push eax
call fcn.004e56ec
add esp, 8
xor ecx, ecx
mov word [eax], cx
lea edi, [ebp - 0x660]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, esi
cmp ax, bx
jne 0x4a22d6
xor eax, eax
mov dword [ebp - 0x42], eax
mov dword [ebp - 0x3e], eax
mov dword [ebp - 0x3a], eax
mov dword [ebp - 0x36], eax
mov dword [ebp - 0x32], eax
mov dword [ebp - 0x2e], eax
mov dword [ebp - 0x2a], eax
mov word [ebp - 0x26], ax
lea eax, [ebp - 0x660]
push eax
push 0x10
mov ecx, 7
mov esi, 0x521318
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x44]
push ecx
push 0x51c514
push str.Delay
xor edx, edx
push str.MultiIni
mov word [ebp - 0x44], dx
mov dword [ebp - 0x698], ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4a234b
cmp word [ebp - 0x44], 0x31
jne 0x4a234b
mov dword [ebp - 0x698], 1
mov eax, dword [ebp - 0x690]
push 4
lea edx, [ebp - 0x698]
push edx
push 4
push ebx
push str.DelayedAutoStart
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, 2
mov ecx, dword [ebp - 0x690]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x690], ebx
call fcn.004b7290
cmp dword [0x562d8c], ebx
je 0x4a23eb
mov ebx, dword [0x562d7c]
call fcn.004cd490
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x4a23e9
push 0xf01ff
push str.WinMaster_Service
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x4a2724
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call ebx
push edi
call ebx
mov ebx, dword [0x562d80]
call fcn.004cd490
mov ebx, dword [0x562d84]
call fcn.004cd490
xor ebx, ebx
lea edx, [ebp - 0x67c]
push edx
mov dword [ebp - 0x67c], ebx
call dword [0x5662e0]
mov eax, dword [ebp - 0x67c]
mov dword [eax + 0x30], ebx
mov ecx, dword [ebp - 0x67c]
mov dword [ecx + 0x34], 0x101
mov edx, dword [ebp - 0x67c]
add esp, 4
push edx
call dword [ebp - 0x694]
mov eax, dword [ebp - 0x67c]
lea ecx, [ebp - 0x67c]
add esp, 4
push ecx
mov dword [eax + 0x54], 0xbb8
call fcn.004bafa0
lea edx, [ebp - 0x67c]
add esp, 4
push edx
call dword [0x5662e4]
lea eax, [ebp - 0x678]
add esp, 4
push eax
mov dword [ebp - 0x678], ebx
call dword [0x5662e0]
mov ecx, dword [ebp - 0x678]
mov edi, 6
mov dword [ecx + 0x30], edi
mov edx, dword [ebp - 0x678]
mov dword [edx + 0x34], 0x118
mov eax, dword [ebp - 0x678]
lea ecx, [ebp - 0x678]
add esp, 4
push ecx
mov dword [eax + 0x54], 0x3a98
call fcn.004bafa0
lea edx, [ebp - 0x678]
add esp, 4
push edx
call dword [0x5662e4]
lea eax, [ebp - 0x670]
add esp, 4
push eax
mov dword [ebp - 0x678], ebx
mov dword [ebp - 0x670], ebx
call dword [0x5662e0]
mov ecx, dword [ebp - 0x670]
mov dword [ecx + 0x30], edi
mov edx, dword [ebp - 0x670]
mov dword [edx + 0x34], 0x116
mov eax, dword [ebp - 0x670]
lea ecx, [ebp - 0x670]
add esp, 4
push ecx
mov dword [eax + 0x54], 0xdbba00
call fcn.004bafa0
lea edx, [ebp - 0x670]
add esp, 4
push edx
call dword [0x5662e4]
lea eax, [ebp - 0x674]
add esp, 4
push eax
mov dword [ebp - 0x670], ebx
mov dword [ebp - 0x674], ebx
call dword [0x5662e0]
mov ecx, dword [ebp - 0x674]
mov dword [ecx + 0x30], edi
mov edx, dword [ebp - 0x674]
mov dword [edx + 0x34], 0x113
mov eax, dword [ebp - 0x674]
lea ecx, [ebp - 0x674]
add esp, 4
push ecx
mov dword [eax + 0x54], 0x5265c00
call fcn.004bafa0
add esp, 4
lea edx, [ebp - 0x674]
push edx
call dword [0x5662e4]
lea eax, [ebp - 0x66c]
add esp, 4
push eax
mov dword [ebp - 0x674], ebx
mov dword [ebp - 0x66c], ebx
call dword [0x5662e0]
mov ecx, dword [ebp - 0x66c]
mov dword [ecx + 0x30], edi
mov edx, dword [ebp - 0x66c]
mov dword [edx + 0x34], 0x112
mov eax, dword [ebp - 0x66c]
mov dword [eax + 0x54], 0x3e8
mov ecx, dword [ebp - 0x66c]
mov dword [ecx + 0x60], 0xe678
mov edx, dword [ebp - 0x66c]
add esp, 4
push edx
call fcn.0046b930
lea eax, [ebp - 0x66c]
add esp, 4
push eax
call fcn.004bb040
lea ecx, [ebp - 0x66c]
add esp, 4
push ecx
call dword [0x5662e4]
add esp, 4
push 0x206
lea eax, [ebp - 0x456]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0x66c], ebx
mov word [ebp - 0x458], dx
call fcn.004e8ba0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x458]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x458]
push 0x5c
push edx
call fcn.004e56ec
add esp, 8
test eax, eax
je 0x4a2648
lea eax, [ebp - 0x458]
push 0x5c
push eax
call fcn.004e56ec
add esp, 8
xor ecx, ecx
mov word [eax], cx
lea edi, [ebp - 0x458]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, esi
cmp ax, bx
jne 0x4a2651
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x458]
push eax
push 0x104
mov ecx, 7
mov esi, 0x521318
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x24]
push ecx
push 0x51c514
push 0x522ef0
xor edx, edx
push str.MultiIni
mov word [ebp - 0x24], dx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x24], 0x31
jne 0x4a2711
lea edx, [ebp - 0x664]
push edx
mov dword [ebp - 0x664], ebx
call dword [0x5662e0]
mov eax, dword [ebp - 0x664]
mov dword [eax + 0x30], 2
mov ecx, dword [ebp - 0x664]
mov dword [ecx + 0x34], 0x394
mov edx, dword [ebp - 0x664]
lea eax, [ebp - 0x664]
add esp, 4
push eax
mov dword [edx + 0x54], 0x1388
call fcn.004bafa0
lea ecx, [ebp - 0x664]
add esp, 4
push ecx
call dword [0x5662e4]
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004e4746
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4a23e9