Function at 0x475a20
Capabilities:
Check os version
Link many functions at runtime
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8cc
mov eax, dword [0x55800c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
xor esi, esi
mov dword [ebp - 0x8b4], edx
lea eax, [ebp - 0x104]
mov dword [ebp - 0x8b0], ecx
push 0x100
push eax
mov dword [ebp - 0x8ac], esi
mov dword [ebp - 0x8c4], esi
mov dword [ebp - 0x8c8], esi
call fcn.004d0170
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
push str.netapi32.dll
call ebx
test eax, eax
jne 0x475a8e
push str.radmin32.dll
call ebx
test eax, eax
je 0x4774c8
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x6a0]
mov dword [ebp - 0x6a0], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4774c8
cmp dword [ebp - 0x690], 2
jne 0x475ae5
mov eax, dword [ebp - 0x69c]
cmp eax, 4
jne 0x475ad4
mov dword [ebp - 0x8c4], 1
jmp 0x475ae5
cmp eax, 5
mov ecx, 1
cmovae esi, ecx
mov dword [ebp - 0x8c8], esi
lea ecx, [ebp - 0x508]
call fcn.004268c0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [ebp - 0x508]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x475b3f
mov dword [ebp - 0x8cc], 0
call fcn.004752f0
cmp dword [0x56349c], 0
je 0x475b38
mov edx, str.group1
call fcn.004754f0
mov dword [ebp - 0x8cc], eax
call fcn.004753a0
jmp 0x475b4f
mov edx, str.group1
call fcn.004754f0
mov dword [ebp - 0x8cc], eax
lea ecx, [ebp - 0x7a4]
call fcn.004268c0
lea eax, [ebp - 0x7a4]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x475b96
xor ebx, ebx
call fcn.004752f0
cmp dword [0x56349c], ebx
je 0x475b8f
mov edx, str.group2
call fcn.004754f0
mov ebx, eax
call fcn.004753a0
jmp 0x475ba2
mov edx, str.group2
call fcn.004754f0
mov ebx, eax
lea ecx, [ebp - 0x8a8]
call fcn.004268c0
lea eax, [ebp - 0x8a8]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x475be9
xor edi, edi
call fcn.004752f0
cmp dword [0x56349c], edi
je 0x475be2
mov edx, str.group3
call fcn.004754f0
mov edi, eax
call fcn.004753a0
jmp 0x475bf5
mov edx, str.group3
call fcn.004754f0
mov edi, eax
lea ecx, [ebp - 0x60c]
mov dword [ebp - 0x8c0], 1
call fcn.004268c0
lea eax, [ebp - 0x60c]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x475c4e
call fcn.004752f0
cmp dword [0x56349c], 0
je 0x475c47
push 1
mov edx, str.locdom1
call fcn.00475420
add esp, 4
mov dword [ebp - 0x8c0], eax
call fcn.004753a0
jmp 0x475c63
push 1
mov edx, str.locdom1
call fcn.00475420
add esp, 4
mov dword [ebp - 0x8c0], eax
lea ecx, [ebp - 0x60c]
mov dword [ebp - 0x8b8], 0
call fcn.004268c0
lea eax, [ebp - 0x60c]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x475cbc
call fcn.004752f0
cmp dword [0x56349c], 0
je 0x475cb5
push 0
mov edx, str.locdom2
call fcn.00475420
add esp, 4
mov dword [ebp - 0x8b8], eax
call fcn.004753a0
jmp 0x475cd1
push 0
mov edx, str.locdom2
call fcn.00475420
add esp, 4
mov dword [ebp - 0x8b8], eax
lea ecx, [ebp - 0x60c]
mov dword [ebp - 0x8bc], 0
call fcn.004268c0
lea eax, [ebp - 0x60c]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x475d2a
call fcn.004752f0
cmp dword [0x56349c], 0
je 0x475d23
push 0
mov edx, str.locdom3
call fcn.00475420
add esp, 4
mov dword [ebp - 0x8bc], eax
call fcn.004753a0
jmp 0x475d3f
push 0
mov edx, str.locdom3
call fcn.00475420
add esp, 4
mov dword [ebp - 0x8bc], eax
push str.VNCACCESS
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.004d0170
push str.Administrators
lea eax, [ebp - 0x304]
push 0x100
push eax
call fcn.004d0170
push str.VNCVIEWONLY
lea eax, [ebp - 0x404]
push 0x100
push eax
call fcn.004d0170
mov eax, dword [ebp - 0x8cc]
add esp, 0x24
test eax, eax
je 0x475da3
push eax
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.004d0170
add esp, 0xc
test ebx, ebx
je 0x475dbc
push ebx
lea eax, [ebp - 0x304]
push 0x100
push eax
call fcn.004d0170
add esp, 0xc
test edi, edi
je 0x475dd5
push edi
lea eax, [ebp - 0x404]
push 0x100
push eax
call fcn.004d0170
add esp, 0xc
lea ecx, [ebp - 0x60c]
call fcn.004268c0
lea eax, [ebp - 0x60c]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x475e23
call fcn.004752f0
cmp dword [0x56349c], 0
je 0x475e1c
lea eax, [ebp - 0x204]
mov edx, str.group1
push eax
call fcn.004756d0
add esp, 4
call fcn.004753a0
jmp 0x475e37
lea eax, [ebp - 0x204]
mov edx, str.group1
push eax
call fcn.004756d0
add esp, 4
lea ecx, [ebp - 0x60c]
call fcn.004268c0
lea eax, [ebp - 0x60c]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x475e85
call fcn.004752f0
cmp dword [0x56349c], 0
je 0x475e7e
lea eax, [ebp - 0x304]
mov edx, str.group2
push eax
call fcn.004756d0
add esp, 4
call fcn.004753a0
jmp 0x475e99
lea eax, [ebp - 0x304]
mov edx, str.group2
push eax
call fcn.004756d0
add esp, 4
lea ecx, [ebp - 0x60c]
call fcn.004268c0
lea eax, [ebp - 0x60c]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x475ee7
call fcn.004752f0
cmp dword [0x56349c], 0
je 0x475ee0
lea eax, [ebp - 0x404]
mov edx, str.group3
push eax
call fcn.004756d0
add esp, 4
call fcn.004753a0
jmp 0x475efb
lea eax, [ebp - 0x404]
mov edx, str.group3
push eax
call fcn.004756d0
add esp, 4
lea ecx, [ebp - 0x60c]
call fcn.004268c0
lea eax, [ebp - 0x60c]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x475f48
call fcn.004752f0
cmp dword [0x56349c], 0
je 0x475f41
push dword [ebp - 0x8c0]
mov edx, str.locdom1
call fcn.00475620
add esp, 4
call fcn.004753a0
jmp 0x475f5b
push dword [ebp - 0x8c0]
mov edx, str.locdom1
call fcn.00475620
add esp, 4
lea ecx, [ebp - 0x60c]
call fcn.004268c0
lea eax, [ebp - 0x60c]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x475fa8
call fcn.004752f0
cmp dword [0x56349c], 0
je 0x475fa1
push dword [ebp - 0x8b8]
mov edx, str.locdom2
call fcn.00475620
add esp, 4
call fcn.004753a0
jmp 0x475fbb
push dword [ebp - 0x8b8]
mov edx, str.locdom2
call fcn.00475620
add esp, 4
lea ecx, [ebp - 0x60c]
call fcn.004268c0
lea eax, [ebp - 0x60c]
push eax
push 0
push str.UseRegistry
push str.admin
call esi
cmp eax, 1
jne 0x476008
call fcn.004752f0
cmp dword [0x56349c], 0
je 0x476001
push dword [ebp - 0x8bc]
mov edx, str.locdom3
call fcn.00475620
add esp, 4
call fcn.004753a0
jmp 0x47601b
push dword [ebp - 0x8bc]
mov edx, str.locdom3
call fcn.00475620
add esp, 4
mov esi, dword [ebp - 0x8cc]
test esi, esi
je 0x476042
push esi
lea eax, [ebp - 0x204]
push 0x100
push eax
call fcn.004d0170
push 1
push esi
call fcn.004cbf6d
add esp, 0x14
test ebx, ebx
je 0x476063
push ebx
lea eax, [ebp - 0x304]
push 0x100
push eax
call fcn.004d0170
push 1
push ebx
call fcn.004cbf6d
add esp, 0x14
test edi, edi
je 0x476084
push edi
lea eax, [ebp - 0x404]
push 0x100
push eax
call fcn.004d0170
push 1
push edi
call fcn.004cbf6d
add esp, 0x14
mov ecx, 0x518188
lea eax, [ebp - 0x204]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4760b0
test dl, dl
je 0x4760ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4760b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x476090
xor eax, eax
jmp 0x4760b5
sbb eax, eax
or eax, 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x47624b
mov ecx, 0x518188
lea eax, [ebp - 0x304]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4760f0
test dl, dl
je 0x4760ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4760f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4760d0
xor eax, eax
jmp 0x4760f5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47624b
mov ecx, 0x518188
lea eax, [ebp - 0x404]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x476128
test dl, dl
je 0x476124
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x476128
add eax, 2
add ecx, 2
test dl, dl
jne 0x476108
xor eax, eax
jmp 0x47612d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47624b
cmp dword [ebp - 0x8c4], eax
jne 0x476149
cmp dword [ebp - 0x8c8], eax
je 0x47624b
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call ebx
test eax, eax
je 0x4761b3
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x476180
mov eax, dword [str._authadmin.dll]
mov dword [ecx], eax
mov eax, dword [0x549670]
mov dword [ecx + 4], eax
mov eax, dword [0x549674]
mov dword [ecx + 8], eax
mov ax, word [0x549678]
mov word [ecx + 0xc], ax
mov al, byte [0x54967a]
mov byte [ecx + 0xe], al
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x47622f
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
mov edi, dword [ebp - 0x8c0]
lea eax, [ebp - 0x204]
push edi
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
mov dword [ebp - 0x8ac], ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x476371
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x476251
push 0
push 0x5674c8
mov edx, str.authadmin.dll_not_found
call fcn.00425e00
add esp, 8
xor esi, esi
mov dword [ebp - 0x8ac], esi
mov edi, dword [ebp - 0x8c0]
mov ecx, 0x518188
lea eax, [ebp - 0x204]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x476280
test dl, dl
je 0x47627c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x476280
add eax, 2
add ecx, 2
test dl, dl
jne 0x476260
xor eax, eax
jmp 0x476285
sbb eax, eax
or eax, 1
test eax, eax
je 0x476760
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call ebx
test eax, eax
je 0x4762ff
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4762c4
mov eax, dword [str.workgrpdomnt4.dll]
mov dword [ecx], eax
mov eax, dword [0x5496a0]
mov dword [ecx + 4], eax
mov eax, dword [0x5496a4]
mov dword [ecx + 8], eax
mov eax, dword [0x5496a8]
mov dword [ecx + 0xc], eax
mov ax, word [0x5496ac]
mov word [ecx + 0x10], ax
mov al, byte [0x5496ae]
mov byte [ecx + 0x12], al
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x47641a
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov dword [ebp - 0x8ac], eax
mov ebx, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
jne 0x476436
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x4763cf
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
lea ecx, [ebp - 0x508]
add esp, 8
dec ecx
mov byte [eax], 0
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4763a6
mov eax, dword [str.logging.dll]
mov dword [ecx], eax
mov eax, dword [0x54269c]
mov dword [ecx + 4], eax
mov eax, dword [0x5426a0]
mov dword [ecx + 8], eax
mov al, byte [0x5426a4]
mov byte [ecx + 0xc], al
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x476407
push str.LOGLOGONUSER
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x8b0]
lea ecx, [ebp - 0x104]
push ecx
call eax
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push 0
push 0x5674c8
mov edx, str.workgrpdomnt4.dll_not_found
call fcn.00425e00
add esp, 8
xor ebx, ebx
mov dword [ebp - 0x8ac], ebx
call fcn.00475770
test al, al
je 0x476534
cmp dword [ebp - 0x8c8], 0
je 0x476534
cmp edi, 2
je 0x47645e
cmp edi, 3
jne 0x476534
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4764cb
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4764a0
mov eax, dword [str.ldapauth.dll]
mov dword [ecx], eax
mov eax, dword [0x5496d0]
mov dword [ecx + 4], eax
mov eax, dword [0x5496d4]
mov dword [ecx + 8], eax
mov ax, word [0x5496d8]
mov word [ecx + 0xc], ax
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x476791
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
mov dword [ebp - 0x8ac], ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x476371
call fcn.00475770
test al, al
je 0x47664a
cmp dword [ebp - 0x8c4], 0
je 0x47664a
call fcn.00475790
test al, al
je 0x47664a
cmp edi, 2
je 0x476572
cmp edi, 3
jne 0x47664a
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4765e1
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4765b0
mov eax, dword [str.ldapauthnt4.dll]
mov dword [ecx], eax
mov eax, dword [0x5496f8]
mov dword [ecx + 4], eax
mov eax, dword [0x5496fc]
mov dword [ecx + 8], eax
mov eax, dword [0x549700]
mov dword [ecx + 0xc], eax
mov al, byte [0x549704]
mov byte [ecx + 0x10], al
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4767b2
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
mov dword [ebp - 0x8ac], ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x476371
call fcn.00475770
test al, al
je 0x476757
cmp dword [ebp - 0x8c4], 0
jne 0x476757
cmp dword [ebp - 0x8c8], 0
jne 0x476757
cmp edi, 2
je 0x476688
cmp edi, 3
jne 0x476757
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4766ec
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4766c3
mov eax, dword [str.ldapauth9x.dll]
mov dword [ecx], eax
mov eax, dword [0x549728]
mov dword [ecx + 4], eax
mov eax, dword [0x54972c]
mov dword [ecx + 8], eax
mov eax, dword [0x549730]
mov dword [ecx + 0xc], eax
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x508]
push eax
call ebx
mov esi, eax
test esi, esi
je 0x4767d3
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
mov dword [ebp - 0x8ac], ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x476371
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, 0x518188
lea eax, [ebp - 0x304]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4767f4
test dl, dl
je 0x47678d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4767f4
add eax, 2
add ecx, 2
test dl, dl
jne 0x476771
xor eax, eax
jmp 0x4767f9
push 0
push 0x5674c8
mov edx, str.ldapauth.dll_not_found
call fcn.00425e00
add esp, 8
xor ebx, ebx
mov dword [ebp - 0x8ac], ebx
jmp 0x47653d
push 0
push 0x5674c8
mov edx, str.ldapauthnt4.dll_not_found
call fcn.00425e00
add esp, 8
xor ebx, ebx
mov dword [ebp - 0x8ac], ebx
jmp 0x476653
push 0
push 0x5674c8
mov edx, str.ldapauth9x.dll_not_found
call fcn.00425e00
add esp, 8
xor esi, esi
mov dword [ebp - 0x8ac], esi
jmp 0x476766
sbb eax, eax
or eax, 1
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x476d52
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x47687b
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x476840
mov eax, dword [str.workgrpdomnt4.dll]
mov dword [ecx], eax
mov eax, dword [0x5496a0]
mov dword [ecx + 4], eax
mov eax, dword [0x5496a4]
mov dword [ecx + 8], eax
mov eax, dword [0x5496a8]
mov dword [ecx + 0xc], eax
mov ax, word [0x5496ac]
mov word [ecx + 0x10], ax
mov al, byte [0x5496ae]
mov byte [ecx + 0x12], al
lea eax, [ebp - 0x508]
push eax
call ebx
mov esi, eax
test esi, esi
je 0x4768ec
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp - 0x8b8]
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov dword [ebp - 0x8ac], eax
mov ebx, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x476377
jmp 0x476908
push 0
push 0x5674c8
mov edx, str.workgrpdomnt4.dll_not_found
call fcn.00425e00
add esp, 8
xor ebx, ebx
mov dword [ebp - 0x8ac], ebx
cmp dword [ebp - 0x8c4], 0
jne 0x47691e
cmp dword [ebp - 0x8c8], 0
je 0x4769f2
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x476988
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x476955
mov eax, dword [str._authadmin.dll]
mov dword [ecx], eax
mov eax, dword [0x549670]
mov dword [ecx + 4], eax
mov eax, dword [0x549674]
mov dword [ecx + 8], eax
mov ax, word [0x549678]
mov word [ecx + 0xc], ax
mov al, byte [0x54967a]
mov byte [ecx + 0xe], al
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4769fd
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp - 0x8b8]
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
mov dword [ebp - 0x8ac], ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x476377
jmp 0x476a19
push 0
push 0x5674c8
mov edx, str.authadmin.dll_not_found
call fcn.00425e00
add esp, 8
xor ebx, ebx
mov dword [ebp - 0x8ac], ebx
call fcn.00475770
test al, al
je 0x476b19
cmp dword [ebp - 0x8c8], 0
je 0x476b19
mov eax, dword [ebp - 0x8b8]
cmp eax, 2
je 0x476a47
cmp eax, 3
jne 0x476b19
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x476aab
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x476a80
mov eax, dword [str.ldapauth.dll]
mov dword [ecx], eax
mov eax, dword [0x5496d0]
mov dword [ecx + 4], eax
mov eax, dword [0x5496d4]
mov dword [ecx + 8], eax
mov ax, word [0x5496d8]
mov word [ecx + 0xc], ax
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x476d87
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp - 0x8b8]
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
mov dword [ebp - 0x8ac], ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x476377
call fcn.00475770
test al, al
je 0x476c33
cmp dword [ebp - 0x8c4], 0
je 0x476c33
call fcn.00475790
test al, al
je 0x476c33
mov eax, dword [ebp - 0x8b8]
cmp eax, 2
je 0x476b5d
cmp eax, 3
jne 0x476c33
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x476bc5
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x476b94
mov eax, dword [str.ldapauthnt4.dll]
mov dword [ecx], eax
mov eax, dword [0x5496f8]
mov dword [ecx + 4], eax
mov eax, dword [0x5496fc]
mov dword [ecx + 8], eax
mov eax, dword [0x549700]
mov dword [ecx + 0xc], eax
mov al, byte [0x549704]
mov byte [ecx + 0x10], al
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x476da8
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp - 0x8b8]
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
mov dword [ebp - 0x8ac], ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x476377
call fcn.00475770
test al, al
je 0x476d49
cmp dword [ebp - 0x8c4], 0
jne 0x476d49
cmp dword [ebp - 0x8c8], 0
jne 0x476d49
mov eax, dword [ebp - 0x8b8]
cmp eax, 2
je 0x476c77
cmp eax, 3
jne 0x476d49
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x476cd9
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x476cb0
mov eax, dword [str.ldapauth9x.dll]
mov dword [ecx], eax
mov eax, dword [0x549728]
mov dword [ecx + 4], eax
mov eax, dword [0x54972c]
mov dword [ecx + 8], eax
mov eax, dword [0x549730]
mov dword [ecx + 0xc], eax
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x508]
push eax
call ebx
mov esi, eax
test esi, esi
je 0x476dc9
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp - 0x8b8]
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
mov dword [ebp - 0x8ac], ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x476377
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, 0x518188
lea eax, [ebp - 0x404]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x476dea
test dl, dl
je 0x476d83
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x476dea
add eax, 2
add ecx, 2
test dl, dl
jne 0x476d63
xor eax, eax
jmp 0x476def
push 0
push 0x5674c8
mov edx, str.ldapauth.dll_not_found
call fcn.00425e00
add esp, 8
xor ebx, ebx
mov dword [ebp - 0x8ac], ebx
jmp 0x476b22
push 0
push 0x5674c8
mov edx, str.ldapauthnt4.dll_not_found
call fcn.00425e00
add esp, 8
xor ebx, ebx
mov dword [ebp - 0x8ac], ebx
jmp 0x476c3c
push 0
push 0x5674c8
mov edx, str.ldapauth9x.dll_not_found
call fcn.00425e00
add esp, 8
xor esi, esi
mov dword [ebp - 0x8ac], esi
jmp 0x476d58
sbb eax, eax
or eax, 1
test eax, eax
je 0x477415
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x476e6b
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x476e30
mov eax, dword [str.workgrpdomnt4.dll]
mov dword [ecx], eax
mov eax, dword [0x5496a0]
mov dword [ecx + 4], eax
mov eax, dword [0x5496a4]
mov dword [ecx + 8], eax
mov eax, dword [0x5496a8]
mov dword [ecx + 0xc], eax
mov ax, word [0x5496ac]
mov word [ecx + 0x10], ax
mov al, byte [0x5496ae]
mov byte [ecx + 0x12], al
lea eax, [ebp - 0x508]
push eax
call ebx
mov esi, eax
test esi, esi
je 0x476ed6
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp - 0x8bc]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x47731e
jmp 0x476eec
push 0
push 0x5674c8
mov edx, str.workgrpdomnt4.dll_not_found
call fcn.00425e00
add esp, 8
xor ebx, ebx
cmp dword [ebp - 0x8c4], 0
jne 0x476f02
cmp dword [ebp - 0x8c8], 0
je 0x476fd7
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x476f73
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x476f40
mov eax, dword [str._authadmin.dll]
mov dword [ecx], eax
mov eax, dword [0x549670]
mov dword [ecx + 4], eax
mov eax, dword [0x549674]
mov dword [ecx + 8], eax
mov ax, word [0x549678]
mov word [ecx + 0xc], ax
mov al, byte [0x54967a]
mov byte [ecx + 0xe], al
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x476fe2
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp - 0x8bc]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x47731e
jmp 0x476ff8
push 0
push 0x5674c8
mov edx, str.authadmin.dll_not_found
call fcn.00425e00
add esp, 8
xor ebx, ebx
call fcn.00475770
test al, al
je 0x4770f3
cmp dword [ebp - 0x8c8], 0
je 0x4770f3
mov eax, dword [ebp - 0x8bc]
cmp eax, 2
je 0x477026
cmp eax, 3
jne 0x4770f3
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x47708b
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x477060
mov eax, dword [str.ldapauth.dll]
mov dword [ecx], eax
mov eax, dword [0x5496d0]
mov dword [ecx + 4], eax
mov eax, dword [0x5496d4]
mov dword [ecx + 8], eax
mov ax, word [0x5496d8]
mov word [ecx + 0xc], ax
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4773c7
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp - 0x8bc]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x47731e
call fcn.00475770
test al, al
je 0x477209
cmp dword [ebp - 0x8c4], 0
je 0x477209
call fcn.00475790
test al, al
je 0x477209
mov eax, dword [ebp - 0x8bc]
cmp eax, 2
je 0x477137
cmp eax, 3
jne 0x477209
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x4771a1
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x477170
mov eax, dword [str.ldapauthnt4.dll]
mov dword [ecx], eax
mov eax, dword [0x5496f8]
mov dword [ecx + 4], eax
mov eax, dword [0x5496fc]
mov dword [ecx + 8], eax
mov eax, dword [0x549700]
mov dword [ecx + 0xc], eax
mov al, byte [0x549704]
mov byte [ecx + 0x10], al
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4773e2
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp - 0x8bc]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
je 0x47731e
call fcn.00475770
test al, al
je 0x477315
cmp dword [ebp - 0x8c4], 0
jne 0x477315
cmp dword [ebp - 0x8c8], 0
jne 0x477315
mov eax, dword [ebp - 0x8bc]
cmp eax, 2
je 0x47724d
cmp eax, 3
jne 0x477315
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x4772ad
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
add esp, 8
test eax, eax
je 0x4774c8
lea ecx, [ebp - 0x508]
mov byte [eax], 0
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x477284
mov eax, dword [str.ldapauth9x.dll]
mov dword [ecx], eax
mov eax, dword [0x549728]
mov dword [ecx + 4], eax
mov eax, dword [0x54972c]
mov dword [ecx + 8], eax
mov eax, dword [0x549730]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4773fd
push str.CUGP
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov dword [0x563498], eax
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [ebp - 0x8bc]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x8b4]
push dword [ebp - 0x8b0]
call dword [0x563498]
add esp, 0x14
mov ebx, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp ebx, 1
jne 0x47741b
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x477379
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
lea ecx, [ebp - 0x508]
add esp, 8
dec ecx
mov byte [eax], 0
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x477350
mov eax, dword [str.logging.dll]
mov dword [ecx], eax
mov eax, dword [0x54269c]
mov dword [ecx + 4], eax
mov eax, dword [0x5426a0]
mov dword [ecx + 8], eax
mov al, byte [0x5426a4]
mov byte [ecx + 0xc], al
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4773b1
push str.LOGLOGONUSER
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x8b0]
lea ecx, [ebp - 0x104]
push ecx
call eax
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
push 0
push 0x5674c8
mov edx, str.ldapauth.dll_not_found
call fcn.00425e00
add esp, 8
xor ebx, ebx
jmp 0x4770fc
push 0
push 0x5674c8
mov edx, str.ldapauthnt4.dll_not_found
call fcn.00425e00
add esp, 8
xor ebx, ebx
jmp 0x477212
push 0
push 0x5674c8
mov edx, str.ldapauth9x.dll_not_found
call fcn.00425e00
add esp, 8
xor ebx, ebx
jmp 0x47741b
mov ebx, dword [ebp - 0x8ac]
push 0x104
lea eax, [ebp - 0x508]
push eax
push 0
call edi
test eax, eax
je 0x477479
lea eax, [ebp - 0x508]
push 0x5c
push eax
call fcn.004cd350
lea ecx, [ebp - 0x508]
add esp, 8
dec ecx
mov byte [eax], 0
nop word [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x477450
mov eax, dword [str.logging.dll]
mov dword [ecx], eax
mov eax, dword [0x54269c]
mov dword [ecx + 4], eax
mov eax, dword [0x5426a0]
mov dword [ecx + 8], eax
mov al, byte [0x5426a4]
mov byte [ecx + 0xc], al
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x476407
push str.LOGFAILEDUSER
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x8b0]
lea ecx, [ebp - 0x104]
push ecx
call eax
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cbf27
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cbf27
mov esp, ebp
pop ebp
ret