Function at 0x4b73b0
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve function by parsing pe exports
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5638bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x15a94
call fcn.00554980
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov cx, word [edi + 2]
movzx ecx, cx
add edi, 4
add eax, 0xfffffffc
mov dword [esp + 0x1c], ecx
mov ecx, 0x300
lea ebx, [esp + 0x328]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
call fcn.004ba980
push eax
mov eax, dword [esp + 0x20]
push eax
push str._tRECV____CD_04X___s_n
call fcn.00451d70
add esp, 0xc
cmp eax, 0x2031
jg 0x4b7d8b
cmp eax, 0x2031
je 0x4b7d43
cmp eax, 0x1ffe
jg 0x4b7b07
je 0x4b79db
sub eax, 0x1001
je 0x4b7824
sub eax, 0x10
je 0x4b74b1
sub eax, 0xe
jne 0x4b821f
push str.NTF_VIP_IPPORT_n
call fcn.00451d70
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 6
jne 0x4b821f
mov byte [esi + 0x7194], 1
mov word [esi + 0x7198], 2
mov edx, dword [edi]
mov dword [esi + 0x719c], edx
mov ax, word [edi + 4]
mov word [esi + 0x719a], ax
xor ecx, ecx
add esi, 0x71a0
mov dword [esi], ecx
mov dword [esi + 4], ecx
jmp 0x4b821f
push str.RET_LOGIN_n
call fcn.00451d70
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ecx, 2
jl 0x4b821f
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x15aac], eax
mov bx, word [edi]
xor edx, edx
mov dword [esp + 0x6d], edx
mov dword [esp + 0x71], edx
mov dword [esp + 0x75], edx
add edi, 2
cmp bx, ax
mov dword [esp + 0x79], edx
mov dword [esp + 0x14], 0x10
mov byte [esp + 0x6c], al
mov dword [esp + 0x7d], edx
mov dword [esp + 0x10], edi
jne 0x4b77da
cmp ecx, 0x1e
jl 0x4b7816
lea ebx, [esi - 0x2c8]
mov dword [esp + 0x1c], ebx
call fcn.004b9930
add esi, 0x7208
call fcn.004b4b00
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esi + 0x718c]
lea eax, [esi - 0x2f0]
call fcn.004b9670
push eax
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
mov ebx, edi
jne 0x4b757d
mov edx, dword [esp + 0x14]
mov ecx, dword [esi - 0x40]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push 4
push ebx
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, dword [esp + 0x18]
add ebx, 4
add esi, 0x71a8
mov edi, ebx
call fcn.004b9bc0
mov edi, dword [esp + 0x18]
push 0x11
lea edx, [esp + 0x90]
push edx
lea eax, [edi + 0x7238]
add ebx, 0xc
call fcn.004b22d0
lea esi, [esp + 0x8c]
lea eax, [esp + 0xe0]
call fcn.004b35e0
lea eax, [edi + 0x71d8]
lea ecx, [esp + 0xe0]
lea esi, [edi + 0x71a8]
push ecx
mov edi, eax
call fcn.004b9be0
mov edi, ebx
lea esi, [esp + 0x4c]
call fcn.004b9580
mov dx, word [ebx + 8]
add ebx, 8
mov ax, word [ebx + 2]
add ebx, 2
add ebx, 2
cmp ax, 0x1f4
mov word [esp + 0x20], dx
jbe 0x4b7607
mov eax, 0x1f4
test ax, ax
jbe 0x4b7701
movzx eax, ax
mov dword [esp + 0x10], eax
jmp 0x4b7620
mov edi, ebx
lea esi, [esp + 0xa0]
call fcn.004b9510
add ebx, 0x10
mov edi, ebx
lea esi, [esp + 0x5c]
call fcn.004b9bc0
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0xa0]
push ecx
lea esi, [esp + 0x60]
add edi, 0x71d8
add ebx, 0xc
call fcn.004b9be0
cmp byte [ebx], 0
jne 0x4b7662
inc ebx
jmp 0x4b7691
mov edx, ebx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esp + 0x6c], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x70], ecx
mov ecx, dword [edx + 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
mov byte [esp + 0x80], 0
add ebx, 0x14
lea edi, [esp + 0x6c]
lea esi, [esp + 0xb2]
call fcn.004b9530
mov edi, ebx
lea esi, [esp + 0xc8]
call fcn.004b9580
mov ax, word [ebx + 8]
add ebx, 8
mov word [esp + 0xd2], ax
lea eax, [esp + 0xa0]
lea ecx, [esp + 0x38]
add ebx, 2
call fcn.004b8610
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xa0]
add ecx, 0x71b8
call fcn.004b8560
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0xa0]
call fcn.004b9770
dec dword [esp + 0x10]
jne 0x4b7620
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 0x71cc]
test eax, eax
jne 0x4b7762
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push closesocket
push str.CBuddy2_Timer_Receiving_Window
push str.STATIC
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [edi + 0x71cc], eax
je 0x4b7762
mov esi, dword [sym.imp.USER32.dll_SetWindowLongA]
lea ecx, [edi - 0x2f4]
push ecx
push 0xffffffffffffffeb
push eax
call esi
mov edx, dword [edi + 0x71cc]
push 0x4b3140
push 0xfffffffffffffffc
push edx
call esi
mov eax, dword [edi + 0x71cc]
test eax, eax
je 0x4b778f
mov ecx, dword [edi + 0x71d0]
test ecx, ecx
jne 0x4b778f
push 0
push 0xea60
push 0x14d
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [edi + 0x71d0], eax
lea esi, [edi - 0x2f4]
mov byte [edi + 0x7189], 1
mov byte [edi + 0x7194], 0
call fcn.004b7220
mov ecx, dword [edi + 0x71c8]
mov eax, dword [ecx]
lea edx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x24]
push edx
lea edx, [esp + 0x54]
push edx
lea edx, [esp + 0x98]
push edx
push 0
call dword [eax + 0xc]
lea esi, [esp + 0x38]
call fcn.004b3590
jmp 0x4b821f
add esi, 0xfffffd0c
call fcn.004b7220
mov esi, 0x581f32
lea eax, [esp + 0xd6]
call fcn.004b9550
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x71c8]
mov edx, dword [ecx]
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0xde]
push eax
push esi
push ebx
call dword [edx + 0xc]
lea esi, [esp + 0x38]
call fcn.004b3590
jmp 0x4b821f
push str.RET_PRECREDENTIAL_n
call fcn.00451d70
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 4
jne 0x4b821f
mov esi, dword [esi + 0x7190]
test esi, esi
je 0x4b7851
push esi
call fcn.00551882
add esp, 4
mov esi, 0x2dbabe65
call fcn.004bd880
mov edi, dword [esp + 0x18]
push 0x11
lea ecx, [esp + 0x90]
mov dword [edi + 0x7190], eax
push ecx
lea eax, [edi + 0x7238]
call fcn.004b22d0
test al, al
je 0x4b821f
push 0x15
lea edx, [esp + 0x70]
push edx
lea eax, [edi + 0x74bc]
call fcn.004b22d0
test al, al
je 0x4b821f
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
lea eax, [esp + 0xe920]
push eax
mov eax, dword [edi + 0x7190]
push edx
push 0x577c3c
push eax
lea eax, [esp + 0x7c]
lea esi, [esp + 0x9c]
call fcn.004bd8b0
add esp, 0x10
test al, al
je 0x4b821f
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [edi + 0x718c]
lea edx, [esp + 0x20]
push edx
lea eax, [edi - 0x2f0]
mov dword [esp + 0x28], 0x10
call fcn.004b9690
test al, al
je 0x4b79c2
mov eax, dword [edi - 0x40]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4b79c2
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x630], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x62c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x634], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x63c], ecx
mov dword [esp + 0x638], eax
mov ax, word [esp + 0x26]
push 0x715a
lea ecx, [esp + 0xe944]
mov dword [esp + 0x644], edx
mov edx, dword [edi + 0x7190]
push ecx
mov word [esp + 0x64c], ax
push edx
mov eax, 0x24
lea ecx, [esp + 0x634]
mov dword [esp + 0x634], 0x19
call fcn.004bdb80
add esp, 0xc
test al, al
je 0x4b821f
push 0x50
push 0x1010
add edi, 0xfffffd0c
push edi
lea ecx, [esp + 0xe92c]
call fcn.004b8300
jmp 0x4b821f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CBuddy2::OnMsg_on_RET_PRECREDENTIAL___getsockname___failed_with__d_n
call fcn.00451d70
add esp, 8
jmp 0x4b821f
push str.NTF_NOTICE_n
call fcn.00451d70
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 4
jl 0x4b821f
xor ebx, ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x15aac], 1
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov byte [esp + 0x15aac], 2
mov ax, word [edi]
add edi, 2
cmp ax, 0xa
ja 0x4b7af0
cmp ax, bx
jbe 0x4b7ae0
movzx eax, ax
mov dword [esp + 0x1c], eax
jmp 0x4b7a44
mov edi, dword [esp + 0x10]
mov al, byte [edi]
movzx edx, al
inc edi
mov dword [esp + 0x10], edi
mov ecx, edx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x228]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [eax + edx]
add eax, edx
mov byte [esp + edx + 0x228], bl
movzx edx, cl
inc eax
mov ecx, edx
mov ebx, ecx
shr ecx, 2
mov esi, eax
lea edi, [esp + 0x128]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, edx
lea ecx, [esp + 0x228]
mov dword [esp + 0x10], eax
xor ebx, ebx
push ecx
lea eax, [esp + 0x60]
mov byte [esp + edx + 0x12c], bl
call fcn.004b71e0
lea edx, [esp + 0x128]
push edx
lea eax, [esp + 0x64]
call fcn.004b71e0
lea edx, [esp + 0x5c]
lea esi, [esp + 0x38]
call fcn.004b86a0
dec dword [esp + 0x1c]
jne 0x4b7a40
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x71c8]
mov eax, dword [ecx]
lea edx, [esp + 0x38]
push edx
call dword [eax + 0x10]
lea edi, [esp + 0x5c]
call fcn.004b8240
lea ebx, [esp + 0x38]
call fcn.004b8870
jmp 0x4b821f
sub eax, 0x1fff
je 0x4b7cfb
sub eax, 0x11
je 0x4b7b9e
sub eax, 0x11
jne 0x4b821f
push str.NTF_TUNNEL_PACKET_n
call fcn.00451d70
add esp, 4
lea esi, [esp + 0x38]
call fcn.004b9510
mov ebx, dword [esp + 0x10]
add ebx, 0x10
mov edi, ebx
lea esi, [esp + 0x4c]
call fcn.004b9bc0
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x38]
push eax
add edi, 0x71d8
lea esi, [esp + 0x50]
add ebx, 0xc
call fcn.004b9be0
movzx ecx, word [ebx + 2]
xor eax, eax
mov ax, word [ebx]
add ebx, 2
push ecx
lea esi, [ebx + 2]
push eax
push 0
call fcn.005514a0
mov edx, dword [esp + 0x24]
add esp, 4
push eax
add edx, 0xfffffd0c
push edx
mov ecx, esi
lea ebx, [esp + 0x48]
call fcn.004ba4f0
jmp 0x4b821f
push str.NTF_SAVE_PACKET_n
call fcn.00451d70
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 0x10
jl 0x4b821f
mov ecx, dword [esi + 0x7190]
push 0x717a
push edi
push ecx
lea ecx, [esp + 0xe92c]
call fcn.004bdc20
add esp, 0xc
test al, al
je 0x4b821f
mov cx, word [esp + 0xe920]
test cx, cx
lea ebx, [esp + 0xe922]
mov word [esp + 0x628], cx
lea eax, [esp + 0x62a]
jbe 0x4b7cd9
lea edx, [esi + 0x71d8]
movzx ecx, cx
add esi, 0xfffffd0c
mov dword [esp + 0x1c], edx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x10], ecx
jmp 0x4b7c24
mov ebx, dword [esp + 0x14]
mov edx, dword [ebx]
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x20], eax
add ebx, 4
mov eax, ebx
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x28], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
mov edx, dword [eax + 0xc]
add ebx, 0x10
mov edi, ebx
lea esi, [esp + 0x4c]
mov dword [esp + 0x30], edx
mov byte [esp + 0x34], 0
call fcn.004b9bc0
lea esi, [esp + 0x24]
lea eax, [esp + 0x104]
add ebx, 0xc
call fcn.004b35e0
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x104]
push eax
lea esi, [esp + 0x50]
call fcn.004b9be0
mov eax, dword [ebx]
add ebx, 4
mov dx, word [ebx + 2]
xor ecx, ecx
mov cx, word [ebx]
add ebx, 2
movzx esi, dx
push esi
add ebx, 2
push ecx
mov ecx, dword [esp + 0x64]
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x24], ebx
lea ebx, [esp + 0x34]
call fcn.004ba4f0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add ecx, esi
dec eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
jne 0x4b7c20
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x628]
sub eax, edx
push eax
push 0x2011
add esi, 0xfffffd0c
push esi
mov ecx, edx
call fcn.004b8300
jmp 0x4b821f
push str.NTF_CLOSE_CONNECTION_n
call fcn.00451d70
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jne 0x4b821f
lea eax, [esi - 0x2f0]
mov esi, dword [esi + 0x718c]
push eax
call fcn.004b3730
mov eax, dword [esp + 0x10]
movzx eax, word [eax]
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x71c8]
mov edx, dword [ecx]
push eax
call dword [edx + 8]
jmp 0x4b821f
push str.RET_SMS_SEND_n
call fcn.00451d70
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jne 0x4b821f
cmp dword [esi + 0x7758], 0x10
jb 0x4b7d6e
mov eax, dword [esi + 0x7744]
jmp 0x4b7d74
lea eax, [esi + 0x7744]
mov ecx, dword [esi + 0x71c8]
mov edx, dword [ecx]
xor esi, esi
mov si, word [edi]
push esi
push eax
call dword [edx + 0x50]
jmp 0x4b821f
cmp eax, 0x3007
jg 0x4b7f9d
je 0x4b7f8b
sub eax, 0x3001
je 0x4b7e5d
sub eax, 2
je 0x4b7dc7
sub eax, 2
jne 0x4b821f
push str.RET_GROUP_BUDDY_n
call fcn.00451d70
add esp, 4
jmp 0x4b821f
push str.RET_REMOVE_BUDDY_n
call fcn.00451d70
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jl 0x4b821f
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4b821f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0xc]
mov edi, dword [esi + 0x71bc]
mov dword [esp + 0x30], eax
cmp edi, dword [esi + 0x71c0]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov byte [esp + 0x34], 0
je 0x4b821f
push 0x10
lea ecx, [esp + 0x28]
push ecx
push edi
call fcn.005549bd
add esp, 0xc
test eax, eax
je 0x4b7e48
mov eax, dword [esi + 0x71c0]
add edi, 0x12
cmp edi, eax
jne 0x4b7e22
jmp 0x4b821f
push edi
add esi, 0x71b8
lea ebx, [esp + 0x60]
call fcn.004b85e0
jmp 0x4b821f
push str.RET_ADD_BUDDY_n
call fcn.00451d70
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jl 0x4b821f
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4b821f
mov edx, edi
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x28], ecx
mov ecx, dword [edx + 0xc]
add edi, 0x10
lea esi, [esp + 0x4c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov byte [esp + 0x34], 0
mov dword [esp + 0x10], edi
call fcn.004b9bc0
mov ebx, edi
lea esi, [esp + 0x24]
lea eax, [esp + 0xf2]
add ebx, 0xc
call fcn.004b35e0
mov edi, dword [esp + 0x18]
lea edx, [esp + 0xf2]
push edx
add edi, 0x71d8
lea esi, [esp + 0x50]
call fcn.004b9be0
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dx, word [ebx + 8]
mov dword [esp + 0x4c], eax
lea esi, [esp + 0x24]
lea eax, [esp + 0x8c]
mov dword [esp + 0x50], ecx
mov byte [esp + 0x54], 0
mov word [esp + 0x5c], dx
call fcn.004b35e0
mov ebx, dword [esp + 0x18]
lea ecx, [ebx + 0x71b8]
lea eax, [esp + 0x8c]
call fcn.004b8560
lea edi, [ebx - 0x2c8]
mov eax, esi
call fcn.004b9770
mov edi, esi
lea esi, [esp + 0xa0]
call fcn.004b9510
lea edi, [esp + 0x4c]
lea esi, [esp + 0xc8]
call fcn.004b9580
mov ax, word [esp + 0x5c]
mov ebx, dword [ebx + 0x71c8]
mov word [esp + 0xd2], ax
lea eax, [esp + 0xa0]
mov byte [esp + 0xc7], 0
mov byte [esp + 0xb2], 0
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x44]
jmp 0x4b821f
push str.RET_RENAME_GROUP_n
call fcn.00451d70
add esp, 4
jmp 0x4b821f
sub eax, 0x3fff
je 0x4b810e
sub eax, 2
je 0x4b8012
sub eax, 0xfff
jne 0x4b821f
push str.NTF_NOTICE2_n
call fcn.00451d70
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ecx, 0xff
jg 0x4b821f
mov edx, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x128]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x71c8]
mov eax, edx
mov byte [esp + eax + 0x128], 0
mov edx, dword [ecx]
lea eax, [esp + 0x128]
push eax
call dword [edx + 0x14]
jmp 0x4b821f
push str.RET_SEARCH_n
call fcn.00451d70
mov edx, dword [esp + 0x18]
add esp, 4
cmp edx, 2
jl 0x4b821f
xor ecx, ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x15aac], 3
mov ax, word [edi]
add edi, 2
cmp ax, cx
jne 0x4b80f0
cmp edx, 4
jl 0x4b8100
mov ax, word [edi]
add edi, 2
cmp ax, cx
mov dword [esp + 0x10], edi
jbe 0x4b80f0
movzx ecx, ax
add esi, 0x71d8
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
jmp 0x4b8087
mov edi, dword [esp + 0x10]
lea esi, [esp + 0x6c]
call fcn.004b9510
mov ebx, dword [esp + 0x10]
add ebx, 0x10
mov edi, ebx
lea esi, [esp + 0x4c]
call fcn.004b9bc0
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x6c]
push edx
lea esi, [esp + 0x50]
add ebx, 0xc
call fcn.004b9be0
mov edi, ebx
lea esi, [esp + 0x7e]
call fcn.004b9580
mov ax, word [ebx + 8]
add ebx, 8
lea ecx, [esp + 0x6c]
mov word [esp + 0x88], ax
add ebx, 2
push ecx
lea eax, [esp + 0x3c]
mov dword [esp + 0x14], ebx
call fcn.004b8700
dec dword [esp + 0x20]
jne 0x4b8083
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x71c8]
mov edx, dword [ecx]
lea eax, [esp + 0x38]
push eax
call dword [edx + 0x4c]
lea esi, [esp + 0x38]
call fcn.004b3590
jmp 0x4b821f
push str.NTF_USER_STATE_n
call fcn.00451d70
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jl 0x4b821f
mov ax, word [edi]
add edi, 2
test ax, ax
jbe 0x4b821f
movzx ecx, ax
add esi, 0xfffffd38
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
jmp 0x4b8152
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov bl, byte [edi + 0x10]
mov edx, edi
mov eax, dword [edx]
mov ecx, dword [edx + 4]
add edi, 0x10
mov dword [esp + 0x24], eax
mov eax, dword [edx + 8]
test bl, bl
mov dword [esp + 0x2c], eax
setne al
mov dword [esp + 0x28], ecx
mov ecx, dword [edx + 0xc]
inc edi
test al, al
mov dword [esp + 0x30], ecx
mov byte [esp + 0x34], 0
mov byte [esp + 0x9e], al
mov dword [esp + 0x10], edi
je 0x4b81be
mov eax, dword [edi]
add edi, 4
mov edx, dword [edi + 2]
xor ecx, ecx
mov cx, word [edi]
add edi, 2
add edi, 4
push edx
xor ebx, ebx
mov bx, word [edi]
add edi, 2
push ecx
push eax
mov dword [esp + 0x1c], edi
lea eax, [esp + 0x30]
mov edi, esi
call fcn.004b9700
jmp 0x4b81ee
lea edx, [esp + 0x24]
push edx
push esi
call fcn.004b97c0
lea esi, [esp + 0x24]
lea eax, [esp + 0x116]
call fcn.004b35e0
mov eax, dword [esp + 0x18]
add eax, 0x7208
lea edx, [esp + 0x116]
call fcn.004b3f10
lea edi, [esp + 0x24]
lea esi, [esp + 0x8c]
call fcn.004b9510
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x71c8]
mov edx, dword [ecx]
lea eax, [esp + 0x8c]
push eax
call dword [edx + 0x2c]
dec dword [esp + 0x20]
jne 0x4b814a
mov ecx, dword [esp + 0x15aa4]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8