Function at 0x4b0ef0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x40]
cmp eax, edx
je 0x4b0e1f
mov dword [esp], eax
call fcn.004aff40
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x58]
cmp eax, edx
je 0x4b0e31
mov dword [esp], eax
call fcn.004aff40
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x70]
cmp eax, edx
je 0x4b0e43
mov dword [esp], eax
call fcn.004aff40
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x88]
cmp eax, edx
je 0x4b0e5b
mov dword [esp], eax
call fcn.004aff40
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 0xa0]
cmp eax, edx
je 0x4b0e73
mov dword [esp], eax
call fcn.004aff40
mov eax, dword [ebp - 0xc0]
lea edx, [ebp - 0xb8]
cmp eax, edx
je 0x4b0e8b
mov dword [esp], eax
call fcn.004aff40
mov eax, dword [ebp - 0xd8]
lea edx, [ebp - 0xd0]
cmp eax, edx
je 0x4b0ea3
mov dword [esp], eax
call fcn.004aff40
mov dword [esp], ebx
call fcn.0040db90
call ebx
mov edi, dword [ebp - 0x128]
mov ebx, esi
mov dword [eax], edi
jmp 0x4b0e0d
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x158
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
call fcn.0040a660
mov dword [esp], 0x4bc19b
lea ecx, [ebp - 0xd8]
call fcn.004015a0
lea ecx, [ebp - 0xc0]
sub esp, 4
mov dword [esp], 0x4bc19b
call fcn.004015a0
sub esp, 4
lea ecx, [ebp - 0xa8]
mov dword [esp], 0x4bc19b
call fcn.004015a0
sub esp, 4
lea ecx, [ebp - 0x90]
mov dword [esp], 0x4bc19b
call fcn.004015a0
sub esp, 4
lea ecx, [ebp - 0x78]
mov dword [esp], 0x4bc19b
call fcn.004015a0
sub esp, 4
lea ecx, [ebp - 0x60]
mov dword [esp], 0x4bc19b
call fcn.004015a0
mov dword [ebp - 0x110], 0
sub esp, 4
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0xf8], 0x35378eac
mov dword [ebp - 0xf4], 0x11d2683f
mov dword [ebp - 0xf0], 0xc0009aa8
mov dword [ebp - 0xec], 0xa2cfbb4f
mov dword [ebp - 0xe8], 0x8fc0b734
mov dword [ebp - 0xe4], 0x11d1a0e1
mov dword [ebp - 0xe0], 0xd3a7
mov dword [ebp - 0xdc], 0xe37175f8
mov dword [ebp - 0x100], 0
mov dword [esp], 0x4bc19b
call fcn.004015a0
mov byte [ebp - 0x124], 0
sub esp, 4
xor edi, edi
mov byte [ebp - 0x128], 0
mov byte [ebp - 0x11c], 0
mov byte [ebp - 0x11d], 0
mov byte [ebp - 0x11e], 0
lea esi, [esi]
mov dword [esp + 8], str.musrp:v:t:d:
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00410810
cmp eax, 0xffffffff
je 0x4b11d1
sub eax, 0x64
cmp eax, 0x12
ja case.0x4b106d.101
jmp dword [eax*4 + 0x4bc5e4]
mov dword [esp], 0x4bc27c
call fcn.004014f0
mov eax, dword [esi]
mov dword [esp], eax
call fcn.00401690
mov ebx, 0xffffffff
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x40]
cmp eax, edx
je 0x4b10a1
mov dword [esp], eax
call fcn.004aff40
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x58]
cmp eax, edx
je 0x4b10b3
mov dword [esp], eax
call fcn.004aff40
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x70]
cmp eax, edx
je 0x4b10c5
mov dword [esp], eax
call fcn.004aff40
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x88]
cmp eax, edx
je 0x4b10dd
mov dword [esp], eax
call fcn.004aff40
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 0xa0]
cmp eax, edx
je 0x4b10f5
mov dword [esp], eax
call fcn.004aff40
mov eax, dword [ebp - 0xc0]
lea edx, [ebp - 0xb8]
cmp eax, edx
je 0x4b110d
mov dword [esp], eax
call fcn.004aff40
mov eax, dword [ebp - 0xd8]
lea edx, [ebp - 0xd0]
cmp eax, edx
je 0x4b1125
mov dword [esp], eax
call fcn.004aff40
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [0x5070f0]
lea ecx, [ebp - 0xc0]
mov dword [esp], eax
call fcn.00401560
sub esp, 4
jmp 0x4b1048
mov eax, dword [0x5070f0]
lea ecx, [ebp - 0xa8]
mov dword [esp], eax
call fcn.00401560
push eax
mov byte [ebp - 0x128], 1
jmp 0x4b1048
mov byte [ebp - 0x11c], 1
jmp 0x4b1048
mov eax, dword [0x5070f0]
lea ecx, [ebp - 0xd8]
mov dword [esp], eax
call fcn.00401560
jmp 0x4b1146
mov edi, 1
jmp 0x4b1048
mov eax, dword [0x5070f0]
lea ecx, [ebp - 0x90]
mov dword [esp], eax
call fcn.00401560
push eax
mov byte [ebp - 0x124], 1
jmp 0x4b1048
mov byte [ebp - 0x11e], 1
jmp 0x4b1048
mov byte [ebp - 0x11d], 1
jmp 0x4b1048
mov eax, edi
test al, al
je 0x4b13f0
cmp byte [ebp - 0x11e], 0
jne 0x4b13fd
mov dword [esp], 0x4bc211
lea ecx, [ebp - 0x78]
call fcn.00401560
push edi
mov dword [ebp - 0x12c], 2
movzx eax, byte [ebp - 0x11d]
xor al, 1
mov byte [ebp - 0x11e], al
jne 0x4b1426
cmp byte [ebp - 0x11c], 0
je 0x4b122d
cmp byte [ebp - 0x11d], 0
jne 0x4b1433
mov dword [esp], 0x4bc19b
lea ecx, [ebp - 0xd8]
call fcn.0042e640
push ecx
test eax, eax
je 0x4b1074
mov dword [esp], 0x4bc19b
lea ecx, [ebp - 0xc0]
call fcn.0042e640
push edx
test eax, eax
je 0x4b1b4a
movzx eax, byte [ebp - 0x11c]
xor eax, 1
and byte [ebp - 0x11d], al
jne 0x4b1444
cmp byte [ebp - 0x11e], 0
je 0x4b12b5
cmp byte [ebp - 0x11c], 0
je 0x4b12b5
mov dword [esp], 0x4bc3af
lea ecx, [ebp - 0x60]
call fcn.00401560
push ebx
cmp byte [ebp - 0x128], 0
jne 0x4b1b6c
cmp byte [ebp - 0x124], 0
jne 0x4b1b6c
xor edi, edi
xor ecx, ecx
mov dword [esp], ecx
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebx, eax
push edx
test eax, eax
js 0x4b1582
lea eax, [ebp - 0x110]
xor ebx, ebx
mov dword [esp + 0xc], 0x4c1bd0
mov dword [esp + 0x10], eax
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x4c18d4
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
mov ebx, eax
test eax, eax
js 0x4b1985
mov eax, dword [ebp - 0x110]
mov edx, dword [eax]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [edx + 0x14]
push ecx
push ecx
mov eax, dword [ebp - 0x110]
lea ecx, [ebp - 0x10c]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov ebx, dword [ebp - 0x12c]
mov dword [esp], eax
mov dword [esp + 4], ebx
call dword [edx + 0x3c]
sub esp, 0xc
mov ebx, eax
test eax, eax
js 0x4b184b
lea eax, [ebp - 0x104]
xor edx, edx
mov dword [esp + 0x14], 0x20007
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x108]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov eax, dword [ebp - 0xd8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
sub esp, 0x24
mov ebx, eax
test eax, eax
jne 0x4b19d5
cmp byte [ebp - 0x11d], 0
je 0x4b15b2
cmp edi, 4
je 0x4b1955
ja 0x4b18dd
cmp edi, 1
je 0x4b1897
cmp edi, 2
jne 0x4b1b04
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], eax
jmp 0x4b18b0
cmp byte [ebp - 0x11e], 0
je 0x4b1974
mov eax, edi
test al, al
jne 0x4b1974
mov dword [esp], 0x4bc224
lea ecx, [ebp - 0x78]
call fcn.00401560
push ebx
mov dword [ebp - 0x12c], 1
jmp 0x4b1202
cmp byte [ebp - 0x11c], 0
jne 0x4b1220
mov dword [esp], 0x4bc234
call fcn.004014f0
jmp case.0x4b106d.101
mov dword [esp], 0x4bc343
lea ecx, [ebp - 0x60]
call fcn.00401560
push edi
cmp byte [ebp - 0x128], 0
je 0x4b1b5b
cmp byte [ebp - 0x124], 0
je 0x4b1b5b
mov edi, dword [ebp - 0xa8]
mov ebx, dword [ebp - 0xa4]
add ebx, edi
cmp edi, ebx
je 0x4b1496
movsx eax, byte [edi]
add edi, 1
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll_toupper]
mov byte [edi - 1], al
cmp edi, ebx
jne 0x4b1480
mov dword [esp], str.REG_DWORD
lea ecx, [ebp - 0xa8]
call fcn.0042e640
push ecx
test eax, eax
jne 0x4b154b
mov eax, dword [ebp - 0x90]
mov ebx, dword [ebp - 0x8c]
mov edx, dword [sym.imp.msvcrt.dll_isdigit]
add ebx, eax
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
call fcn.004a9d60
cmp ebx, eax
jne 0x4b1b39
mov edi, dword [ebp - 0x90]
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov eax, dword [eax]
mov dword [ebp - 0x128], eax
call ebx
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x30]
mov dword [esp + 8], 0xa
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll_strtol
mov dword [ebp - 0x124], eax
cmp edi, dword [ebp - 0x30]
je 0x4b1ba6
call ebx
cmp dword [eax], 0x22
je 0x4b1b9a
call ebx
cmp dword [eax], 0
je 0x4b19c6
mov eax, dword [ebp - 0x124]
mov edi, 4
mov dword [ebp - 0x100], eax
jmp 0x4b12b7
mov dword [esp], str.REG_SZ
lea ecx, [ebp - 0xa8]
call fcn.0042e640
push ebx
test eax, eax
jne 0x4b17fd
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x48]
mov dword [esp], eax
call fcn.0049d6f0
mov edi, 1
push ecx
jmp 0x4b12b7
mov dword [esp], 2
call dword [0x4ba0bc]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], str.CoInitialize___Falied_with_0x_08lX___ld___n
mov dword [esp], eax
call fcn.00401520
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4b108f
cmp byte [ebp - 0x11e], 0
mov eax, dword [ebp - 0x108]
je 0x4b15e5
cmp byte [ebp - 0x11c], 0
je 0x4b15e5
mov edx, dword [ebp - 0xc0]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
push edi
mov eax, dword [ebp - 0x108]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov eax, dword [ebp - 0x110]
lea ecx, [ebp - 0xe8]
cmp dword [ebp - 0x12c], 1
mov edx, dword [eax]
mov dword [esp + 0x10], ecx
lea ecx, [ebp - 0xf8]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 1
je 0x4b19b5
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [edx + 0x1c]
sub esp, 0x14
mov esi, eax
test eax, eax
jns 0x4b1669
mov dword [esp], 2
call dword [0x4ba0bc]
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov dword [esp + 4], str.IGroupPolicyObject::Save___Falied_with_0x_08lX___ld___n
mov dword [esp], eax
call fcn.00401520
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, esi
jmp 0x4b108f
mov dword [esp + 8], 0xe
mov dword [esp + 4], 0x4bc49f
mov dword [esp], 0x4bb8e0
call fcn.004aaa30
mov eax, dword [ebp - 0x78]
mov esi, dword [ebp - 0x74]
lea edi, [ebp - 0x28]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0xfc], esi
cmp esi, 0xf
ja 0x4b1ac4
cmp esi, 1
je 0x4b1944
test esi, esi
jne 0x4b1b35
mov eax, dword [ebp - 0xfc]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [edx + eax], 0
mov edx, dword [ebp - 0x5c]
mov eax, 0x3fffffff
sub eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x60]
cmp eax, edx
jb 0x4b1b8e
mov dword [esp], ecx
lea ecx, [ebp - 0x30]
mov dword [esp + 4], edx
call fcn.0049d650
push edx
push edx
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp], 0x4bb8e0
mov dword [esp + 4], eax
call fcn.004aaa30
call fcn.00401630
mov eax, dword [ebp - 0x30]
cmp eax, edi
je 0x4b171c
mov dword [esp], eax
call fcn.004aff40
mov dword [esp + 8], 0xf
mov dword [esp + 4], 0x4bc4c3
mov dword [esp], 0x4bb8e0
call fcn.004aaa30
mov eax, dword [ebp - 0xd4]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xd8]
mov dword [esp], 0x4bb8e0
mov dword [esp + 4], eax
call fcn.004aaa30
mov dword [esp + 8], 1
mov esi, eax
mov dword [esp + 4], 0x4bc4d3
mov dword [esp], eax
call fcn.004aaa30
mov eax, esi
call fcn.00401630
mov dword [esp + 8], 0xf
mov dword [esp + 4], 0x4bc4d5
mov dword [esp], 0x4bb8e0
call fcn.004aaa30
mov eax, dword [ebp - 0xbc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc0]
mov dword [esp], 0x4bb8e0
mov dword [esp + 4], eax
call fcn.004aaa30
mov dword [esp + 8], 1
mov esi, eax
mov dword [esp + 4], 0x4bc4d3
mov dword [esp], eax
call fcn.004aaa30
mov eax, esi
call fcn.00401630
cmp byte [ebp - 0x11d], 0
jne 0x4b1a05
mov eax, dword [ebp - 0x110]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
push eax
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4b108f
mov dword [esp], str.REG_EXPAND_SZ
lea ecx, [ebp - 0xa8]
call fcn.0042e640
push edx
test eax, eax
je 0x4b187b
mov dword [esp], str.REG_MULTI_SZ
lea ecx, [ebp - 0xa8]
call fcn.0042e640
push edi
test eax, eax
jne 0x4b1b7d
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x48]
mov dword [esp], eax
call fcn.0049d6f0
mov edi, 7
push ebx
jmp 0x4b12b7
mov dword [esp], 2
call dword [0x4ba0bc]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], str.IGroupPolicyObject::GetRegistryKey___Falied_with_0x_08lX___ld___n
mov dword [esp], eax
call fcn.00401520
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4b108f
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x48]
mov dword [esp], eax
call fcn.0049d6f0
mov edi, 2
push eax
jmp 0x4b12b7
mov eax, dword [ebp - 0x44]
add eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x108]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x108]
sub esp, 0x18
jmp 0x4b15e5
mov eax, dword [ebp - 0x44]
lea edi, [eax + 2]
mov dword [esp], edi
call fcn.004aff60
mov esi, eax
xor eax, eax
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 7
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x108]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
mov dword [esp], esi
call fcn.004aff30
mov eax, dword [ebp - 0x108]
jmp 0x4b15e5
mov eax, dword [ebp - 0x11c]
movzx eax, byte [eax]
mov byte [ebp - 0x28], al
jmp 0x4b16b7
lea eax, [ebp - 0x100]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
jmp 0x4b18b0
mov dword [esp], 0x4bc1ac
call fcn.004014f0
jmp case.0x4b106d.101
mov dword [esp], 2
call dword [0x4ba0bc]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], str.CoCreateInstance___Falied_with_0x_08lX___ld___n
mov dword [esp], eax
call fcn.00401520
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4b108f
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [edx + 0x1c]
jmp 0x4b162e
call ebx
mov edi, dword [ebp - 0x128]
mov dword [eax], edi
jmp 0x4b1535
mov dword [esp], 2
call dword [0x4ba0bc]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], str.RegCreateKeyEx___Falied_with_0x_08lX___ld___n
mov dword [esp], eax
call fcn.00401520
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4b108f
mov dword [esp + 8], 0xf
mov dword [esp + 4], 0x4bc4e5
mov dword [esp], 0x4bb8e0
call fcn.004aaa30
mov eax, dword [ebp - 0xa4]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xa8]
mov dword [esp], 0x4bb8e0
mov dword [esp + 4], eax
call fcn.004aaa30
mov dword [esp + 8], 1
mov esi, eax
mov dword [esp + 4], 0x4bc4d3
mov dword [esp], eax
call fcn.004aaa30
mov eax, esi
call fcn.00401630
mov dword [esp + 8], 0xf
mov dword [esp + 4], 0x4bc4f5
mov dword [esp], 0x4bb8e0
call fcn.004aaa30
mov eax, dword [ebp - 0x8c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x90]
mov dword [esp], 0x4bb8e0
mov dword [esp + 4], eax
call fcn.004aaa30
mov dword [esp + 8], 1
mov esi, eax
mov dword [esp + 4], 0x4bc4d3
mov dword [esp], eax
call fcn.004aaa30
mov eax, esi
call fcn.00401630
jmp 0x4b17e3
xor eax, eax
lea ecx, [ebp - 0x30]
mov dword [esp + 4], eax
lea eax, [ebp - 0xfc]
mov dword [esp], eax
call fcn.0049d7b0
push ecx
push ecx
mov edx, dword [ebp - 0xfc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], edx
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x11c]
mov dword [esp], eax
mov dword [esp + 4], esi
call sub.msvcrt.dll_memcpy
jmp 0x4b16b7
mov dword [esp], 0x4bc43c
call fcn.004014f0
mov eax, dword [esi]
mov dword [esp], eax
call fcn.00401690
mov eax, dword [ebp - 0x108]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4b108a
mov eax, edi
jmp 0x4b1ae9
mov dword [esp], 0x4bc3f4
call fcn.004014f0
jmp case.0x4b106d.101
mov dword [esp], 0x4bc2f4
call fcn.004014f0
jmp case.0x4b106d.101
mov dword [esp], 0x4bc350
call fcn.004014f0
jmp case.0x4b106d.101
mov dword [esp], 0x4bc3bc
call fcn.004014f0
jmp case.0x4b106d.101
mov dword [esp], 0x4bc43c
call fcn.004014f0
jmp case.0x4b106d.101
mov dword [esp], 0x4bc4ae
call fcn.004b2cf0
mov dword [esp], str.stoi
call fcn.004b2d40
mov dword [esp], str.stoi
call fcn.004b2ca0
mov ebx, eax
jmp 0x4b0e0d