Function at 0x4a3760
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Link many functions at runtime
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x5322a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
push str.wmcHook.Dll
call esi
push str.wmcMemmgr.dll
mov dword [0x53b648], eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.fnIRPAlloc
push eax
mov dword [0x53b644], eax
call esi
mov dword [0x539320], eax
mov eax, dword [0x53b644]
push str.fnIRPFree
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnIRPAllocSourNet
push ecx
mov dword [0x539324], eax
call esi
mov edx, dword [0x53b644]
push str.fnIRPFreeSourNet
push edx
mov dword [0x539328], eax
call esi
mov dword [0x53932c], eax
mov eax, dword [0x53b644]
push str.fnIRPSetSourNet
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnIRPCopyTo
push ecx
mov dword [0x539330], eax
call esi
mov edx, dword [0x53b644]
push str.fnIRPAllocDestNet
push edx
mov dword [0x53935c], eax
call esi
mov dword [0x539334], eax
mov eax, dword [0x53b644]
push str.fnIRPFreeDestNet
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnIRPSetDestNet
push ecx
mov dword [0x539338], eax
call esi
mov edx, dword [0x53b644]
push str.fnIRPAppendDestNet
push edx
mov dword [0x53933c], eax
call esi
mov dword [0x539340], eax
mov eax, dword [0x53b644]
push str.fnIRPAllocPipe
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnIRPFreePipe
push ecx
mov dword [0x539344], eax
call esi
mov edx, dword [0x53b644]
push str.fnIRPAllocBuf
push edx
mov dword [0x539348], eax
call esi
mov dword [0x53934c], eax
mov eax, dword [0x53b644]
push str.fnIRPFreeBuf
push eax
call esi
mov dword [0x539350], eax
push str.fnIRPSetBuf
mov ecx, dword [0x53b644]
push ecx
call esi
mov edx, dword [0x53b644]
push str.fnIRPAppendBuf
push edx
mov dword [0x539354], eax
call esi
mov dword [0x539358], eax
mov eax, dword [0x53b644]
push str.fnObjectAlloc
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnObjectReset
push ecx
mov dword [0x539360], eax
call esi
mov edx, dword [0x53b644]
push str.fnObjectFree
push edx
mov dword [0x539364], eax
call esi
mov dword [0x539368], eax
mov eax, dword [0x53b644]
push str.fnObjectCopyTo
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnObjectSetValueByInt
push ecx
mov dword [0x53936c], eax
call esi
mov edx, dword [0x53b644]
push str.fnObjectGetValueByInt
push edx
mov dword [0x539370], eax
call esi
mov dword [0x539374], eax
mov eax, dword [0x53b644]
push str.fnObjectModifyValueByInt
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnObjectSetValueByStringW
push ecx
mov dword [0x539378], eax
call esi
mov edx, dword [0x53b644]
push str.fnObjectAppendValueByStringW
push edx
mov dword [0x53937c], eax
call esi
mov dword [0x539380], eax
mov eax, dword [0x53b644]
push str.fnObjectGetValueSizeByStringW
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnObjectGetValueByStringW
push ecx
mov dword [0x539384], eax
call esi
mov edx, dword [0x53b644]
push str.fnObjectSetValueByStringA
push edx
mov dword [0x539388], eax
call esi
mov dword [0x53938c], eax
mov eax, dword [0x53b644]
push str.fnObjectAppendValueByStringA
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnObjectGetValueSizeByStringA
push ecx
mov dword [0x539390], eax
call esi
mov edx, dword [0x53b644]
mov dword [0x539394], eax
push str.fnObjectGetValueByStringA
push edx
call esi
mov dword [0x539398], eax
mov eax, dword [0x53b644]
push str.fnObjectSetValueByByte
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnObjectAppendValueByByte
push ecx
mov dword [0x53939c], eax
call esi
mov edx, dword [0x53b644]
push str.fnObjectGetValueSizeByByte
push edx
mov dword [0x5393a0], eax
call esi
mov dword [0x5393a4], eax
mov eax, dword [0x53b644]
push str.fnObjectGetValueByByte
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnObjectSetValueByEmpty
push ecx
mov dword [0x5393a8], eax
call esi
mov edx, dword [0x53b644]
push str.fnMemoryAllocByStringW
push edx
mov dword [0x5393ac], eax
call esi
mov dword [0x5393b0], eax
mov eax, dword [0x53b644]
push str.fnMemoryResetByStringW
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnMemoryFreeByStringW
push ecx
mov dword [0x5393b4], eax
call esi
mov edx, dword [0x53b644]
push str.fnMemoryAllocByStringA
push edx
mov dword [0x5393b8], eax
call esi
mov dword [0x5393bc], eax
mov eax, dword [0x53b644]
push str.fnMemoryResetByStringA
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnMemoryFreeByStringA
push ecx
mov dword [0x5393c0], eax
call esi
mov edx, dword [0x53b644]
push str.fnMemoryAllocByByte
push edx
mov dword [0x5393c4], eax
call esi
mov dword [0x5393c8], eax
mov eax, dword [0x53b644]
push str.fnMemoryResetByByte
push eax
call esi
mov ecx, dword [0x53b644]
push str.fnMemoryFreeByByte
push ecx
mov dword [0x5393cc], eax
call esi
mov dword [0x5393d0], eax
call fcn.004a3670
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp byte [0x53b5fd], bl
jne 0x4a3b0e
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x4a3b14
mov byte [0x53b5fd], 1
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.004a46f0
call fcn.004cdcf0
call fcn.004bc8b0
push 0x38
push ebx
push 0x536cb4
call fcn.004e7d90
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
add esp, 0xc
push 0x400
push 0x536798
call edi
push 0x400
push 0x5367b0
call edi
push 0x400
push 0x5367c8
call edi
push 0x400
push 0x5367e0
call edi
push 0x400
push 0x5367f8
call edi
push 0x400
push 0x536810
call edi
push 0x400
push 0x536828
call edi
push 0x400
push 0x536840
call edi
push 0x400
push 0x536858
call edi
push 0x400
push 0x536870
call edi
push 0x400
push 0x536888
call edi
push 0x400
push 0x5368a0
call edi
push 0x400
push 0x5368b8
call edi
push 0x400
push 0x5368d0
call edi
push 0x250
push ebx
push 0x536948
call fcn.004e7d90
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x21c], edx
jmp 0x4a3c08
mov edx, dword [ebp - 0x21c]
xor ebx, ebx
cmp edx, ebx
jne 0x4a3c28
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.System]
mov word [eax + 0x536cf0], cx
add eax, 2
cmp cx, bx
jne 0x4a3c10
jmp 0x4a3c55
imul edx, edx, 0x128
mov eax, 0x51cd40
sub edx, eax
lea edx, [edx + 0x536cf0]
jmp 0x4a3c40
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
cmp cx, bx
jne 0x4a3c40
mov edx, dword [ebp - 0x21c]
mov eax, edx
imul eax, eax, 0x128
mov dword [eax + 0x536df0], ebx
mov dword [eax + 0x536df4], ebx
mov dword [eax + 0x536df8], ebx
mov dword [eax + 0x536dfc], ebx
mov dword [eax + 0x536e00], ebx
mov dword [eax + 0x536e0c], ebx
mov dword [eax + 0x536e08], ebx
mov ebx, edx
imul ebx, ebx, 0xf0
push 0x400
lea edx, [ebx + 0x5393d8]
push edx
call edi
push 0x400
lea eax, [ebx + 0x5393f0]
push eax
call edi
push 0x400
lea ecx, [ebx + 0x539408]
push ecx
call edi
push 0x400
lea edx, [ebx + 0x539420]
push edx
call edi
push 0x400
lea eax, [ebx + 0x539438]
push eax
call edi
push 0x400
lea ecx, [ebx + 0x539450]
push ecx
call edi
push 0x400
lea edx, [ebx + 0x539468]
push edx
call edi
push 0x400
lea eax, [ebx + 0x539480]
push eax
call edi
push 0x400
lea ecx, [ebx + 0x539498]
push ecx
call edi
push 0x400
lea edx, [ebx + 0x5394b0]
push edx
call edi
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp eax, 0x20
jl 0x4a3c00
push 0x400
push 0x5368e8
call edi
push 0x400
push 0x536900
call edi
push 0x400
push 0x536918
call edi
push 0x400
push 0x536930
call edi
push 0x400
push 0x5392f0
call edi
push 0x400
push 0x536c9c
call edi
push 0x400
push 0x539308
call edi
push 0x400
push 0x5366fc
call edi
xor ebx, ebx
xor eax, eax
mov dword [0x536b98], eax
mov dword [0x536b9c], eax
mov dword [0x536ba0], eax
mov dword [0x536ba4], eax
mov dword [0x536ba8], eax
mov dword [0x536bac], eax
mov dword [0x536bb0], eax
mov dword [0x536bb4], eax
mov dword [0x536bb8], eax
mov dword [0x536bbc], eax
mov dword [0x536bc0], eax
mov dword [0x536bc4], eax
mov dword [0x536bc8], eax
mov dword [0x536bcc], eax
mov dword [0x536bd0], eax
mov dword [0x536bd4], eax
mov dword [0x536bd8], eax
mov dword [0x536bdc], eax
mov dword [0x536be0], eax
mov dword [0x536be4], eax
mov dword [0x536be8], eax
mov dword [0x536bec], eax
mov dword [0x536bf0], eax
mov dword [0x536bf4], eax
mov dword [0x536bf8], eax
mov dword [0x536bfc], eax
mov dword [0x536c00], eax
mov dword [0x536c04], eax
mov dword [0x536c08], eax
mov dword [0x536c0c], eax
mov dword [0x536c10], eax
mov dword [0x536c14], eax
mov dword [0x5391f0], eax
mov dword [0x5391f4], eax
mov dword [0x5391f8], eax
mov dword [0x5391fc], eax
mov dword [0x539200], eax
mov dword [0x539204], eax
mov dword [0x539208], eax
mov dword [0x53920c], eax
mov dword [0x539210], eax
mov dword [0x539214], eax
mov dword [0x539218], eax
mov dword [0x53921c], eax
mov dword [0x539220], eax
mov dword [0x539224], eax
mov dword [0x539228], eax
mov dword [0x53922c], eax
mov dword [0x539230], eax
mov dword [0x539234], eax
mov dword [0x539238], eax
mov dword [0x53923c], eax
mov dword [0x539240], eax
mov dword [0x539244], eax
mov dword [0x539248], eax
mov dword [0x53924c], eax
mov dword [0x539250], eax
mov dword [0x539254], eax
mov dword [0x539258], eax
mov dword [0x53925c], eax
mov dword [0x539260], eax
mov dword [0x539264], eax
mov dword [0x539268], eax
mov dword [0x53926c], eax
mov dword [0x539270], eax
mov dword [0x539274], eax
mov dword [0x539278], eax
mov dword [0x53927c], eax
mov dword [0x539280], eax
mov dword [0x539284], eax
mov dword [0x539288], eax
mov dword [0x53928c], eax
mov dword [0x539290], eax
mov dword [0x539294], eax
mov dword [0x539298], eax
mov dword [0x53929c], eax
mov dword [0x5392a0], eax
mov dword [0x5392a4], eax
mov dword [0x5392a8], eax
mov dword [0x5392ac], eax
mov dword [0x5392b0], eax
mov dword [0x5392b4], eax
mov dword [0x5392b8], eax
mov dword [0x5392bc], eax
mov dword [0x5392c0], eax
mov dword [0x5392c4], eax
mov dword [0x5392c8], eax
mov dword [0x5392cc], eax
mov dword [0x5392d0], eax
mov dword [0x5392d4], eax
mov dword [0x5392d8], eax
mov dword [0x5392dc], eax
mov dword [0x5392e0], eax
mov dword [0x5392e4], eax
mov dword [0x5392e8], eax
mov dword [0x5392ec], eax
cmp byte [0x53e5b0], al
jne 0x4a4010
push 0x53b4a0
mov byte [0x53e5b0], 1
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea ecx, [ebp - 0x21c]
push ecx
push 0x40
mov eax, 0x4cbc20
sub eax, fcn.004cbac0
push 5
sub eax, 5
push fcn.004cbac0
mov dword [0x53b314], 0x4cbac0
mov byte [0x53cde8], 0xe8
mov dword [0x53cde9], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4a4010
mov eax, dword [0x53b314]
mov edx, dword [eax]
mov dword [0x53cde0], edx
movzx ecx, byte [eax + 4]
mov edx, dword [0x53cde8]
mov byte [0x53cde4], cl
mov dword [eax], edx
movzx ecx, byte [0x53cdec]
lea edx, [ebp - 0x21c]
push edx
mov byte [eax + 4], cl
mov ecx, dword [ebp - 0x21c]
push ecx
push 5
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.Ws2_32.dll
mov dword [0x536714], 0x4a3050
mov dword [0x536cec], 0x4a3540
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x53b498], eax
cmp eax, ebx
je 0x4a4058
push str.inet_pton
push eax
call esi
mov edx, dword [0x53b498]
push str.inet_ntop
push edx
mov dword [0x53b49c], eax
call esi
mov dword [0x53b310], eax
mov eax, dword [0x536cec]
push 0x400
push 0x53b23c
mov dword [0x5365ac], 0x4ccc00
mov dword [0x53b238], eax
mov dword [0x5365f4], 0x4a8580
call edi
push 0x5393d4
push ebx
push str.wmcPipeSystem
push 0x4a8110
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 0x21c]
push ecx
mov dword [ebp - 0x21c], fcn.0046b930
call fcn.004a8ba0
lea edx, [ebp - 0x230]
add esp, 4
push edx
mov dword [ebp - 0x230], ebx
call dword [0x539320]
mov eax, dword [ebp - 0x230]
mov esi, 6
mov dword [eax + 0x30], esi
mov ecx, dword [ebp - 0x230]
mov dword [ecx + 0x34], 0x116
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x230]
add esp, 4
push eax
mov dword [edx + 0x54], 0xdbba00
call fcn.004a8c50
lea ecx, [ebp - 0x230]
add esp, 4
push ecx
call dword [0x539324]
lea edx, [ebp - 0x228]
add esp, 4
push edx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
call dword [0x539320]
mov eax, dword [ebp - 0x228]
mov dword [eax + 0x30], esi
mov ecx, dword [ebp - 0x228]
mov dword [ecx + 0x34], 0x113
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x228]
add esp, 4
push eax
mov dword [edx + 0x54], 0x5265c00
call fcn.004a8c50
lea ecx, [ebp - 0x228]
add esp, 4
push ecx
call dword [0x539324]
lea edx, [ebp - 0x220]
add esp, 4
push edx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x220], ebx
call dword [0x539320]
mov eax, dword [ebp - 0x220]
mov dword [eax + 0x30], 2
mov ecx, dword [ebp - 0x220]
mov edi, 0x202
mov dword [ecx + 0x34], edi
mov edx, dword [ebp - 0x220]
add esp, 4
push edx
call fcn.0046b930
mov eax, dword [ebp - 0x220]
mov dword [eax + 0x34], 0x102
mov ecx, dword [ebp - 0x220]
add esp, 4
push ecx
call fcn.0046b930
mov edx, dword [ebp - 0x220]
add esp, 4
mov dword [edx + 0x60], 0x61a8
mov eax, dword [ebp - 0x220]
lea ecx, [ebp - 0x220]
push ecx
mov dword [eax + 0x54], 0x1388
call fcn.004a8c50
lea edx, [ebp - 0x220]
add esp, 4
push edx
call dword [0x539324]
lea eax, [ebp - 0x240]
add esp, 4
push eax
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x240], ebx
call dword [0x539320]
mov ecx, dword [ebp - 0x240]
mov dword [ecx + 0x30], 1
mov edx, dword [ebp - 0x240]
mov dword [edx + 0x34], edi
mov eax, dword [ebp - 0x240]
add esp, 4
push eax
call fcn.0046b930
lea ecx, [ebp - 0x240]
add esp, 4
push ecx
call dword [0x539324]
lea edx, [ebp - 0x238]
add esp, 4
push edx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x238], ebx
call dword [0x539320]
mov eax, dword [ebp - 0x238]
mov edi, 5
mov dword [eax + 0x30], edi
mov ecx, dword [ebp - 0x238]
mov dword [ecx + 0x34], 0x502
mov edx, dword [ebp - 0x238]
add esp, 4
push edx
call fcn.0046b930
lea eax, [ebp - 0x238]
add esp, 4
push eax
call dword [0x539324]
lea ecx, [ebp - 0x224]
add esp, 4
push ecx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x224], ebx
call dword [0x539320]
mov edx, dword [ebp - 0x224]
mov dword [edx + 0x30], esi
mov eax, dword [ebp - 0x224]
mov dword [eax + 0x34], 0x112
mov ecx, dword [ebp - 0x224]
mov dword [ecx + 0x54], 0x3e8
mov edx, dword [ebp - 0x224]
mov dword [edx + 0x60], 0xe678
mov eax, dword [ebp - 0x224]
add esp, 4
push eax
call fcn.0046b930
lea ecx, [ebp - 0x224]
add esp, 4
push ecx
call fcn.004a8cf0
lea edx, [ebp - 0x224]
add esp, 4
push edx
call dword [0x539324]
lea eax, [ebp - 0x22c]
add esp, 4
push eax
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x22c], ebx
call dword [0x539320]
mov ecx, dword [ebp - 0x22c]
add esp, 4
mov esi, 2
mov dword [ecx + 0x30], esi
mov edx, dword [ebp - 0x22c]
mov dword [edx + 0x34], 0x105
mov eax, dword [ebp - 0x22c]
mov dword [eax + 0x54], 0x1b7740
mov ecx, dword [ebp - 0x22c]
push ecx
call fcn.0046b930
lea edx, [ebp - 0x22c]
add esp, 4
push edx
call dword [0x539324]
lea eax, [ebp - 0x234]
add esp, 4
push eax
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x234], ebx
call dword [0x539320]
mov ecx, dword [ebp - 0x234]
mov dword [ecx + 0x30], 1
mov edx, dword [ebp - 0x234]
mov dword [edx + 0x34], 0x201
mov eax, dword [ebp - 0x234]
add esp, 4
push eax
call fcn.0046b930
lea ecx, [ebp - 0x234]
add esp, 4
push ecx
call dword [0x539324]
lea edx, [ebp - 0x23c]
add esp, 4
push edx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x23c], ebx
call dword [0x539320]
mov eax, dword [ebp - 0x23c]
mov dword [eax + 0x30], esi
mov ecx, dword [ebp - 0x23c]
mov dword [ecx + 0x34], 0xd01
mov edx, dword [ebp - 0x23c]
add esp, 4
push edx
call fcn.0046b930
lea eax, [ebp - 0x23c]
add esp, 4
push eax
call dword [0x539324]
lea ecx, [ebp - 0x244]
add esp, 4
push ecx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x244], ebx
call dword [0x539320]
mov edx, dword [ebp - 0x244]
mov dword [edx + 0x30], edi
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x244]
add esp, 4
push ecx
mov dword [eax + 0x34], 0x501
call fcn.004a8c50
lea edx, [ebp - 0x244]
add esp, 4
push edx
call dword [0x539324]
add esp, 4
lea eax, [ebp - 0x248]
push eax
push 0x20019
push ebx
push str.SystemCurrentcontrolsetServicesWin_Win
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x248], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a4506
mov eax, 4
lea ecx, [ebp - 0x24c]
push ecx
mov ecx, dword [ebp - 0x248]
lea edx, [ebp - 0x21c]
push edx
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], eax
lea eax, [ebp - 0x250]
push eax
push ebx
push str.InitReceNetwork
push ecx
mov dword [ebp - 0x21c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a4506
cmp dword [ebp - 0x21c], ebx
jne 0x4a4506
mov dword [0x53364c], ebx
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004bb330
cmp dword [0x53364c], ebx
je 0x4a457d
mov ebx, dword [0x533638]
call fcn.004ccab0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x4a457b
push 0xf01ff
push 0x527838
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
test eax, eax
je 0x4a4688
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call edi
push esi
call edi
mov ebx, dword [0x53363c]
call fcn.004ccab0
mov ebx, dword [0x533640]
call fcn.004ccab0
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], 0
call fcn.004e7d90
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x110]
push 0x5c
push edx
call fcn.004e50f0
mov byte [eax], 0
push 0x103
lea eax, [ebp - 0x217]
push ebx
push eax
mov byte [ebp - 0x218], 0
call fcn.004e7d90
add esp, 0x14
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x218]
push str._sPresto.CMA
push edx
call fcn.004e5066
add esp, 0xc
push ebx
push 0x80
push 3
push ebx
push 1
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x4a4675
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x21c]
push ecx
mov dword [ebp - 0x21c], ebx
call dword [0x539320]
mov edx, dword [ebp - 0x21c]
mov dword [edx + 0x30], 2
mov eax, dword [ebp - 0x21c]
mov dword [eax + 0x34], 0x394
mov ecx, dword [ebp - 0x21c]
lea edx, [ebp - 0x21c]
add esp, 4
push edx
mov dword [ecx + 0x54], 0x1388
call fcn.004a8c50
lea eax, [ebp - 0x21c]
add esp, 4
push eax
call dword [0x539324]
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004e3946
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4a457b