Function at 0x4b6a0c
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1c
push 0
push 0
dec ecx
jne 0x4b6a15
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x78], ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 0x30], eax
mov ecx, 0xa
lea eax, [ebp - 0x28]
mov edx, dword [0x4010ac]
call fcn.004071ec
xor eax, eax
push ebp
push 0x4b77ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4b77e8
call fcn.004b2860
lea eax, [ebp - 0xa4]
call fcn.0047f66c
mov eax, dword [ebp - 0xa4]
call fcn.0040dc30
mov byte [ebp - 0x79], 1
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x7a], 0
xor eax, eax
mov dword [ebp - 0x80], eax
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dl, 1
mov eax, dword [0x4ad70c]
call fcn.00404068
mov dword [ebp - 0x3c], eax
xor edx, edx
push ebp
push 0x4b775d
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x4ad70c]
call fcn.00404068
mov dword [ebp - 0x80], eax
mov dl, 1
mov eax, dword [0x4ad70c]
call fcn.00404068
mov dword [ebp - 0x44], eax
mov dl, 1
mov eax, dword [0x4ad70c]
call fcn.00404068
mov dword [ebp - 0x40], eax
mov dl, 1
mov eax, dword [0x4ad70c]
call fcn.00404068
mov dword [ebp - 0x38], eax
mov dl, 1
mov eax, dword [0x4ad70c]
call fcn.00404068
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x78], 0
je 0x4b6b17
mov dl, 1
mov eax, dword [0x4ad70c]
call fcn.00404068
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x84], eax
mov ecx, eax
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 0x29], 0
je 0x4b6ed0
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4b6ed0
mov eax, dword [ebp - 0x88]
cmp word [eax + 0x10], 0x80
jne 0x4b6eb5
xor eax, eax
push ebp
push 0x4b6e62
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b69b8
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x4b6b9b
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x80]
call fcn.004b0d2c
inc eax
jne 0x4b6e23
mov bl, 1
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 8]
test esi, 1
je 0x4b6bb2
xor ebx, ebx
jmp 0x4b6bbc
test esi, 2
je 0x4b6bbc
mov bl, 2
mov dword [ebp - 0xa0], 1
test esi, 8
je 0x4b6bda
mov dword [ebp - 0xa0], 7
jmp 0x4b6bfe
test esi, 0x10
je 0x4b6bee
mov dword [ebp - 0xa0], 3
jmp 0x4b6bfe
test esi, 0x40
je 0x4b6bfe
xor eax, eax
mov dword [ebp - 0xa0], eax
test esi, 4
jne 0x4b6d19
lea eax, [ebp - 0xa8]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4b7840
call fcn.00406914
mov eax, dword [ebp - 0xa8]
call fcn.004b2860
cmp dword [ebp - 0x24], 0
je 0x4b6c4c
lea eax, [ebp - 0xac]
mov ecx, dword [ebp - 0x24]
mov edx, 0x4b787c
call fcn.00406914
mov eax, dword [ebp - 0xac]
call fcn.004b2860
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
je 0x4b6c75
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
mov edx, dword [ebp - 0x28]
call fcn.004ad270
test al, al
je 0x4b6d0a
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa0]
push eax
push 0x4b5b20
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
call fcn.004af6d4
test al, al
jne 0x4b6cd7
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b78bc
call fcn.004b2ae4
mov byte [ebp - 0x79], 0
jmp 0x4b6e10
cmp bl, 1
jne 0x4b6e10
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7900
call fcn.004b2ae4
jmp 0x4b6e10
mov eax, 0x4b7938
call fcn.004b2860
jmp 0x4b6e10
lea eax, [ebp - 0xb8]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4b7980
call fcn.00406914
mov eax, dword [ebp - 0xb8]
call fcn.004b2860
cmp dword [ebp - 0x24], 0
je 0x4b6d5b
lea eax, [ebp - 0xbc]
mov ecx, dword [ebp - 0x24]
mov edx, 0x4b79c8
call fcn.00406914
mov eax, dword [ebp - 0xbc]
call fcn.004b2860
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
je 0x4b6d77
mov eax, dword [ebp - 0x28]
call fcn.0047eaa8
test al, al
je 0x4b6e06
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
jne 0x4b6d85
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa0]
push eax
push 0x4b5b20
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.004af9a0
test al, al
jne 0x4b6dda
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7a14
call fcn.004b2ae4
mov byte [ebp - 0x79], 0
jmp 0x4b6e10
cmp bl, 1
jne 0x4b6e10
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7900
call fcn.004b2ae4
jmp 0x4b6e10
mov eax, 0x4b7a58
call fcn.004b2860
cmp dword [ebp - 0x1c], 0
je 0x4b6e58
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x80]
call fcn.004b0c34
jmp 0x4b6e58
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0xc0], 0x11
lea edx, [ebp - 0xcc]
mov ecx, 1
mov eax, 0x4b7ab4
call fcn.004b2ae4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b6e8b
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x30]
call fcn.004b599c
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x4b6ec3
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4b6b56
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4b7105
mov byte [ebp - 0x89], 0
mov eax, dword [ebp - 0x88]
cmp word [eax + 0x10], 0x82
jne 0x4b70b7
mov byte [ebp - 0x89], 1
xor eax, eax
push ebp
push 0x4b708e
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b69b8
pop ecx
cmp byte [ebp - 0x29], 0
jne 0x4b6f3a
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne 0x4b707d
cmp byte [ebp - 0x29], 0
jne 0x4b6f46
cmp dword [ebp - 0x24], 0
jne 0x4b6f4a
xor eax, eax
jmp 0x4b6f4c
mov al, 1
mov byte [ebp - 0x8a], al
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 8]
test esi, 8
setne bl
test bl, bl
je 0x4b6f81
test esi, 0x400
setne dl
mov eax, dword [ebp - 0x28]
call fcn.004b6210
mov byte [ebp - 0x8b], al
jmp 0x4b6f88
mov byte [ebp - 0x8b], 0
test bl, bl
je 0x4b6fda
cmp byte [ebp - 0x8b], 0
je 0x4b7084
cmp byte [ebp - 0x8a], 0
jne 0x4b6fda
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.004ad270
test al, al
je 0x4b6fda
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 2
jne 0x4b6fda
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x4b7084
mov byte [ebp - 0x89], 0
cmp byte [ebp - 0x8a], 0
jne 0x4b702e
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x10
je 0x4b700d
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.004b6318
pop ecx
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x40
je 0x4b702e
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.004b65a8
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 4
je 0x4b7067
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0x11
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7b0c
call fcn.004b2ae4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.004b06a0
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 0x10
je 0x4b7084
mov eax, dword [ebp - 0x18]
call fcn.004b67bc
jmp 0x4b7084
mov byte [ebp - 0x89], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b70b7
cmp byte [ebp - 0x89], 0
je 0x4b70ea
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x30]
call fcn.004b599c
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x4b70f8
mov eax, dword [ebp - 0x88]
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jne 0x4b6ee9
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
je 0x4b7685
push ebp
mov eax, dword [ebp - 0x88]
call fcn.004b69b8
pop ecx
xor eax, eax
push ebp
push 0x4b7627
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x88]
movzx esi, word [eax + 0x10]
movzx eax, si
cmp eax, 0x85
jg 0x4b71a4
je 0x4b73f1
cmp eax, 0x81
jg 0x4b7186
je 0x4b7217
dec eax
je 0x4b71d5
add eax, 0xfffffff1
sub eax, 2
jb case.0x4b71b2.140
sub eax, 0xe
je case.0x4b71b2.140
sub eax, 0x60
je case.0x4b71b2.140
jmp case.default.0x4b71b2
sub eax, 0x82
je 0x4b72c0
dec eax
je case.0x4b71b2.140
dec eax
je 0x4b73de
jmp case.default.0x4b71b2
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x4b71b2
jmp dword [eax*4 + 0x4b71b9]
lea eax, [ebp - 0xd4]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4b7b48
call fcn.00406914
mov edx, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd0]
mov al, 0xc2
call fcn.004ab7d4
mov ecx, dword [ebp - 0xd0]
mov dl, 1
mov eax, dword [0x40aa28]
call fcn.0041185c
call fcn.00404a74
jmp case.0x4b71b2.140
cmp byte [ebp - 0x29], 0
jne 0x4b722d
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne case.0x4b71b2.140
mov eax, dword [ebp - 0x88]
mov ebx, dword [eax + 8]
test bl, 4
setne al
push eax
test bl, 8
setne al
push eax
push 0
push 0x4b5a1c
push 0x4b5a28
lea eax, [ebp - 0x48]
push eax
test bl, 2
setne cl
test bl, 0x20
setne al
mov edx, dword [ebp - 0x28]
call fcn.004ae6a4
test al, al
je case.0x4b71b2.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 2
je case.0x4b71b2.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x10
je case.0x4b71b2.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 5
push 0x10
call fcn.0043ada8
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0x28]
call fcn.0047e698
mov edx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x3c]
call fcn.004b0c88
jmp case.0x4b71b2.140
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x24]
call fcn.0040649c
cmp byte [ebp - 0x29], 0
jne 0x4b72d7
cmp dword [ebp - 0x74], 0
jne 0x4b72e2
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040649c
cmp byte [ebp - 0x29], 0
jne 0x4b72f4
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
jne 0x4b735b
cmp byte [ebp - 0x29], 0
jne 0x4b730a
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 2
jne case.0x4b71b2.140
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.004b5cb0
pop ecx
test al, al
jne case.0x4b71b2.140
mov byte [ebp - 0x79], 0
jmp case.0x4b71b2.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 8
je 0x4b737c
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 4
setne dl
mov eax, dword [ebp - 0x28]
call fcn.004b6210
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.00406be4
je case.0x4b71b2.140
push ebp
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x88]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.004b5cb0
pop ecx
test al, al
jne case.0x4b71b2.140
mov byte [ebp - 0x79], 0
jmp case.0x4b71b2.140
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.0047eee4
jmp case.0x4b71b2.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
je 0x4b7410
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0047ed88
test al, al
je case.0x4b71b2.140
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.0047ef30
jmp case.0x4b71b2.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5704
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.0047fd0c
test eax, eax
je case.0x4b71b2.140
sub eax, 2
je case.0x4b71b2.140
mov byte [ebp - 0x79], 0
jmp case.0x4b71b2.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5704
push 0
push 2
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.0047fc4c
test eax, eax
jne case.0x4b71b2.140
push 2
push 0x5033a4
push 1
push 0
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegSetValueExW
test eax, eax
je 0x4b74ce
mov byte [ebp - 0x79], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x4b71b2.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5704
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.0047fe90
test eax, eax
je case.0x4b71b2.140
sub eax, 2
je case.0x4b71b2.140
sub eax, 0x8f
je case.0x4b71b2.140
mov byte [ebp - 0x79], 0
jmp case.0x4b71b2.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x88]
mov eax, dword [eax + 8]
call fcn.004b5704
push 0
push 3
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
movzx eax, byte [ebp - 0x91]
call fcn.0047fc4c
test eax, eax
jne case.0x4b71b2.140
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x9c]
call fcn.0047fb8c
test al, al
je 0x4b759f
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
je 0x4b759f
mov byte [ebp - 0x79], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp case.0x4b71b2.140
mov eax, dword [ebp - 0x88]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x28]
call fcn.004b6210
jmp case.0x4b71b2.140
mov byte [ebp - 0x7a], 1
jmp case.0x4b71b2.140
lea eax, [ebp - 0xe0]
push eax
movzx eax, si
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0xb0], 0
lea edx, [ebp - 0xb4]
xor ecx, ecx
mov eax, 0x4b7b74
call fcn.0040e184
mov edx, dword [ebp - 0xe0]
lea ecx, [ebp - 0xdc]
mov al, 0xc2
call fcn.004ab7d4
mov ecx, dword [ebp - 0xdc]
mov dl, 1
mov eax, dword [0x40aa28]
call fcn.0041185c
call fcn.00404a74
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b7650
mov edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x30]
call fcn.004b599c
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x88], 0
jne 0x4b711e
cmp byte [ebp - 0x7a], 0
je 0x4b769b
push 0
push 0
push 0
push 0x8000000
call fcn.0043ada8
mov eax, dword [ebp - 0x30]
test byte [eax + 0x1d], 0x10
je 0x4b76a9
call fcn.004b096c
cmp dword [ebp - 0x78], 0
je 0x4b76b9
call dword [ebp - 0x78]
push ebp
call fcn.004b6924
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b7767
mov eax, dword [ebp - 0x48]
call fcn.00404098
mov eax, dword [ebp - 0x34]
call fcn.00404098
mov eax, dword [ebp - 0x38]
call fcn.00404098
mov eax, dword [ebp - 0x3c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4b773c
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xe4]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.004b0d10
mov eax, dword [ebp - 0xe4]
call fcn.0047ea94
test al, al
je 0x4b7738
push 0
lea ecx, [ebp - 0xe8]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.004b0d10
mov eax, dword [ebp - 0xe8]
call fcn.004064d4
push eax
push 0x1005
push 0x1000
call fcn.0043ada8
inc ebx
dec esi
jne 0x4b76ec
mov eax, dword [ebp - 0x40]
call fcn.00404098
mov eax, dword [ebp - 0x44]
call fcn.00404098
mov eax, dword [ebp - 0x80]
call fcn.00404098
mov eax, dword [ebp - 0x3c]
call fcn.00404098
ret