Function at 0x4b2200
Capabilities:
Get local ipv4 addresses
Get socket information
Resolve function by parsing pe exports
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55bffc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0xe91c
call fcn.0054d230
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov cx, word [edi + 2]
movzx ecx, cx
add edi, 4
add eax, 0xfffffffc
mov dword [esp + 0x1c], ecx
mov ecx, 0x300
lea ebx, [esp + 0x328]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
call fcn.004b5820
push eax
mov eax, dword [esp + 0x20]
push eax
push str._tRECV____CD_04X___s_n
call fcn.0046c4c0
add esp, 0xc
cmp eax, 0x2031
jg 0x4b2bdb
cmp eax, 0x2031
je 0x4b2b93
cmp eax, 0x1ffe
jg 0x4b2957
je 0x4b282b
sub eax, 0x1001
je 0x4b2674
sub eax, 0x10
je 0x4b2301
sub eax, 0xe
jne 0x4b306f
push str.NTF_VIP_IPPORT_n
call fcn.0046c4c0
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 6
jne 0x4b306f
mov byte [esi + 0x7194], 1
mov word [esi + 0x7198], 2
mov edx, dword [edi]
mov dword [esi + 0x719c], edx
mov ax, word [edi + 4]
mov word [esi + 0x719a], ax
xor ecx, ecx
add esi, 0x71a0
mov dword [esi], ecx
mov dword [esi + 4], ecx
jmp 0x4b306f
push str.RET_LOGIN_n
call fcn.0046c4c0
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ecx, 2
jl 0x4b306f
xor eax, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0xe934], eax
mov bx, word [edi]
xor edx, edx
mov dword [esp + 0x6d], edx
mov dword [esp + 0x71], edx
mov dword [esp + 0x75], edx
add edi, 2
cmp bx, ax
mov dword [esp + 0x79], edx
mov dword [esp + 0x14], 0x10
mov byte [esp + 0x6c], al
mov dword [esp + 0x7d], edx
mov dword [esp + 0x10], edi
jne 0x4b262a
cmp ecx, 0x1e
jl 0x4b2666
lea ebx, [esi - 0x2c8]
mov dword [esp + 0x1c], ebx
call fcn.004b4760
add esi, 0x7208
call fcn.004af9a0
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esi + 0x718c]
lea eax, [esi - 0x2f0]
call fcn.004b44a0
push eax
call dword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
mov ebx, edi
jne 0x4b23cd
mov edx, dword [esp + 0x14]
mov ecx, dword [esi - 0x40]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push 4
push ebx
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, dword [esp + 0x18]
add ebx, 4
add esi, 0x71a8
mov edi, ebx
call fcn.004b49f0
mov edi, dword [esp + 0x18]
push 0x11
lea edx, [esp + 0x90]
push edx
lea eax, [edi + 0x7238]
add ebx, 0xc
call fcn.004ad150
lea esi, [esp + 0x8c]
lea eax, [esp + 0xe0]
call fcn.004ae460
lea eax, [edi + 0x71d8]
lea ecx, [esp + 0xe0]
lea esi, [edi + 0x71a8]
push ecx
mov edi, eax
call fcn.004b4a10
mov edi, ebx
lea esi, [esp + 0x4c]
call fcn.004b43b0
mov dx, word [ebx + 8]
add ebx, 8
mov ax, word [ebx + 2]
add ebx, 2
add ebx, 2
cmp ax, 0x1f4
mov word [esp + 0x20], dx
jbe 0x4b2457
mov eax, 0x1f4
test ax, ax
jbe 0x4b2551
movzx eax, ax
mov dword [esp + 0x10], eax
jmp 0x4b2470
mov edi, ebx
lea esi, [esp + 0xa0]
call fcn.004aeed0
add ebx, 0x10
mov edi, ebx
lea esi, [esp + 0x5c]
call fcn.004b49f0
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0xa0]
push ecx
lea esi, [esp + 0x60]
add edi, 0x71d8
add ebx, 0xc
call fcn.004b4a10
cmp byte [ebx], 0
jne 0x4b24b2
inc ebx
jmp 0x4b24e1
mov edx, ebx
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esp + 0x6c], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x70], ecx
mov ecx, dword [edx + 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], edx
mov byte [esp + 0x80], 0
add ebx, 0x14
lea edi, [esp + 0x6c]
lea esi, [esp + 0xb2]
call fcn.004b4360
mov edi, ebx
lea esi, [esp + 0xc8]
call fcn.004b43b0
mov ax, word [ebx + 8]
add ebx, 8
mov word [esp + 0xd2], ax
lea eax, [esp + 0xa0]
lea ecx, [esp + 0x38]
add ebx, 2
call fcn.004b3460
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xa0]
add ecx, 0x71b8
call fcn.004b33b0
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0xa0]
call fcn.004b45a0
dec dword [esp + 0x10]
jne 0x4b2470
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 0x71cc]
test eax, eax
jne 0x4b25b2
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push bind
push str.CBuddy2_Timer_Receiving_Window
push str.STATIC
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [edi + 0x71cc], eax
je 0x4b25b2
mov esi, dword [sym.imp.USER32.dll_SetWindowLongA]
lea ecx, [edi - 0x2f4]
push ecx
push 0xffffffffffffffeb
push eax
call esi
mov edx, dword [edi + 0x71cc]
push 0x4adfc0
push 0xfffffffffffffffc
push edx
call esi
mov eax, dword [edi + 0x71cc]
test eax, eax
je 0x4b25df
mov ecx, dword [edi + 0x71d0]
test ecx, ecx
jne 0x4b25df
push 0
push 0xea60
push 0x14d
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [edi + 0x71d0], eax
lea esi, [edi - 0x2f4]
mov byte [edi + 0x7189], 1
mov byte [edi + 0x7194], 0
call fcn.004b2070
mov ecx, dword [edi + 0x71c8]
mov eax, dword [ecx]
lea edx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x24]
push edx
lea edx, [esp + 0x54]
push edx
lea edx, [esp + 0x98]
push edx
push 0
call dword [eax + 0xc]
lea esi, [esp + 0x38]
call fcn.004ae410
jmp 0x4b306f
add esi, 0xfffffd0c
call fcn.004b2070
mov esi, 0x5796fa
lea eax, [esp + 0xd6]
call fcn.004b4380
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x71c8]
mov edx, dword [ecx]
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0xde]
push eax
push esi
push ebx
call dword [edx + 0xc]
lea esi, [esp + 0x38]
call fcn.004ae410
jmp 0x4b306f
push str.RET_PRECREDENTIAL_n
call fcn.0046c4c0
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 4
jne 0x4b306f
mov esi, dword [esi + 0x7190]
test esi, esi
je 0x4b26a1
push esi
call fcn.0054a142
add esp, 4
mov esi, 0x2dbabe65
call fcn.004b85a0
mov edi, dword [esp + 0x18]
push 0x11
lea ecx, [esp + 0x90]
mov dword [edi + 0x7190], eax
push ecx
lea eax, [edi + 0x7238]
call fcn.004ad150
test al, al
je 0x4b306f
push 0x15
lea edx, [esp + 0x70]
push edx
lea eax, [edi + 0x74bc]
call fcn.004ad150
test al, al
je 0x4b306f
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
lea eax, [esp + 0x77a8]
push eax
mov eax, dword [edi + 0x7190]
push edx
push 0x56ffe4
push eax
lea eax, [esp + 0x7c]
lea esi, [esp + 0x9c]
call fcn.004b85d0
add esp, 0x10
test al, al
je 0x4b306f
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [edi + 0x718c]
lea edx, [esp + 0x20]
push edx
lea eax, [edi - 0x2f0]
mov dword [esp + 0x28], 0x10
call fcn.004b44c0
test al, al
je 0x4b2812
mov eax, dword [edi - 0x40]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push eax
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4b2812
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x630], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x62c], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x634], edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x63c], ecx
mov dword [esp + 0x638], eax
mov ax, word [esp + 0x26]
push 0x715a
lea ecx, [esp + 0x77cc]
mov dword [esp + 0x644], edx
mov edx, dword [edi + 0x7190]
push ecx
mov word [esp + 0x64c], ax
push edx
mov eax, 0x24
lea ecx, [esp + 0x634]
mov dword [esp + 0x634], 0x19
call fcn.004b88a0
add esp, 0xc
test al, al
je 0x4b306f
push 0x50
push 0x1010
add edi, 0xfffffd0c
push edi
lea ecx, [esp + 0x77b4]
call fcn.004b3150
jmp 0x4b306f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CBuddy2::OnMsg_on_RET_PRECREDENTIAL___getsockname___failed_with__d_n
call fcn.0046c4c0
add esp, 8
jmp 0x4b306f
push str.NTF_NOTICE_n
call fcn.0046c4c0
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 4
jl 0x4b306f
xor ebx, ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0xe934], 1
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov byte [esp + 0xe934], 2
mov ax, word [edi]
add edi, 2
cmp ax, 0xa
ja 0x4b2940
cmp ax, bx
jbe 0x4b2930
movzx eax, ax
mov dword [esp + 0x1c], eax
jmp 0x4b2894
mov edi, dword [esp + 0x10]
mov al, byte [edi]
movzx edx, al
inc edi
mov dword [esp + 0x10], edi
mov ecx, edx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x228]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [eax + edx]
add eax, edx
mov byte [esp + edx + 0x228], bl
movzx edx, cl
inc eax
mov ecx, edx
mov ebx, ecx
shr ecx, 2
mov esi, eax
lea edi, [esp + 0x128]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add eax, edx
lea ecx, [esp + 0x228]
mov dword [esp + 0x10], eax
xor ebx, ebx
push ecx
lea eax, [esp + 0x60]
mov byte [esp + edx + 0x12c], bl
call fcn.004b2030
lea edx, [esp + 0x128]
push edx
lea eax, [esp + 0x64]
call fcn.004b2030
lea edx, [esp + 0x5c]
lea esi, [esp + 0x38]
call fcn.004b34f0
dec dword [esp + 0x1c]
jne 0x4b2890
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x71c8]
mov eax, dword [ecx]
lea edx, [esp + 0x38]
push edx
call dword [eax + 0x10]
lea edi, [esp + 0x5c]
call fcn.004b3090
lea ebx, [esp + 0x38]
call fcn.004b36c0
jmp 0x4b306f
sub eax, 0x1fff
je 0x4b2b4b
sub eax, 0x11
je 0x4b29ee
sub eax, 0x11
jne 0x4b306f
push str.NTF_TUNNEL_PACKET_n
call fcn.0046c4c0
add esp, 4
lea esi, [esp + 0x38]
call fcn.004aeed0
mov ebx, dword [esp + 0x10]
add ebx, 0x10
mov edi, ebx
lea esi, [esp + 0x4c]
call fcn.004b49f0
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x38]
push eax
add edi, 0x71d8
lea esi, [esp + 0x50]
add ebx, 0xc
call fcn.004b4a10
movzx ecx, word [ebx + 2]
xor eax, eax
mov ax, word [ebx]
add ebx, 2
push ecx
lea esi, [ebx + 2]
push eax
push 0
call fcn.00549d62
mov edx, dword [esp + 0x24]
add esp, 4
push eax
add edx, 0xfffffd0c
push edx
mov ecx, esi
lea ebx, [esp + 0x48]
call fcn.004b5320
jmp 0x4b306f
push str.NTF_SAVE_PACKET_n
call fcn.0046c4c0
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 0x10
jl 0x4b306f
mov ecx, dword [esi + 0x7190]
push 0x717a
push edi
push ecx
lea ecx, [esp + 0x77b4]
call fcn.004b8940
add esp, 0xc
test al, al
je 0x4b306f
mov cx, word [esp + 0x77a8]
test cx, cx
lea ebx, [esp + 0x77aa]
mov word [esp + 0x628], cx
lea eax, [esp + 0x62a]
jbe 0x4b2b29
lea edx, [esi + 0x71d8]
movzx ecx, cx
add esi, 0xfffffd0c
mov dword [esp + 0x1c], edx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x10], ecx
jmp 0x4b2a74
mov ebx, dword [esp + 0x14]
mov edx, dword [ebx]
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x20], eax
add ebx, 4
mov eax, ebx
mov ecx, dword [eax]
mov dword [esp + 0x24], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x28], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
mov edx, dword [eax + 0xc]
add ebx, 0x10
mov edi, ebx
lea esi, [esp + 0x4c]
mov dword [esp + 0x30], edx
mov byte [esp + 0x34], 0
call fcn.004b49f0
lea esi, [esp + 0x24]
lea eax, [esp + 0x104]
add ebx, 0xc
call fcn.004ae460
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x104]
push eax
lea esi, [esp + 0x50]
call fcn.004b4a10
mov eax, dword [ebx]
add ebx, 4
mov dx, word [ebx + 2]
xor ecx, ecx
mov cx, word [ebx]
add ebx, 2
movzx esi, dx
push esi
add ebx, 2
push ecx
mov ecx, dword [esp + 0x64]
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x24], ebx
lea ebx, [esp + 0x34]
call fcn.004b5320
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add ecx, esi
dec eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
jne 0x4b2a70
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x628]
sub eax, edx
push eax
push 0x2011
add esi, 0xfffffd0c
push esi
mov ecx, edx
call fcn.004b3150
jmp 0x4b306f
push str.NTF_CLOSE_CONNECTION_n
call fcn.0046c4c0
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jne 0x4b306f
lea eax, [esi - 0x2f0]
mov esi, dword [esi + 0x718c]
push eax
call fcn.004ae5b0
mov eax, dword [esp + 0x10]
movzx eax, word [eax]
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x71c8]
mov edx, dword [ecx]
push eax
call dword [edx + 8]
jmp 0x4b306f
push str.RET_SMS_SEND_n
call fcn.0046c4c0
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jne 0x4b306f
cmp dword [esi + 0x7758], 0x10
jb 0x4b2bbe
mov eax, dword [esi + 0x7744]
jmp 0x4b2bc4
lea eax, [esi + 0x7744]
mov ecx, dword [esi + 0x71c8]
mov edx, dword [ecx]
xor esi, esi
mov si, word [edi]
push esi
push eax
call dword [edx + 0x50]
jmp 0x4b306f
cmp eax, 0x3007
jg 0x4b2ded
je 0x4b2ddb
sub eax, 0x3001
je 0x4b2cad
sub eax, 2
je 0x4b2c17
sub eax, 2
jne 0x4b306f
push str.RET_GROUP_BUDDY_n
call fcn.0046c4c0
add esp, 4
jmp 0x4b306f
push str.RET_REMOVE_BUDDY_n
call fcn.0046c4c0
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jl 0x4b306f
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4b306f
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 0x24], eax
mov eax, dword [edi + 0xc]
mov edi, dword [esi + 0x71bc]
mov dword [esp + 0x30], eax
cmp edi, dword [esi + 0x71c0]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov byte [esp + 0x34], 0
je 0x4b306f
push 0x10
lea ecx, [esp + 0x28]
push ecx
push edi
call fcn.0054d26d
add esp, 0xc
test eax, eax
je 0x4b2c98
mov eax, dword [esi + 0x71c0]
add edi, 0x12
cmp edi, eax
jne 0x4b2c72
jmp 0x4b306f
push edi
add esi, 0x71b8
lea ebx, [esp + 0x60]
call fcn.004b3430
jmp 0x4b306f
push str.RET_ADD_BUDDY_n
call fcn.0046c4c0
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jl 0x4b306f
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4b306f
mov edx, edi
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x28], ecx
mov ecx, dword [edx + 0xc]
add edi, 0x10
lea esi, [esp + 0x4c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov byte [esp + 0x34], 0
mov dword [esp + 0x10], edi
call fcn.004b49f0
mov ebx, edi
lea esi, [esp + 0x24]
lea eax, [esp + 0xf2]
add ebx, 0xc
call fcn.004ae460
mov edi, dword [esp + 0x18]
lea edx, [esp + 0xf2]
push edx
add edi, 0x71d8
lea esi, [esp + 0x50]
call fcn.004b4a10
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dx, word [ebx + 8]
mov dword [esp + 0x4c], eax
lea esi, [esp + 0x24]
lea eax, [esp + 0x8c]
mov dword [esp + 0x50], ecx
mov byte [esp + 0x54], 0
mov word [esp + 0x5c], dx
call fcn.004ae460
mov ebx, dword [esp + 0x18]
lea ecx, [ebx + 0x71b8]
lea eax, [esp + 0x8c]
call fcn.004b33b0
lea edi, [ebx - 0x2c8]
mov eax, esi
call fcn.004b45a0
mov edi, esi
lea esi, [esp + 0xa0]
call fcn.004aeed0
lea edi, [esp + 0x4c]
lea esi, [esp + 0xc8]
call fcn.004b43b0
mov ax, word [esp + 0x5c]
mov ebx, dword [ebx + 0x71c8]
mov word [esp + 0xd2], ax
lea eax, [esp + 0xa0]
mov byte [esp + 0xc7], 0
mov byte [esp + 0xb2], 0
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x44]
jmp 0x4b306f
push str.RET_RENAME_GROUP_n
call fcn.0046c4c0
add esp, 4
jmp 0x4b306f
sub eax, 0x3fff
je 0x4b2f5e
sub eax, 2
je 0x4b2e62
sub eax, 0xfff
jne 0x4b306f
push str.NTF_NOTICE2_n
call fcn.0046c4c0
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ecx, 0xff
jg 0x4b306f
mov edx, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x128]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 0x71c8]
mov eax, edx
mov byte [esp + eax + 0x128], 0
mov edx, dword [ecx]
lea eax, [esp + 0x128]
push eax
call dword [edx + 0x14]
jmp 0x4b306f
push str.RET_SEARCH_n
call fcn.0046c4c0
mov edx, dword [esp + 0x18]
add esp, 4
cmp edx, 2
jl 0x4b306f
xor ecx, ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0xe934], 3
mov ax, word [edi]
add edi, 2
cmp ax, cx
jne 0x4b2f40
cmp edx, 4
jl 0x4b2f50
mov ax, word [edi]
add edi, 2
cmp ax, cx
mov dword [esp + 0x10], edi
jbe 0x4b2f40
movzx ecx, ax
add esi, 0x71d8
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
jmp 0x4b2ed7
mov edi, dword [esp + 0x10]
lea esi, [esp + 0x6c]
call fcn.004aeed0
mov ebx, dword [esp + 0x10]
add ebx, 0x10
mov edi, ebx
lea esi, [esp + 0x4c]
call fcn.004b49f0
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x6c]
push edx
lea esi, [esp + 0x50]
add ebx, 0xc
call fcn.004b4a10
mov edi, ebx
lea esi, [esp + 0x7e]
call fcn.004b43b0
mov ax, word [ebx + 8]
add ebx, 8
lea ecx, [esp + 0x6c]
mov word [esp + 0x88], ax
add ebx, 2
push ecx
lea eax, [esp + 0x3c]
mov dword [esp + 0x14], ebx
call fcn.004b3550
dec dword [esp + 0x20]
jne 0x4b2ed3
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x71c8]
mov edx, dword [ecx]
lea eax, [esp + 0x38]
push eax
call dword [edx + 0x4c]
lea esi, [esp + 0x38]
call fcn.004ae410
jmp 0x4b306f
push str.NTF_USER_STATE_n
call fcn.0046c4c0
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 2
jl 0x4b306f
mov ax, word [edi]
add edi, 2
test ax, ax
jbe 0x4b306f
movzx ecx, ax
add esi, 0xfffffd38
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
jmp 0x4b2fa2
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov bl, byte [edi + 0x10]
mov edx, edi
mov eax, dword [edx]
mov ecx, dword [edx + 4]
add edi, 0x10
mov dword [esp + 0x24], eax
mov eax, dword [edx + 8]
test bl, bl
mov dword [esp + 0x2c], eax
setne al
mov dword [esp + 0x28], ecx
mov ecx, dword [edx + 0xc]
inc edi
test al, al
mov dword [esp + 0x30], ecx
mov byte [esp + 0x34], 0
mov byte [esp + 0x9e], al
mov dword [esp + 0x10], edi
je 0x4b300e
mov eax, dword [edi]
add edi, 4
mov edx, dword [edi + 2]
xor ecx, ecx
mov cx, word [edi]
add edi, 2
add edi, 4
push edx
xor ebx, ebx
mov bx, word [edi]
add edi, 2
push ecx
push eax
mov dword [esp + 0x1c], edi
lea eax, [esp + 0x30]
mov edi, esi
call fcn.004b4530
jmp 0x4b303e
lea edx, [esp + 0x24]
push edx
push esi
call fcn.004b45f0
lea esi, [esp + 0x24]
lea eax, [esp + 0x116]
call fcn.004ae460
mov eax, dword [esp + 0x18]
add eax, 0x7208
lea edx, [esp + 0x116]
call fcn.004aee00
lea edi, [esp + 0x24]
lea esi, [esp + 0x8c]
call fcn.004aeed0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x71c8]
mov edx, dword [ecx]
lea eax, [esp + 0x8c]
push eax
call dword [edx + 0x2c]
dec dword [esp + 0x20]
jne 0x4b2f9a
mov ecx, dword [esp + 0xe92c]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8