Function at 0x476f70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b83f9
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x6b06f8]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push esi
push edi
mov eax, dword [0x6b06f8]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [esp + 0x28]
push ecx
xor edi, edi
mov byte [esp + 0x23], 0
call fcn.004839a0
add esp, 8
mov dword [esp + 0x160], edi
mov eax, dword [esp + 0x24]
cmp dword [eax], edi
je 0x477a47
cmp dword [eax + 4], edi
je 0x477a47
mov ecx, dword [eax + 4]
mov eax, dword [eax]
push ecx
mov esi, 0xf
push eax
lea ecx, [esp + 0x13c]
mov dword [esp + 0x154], esi
mov dword [esp + 0x150], edi
mov byte [esp + 0x140], 0
call fcn.0040af71
mov byte [esp + 0x160], 1
push 1
push 1
lea edx, [esp + 0x13c]
push edx
lea eax, [esp + 0x98]
push eax
call fcn.00478850
mov byte [esp + 0x160], 2
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], edi
mov byte [esp + 0x11c], 0
mov byte [esp + 0x160], 3
lea ecx, [esp + 0x118]
push ecx
lea esi, [esp + 0x90]
call fcn.00478e50
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, eax
mov eax, dword [ecx + 8]
and al, 6
movsx edx, al
add esp, 4
neg edx
sbb edx, edx
not edx
test ecx, edx
je 0x4779bb
cmp dword [esp + 0x130], 0x10
mov eax, dword [esp + 0x11c]
jae 0x4770ac
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00408420
mov byte [esp + 0x160], 4
push 0x67f5a8
lea eax, [esp + 0x18]
call fcn.0042f16b
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00575e7d
add esp, 4
lea edx, [esp + 0x44]
push edx
mov esi, eax
call fcn.004137bf
mov byte [esp + 0x160], 5
push esi
lea ecx, [esp + 0x48]
call fcn.00478a90
cmp esi, edi
jbe 0x4771a9
mov ebx, esi
jmp 0x477110
lea eax, [esp + 0x118]
push eax
lea esi, [esp + 0x90]
call fcn.00478e50
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax + 8]
add ecx, eax
and dl, 6
movsx eax, dl
add esp, 4
neg eax
sbb eax, eax
not eax
test ecx, eax
je 0x4771a0
cmp dword [esp + 0x130], 0x10
jb 0x47715d
mov eax, dword [esp + 0x11c]
mov esi, eax
cmp eax, edi
jne 0x477164
xor eax, eax
jmp 0x477179
lea esi, [esp + 0x11c]
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x477170
sub eax, edx
push eax
push esi
lea eax, [esp + 0x1c]
call fcn.0040b232
push 0x67f5a8
lea eax, [esp + 0x18]
call fcn.0042f16b
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x48]
call fcn.00426d53
sub ebx, 1
jne 0x477110
lea edx, [esp + 0x74]
push edx
call fcn.00482d80
mov byte [esp + 0x160], 6
lea eax, [esp + 0x118]
push eax
lea esi, [esp + 0x90]
call fcn.00478e50
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax + 8]
add ecx, eax
and dl, 6
movsx eax, dl
add esp, 4
neg eax
sbb eax, eax
not eax
test ecx, eax
je 0x4778fd
cmp dword [esp + 0x130], 0x10
jb 0x477255
mov ebx, dword [esp + 0x11c]
test ebx, ebx
je 0x47721b
mov esi, ebx
lea ecx, [esi + 1]
jmp 0x477210
mov al, byte [esi]
inc esi
test al, al
jne 0x477210
sub esi, ecx
jne 0x477286
mov edx, dword [esp + 0x14]
cmp dword [edx - 0xc], 0
mov esi, dword [edx - 0x10]
lea eax, [edx - 0x10]
je 0x4772f6
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x47725e
cmp dword [edx - 8], 0
jl 0x477ab2
mov dword [edx - 0xc], 0
mov ecx, dword [esp + 0x14]
mov byte [ecx], 0
jmp 0x4772f6
lea ebx, [esp + 0x11c]
jmp 0x477206
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477274
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
jmp 0x4772f6
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
mov edi, ebx
sub ecx, esi
sub edi, eax
or ecx, edx
jge 0x4772b5
mov eax, esi
lea ecx, [esp + 0x14]
call fcn.0040d918
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
push esi
cmp edi, dword [esp + 0x34]
ja 0x4772cb
add edi, eax
push edi
push ecx
push eax
call fcn.0057380c
jmp 0x4772d3
push ebx
push ecx
push eax
call fcn.005745c0
add esp, 0x10
test esi, esi
jl 0x477ab2
mov eax, dword [esp + 0x14]
cmp esi, dword [eax - 8]
jg 0x477ab2
mov dword [eax - 0xc], esi
mov edx, dword [esp + 0x14]
mov byte [esi + edx], 0
push 0x67f5a8
lea eax, [esp + 0x18]
call fcn.0042f16b
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jl 0x4778bf
push 0x67f5ac
push eax
call fcn.005757bc
add esp, 8
test eax, eax
je 0x4778bf
sub eax, dword [esp + 0x14]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4778bf
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
call fcn.0042f21e
mov byte [esp + 0x160], 7
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00471230
add esp, 8
mov byte [esp + 0x160], 8
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
movzx eax, word [edx]
movzx esi, al
shr eax, 8
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x50]
sar eax, 2
cmp esi, eax
jb 0x477391
call fcn.0057451a
mov ecx, dword [esp + 0x50]
mov esi, dword [ecx + esi*4]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
sub esi, 0x10
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x4773bf
cmp eax, dword [esi]
jne 0x4773bf
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4773f3
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x477abc
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.005745c0
add esp, 0x10
add edi, 0x10
mov dword [esp + 0x40], edi
mov byte [esp + 0x160], 0xa
mov edx, dword [0x6c7718]
mov eax, dword [edx + 0xc]
mov ecx, 0x6c7718
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x160], 0xc
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x4774aa
lea edx, [esp + 0x5c]
push edx
lea ecx, [ebx + 1]
lea edx, [esp + 0x18]
call fcn.0042f1e8
mov byte [esp + 0x160], 0xd
mov ecx, dword [eax]
mov esi, dword [esp + 0x1c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x477499
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x47748b
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x47748b
call fcn.0040b2a1
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x477482
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [esp + 0x1c], ebx
jmp 0x477499
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea eax, [esp + 0x24]
call fcn.0040b232
mov byte [esp + 0x160], 0xc
mov eax, dword [esp + 0x5c]
jmp 0x477631
push eax
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x7c]
call fcn.00483140
mov byte [esp + 0x160], 0xf
mov edx, dword [esp + 0x2c]
cmp dword [edx - 0xc], 0
je 0x477625
lea eax, [esp + 0x70]
lea ecx, [ebx + 1]
push eax
lea edx, [esp + 0x18]
call fcn.0042f1e8
mov edi, eax
mov byte [esp + 0x160], 0x10
mov ecx, dword [esp + 0x2c]
push ecx
lea edx, [esp + 0x68]
push edx
call fcn.00470550
mov byte [esp + 0x168], 0x11
lea ecx, [esp + 0x68]
push 0x67f5ac
push ecx
mov esi, eax
call fcn.004135f4
mov byte [esp + 0x170], 0x12
lea edx, [esp + 0x78]
push edi
push edx
mov esi, eax
call fcn.004135a2
add esp, 0x18
mov byte [esp + 0x160], 0x13
mov ecx, dword [eax]
mov esi, dword [esp + 0x1c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x477585
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x477577
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x477577
call fcn.0040b2a1
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x47756e
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [esp + 0x1c], ebx
jmp 0x477585
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea eax, [esp + 0x24]
call fcn.0040b232
mov byte [esp + 0x160], 0x12
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4775ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0x11
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4775d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0x10
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4775fd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0xf
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477625
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0xc
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47764d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
cmp dword [ecx - 0xc], ebx
je 0x4777ff
mov ecx, dword [esp + 0x6c]
mov eax, dword [ecx + 0x14]
mov esi, dword [eax]
mov eax, dword [ecx]
mov edi, eax
mov dword [esp + 0x34], esi
cmp eax, ebx
jne 0x477746
call fcn.0057451a
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x477686
call fcn.0057451a
mov esi, dword [esi]
cmp edi, ebx
jne 0x47774d
call fcn.0057451a
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x4776a1
call fcn.0057451a
mov edx, dword [esp + 0x1c]
mov esi, dword [esi]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00470690
add esp, 8
mov byte [esp + 0x160], 0x19
cmp edi, ebx
jne 0x477754
call fcn.0057451a
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x4776d6
call fcn.0057451a
mov ecx, dword [esp + 0x20]
cmp dword [ecx - 0xc], ebx
jl 0x47775b
push str.HKLM_
push ecx
call fcn.0057452a
mov ecx, dword [esp + 0x28]
add esp, 8
cmp eax, ebx
je 0x4776fb
sub eax, ecx
sar eax, 1
je 0x47773b
cmp dword [ecx - 0xc], ebx
jl 0x47775b
push str.HKCU_
push ecx
call fcn.0057452a
mov ecx, dword [esp + 0x28]
add esp, 8
cmp eax, ebx
je 0x47771c
sub eax, ecx
sar eax, 1
je 0x47773b
cmp dword [ecx - 0xc], ebx
jl 0x47775b
push str.HKCR_
push ecx
call fcn.0057452a
add esp, 8
cmp eax, ebx
je 0x47775b
sub eax, dword [esp + 0x20]
sar eax, 1
jne 0x47775b
cmp byte [ebp + 0x14], 0
jne 0x477761
jmp 0x4777ce
mov eax, dword [eax]
jmp 0x47767c
mov eax, dword [edi]
jmp 0x477697
mov eax, dword [edi]
jmp 0x4776cc
cmp byte [ebp + 0x10], 0
je 0x4777ce
cmp edi, ebx
jne 0x4777f8
call fcn.0057451a
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x47777a
call fcn.0057451a
mov ecx, dword [esp + 0x40]
mov esi, dword [esi + 8]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.00470690
add esp, 8
mov byte [esp + 0x160], 0x1a
mov edx, dword [esi]
mov edx, dword [edx + 4]
lea ecx, [esp + 0x20]
push ecx
push eax
mov ecx, esi
call edx
mov byte [esp + 0x160], 0x19
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4777ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0xc
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477806
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x477806
mov eax, dword [edi]
jmp 0x477770
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x160], 0xa
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47782e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 8
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477856
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 7
mov eax, dword [esp + 0x28]
dec dword [eax + 8]
mov esi, eax
add eax, 8
cmp dword [eax], ebx
jne 0x477895
cmp dword [esi + 4], ebx
je 0x477884
mov eax, dword [esi]
push ebx
push eax
call fcn.005765a8
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00573721
add esp, 4
mov dword [esp + 0x28], ebx
mov byte [esp + 0x160], 6
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4778c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4778c7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x118]
push ecx
lea esi, [esp + 0x90]
call fcn.00478e50
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, eax
mov eax, dword [ecx + 8]
and al, 6
movsx edx, al
add esp, 4
neg edx
sbb edx, edx
not edx
test ecx, edx
jne 0x4771f1
xor edi, edi
mov byte [esp + 0x1b], 1
mov byte [esp + 0x160], 5
lea eax, [esp + 0x74]
push eax
call fcn.00482450
mov bl, 0x21
mov byte [esp + 0x160], bl
mov esi, dword [esp + 0x50]
cmp esi, edi
je 0x477972
mov eax, dword [esp + 0x54]
mov edi, eax
mov dword [esp + 0x38], esi
cmp esi, eax
je 0x477967
mov byte [esp + 0x160], bl
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477958
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
mov dword [esp + 0x38], esi
cmp esi, edi
jne 0x477933
mov esi, dword [esp + 0x50]
push esi
call fcn.00573721
add esp, 4
xor edi, edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov byte [esp + 0x160], 4
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00573721
add esp, 4
mov byte [esp + 0x160], 3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4779bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 2
mov ebx, 0x10
cmp dword [esp + 0x130], ebx
jb 0x4779e1
mov ecx, dword [esp + 0x11c]
push ecx
call fcn.00573721
add esp, 4
mov esi, 0xf
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], edi
mov byte [esp + 0x11c], 0
mov byte [esp + 0x160], 1
lea ecx, [esp + 0x8c]
call fcn.00476f00
mov byte [esp + 0x160], 0
cmp dword [esp + 0x14c], ebx
jb 0x477a31
mov edx, dword [esp + 0x138]
push edx
call fcn.00573721
add esp, 4
mov dword [esp + 0x14c], esi
mov dword [esp + 0x148], edi
mov byte [esp + 0x138], 0
mov dword [esp + 0x160], 0xffffffff
mov esi, dword [esp + 0x24]
dec dword [esi + 8]
cmp dword [esi + 8], edi
lea eax, [esi + 8]
jne 0x477a88
cmp dword [esi + 4], edi
je 0x477a77
mov eax, dword [esi]
push edi
push eax
call fcn.005765a8
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], edi
mov eax, dword [esp + 0x24]
push eax
call fcn.00573721
add esp, 4
mov dword [esp + 0x24], edi
mov al, byte [esp + 0x1b]
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0057372c
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.00402d79
call fcn.0040b3d4
int3