Function at 0x47c1a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ed02b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x14], ebx
call sub.MFC42.DLL_CDocument::CDocument
xor edi, edi
lea ecx, [ebx + 0x70]
mov dword [esp + 0x20], edi
call sub.MFC42.DLL_CString::CString
lea ecx, [ebx + 0x74]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea esi, [ebx + 0x78]
mov dword [esi], 0x4f583c
mov dword [esi + 4], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], edi
mov dword [esi + 8], edi
lea ecx, [ebx + 0x8c]
mov byte [esp + 0x20], 3
call fcn.00443e20
lea ecx, [ebx + 0xe0]
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CObArray::CObArray
mov dword [ebx + 0xe0], 0x4f57d4
lea ecx, [ebx + 0xf4]
mov byte [esp + 0x20], 5
call fcn.00475800
lea ecx, [ebx + 0x10c]
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CPtrArray::CPtrArray
mov dword [ebx + 0x10c], 0x4f9518
mov dword [ebx + 0x124], 0x4f5778
mov dword [ebx + 0x128], edi
mov dword [ebx + 0x134], edi
mov dword [ebx + 0x130], edi
mov dword [ebx + 0x12c], edi
lea ecx, [ebx + 0x138]
mov byte [esp + 0x20], 8
call sub.MFC42.DLL_CString::CString
lea ecx, [ebx + 0x15c]
mov byte [esp + 0x20], 9
call sub.MFC42.DLL_CObArray::CObArray
mov dword [ebx + 0x15c], 0x4f57d4
xor eax, eax
mov dword [ebx + 0x58], 0x9999999a
mov dword [ebx + 0x60], edi
mov dword [ebx + 0x68], eax
lea ecx, [ebx + 0x70]
mov byte [esp + 0x20], 0xa
mov dword [ebx], 0x4f9460
mov dword [ebx + 0x5c], 0x3f999999
mov dword [ebx + 0x64], 0x3ff00000
mov dword [ebx + 0x6c], edi
call sub.MFC42.DLL_CString::Empty
lea ecx, [ebx + 0x74]
call sub.MFC42.DLL_CString::Empty
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.0042f6b0
mov eax, dword [esi + 4]
cmp eax, edi
jne 0x47c30d
push 0x40
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esi + 4], eax
push 0x10
push eax
call fcn.0048e170
mov eax, 0x10
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
jmp 0x47c3e9
mov ecx, dword [esi + 0xc]
cmp ecx, 0x10
jl 0x47c33a
mov ecx, dword [esi + 8]
cmp ecx, 0x10
jge 0x47c32e
mov edx, 0x10
lea eax, [eax + ecx*4]
sub edx, ecx
push edx
push eax
call fcn.0048e170
mov dword [esi + 8], 0x10
jmp 0x47c3e9
mov eax, dword [esi + 0x10]
cmp eax, edi
jne 0x47c365
mov eax, dword [esi + 8]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp eax, 4
jge 0x47c359
mov eax, 4
jmp 0x47c365
cmp eax, 0x400
jle 0x47c365
mov eax, 0x400
add eax, ecx
cmp eax, 0x10
mov dword [esp + 0xc], eax
jg 0x47c378
mov dword [esp + 0xc], 0x10
mov ecx, dword [esp + 0xc]
lea edx, [ecx*4]
push edx
call sub.MFC42.DLL_operatornew
mov ecx, dword [esi + 8]
mov esi, dword [esi + 4]
shl ecx, 2
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, 0x10
and ecx, 3
add esp, 4
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x80]
mov dword [esp + 0x10], eax
sub edx, ecx
lea eax, [eax + ecx*4]
push edx
push eax
call fcn.0048e170
mov ecx, dword [ebx + 0x7c]
push ecx
call sub.MFC42.DLL_operatordelete
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
add esp, 4
mov dword [ebx + 0x7c], edx
mov dword [ebx + 0x80], 0x10
mov dword [ebx + 0x84], eax
xor edi, edi
mov ecx, dword [ebx + 0x7c]
push 0xffffffffffffffff
push edi
mov dword [ecx], 0x646464
mov edx, dword [ebx + 0x7c]
mov dword [edx + 4], 0xff0000
mov eax, dword [ebx + 0x7c]
mov dword [eax + 8], 0xff
mov ecx, dword [ebx + 0x7c]
mov dword [ecx + 0xc], 0xff00ff
mov edx, dword [ebx + 0x7c]
mov dword [edx + 0x10], 0xff00
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0x14], 0xc8c800
mov ecx, dword [ebx + 0x7c]
mov dword [ecx + 0x18], 0xc8c8
mov edx, dword [ebx + 0x7c]
mov dword [edx + 0x1c], 0xc8c8c8
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0x20], edi
mov ecx, dword [ebx + 0x7c]
mov dword [ecx + 0x24], 0xaa0000
mov edx, dword [ebx + 0x7c]
mov dword [edx + 0x28], 0xaa
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0x2c], 0xaa00aa
mov ecx, dword [ebx + 0x7c]
mov dword [ecx + 0x30], 0xaa00
mov edx, dword [ebx + 0x7c]
mov dword [edx + 0x34], 0xaaaa00
mov eax, dword [ebx + 0x7c]
mov dword [eax + 0x38], 0xaaaa
mov ecx, dword [ebx + 0x7c]
xor eax, eax
mov dword [ecx + 0x3c], 0x464646
mov ecx, 0x66666666
mov dword [ebx + 0xb4], eax
mov dword [ebx + 0xbc], eax
mov dword [ebx + 0xc8], ecx
mov eax, 0x40296666
mov dword [ebx + 0xd8], ecx
mov dword [ebx + 0xd0], 0x9999999a
lea ecx, [ebx + 0xe0]
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xc0], edi
mov dword [ebx + 0xcc], eax
mov dword [ebx + 0xd4], 0x3fa99999
mov dword [ebx + 0xdc], eax
call sub.MFC42.DLL_CObArray::SetSize
push 0xffffffffffffffff
push edi
lea ecx, [ebx + 0x10c]
call sub.MFC42.DLL_CPtrArray::SetSize
xor eax, eax
push 0xffffffffffffffff
mov dword [ebx + 0xfc], eax
mov dword [ebx + 0x104], eax
mov eax, 1
push edi
lea ecx, [ebx + 0x15c]
mov dword [ebx + 0x120], edi
mov dword [ebx + 0x100], edi
mov dword [ebx + 0x108], edi
mov dword [ebx + 0x150], eax
mov dword [ebx + 0x14c], eax
mov dword [ebx + 0x148], eax
mov dword [ebx + 0x154], eax
mov dword [ebx + 0x13c], eax
mov dword [ebx + 0x140], eax
mov dword [ebx + 0x144], eax
mov dword [ebx + 0x158], eax
call sub.MFC42.DLL_CObArray::SetSize
mov ecx, dword [esp + 0x18]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret