Function at 0x427610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x45eea6
mov eax, dword fs:[0]
push eax
sub esp, 0x1fc
mov eax, dword [0x473354]
xor eax, esp
mov dword [esp + 0x1f8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x473354]
xor eax, esp
push eax
lea eax, [esp + 0x210]
mov dword fs:[0], eax
mov esi, dword [esp + 0x228]
mov edi, dword [esp + 0x220]
xor ebx, ebx
mov dword [esp + 0x70], esi
mov dword [esp + 0x2c], ebx
push 1
mov dword [esp + 0x21c], ebx
call fcn.0042f396
mov dword [esp + 0x28], eax
mov byte [eax], bl
push 1
call fcn.0042f396
mov dword [esp + 0x3c], eax
mov byte [eax], bl
push 1
call fcn.0042f396
mov ebp, eax
mov dword [esp + 0x58], ebp
mov byte [ebp], bl
push 1
call fcn.0042f396
mov dword [esp + 0x24], eax
mov byte [eax], bl
push 1
call fcn.0042f396
mov dword [esp + 0x3c], eax
mov byte [eax], bl
push 1
call fcn.0042f396
mov dword [esp + 0x54], eax
add esp, 0x18
mov byte [eax], bl
cmp dword [0x474d7c], ebx
je 0x427807
cmp dword [esp + 0x224], 0xffffffff
jne 0x427807
mov bl, byte [esp + 0x230]
test bl, bl
je 0x427807
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x48], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x50], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x4c], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x48], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x44], eax
push 0x46043c
call fcn.0042f484
add esp, 0x18
mov dword [esp + 0x18], eax
mov eax, esi
test esi, esi
jne 0x427749
mov eax, 0x46043c
push eax
call fcn.0042f484
add esp, 4
mov dword [esp + 0x1c], eax
mov eax, esi
test esi, esi
jne 0x427761
mov eax, 0x46043c
push eax
call fcn.0042f484
mov dword [esp + 0x24], eax
push 0xffffffffffffffff
push 0
push 0
lea eax, [esp + 0x54]
push eax
movzx ecx, bl
push ecx
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x50]
push edx
push 0
push 0xffffffffffffffff
push 2
push edi
mov byte [esp + 0x25c], 0xe
call fcn.0040c0f0
mov eax, dword [esp + 0x64]
add esp, 0x44
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x20]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x3c]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x48]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x54]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x60]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x60]
push ecx
call fcn.0042f4d9
add esp, 0x20
push 0
push SysReAllocString
push 0x460cb4
lea ecx, [esp + 0x238]
call fcn.00401250
lea edx, [esp + 0x22c]
push edx
mov eax, 0x465d2c
lea ecx, [esp + 0x9c]
call fcn.004275d0
mov eax, dword [eax]
lea ecx, [esp + 0xd0]
push ecx
push eax
mov byte [esp + 0x224], 0xf
call fcn.00417050
mov edx, dword [esp + 0xa4]
mov esi, eax
push edx
mov dword [esp + 0xb4], esi
mov byte [esp + 0x228], 6
call fcn.0042f4d9
add esp, 0x10
cmp esi, 0xffffffff
je 0x4280bc
push 1
call fcn.0042f396
mov ebp, eax
add esp, 4
mov dword [esp + 0x20], ebp
mov byte [ebp], 0
cmp byte [esp + 0xf8], 0x2e
je 0x428089
lea eax, [esp + 0xf8]
push str.AutorunsDisabled
push eax
call fcn.00439b20
add esp, 8
test eax, eax
je 0x428089
lea ecx, [esp + 0x22c]
push ecx
lea eax, [esp + 0xfc]
lea ecx, [esp + 0x1c]
call fcn.004275d0
add esp, 4
mov esi, dword [esp + 0x18]
mov eax, esi
mov byte [esp + 0x218], 0x11
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4278e5
sub eax, edx
cmp eax, 4
jb 0x427957
push 0
push esi
call fcn.004308e5
add eax, 0xfffffffc
push str..lnk
push eax
call fcn.00430d4d
add esp, 0x10
test eax, eax
jne 0x427957
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0xa4]
push edi
push eax
call fcn.004077e0
mov eax, dword [eax]
or dword [esp + 0x38], 1
push eax
call fcn.0042f484
mov esi, eax
push ebp
mov dword [esp + 0x34], esi
call fcn.0042f4d9
mov eax, esi
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427944
sub eax, edx
mov ebp, dword [esp + 0x20]
je 0x427957
mov bl, 1
jmp 0x427959
xor bl, bl
test byte [esp + 0x2c], 1
je 0x427975
mov ecx, dword [esp + 0xa0]
and dword [esp + 0x2c], 0xfffffffe
push ecx
call fcn.0042f4d9
add esp, 4
test bl, bl
je 0x427d2e
push 1
call fcn.0042f396
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
mov byte [esi], 0
lea ecx, [esp + 0xb0]
mov byte [esp + 0x218], 0x12
call fcn.00402320
lea edx, [esp + 0xb0]
push edx
push ebp
mov byte [esp + 0x220], 0x13
call fcn.00411310
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
push eax
call fcn.0042f484
push ebp
mov dword [esp + 0x38], eax
call fcn.0042f4d9
push 0
lea ecx, [esp + 0xc4]
push ecx
lea edx, [esp + 0xc4]
push edx
call fcn.0040b350
mov eax, dword [eax]
mov ebp, dword [esp + 0x68]
push eax
call fcn.0042f484
mov ebx, eax
push ebp
mov dword [esp + 0x70], ebx
call fcn.0042f4d9
mov eax, dword [esp + 0xd0]
push eax
call fcn.0042f4d9
push 0x5c
push ebx
call fcn.004306d0
add esp, 0x30
test eax, eax
je 0x427a3b
push 0x5c
push ebx
call fcn.004306d0
inc eax
push eax
call fcn.0042f484
push esi
mov dword [esp + 0x2c], eax
call fcn.0042f4d9
add esp, 0x10
jmp 0x427a4e
push ebx
call fcn.0042f484
push esi
mov dword [esp + 0x24], eax
call fcn.0042f4d9
add esp, 8
push 0
lea ecx, [esp + 0xb4]
push ecx
lea edx, [esp + 0xb0]
push edx
call fcn.0040b350
mov eax, dword [eax]
mov esi, dword [esp + 0x20]
push eax
call fcn.0042f484
push esi
mov dword [esp + 0x28], eax
call fcn.0042f4d9
mov eax, dword [esp + 0xbc]
push eax
call fcn.0042f4d9
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x40]
push edx
push eax
push edi
call fcn.0040b950
lea ecx, [esp + 0x120]
push ecx
mov ebp, eax
call fcn.0042f484
mov dword [esp + 0x70], eax
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x7c]
push edx
push edi
mov byte [esp + 0x258], 0x14
call fcn.0040bd70
mov bl, al
mov eax, dword [esp + 0x84]
add esp, 0x40
push eax
mov byte [esp + 0x21c], 0x13
call fcn.0042f4d9
add esp, 4
test bl, bl
je 0x427cf6
cmp dword [esp + 0x224], 0xffffffff
jne 0x427c64
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00405340
add esp, 4
test al, al
je 0x427cf6
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x64], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x90], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x64], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x78], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x44], eax
push 0x46043c
call fcn.0042f484
add esp, 0x18
mov dword [esp + 0x38], eax
mov esi, dword [esp + 0x70]
mov eax, esi
test esi, esi
jne 0x427b83
mov eax, 0x46043c
push eax
call fcn.0042f484
add esp, 4
mov dword [esp + 0x40], eax
mov eax, esi
test esi, esi
jne 0x427b9b
mov eax, 0x46043c
push eax
call fcn.0042f484
mov dword [esp + 0x4c], eax
movzx eax, byte [esp + 0x234]
push 0xffffffffffffffff
push 0
push 0
lea edx, [esp + 0x70]
push edx
push eax
lea ecx, [esp + 0xa0]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x78]
push ecx
push 0
push 0xffffffffffffffff
push 2
push edi
mov byte [esp + 0x25c], 0x1c
call fcn.0040c0f0
mov edx, dword [esp + 0x8c]
add esp, 0x44
mov esi, eax
push edx
mov dword [esp + 0x228], esi
call fcn.0042f4d9
mov eax, dword [esp + 0x44]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x3c]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x78]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0xa0]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x7c]
push eax
call fcn.0042f4d9
add esp, 0x20
cmp esi, 0xffffffff
je 0x427cf6
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x54], eax
lea ecx, [esp + 0xfc]
push ecx
call fcn.0042f484
mov dword [esp + 0x84], eax
movzx eax, byte [esp + 0x238]
push 0xffffffffffffffff
push 0
push 0
lea edx, [esp + 0x64]
push edx
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x40]
push edx
mov edx, dword [esp + 0x254]
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0xb0]
push ecx
push 7
push edx
push ebp
push edi
mov byte [esp + 0x260], 0x1e
call fcn.0040c0f0
mov eax, dword [esp + 0xc4]
add esp, 0x48
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x54]
push ecx
call fcn.0042f4d9
add esp, 8
lea ecx, [esp + 0xb4]
call fcn.00402070
mov edx, dword [esp + 0xb4]
push edx
call fcn.0042f2c2
mov eax, dword [esp + 0xb4]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0042f4d9
add esp, 0xc
jmp 0x428061
lea ecx, [esp + 0xb0]
call fcn.00402320
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xb0]
push edx
push eax
mov byte [esp + 0x220], 0x1f
call fcn.0040ef90
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
push ecx
call fcn.0042f484
push esi
mov dword [esp + 0x38], eax
call fcn.0042f4d9
push 0
lea edx, [esp + 0xc4]
push edx
lea eax, [esp + 0xb4]
push eax
call fcn.0040b350
mov eax, dword [eax]
mov esi, dword [esp + 0x30]
push eax
call fcn.0042f484
push esi
mov dword [esp + 0x38], eax
call fcn.0042f4d9
mov ecx, dword [esp + 0xc0]
push ecx
call fcn.0042f4d9
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x50]
push eax
push ecx
push edi
call fcn.0040b950
lea edx, [esp + 0x130]
push edx
mov ebp, eax
call fcn.0042f484
mov dword [esp + 0xc0], eax
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0xcc]
push eax
push edi
mov byte [esp + 0x268], 0x20
call fcn.0040bd70
mov ecx, dword [esp + 0xd4]
add esp, 0x50
push ecx
mov bl, al
mov byte [esp + 0x21c], 0x1f
call fcn.0042f4d9
add esp, 4
test bl, bl
je 0x428038
cmp dword [esp + 0x224], 0xffffffff
jne 0x427fa6
lea edx, [esp + 0xf8]
push edx
call fcn.00405340
add esp, 4
test al, al
je 0x428038
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x68], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x64], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x60], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0xa0], eax
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x94], eax
push 0x46043c
call fcn.0042f484
add esp, 0x18
mov dword [esp + 0x94], eax
mov esi, dword [esp + 0x70]
mov eax, esi
test esi, esi
jne 0x427eb0
mov eax, 0x46043c
push eax
call fcn.0042f484
add esp, 4
mov dword [esp + 0x78], eax
mov eax, esi
test esi, esi
jne 0x427ec8
mov eax, 0x46043c
push eax
call fcn.0042f484
mov dword [esp + 0x90], eax
movzx ecx, byte [esp + 0x234]
push 0xffffffffffffffff
push 0
push 0
lea eax, [esp + 0x74]
push eax
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0xb0]
push ecx
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0xbc]
push eax
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0xbc]
push edx
push 0
push 0xffffffffffffffff
push 2
push edi
mov byte [esp + 0x25c], 0x28
call fcn.0040c0f0
mov esi, eax
mov eax, dword [esp + 0xd0]
add esp, 0x44
push eax
mov dword [esp + 0x228], esi
call fcn.0042f4d9
mov ecx, dword [esp + 0x7c]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x9c]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x8c]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0xa0]
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x68]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x74]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x80]
push ecx
call fcn.0042f4d9
add esp, 0x20
cmp esi, 0xffffffff
je 0x428038
push 0x46043c
call fcn.0042f484
mov dword [esp + 0x78], eax
lea edx, [esp + 0xfc]
push edx
call fcn.0042f484
mov dword [esp + 0x74], eax
movzx ecx, byte [esp + 0x238]
push 0xffffffffffffffff
push 0
push 0
lea eax, [esp + 0x88]
push eax
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x254]
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0xa0]
push edx
push 6
push eax
push ebp
push edi
mov byte [esp + 0x260], 0x2a
call fcn.0040c0f0
mov ecx, dword [esp + 0xb4]
add esp, 0x48
push ecx
call fcn.0042f4d9
mov edx, dword [esp + 0x78]
push edx
call fcn.0042f4d9
add esp, 8
lea ecx, [esp + 0xb4]
call fcn.00402070
mov eax, dword [esp + 0xb4]
push eax
call fcn.0042f2c2
mov ecx, dword [esp + 0xb4]
push ecx
call fcn.0042f4d9
add esp, 8
mov edx, dword [esp + 0x18]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x24]
push eax
mov byte [esp + 0x220], 6
call fcn.0042f4d9
mov esi, dword [esp + 0xac]
add esp, 8
jmp 0x42809a
push ebp
mov byte [esp + 0x21c], 6
call fcn.0042f4d9
add esp, 4
lea ecx, [esp + 0xcc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42787a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, dword [esp + 0x4c]
mov edx, dword [esp + 0x3c]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x2c]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0042f4d9
push ebp
call fcn.0042f4d9
mov edx, dword [esp + 0x44]
push edx
call fcn.0042f4d9
mov eax, dword [esp + 0x38]
push eax
call fcn.0042f4d9
mov ecx, dword [esp + 0x244]
push ecx
call fcn.0042f4d9
mov eax, dword [esp + 0x240]
add esp, 0x1c
mov ecx, dword [esp + 0x210]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1f8]
xor ecx, esp
call fcn.00430430
add esp, 0x208
ret