Function at 0x475e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c4a86
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f2fb0]
xor eax, esp
push eax
lea eax, [esp + 0xe8]
mov dword fs:[0], eax
xor ebx, ebx
xor ebp, ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x34], ebx
call fcn.00469390
push ebx
or esi, 0xffffffff
push esi
push ebx
lea ecx, [esp + 0x54]
mov byte [esp + 0xfc], 1
call fcn.00469a80
mov ecx, dword [esp + 0xf8]
lea eax, [esp + 0x48]
push eax
push ebx
push ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0xfc], 2
call fcn.004693b0
test eax, eax
jne 0x475f08
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
mov byte [esp + 0xf0], 1
mov dword [esp + 0x48], vtable.CFileException.0
lea edx, [eax + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x475ec6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xf0], 0
call fcn.00469760
mov eax, dword [esp + 0xf8]
add eax, 0xfffffff0
mov dword [esp + 0xf0], esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x475efe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x476be1
lea ecx, [esp + 0x20]
call fcn.004694f0
or eax, edx
jne 0x475f75
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
mov byte [esp + 0xf0], 1
mov dword [esp + 0x48], vtable.CFileException.0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x475f44
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xf0], 0
call fcn.00469760
mov eax, dword [esp + 0xf8]
add eax, 0xfffffff0
mov dword [esp + 0xf0], esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jmp 0x476bd3
push 0xc69f5
call fcn.0047af44
add esp, 4
mov edi, eax
push 0xc69f5
push edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edi
call fcn.00469520
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push str._d._d
push edi
call fcn.0049a161
add esp, 0x10
mov esi, 0x4cc64c
mov ecx, edi
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x475fd6
test dl, dl
je 0x475fd2
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x475fd6
add ecx, 2
add esi, 2
test dl, dl
jne 0x475fb6
xor ecx, ecx
jmp 0x475fdb
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x476b62
xor esi, esi
cmp eax, esi
jg 0x475fef
mov dword [esp + 0x14], esi
jmp 0x475ff8
mov eax, dword [esp + 0x14]
cmp eax, 2
jge 0x47600b
push edi
call fcn.0046bda0
add esp, 4
mov dword [esp + 0x14], 2
jmp 0x476010
cmp eax, 3
jge 0x476045
push 0xc6f8b
call fcn.0047af44
push eax
push edi
mov dword [esp + 0x50], eax
call fcn.004757e0
push edi
mov esi, 1
mov dword [esp + 0x24], 3
call fcn.0047af7e
mov eax, dword [esp + 0x24]
add esp, 0x10
xor edi, edi
mov dword [esp + 0x1c], edi
cmp eax, 4
jge 0x4760d3
test esi, esi
jne 0x476089
push edi
call fcn.0047af7e
xor edi, edi
push 0xc6f8b
mov dword [esp + 0x24], edi
call fcn.0047af44
mov esi, eax
add esp, 8
lea ecx, [esp + 0x20]
mov dword [esp + 0x44], esi
call fcn.00469650
push 0xc6f8b
push esi
lea ecx, [esp + 0x28]
call fcn.00469520
push 0x1095cf
call fcn.0047af44
mov ecx, dword [esp + 0x48]
push eax
push ecx
mov dword [esp + 0x4c], eax
call fcn.0046c1e0
mov edx, dword [esp + 0x50]
push edx
mov esi, 1
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], 0
call fcn.0047af7e
mov eax, dword [esp + 0x24]
add esp, 0x10
mov dword [esp + 0x44], 0
cmp eax, 4
jne 0x476292
mov eax, dword [esp + 0x18]
cmp eax, 1
jge 0x47616b
test esi, esi
jne 0x476121
push edi
call fcn.0047af7e
xor edi, edi
push 0x1095cf
mov dword [esp + 0x24], edi
call fcn.0047af44
mov esi, eax
add esp, 8
lea ecx, [esp + 0x20]
mov dword [esp + 0x40], esi
call fcn.00469650
push 0x1095cf
push esi
lea ecx, [esp + 0x28]
call fcn.00469520
push 0x10a8db
call fcn.0047af44
push eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x48]
push eax
call fcn.0046c440
mov ecx, dword [esp + 0x4c]
mov esi, 1
push ecx
mov dword [esp + 0x28], esi
call fcn.0047af7e
mov eax, dword [esp + 0x24]
add esp, 0x10
mov dword [esp + 0x40], 0
cmp eax, 4
jne 0x476292
mov eax, dword [esp + 0x18]
cmp eax, esi
jne 0x4761d2
test esi, esi
jne 0x4761a8
push edi
call fcn.0047af7e
xor edi, edi
push 0x10a8db
mov dword [esp + 0x24], edi
call fcn.0047af44
mov esi, eax
add esp, 8
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], esi
call fcn.00469650
push 0x10a8db
push esi
lea ecx, [esp + 0x28]
call fcn.00469520
mov edx, dword [esp + 0x38]
push edx
call fcn.00475a40
mov eax, dword [esp + 0x18]
add esp, 4
mov ecx, 2
mov esi, 1
mov dword [esp + 0x18], ecx
cmp eax, 4
jne 0x476296
jmp 0x476221
cmp eax, 2
jne 0x4763a0
test esi, esi
jne 0x476221
push edi
call fcn.0047af7e
mov esi, dword [esp + 0x3c]
xor edi, edi
add esp, 4
mov dword [esp + 0x1c], edi
test esi, esi
jne 0x476209
push 0x10a8db
call fcn.0047af44
mov esi, eax
add esp, 4
mov dword [esp + 0x38], esi
lea ecx, [esp + 0x20]
call fcn.00469650
push 0x10a8db
push esi
lea ecx, [esp + 0x28]
call fcn.00469520
push fcn.00499e0b
call fcn.0047af44
add esp, 4
mov dword [esp + 0x3c], eax
mov byte [esp + 0xf0], 3
test eax, eax
je 0x476247
mov ecx, eax
call fcn.00475bd0
jmp 0x476249
xor eax, eax
push fcn.00499e0b
mov ebp, eax
push 0
push eax
mov byte [esp + 0xfc], 2
mov dword [esp + 0x48], ebp
call fcn.00499ae0
mov eax, dword [esp + 0x44]
push eax
mov esi, 1
mov dword [esp + 0x24], 5
mov dword [esp + 0x28], 0
call fcn.0047af7e
mov eax, dword [esp + 0x24]
add esp, 0x10
mov dword [esp + 0x38], 0
mov ecx, dword [esp + 0x18]
cmp eax, 5
jne 0x476397
test esi, esi
jne 0x476361
push edi
call fcn.0047af7e
xor edi, edi
add esp, 4
mov dword [esp + 0x1c], edi
test ebp, ebp
jne 0x4762f0
push fcn.00499e0b
call fcn.0047af44
add esp, 4
mov dword [esp + 0x3c], eax
mov byte [esp + 0xf0], 4
test eax, eax
je 0x4762e0
mov ecx, eax
call fcn.00475bd0
jmp 0x4762e2
xor eax, eax
mov ebp, eax
mov byte [esp + 0xf0], 2
mov dword [esp + 0x3c], ebp
push fcn.00499e0b
push 0
push ebp
call fcn.00499ae0
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.00469650
push ebp
lea ecx, [esp + 0xd0]
call fcn.0046c880
push ebp
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0xd4]
mov byte [esp + 0xf8], 5
call fcn.00472720
test eax, eax
jne 0x476345
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0xd0]
call fcn.0046a280
lea ecx, [esp + 0xcc]
mov byte [esp + 0xf0], 2
call fcn.0046bd70
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov esi, 1
cmp eax, 5
jne 0x476397
test ecx, ecx
je 0x476382
cmp ecx, 2
jl 0x476382
cmp ecx, 3
jl 0x476382
cmp ecx, 4
jge 0x476451
mov dword [esp + 0x14], 5
mov dword [esp + 0x18], 4
jmp 0x476451
cmp eax, 6
jge 0x47664e
test esi, esi
jne 0x476451
push edi
call fcn.0047af7e
xor edi, edi
add esp, 4
mov dword [esp + 0x1c], edi
test ebp, ebp
jne 0x4763ed
push fcn.00499e0b
call fcn.0047af44
add esp, 4
mov dword [esp + 0x3c], eax
mov byte [esp + 0xf0], 6
test eax, eax
je 0x4763e1
mov ecx, eax
call fcn.00475bd0
jmp 0x4763e3
xor eax, eax
mov byte [esp + 0xf0], 2
mov ebp, eax
push fcn.00499e0b
push 0
push ebp
call fcn.00499ae0
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.00469650
push ebp
lea ecx, [esp + 0x7c]
call fcn.0046c880
push 0x5ae2e0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xf8], 7
call fcn.00472720
test eax, eax
jne 0x476440
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x7c]
call fcn.0046a280
lea ecx, [esp + 0x78]
mov byte [esp + 0xf0], 2
call fcn.0046bd70
push 0x1298
push 0x5a1950
lea ecx, [esp + 0x28]
call fcn.00469520
push 0xad8
push 0x5a2be8
lea ecx, [esp + 0x28]
call fcn.00469520
push 0xac1c
push 0x5a36c0
lea ecx, [esp + 0x28]
call fcn.00469520
lea ecx, [esp + 0x20]
call fcn.004696c0
push ebp
lea ecx, [esp + 0x98]
call fcn.0046c880
mov eax, dword [esp + 0xf8]
lea edx, [esp + 0x48]
push edx
push 0x1001
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xfc], 8
call fcn.004693b0
test eax, eax
jne 0x476513
lea ecx, [esp + 0x94]
mov byte [esp + 0xf0], 2
call fcn.0046bd70
lea ecx, [esp + 0x48]
mov byte [esp + 0xf0], 1
call fcn.004698b0
lea ecx, [esp + 0x20]
mov byte [esp + 0xf0], 0
call fcn.00469760
lea ecx, [esp + 0xf8]
call fcn.00401470
mov eax, 1
jmp 0x476be1
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push ecx
push edx
push str._0d._0d
push ebp
call fcn.00402320
add esp, 0x10
push ebp
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x9c]
call fcn.00475660
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x98]
call fcn.0046a470
lea ecx, [esp + 0x20]
call fcn.004696c0
push 0x1298
push 0
push 0x5a1950
call fcn.00499ae0
mov eax, dword [esp + 0x104]
add esp, 0xc
lea edx, [esp + 0x48]
push edx
push 0
push eax
lea ecx, [esp + 0x2c]
call fcn.004693b0
test eax, eax
je 0x476611
push 0x743333
call fcn.0047af44
add esp, 4
mov dword [esp + 0x3c], eax
mov byte [esp + 0xf0], 9
test eax, eax
je 0x4765b3
mov ecx, eax
call fcn.00475c10
mov esi, eax
jmp 0x4765b5
xor esi, esi
push esi
lea ecx, [esp + 0xb4]
mov byte [esp + 0xf4], 8
mov dword [esp + 0x38], esi
call fcn.0046c850
push esi
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0xb8]
mov byte [esp + 0xf8], 0xa
call fcn.00472720
test eax, eax
jne 0x4765fd
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0xb4]
call fcn.0046a280
lea ecx, [esp + 0xb0]
mov byte [esp + 0xf0], 8
call fcn.0046bd70
push ebp
call fcn.0047af7e
xor ebp, ebp
add esp, 4
lea ecx, [esp + 0x94]
mov dword [esp + 0x3c], ebp
lea esi, [ebp + 1]
mov dword [esp + 0x14], 6
mov dword [esp + 0x18], ebp
mov byte [esp + 0xf0], 2
call fcn.0046bd70
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp eax, 6
jne 0x47670a
cmp ecx, 1
jge 0x476713
test esi, esi
jne 0x4766f5
push edi
call fcn.0047af7e
push 0x743333
mov dword [esp + 0x24], esi
call fcn.0047af44
add esp, 8
mov dword [esp + 0x34], eax
mov byte [esp + 0xf0], 0xb
test eax, eax
je 0x476697
mov ecx, eax
call fcn.00475c10
mov esi, eax
jmp 0x476699
xor esi, esi
lea ecx, [esp + 0x20]
mov byte [esp + 0xf0], 2
mov dword [esp + 0x34], esi
call fcn.00469650
push esi
lea ecx, [esp + 0x7c]
call fcn.0046c850
push esi
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xf8], 0xc
call fcn.00472720
test eax, eax
jne 0x4766e4
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x7c]
call fcn.0046a280
lea ecx, [esp + 0x78]
mov byte [esp + 0xf0], 2
call fcn.0046bd70
mov dword [esp + 0x14], 6
mov dword [esp + 0x18], 1
jmp 0x4767a8
cmp eax, 7
jge 0x4767c4
test esi, esi
jne 0x4767a8
push edi
call fcn.0047af7e
push 0x743333
mov dword [esp + 0x24], esi
call fcn.0047af44
add esp, 8
mov dword [esp + 0x34], eax
mov byte [esp + 0xf0], 0xd
test eax, eax
je 0x47674d
mov ecx, eax
call fcn.00475c10
mov esi, eax
jmp 0x47674f
xor esi, esi
lea ecx, [esp + 0x20]
mov byte [esp + 0xf0], 2
mov dword [esp + 0x34], esi
call fcn.00469650
push esi
lea ecx, [esp + 0x60]
call fcn.0046c850
push esi
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x64]
mov byte [esp + 0xf8], 0xe
call fcn.00472720
test eax, eax
jne 0x476797
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x60]
call fcn.0046a280
lea ecx, [esp + 0x5c]
mov byte [esp + 0xf0], 2
call fcn.0046bd70
mov ecx, dword [esp + 0x34]
push ecx
mov ebx, 0x5ae2e0
call fcn.0047af7e
add esp, 4
mov dword [esp + 0x34], 0
jmp 0x476836
jne 0x476b01
cmp ecx, 1
jge 0x4768e1
test esi, esi
jne 0x476836
push edi
call fcn.0047af7e
add esp, 4
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], esi
mov ebx, 0x5ae2e0
call fcn.00469650
push ebx
lea ecx, [esp + 0x60]
call fcn.0046c820
push ebx
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x64]
mov byte [esp + 0xf8], 0xf
call fcn.00472720
test eax, eax
jne 0x476825
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x60]
call fcn.0046a280
lea ecx, [esp + 0x5c]
mov byte [esp + 0xf0], 2
call fcn.0046bd70
fld qword [0x4c84e0]
mov esi, 0x6ee80c
lea eax, [ebx + 0x29b68]
fld qword [eax - 0x124]
mov ecx, esi
fstp qword [eax]
mov edx, 0xc8
fld qword [eax - 0x11c]
fstp qword [eax + 8]
fld qword [eax + 0x40]
fstp qword [eax + 0x164]
fld qword [eax + 0x48]
fstp qword [eax + 0x16c]
fld qword [eax + 0x1a4]
fstp qword [eax + 0x2c8]
fld qword [eax + 0x1ac]
fstp qword [eax + 0x2d0]
fld qword [eax + 0x308]
fstp qword [eax + 0x42c]
fld qword [eax + 0x310]
fstp qword [eax + 0x434]
fld qword [eax + 0x46c]
fstp qword [eax + 0x590]
fld qword [eax + 0x474]
fstp qword [eax + 0x598]
fst qword [ecx]
add ecx, 0x790
sub edx, 1
jne 0x4768b9
add esi, 0x3c8
add eax, 0x8c1b4
cmp esi, 0x6eef9c
jl 0x476847
fstp st(0)
jmp 0x47694d
cmp ecx, 2
jge 0x476a35
test esi, esi
jne 0x47694d
push edi
call fcn.0047af7e
add esp, 4
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], esi
mov ebx, 0x5ae2e0
call fcn.00469650
push ebx
lea ecx, [esp + 0x60]
call fcn.0046c820
push ebx
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x64]
mov byte [esp + 0xf8], 0x10
call fcn.00472720
test eax, eax
jne 0x47693c
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x60]
call fcn.0046a280
lea ecx, [esp + 0x5c]
mov byte [esp + 0xf0], 2
call fcn.0046bd70
push 0x40
lea esi, [ebx + 0x4c4]
push 0
push esi
call fcn.00499ae0
push 0x40
lea edi, [ebx + 0x484]
push 0
push edi
call fcn.00499ae0
push pe_nt_image_headers32
lea ebp, [ebx + 0x504]
push 0
push ebp
call fcn.00499ae0
push pe_nt_image_headers32
lea eax, [ebx + 0x604]
push 0
push eax
call fcn.00499ae0
mov ecx, dword [ebx + 0x100]
mov edx, dword [ebx + 0x104]
mov eax, dword [ebx + 0x108]
mov dword [esi], ecx
mov ecx, dword [ebx + 0x10c]
mov dword [esi + 4], edx
mov edx, dword [ebx + 0x110]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xec]
mov dword [edi], eax
mov eax, dword [ebx + 0xf8]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebx + 0xf0]
mov dword [edi + 4], ecx
mov ecx, dword [ebx + 0xfc]
mov dword [esi + 0x10], edx
mov edx, dword [ebx + 0xf4]
mov dword [edi + 8], edx
mov edx, dword [ebx + 0x114]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x118]
mov dword [ebp], edx
mov edx, dword [ebx + 0x120]
mov dword [ebp + 4], eax
mov eax, dword [ebx + 0x124]
mov dword [edi + 0x10], ecx
mov ecx, dword [ebx + 0x11c]
mov edi, dword [esp + 0x4c]
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ebp, dword [esp + 0x6c]
add esp, 0x30
mov dword [esp + 0x14], 7
mov dword [esp + 0x18], 2
jmp 0x476a9f
cmp ecx, 3
jge 0x476b01
test esi, esi
jne 0x476a9f
push edi
call fcn.0047af7e
add esp, 4
lea ecx, [esp + 0x20]
xor edi, edi
mov ebx, 0x5ae2e0
call fcn.00469650
push ebx
lea ecx, [esp + 0x60]
call fcn.0046c820
push ebx
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x64]
mov byte [esp + 0xf8], 0x11
call fcn.00472720
test eax, eax
jne 0x476a8e
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x60]
call fcn.0046a280
lea ecx, [esp + 0x5c]
mov byte [esp + 0xf0], 2
call fcn.0046bd70
mov eax, dword [ebx + 0x138]
cmp eax, 4
je 0x476aaf
cmp eax, 3
jne 0x476b01
fld qword [ebx + 0x1d39e4]
fabs
fld qword [0x4c77f8]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x476ad4
fld qword [ebx + 0x1d396c]
fstp qword [ebx + 0x1d39e4]
fld qword [ebx + 0x1d3a0c]
fabs
fcompp
fnstsw ax
test ah, 5
jp 0x476af1
fld qword [ebx + 0x1d3994]
fstp qword [ebx + 0x1d3a0c]
mov dword [esp + 0x14], 7
mov dword [esp + 0x18], 3
cmp dword [esp + 0x34], 0
je 0x476b15
mov eax, dword [esp + 0x34]
push eax
call fcn.0047af7e
add esp, 4
test ebp, ebp
je 0x476b22
push ebp
call fcn.0047af7e
add esp, 4
cmp dword [esp + 0x40], 0
je 0x476b36
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0047af7e
add esp, 4
cmp dword [esp + 0x38], 0
je 0x476b4a
mov edx, dword [esp + 0x38]
push edx
call fcn.0047af7e
add esp, 4
cmp dword [esp + 0x44], 0
je 0x476b5e
mov eax, dword [esp + 0x44]
push eax
call fcn.0047af7e
add esp, 4
test edi, edi
je 0x476b6b
push edi
call fcn.0047af7e
add esp, 4
lea ecx, [esp + 0x20]
call fcn.004696c0
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x48], vtable.CFileException.0
mov byte [esp + 0xf0], 1
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476ba4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xf0], 0
call fcn.00469760
mov eax, dword [esp + 0xf8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0xf0], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476bdf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0xe8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe0
ret