Function at 0x476980
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5b8109
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x6bd6f8]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push esi
push edi
mov eax, dword [0x6bd6f8]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [esp + 0x28]
push ecx
xor edi, edi
mov byte [esp + 0x23], 0
call fcn.004835d0
add esp, 8
mov dword [esp + 0x160], edi
mov eax, dword [esp + 0x24]
cmp dword [eax], edi
je 0x477457
cmp dword [eax + 4], edi
je 0x477457
mov ecx, dword [eax + 4]
mov eax, dword [eax]
push ecx
mov esi, 0xf
push eax
lea ecx, [esp + 0x13c]
mov dword [esp + 0x154], esi
mov dword [esp + 0x150], edi
mov byte [esp + 0x140], 0
call fcn.0040ad71
mov byte [esp + 0x160], 1
push 1
push 1
lea edx, [esp + 0x13c]
push edx
lea eax, [esp + 0x98]
push eax
call fcn.00478260
mov byte [esp + 0x160], 2
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], edi
mov byte [esp + 0x11c], 0
mov byte [esp + 0x160], 3
lea ecx, [esp + 0x118]
push ecx
lea esi, [esp + 0x90]
call fcn.004788f0
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, eax
mov eax, dword [ecx + 8]
and al, 6
movsx edx, al
add esp, 4
neg edx
sbb edx, edx
not edx
test ecx, edx
je 0x4773cb
cmp dword [esp + 0x130], 0x10
mov eax, dword [esp + 0x11c]
jae 0x476abc
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004083ec
mov byte [esp + 0x160], 4
push 0x68bd14
lea eax, [esp + 0x18]
call fcn.0042f4be
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00575b5d
add esp, 4
lea edx, [esp + 0x44]
push edx
mov esi, eax
call fcn.00413cf5
mov byte [esp + 0x160], 5
push esi
lea ecx, [esp + 0x48]
call fcn.004784a0
cmp esi, edi
jbe 0x476bb9
mov ebx, esi
jmp 0x476b20
lea eax, [esp + 0x118]
push eax
lea esi, [esp + 0x90]
call fcn.004788f0
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax + 8]
add ecx, eax
and dl, 6
movsx eax, dl
add esp, 4
neg eax
sbb eax, eax
not eax
test ecx, eax
je 0x476bb0
cmp dword [esp + 0x130], 0x10
jb 0x476b6d
mov eax, dword [esp + 0x11c]
mov esi, eax
cmp eax, edi
jne 0x476b74
xor eax, eax
jmp 0x476b89
lea esi, [esp + 0x11c]
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x476b80
sub eax, edx
push eax
push esi
lea eax, [esp + 0x1c]
call fcn.0040b032
push 0x68bd14
lea eax, [esp + 0x18]
call fcn.0042f4be
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x48]
call fcn.00426ac8
sub ebx, 1
jne 0x476b20
lea edx, [esp + 0x74]
push edx
call fcn.004828d0
mov byte [esp + 0x160], 6
lea eax, [esp + 0x118]
push eax
lea esi, [esp + 0x90]
call fcn.004788f0
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax + 8]
add ecx, eax
and dl, 6
movsx eax, dl
add esp, 4
neg eax
sbb eax, eax
not eax
test ecx, eax
je 0x47730d
cmp dword [esp + 0x130], 0x10
jb 0x476c65
mov ebx, dword [esp + 0x11c]
test ebx, ebx
je 0x476c2b
mov esi, ebx
lea ecx, [esi + 1]
jmp 0x476c20
mov al, byte [esi]
inc esi
test al, al
jne 0x476c20
sub esi, ecx
jne 0x476c96
mov edx, dword [esp + 0x14]
cmp dword [edx - 0xc], 0
mov esi, dword [edx - 0x10]
lea eax, [edx - 0x10]
je 0x476d06
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x476c6e
cmp dword [edx - 8], 0
jl 0x4774c2
mov dword [edx - 0xc], 0
mov ecx, dword [esp + 0x14]
mov byte [ecx], 0
jmp 0x476d06
lea ebx, [esp + 0x11c]
jmp 0x476c16
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476c84
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
jmp 0x476d06
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
mov edi, ebx
sub ecx, esi
sub edi, eax
or ecx, edx
jge 0x476cc5
mov eax, esi
lea ecx, [esp + 0x14]
call fcn.0040d8d9
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
push esi
cmp edi, dword [esp + 0x34]
ja 0x476cdb
add edi, eax
push edi
push ecx
push eax
call fcn.005734ec
jmp 0x476ce3
push ebx
push ecx
push eax
call fcn.005742a0
add esp, 0x10
test esi, esi
jl 0x4774c2
mov eax, dword [esp + 0x14]
cmp esi, dword [eax - 8]
jg 0x4774c2
mov dword [eax - 0xc], esi
mov edx, dword [esp + 0x14]
mov byte [esi + edx], 0
push 0x68bd14
lea eax, [esp + 0x18]
call fcn.0042f4be
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jl 0x4772cf
push 0x68bd18
push eax
call fcn.0057549c
add esp, 8
test eax, eax
je 0x4772cf
sub eax, dword [esp + 0x14]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4772cf
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
call fcn.0042f571
mov byte [esp + 0x160], 7
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00470df0
add esp, 8
mov byte [esp + 0x160], 8
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
movzx eax, word [edx]
movzx esi, al
shr eax, 8
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x50]
sar eax, 2
cmp esi, eax
jb 0x476da1
call fcn.005741fa
mov ecx, dword [esp + 0x50]
mov esi, dword [ecx + esi*4]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
sub esi, 0x10
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x476dcf
cmp eax, dword [esi]
jne 0x476dcf
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x476e03
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x4774cc
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.005742a0
add esp, 0x10
add edi, 0x10
mov dword [esp + 0x40], edi
mov byte [esp + 0x160], 0xa
mov edx, dword [0x6d50f8]
mov eax, dword [edx + 0xc]
mov ecx, 0x6d50f8
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x160], 0xc
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x476eba
lea edx, [esp + 0x5c]
push edx
lea ecx, [ebx + 1]
lea edx, [esp + 0x18]
call fcn.0042f53b
mov byte [esp + 0x160], 0xd
mov ecx, dword [eax]
mov esi, dword [esp + 0x1c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x476ea9
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x476e9b
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x476e9b
call fcn.0040b0a1
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x476e92
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [esp + 0x1c], ebx
jmp 0x476ea9
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea eax, [esp + 0x24]
call fcn.0040b032
mov byte [esp + 0x160], 0xc
mov eax, dword [esp + 0x5c]
jmp 0x477041
push eax
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x7c]
call fcn.00482d00
mov byte [esp + 0x160], 0xf
mov edx, dword [esp + 0x2c]
cmp dword [edx - 0xc], 0
je 0x477035
lea eax, [esp + 0x70]
lea ecx, [ebx + 1]
push eax
lea edx, [esp + 0x18]
call fcn.0042f53b
mov edi, eax
mov byte [esp + 0x160], 0x10
mov ecx, dword [esp + 0x2c]
push ecx
lea edx, [esp + 0x68]
push edx
call fcn.00470110
mov byte [esp + 0x168], 0x11
lea ecx, [esp + 0x68]
push 0x68bd18
push ecx
mov esi, eax
call fcn.004135e5
mov byte [esp + 0x170], 0x12
lea edx, [esp + 0x78]
push edi
push edx
mov esi, eax
call fcn.00413593
add esp, 0x18
mov byte [esp + 0x160], 0x13
mov ecx, dword [eax]
mov esi, dword [esp + 0x1c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x476f95
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x476f87
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x476f87
call fcn.0040b0a1
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x476f7e
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [esp + 0x1c], ebx
jmp 0x476f95
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea eax, [esp + 0x24]
call fcn.0040b032
mov byte [esp + 0x160], 0x12
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476fbd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0x11
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476fe5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0x10
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47700d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0xf
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477035
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0xc
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47705d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
cmp dword [ecx - 0xc], ebx
je 0x47720f
mov ecx, dword [esp + 0x6c]
mov eax, dword [ecx + 0x14]
mov esi, dword [eax]
mov eax, dword [ecx]
mov edi, eax
mov dword [esp + 0x34], esi
cmp eax, ebx
jne 0x477156
call fcn.005741fa
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x477096
call fcn.005741fa
mov esi, dword [esi]
cmp edi, ebx
jne 0x47715d
call fcn.005741fa
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x4770b1
call fcn.005741fa
mov edx, dword [esp + 0x1c]
mov esi, dword [esi]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00470250
add esp, 8
mov byte [esp + 0x160], 0x19
cmp edi, ebx
jne 0x477164
call fcn.005741fa
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x4770e6
call fcn.005741fa
mov ecx, dword [esp + 0x20]
cmp dword [ecx - 0xc], ebx
jl 0x47716b
push str.HKLM_
push ecx
call fcn.0057420a
mov ecx, dword [esp + 0x28]
add esp, 8
cmp eax, ebx
je 0x47710b
sub eax, ecx
sar eax, 1
je 0x47714b
cmp dword [ecx - 0xc], ebx
jl 0x47716b
push str.HKCU_
push ecx
call fcn.0057420a
mov ecx, dword [esp + 0x28]
add esp, 8
cmp eax, ebx
je 0x47712c
sub eax, ecx
sar eax, 1
je 0x47714b
cmp dword [ecx - 0xc], ebx
jl 0x47716b
push str.HKCR_
push ecx
call fcn.0057420a
add esp, 8
cmp eax, ebx
je 0x47716b
sub eax, dword [esp + 0x20]
sar eax, 1
jne 0x47716b
cmp byte [ebp + 0x14], 0
jne 0x477171
jmp 0x4771de
mov eax, dword [eax]
jmp 0x47708c
mov eax, dword [edi]
jmp 0x4770a7
mov eax, dword [edi]
jmp 0x4770dc
cmp byte [ebp + 0x10], 0
je 0x4771de
cmp edi, ebx
jne 0x477208
call fcn.005741fa
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x47718a
call fcn.005741fa
mov ecx, dword [esp + 0x40]
mov esi, dword [esi + 8]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.00470250
add esp, 8
mov byte [esp + 0x160], 0x1a
mov edx, dword [esi]
mov edx, dword [edx + 4]
lea ecx, [esp + 0x20]
push ecx
push eax
mov ecx, esi
call edx
mov byte [esp + 0x160], 0x19
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4771de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0xc
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477216
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x477216
mov eax, dword [edi]
jmp 0x477180
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x160], 0xa
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47723e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 8
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477266
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 7
mov eax, dword [esp + 0x28]
dec dword [eax + 8]
mov esi, eax
add eax, 8
cmp dword [eax], ebx
jne 0x4772a5
cmp dword [esi + 4], ebx
je 0x477294
mov eax, dword [esi]
push ebx
push eax
call fcn.00576288
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00573401
add esp, 4
mov dword [esp + 0x28], ebx
mov byte [esp + 0x160], 6
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4772d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4772d7
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x118]
push ecx
lea esi, [esp + 0x90]
call fcn.004788f0
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, eax
mov eax, dword [ecx + 8]
and al, 6
movsx edx, al
add esp, 4
neg edx
sbb edx, edx
not edx
test ecx, edx
jne 0x476c01
xor edi, edi
mov byte [esp + 0x1b], 1
mov byte [esp + 0x160], 5
lea eax, [esp + 0x74]
push eax
call fcn.00481f90
mov bl, 0x21
mov byte [esp + 0x160], bl
mov esi, dword [esp + 0x50]
cmp esi, edi
je 0x477382
mov eax, dword [esp + 0x54]
mov edi, eax
mov dword [esp + 0x38], esi
cmp esi, eax
je 0x477377
mov byte [esp + 0x160], bl
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x477368
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
mov dword [esp + 0x38], esi
cmp esi, edi
jne 0x477343
mov esi, dword [esp + 0x50]
push esi
call fcn.00573401
add esp, 4
xor edi, edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov byte [esp + 0x160], 4
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00573401
add esp, 4
mov byte [esp + 0x160], 3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4773cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 2
mov ebx, 0x10
cmp dword [esp + 0x130], ebx
jb 0x4773f1
mov ecx, dword [esp + 0x11c]
push ecx
call fcn.00573401
add esp, 4
mov esi, 0xf
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], edi
mov byte [esp + 0x11c], 0
mov byte [esp + 0x160], 1
lea ecx, [esp + 0x8c]
call fcn.00476910
mov byte [esp + 0x160], 0
cmp dword [esp + 0x14c], ebx
jb 0x477441
mov edx, dword [esp + 0x138]
push edx
call fcn.00573401
add esp, 4
mov dword [esp + 0x14c], esi
mov dword [esp + 0x148], edi
mov byte [esp + 0x138], 0
mov dword [esp + 0x160], 0xffffffff
mov esi, dword [esp + 0x24]
dec dword [esi + 8]
cmp dword [esi + 8], edi
lea eax, [esi + 8]
jne 0x477498
cmp dword [esi + 4], edi
je 0x477487
mov eax, dword [esi]
push edi
push eax
call fcn.00576288
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], edi
mov eax, dword [esp + 0x24]
push eax
call fcn.00573401
add esp, 4
mov dword [esp + 0x24], edi
mov al, byte [esp + 0x1b]
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.0057340c
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.00402d73
call fcn.0040b1d4
int3