Function at 0x47b520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5befe9
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x6c56f8]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x158]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [esp + 0x28]
push ecx
xor edi, edi
mov byte [esp + 0x23], 0
call fcn.00487500
add esp, 8
mov dword [esp + 0x160], edi
mov eax, dword [esp + 0x24]
cmp dword [eax], edi
je 0x47bff4
cmp dword [eax + 4], edi
je 0x47bff4
mov ecx, dword [eax + 4]
mov eax, dword [eax]
push ecx
mov esi, 0xf
push eax
lea ecx, [esp + 0x13c]
mov dword [esp + 0x154], esi
mov dword [esp + 0x150], edi
mov byte [esp + 0x140], 0
call fcn.0040afe1
mov byte [esp + 0x160], 1
push 1
push 1
lea edx, [esp + 0x13c]
push edx
lea eax, [esp + 0x98]
push eax
call fcn.0047c320
mov byte [esp + 0x160], 2
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], edi
mov byte [esp + 0x11c], 0
mov byte [esp + 0x160], 3
lea ecx, [esp + 0x118]
push ecx
lea esi, [esp + 0x90]
call fcn.0047c920
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, eax
mov eax, dword [ecx + 8]
and al, 6
movsx edx, al
add esp, 4
neg edx
sbb edx, edx
not edx
test ecx, edx
je 0x47bf68
cmp dword [esp + 0x130], 0x10
mov eax, dword [esp + 0x11c]
jae 0x47b65c
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004083d7
mov byte [esp + 0x160], 4
push 0x6933c4
lea eax, [esp + 0x18]
call fcn.0042f605
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0057be2d
add esp, 4
lea edx, [esp + 0x44]
push edx
mov esi, eax
call fcn.00413a77
mov byte [esp + 0x160], 5
push esi
lea ecx, [esp + 0x48]
call fcn.0047c560
cmp esi, edi
jbe 0x47b759
mov ebx, esi
jmp 0x47b6c0
lea eax, [esp + 0x118]
push eax
lea esi, [esp + 0x90]
call fcn.0047c920
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax + 8]
add ecx, eax
and dl, 6
movsx eax, dl
add esp, 4
neg eax
sbb eax, eax
not eax
test ecx, eax
je 0x47b750
cmp dword [esp + 0x130], 0x10
jb 0x47b70d
mov eax, dword [esp + 0x11c]
mov esi, eax
cmp eax, edi
jne 0x47b714
xor eax, eax
jmp 0x47b729
lea esi, [esp + 0x11c]
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47b720
sub eax, edx
push eax
push esi
lea eax, [esp + 0x1c]
call fcn.0040b2a2
push 0x6933c4
lea eax, [esp + 0x18]
call fcn.0042f605
lea ecx, [esp + 0x14]
push ecx
lea eax, [esp + 0x48]
call fcn.00426c70
sub ebx, 1
jne 0x47b6c0
lea edx, [esp + 0x74]
push edx
call fcn.00486860
mov byte [esp + 0x160], 6
lea eax, [esp + 0x118]
push eax
lea esi, [esp + 0x90]
call fcn.0047c920
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax + 8]
add ecx, eax
and dl, 6
movsx eax, dl
add esp, 4
neg eax
sbb eax, eax
not eax
test ecx, eax
je 0x47bea4
cmp dword [esp + 0x130], 0x10
jb 0x47b805
mov ebx, dword [esp + 0x11c]
test ebx, ebx
je 0x47b7cb
mov esi, ebx
lea ecx, [esi + 1]
jmp 0x47b7c0
mov al, byte [esi]
inc esi
test al, al
jne 0x47b7c0
sub esi, ecx
jne 0x47b836
mov edx, dword [esp + 0x14]
cmp dword [edx - 0xc], 0
mov esi, dword [edx - 0x10]
lea eax, [edx - 0x10]
je 0x47b8a6
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x47b80e
cmp dword [edx - 8], 0
jl 0x47c05f
mov dword [edx - 0xc], 0
mov ecx, dword [esp + 0x14]
mov byte [ecx], 0
jmp 0x47b8a6
lea ebx, [esp + 0x11c]
jmp 0x47b7b6
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47b824
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
jmp 0x47b8a6
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
mov edi, ebx
sub ecx, esi
sub edi, eax
or ecx, edx
jge 0x47b865
mov eax, esi
lea ecx, [esp + 0x14]
call fcn.0040d99b
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
push esi
cmp edi, dword [esp + 0x34]
ja 0x47b87b
add edi, eax
push edi
push ecx
push eax
call fcn.005797bc
jmp 0x47b883
push ebx
push ecx
push eax
call fcn.0057a570
add esp, 0x10
test esi, esi
jl 0x47c05f
mov eax, dword [esp + 0x14]
cmp esi, dword [eax - 8]
jg 0x47c05f
mov dword [eax - 0xc], esi
mov edx, dword [esp + 0x14]
mov byte [esi + edx], 0
push 0x6933c4
lea eax, [esp + 0x18]
call fcn.0042f605
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
jl 0x47be66
push 0x6933c8
push eax
call fcn.0057b76c
add esp, 8
test eax, eax
je 0x47be66
sub eax, dword [esp + 0x14]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x47be66
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
call fcn.0042f6b8
mov byte [esp + 0x160], 7
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00475a40
add esp, 8
mov byte [esp + 0x160], 8
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
movzx eax, word [edx]
movzx esi, al
shr eax, 8
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x50]
sar eax, 2
cmp esi, eax
jb 0x47b941
call fcn.0057a4ca
mov ecx, dword [esp + 0x50]
mov esi, dword [ecx + esi*4]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
sub esi, 0x10
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x47b96f
cmp eax, dword [esi]
jne 0x47b96f
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x47b9a3
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x47c069
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0057a570
add esp, 0x10
add edi, 0x10
mov dword [esp + 0x40], edi
mov byte [esp + 0x160], 0xa
mov edx, dword [0x6dd118]
mov eax, dword [edx + 0xc]
mov ecx, 0x6dd118
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x160], 0xc
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x47ba5a
lea edx, [esp + 0x5c]
push edx
lea ecx, [ebx + 1]
lea edx, [esp + 0x18]
call fcn.0042f682
mov byte [esp + 0x160], 0xd
mov ecx, dword [eax]
mov esi, dword [esp + 0x1c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x47ba49
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x47ba3b
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x47ba3b
call fcn.0040b311
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x47ba32
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [esp + 0x1c], ebx
jmp 0x47ba49
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea eax, [esp + 0x24]
call fcn.0040b2a2
mov byte [esp + 0x160], 0xc
mov eax, dword [esp + 0x5c]
jmp 0x47bbe1
push eax
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x7c]
call fcn.00486c20
mov byte [esp + 0x160], 0xf
mov edx, dword [esp + 0x2c]
cmp dword [edx - 0xc], 0
je 0x47bbd5
lea eax, [esp + 0x70]
lea ecx, [ebx + 1]
push eax
lea edx, [esp + 0x18]
call fcn.0042f682
mov edi, eax
mov byte [esp + 0x160], 0x10
mov ecx, dword [esp + 0x2c]
push ecx
lea edx, [esp + 0x68]
push edx
call fcn.00474d20
mov byte [esp + 0x168], 0x11
lea ecx, [esp + 0x68]
push 0x6933c8
push ecx
mov esi, eax
call fcn.00413787
mov byte [esp + 0x170], 0x12
lea edx, [esp + 0x78]
push edi
push edx
mov esi, eax
call fcn.00413735
add esp, 0x18
mov byte [esp + 0x160], 0x13
mov ecx, dword [eax]
mov esi, dword [esp + 0x1c]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x47bb35
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x47bb27
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x47bb27
call fcn.0040b311
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x47bb1e
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [esp + 0x1c], ebx
jmp 0x47bb35
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea eax, [esp + 0x24]
call fcn.0040b2a2
mov byte [esp + 0x160], 0x12
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47bb5d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0x11
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47bb85
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0x10
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47bbad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0xf
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47bbd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0xc
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47bbfd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
cmp dword [ecx - 0xc], ebx
je 0x47bda6
mov ecx, dword [esp + 0x6c]
mov eax, dword [ecx + 0x14]
mov esi, dword [eax]
mov eax, dword [ecx]
mov edi, eax
mov dword [esp + 0x34], esi
cmp eax, ebx
jne 0x47bd8a
call fcn.0057a4ca
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x47bc36
call fcn.0057a4ca
mov esi, dword [esi]
cmp edi, ebx
jne 0x47bd91
call fcn.0057a4ca
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x47bc51
call fcn.0057a4ca
mov edx, dword [esp + 0x1c]
mov esi, dword [esi]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00474e60
add esp, 8
mov byte [esp + 0x160], 0x19
cmp edi, ebx
jne 0x47bd98
call fcn.0057a4ca
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x47bc86
call fcn.0057a4ca
mov ecx, dword [esp + 0x20]
cmp dword [ecx - 0xc], ebx
jl 0x47bcf3
push str.HKLM_
push ecx
call fcn.0057a4da
mov ecx, dword [esp + 0x28]
add esp, 8
cmp eax, ebx
je 0x47bcaf
sub eax, ecx
sar eax, 1
je 0x47bd60
cmp dword [ecx - 0xc], ebx
jl 0x47bcf3
push str.HKCU_
push ecx
call fcn.0057a4da
mov ecx, dword [esp + 0x28]
add esp, 8
cmp eax, ebx
je 0x47bcd4
sub eax, ecx
sar eax, 1
je 0x47bd60
cmp dword [ecx - 0xc], ebx
jl 0x47bcf3
push str.HKCR_
push ecx
call fcn.0057a4da
add esp, 8
cmp eax, ebx
je 0x47bcf3
sub eax, dword [esp + 0x20]
sar eax, 1
je 0x47bd60
cmp edi, ebx
jne 0x47bd9f
call fcn.0057a4ca
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x47bd0c
call fcn.0057a4ca
mov ecx, dword [esp + 0x40]
mov esi, dword [esi + 8]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.00474e60
add esp, 8
mov byte [esp + 0x160], 0x1a
mov edx, dword [esi]
mov edx, dword [edx + 4]
lea ecx, [esp + 0x20]
push ecx
push eax
mov ecx, esi
call edx
mov byte [esp + 0x160], 0x19
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47bd60
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 0xc
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47bdad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x47bdad
mov eax, dword [eax]
jmp 0x47bc2c
mov eax, dword [edi]
jmp 0x47bc47
mov eax, dword [edi]
jmp 0x47bc7c
mov eax, dword [edi]
jmp 0x47bd02
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x160], 0xa
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47bdd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 8
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47bdfd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 7
mov eax, dword [esp + 0x28]
dec dword [eax + 8]
mov esi, eax
add eax, 8
cmp dword [eax], ebx
jne 0x47be3c
cmp dword [esi + 4], ebx
je 0x47be2b
mov eax, dword [esi]
push ebx
push eax
call fcn.0057c558
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
mov ecx, dword [esp + 0x28]
push ecx
call fcn.005796d1
add esp, 4
mov dword [esp + 0x28], ebx
mov byte [esp + 0x160], 6
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x47be6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x47be6e
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x118]
push ecx
lea esi, [esp + 0x90]
call fcn.0047c920
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, eax
mov eax, dword [ecx + 8]
and al, 6
movsx edx, al
add esp, 4
neg edx
sbb edx, edx
not edx
test ecx, edx
jne 0x47b7a1
xor edi, edi
mov byte [esp + 0x1b], 1
mov byte [esp + 0x160], 5
lea eax, [esp + 0x74]
push eax
call fcn.00486d30
mov bl, 0x21
mov byte [esp + 0x160], bl
mov esi, dword [esp + 0x50]
cmp esi, edi
je 0x47bf1f
mov eax, dword [esp + 0x54]
mov edi, eax
mov dword [esp + 0x38], esi
cmp esi, eax
je 0x47bf14
lea ebx, [ebx]
mov byte [esp + 0x160], bl
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47bf05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
mov dword [esp + 0x38], esi
cmp esi, edi
jne 0x47bee0
mov esi, dword [esp + 0x50]
push esi
call fcn.005796d1
add esp, 4
xor edi, edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov byte [esp + 0x160], 4
mov ecx, dword [esp + 0x44]
push ecx
call fcn.005796d1
add esp, 4
mov byte [esp + 0x160], 3
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x47bf68
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x160], 2
mov ebx, 0x10
cmp dword [esp + 0x130], ebx
jb 0x47bf8e
mov ecx, dword [esp + 0x11c]
push ecx
call fcn.005796d1
add esp, 4
mov esi, 0xf
mov dword [esp + 0x130], esi
mov dword [esp + 0x12c], edi
mov byte [esp + 0x11c], 0
mov byte [esp + 0x160], 1
lea ecx, [esp + 0x8c]
call fcn.0047b4b0
mov byte [esp + 0x160], 0
cmp dword [esp + 0x14c], ebx
jb 0x47bfde
mov edx, dword [esp + 0x138]
push edx
call fcn.005796d1
add esp, 4
mov dword [esp + 0x14c], esi
mov dword [esp + 0x148], edi
mov byte [esp + 0x138], 0
mov dword [esp + 0x160], 0xffffffff
mov esi, dword [esp + 0x24]
dec dword [esi + 8]
cmp dword [esi + 8], edi
lea eax, [esi + 8]
jne 0x47c035
cmp dword [esi + 4], edi
je 0x47c024
mov eax, dword [esi]
push edi
push eax
call fcn.0057c558
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], edi
mov eax, dword [esp + 0x24]
push eax
call fcn.005796d1
add esp, 4
mov dword [esp + 0x24], edi
mov al, byte [esp + 0x1b]
mov ecx, dword [esp + 0x158]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.005796dc
mov esp, ebp
pop ebp
ret 8
push 0x80070057
call fcn.00402d79
call fcn.0040b444
int3