Function at 0x47bc4c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov edi, eax
xor eax, eax
push ebp
push 0x47beb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x308]
cmp byte [eax + 0x38], 0
je 0x47bc78
xor ebx, ebx
mov eax, dword [edi + 0x30c]
cmp byte [eax + 0x38], 0
je 0x47bc86
mov bl, 1
mov eax, dword [edi + 0x310]
cmp byte [eax + 0x38], 0
je 0x47bc94
mov bl, 2
mov eax, dword [edi + 0x314]
cmp byte [eax + 0x38], 0
je 0x47bca2
mov bl, 3
mov eax, dword [edi + 0x318]
cmp byte [eax + 0x38], 0
je 0x47bcb0
mov bl, 4
mov eax, dword [edi + 0x31c]
cmp byte [eax + 0x38], 0
je 0x47bcbe
mov bl, 5
mov eax, dword [edi + 0x320]
cmp byte [eax + 0x38], 0
je 0x47bccc
mov bl, 6
mov eax, dword [edi + 0x324]
cmp byte [eax + 0x38], 0
je 0x47bcda
mov bl, 7
mov eax, dword [edi + 0x328]
cmp byte [eax + 0x38], 0
je 0x47bce8
mov bl, 8
mov eax, dword [edi + 0x32c]
cmp byte [eax + 0x38], 0
je 0x47bcf6
mov bl, 9
mov dword [ebp - 8], 1
mov eax, dword [edi + 0x3d4]
cmp byte [eax + 0x38], 0
je 0x47bd0e
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x3d8]
cmp byte [eax + 0x38], 0
je 0x47bd21
mov dword [ebp - 8], 1
mov eax, dword [edi + 0x3dc]
cmp byte [eax + 0x38], 0
je 0x47bd34
mov dword [ebp - 8], 2
mov eax, dword [edi + 0x3e0]
cmp byte [eax + 0x38], 0
je 0x47bd47
mov dword [ebp - 8], 3
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x38c]
cmp byte [eax + 0x38], 0
je 0x47bd5d
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x390]
cmp byte [eax + 0x38], 0
je 0x47bd70
mov dword [ebp - 4], 1
mov eax, dword [edi + 0x394]
cmp byte [eax + 0x38], 0
je 0x47bd83
mov dword [ebp - 4], 2
mov eax, dword [edi + 0x3e8]
mov al, byte [eax + 0x38]
mov byte [0x47ff58], al
mov dl, 1
mov eax, dword [0x429410]
call fcn.00429510
mov esi, eax
mov edx, 0x80000001
mov eax, esi
call fcn.004295b0
mov cl, 1
mov edx, 0x47bed0
mov eax, esi
call fcn.00429614
mov eax, dword [edi + 0x330]
mov cl, byte [eax + 0x38]
mov edx, 0x47bef4
mov eax, esi
call fcn.004299d0
mov eax, dword [edi + 0x408]
mov cl, byte [eax + 0x38]
mov edx, 0x47bf04
mov eax, esi
call fcn.004299d0
xor ecx, ecx
mov cl, bl
mov edx, 0x47bf1c
mov eax, esi
call fcn.0042998c
mov eax, dword [0x482464]
mov ecx, dword [eax + 0x44]
mov edx, 0x47bf2c
mov eax, esi
call fcn.0042998c
mov eax, dword [0x482464]
mov ecx, dword [eax + 0x40]
mov edx, 0x47bf38
mov eax, esi
call fcn.0042998c
mov ecx, dword [ebp - 4]
mov edx, 0x47bf48
mov eax, esi
call fcn.0042998c
mov ecx, dword [ebp - 8]
mov edx, 0x47bf5c
mov eax, esi
call fcn.0042998c
mov cl, byte [0x47ff58]
mov edx, 0x47bf6c
mov eax, esi
call fcn.004299d0
mov eax, esi
call fcn.00429580
mov cl, 1
mov edx, 0x47bf80
mov eax, esi
call fcn.00429614
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x38], 0
je 0x47be87
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.004029f4
mov ecx, dword [ebp - 0xc]
mov edx, 0x47bfb8
mov eax, esi
call fcn.00429960
jmp 0x47be93
mov edx, 0x47bfb8
mov eax, esi
call fcn.004298f0
mov eax, esi
call fcn.00429580
mov eax, esi
call fcn.00403370
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bebe
lea eax, [ebp - 0xc]
call fcn.004040c0
ret