Function at 0x472c40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x61848f
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x7161c0]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x7161c0]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov ebx, dword [esp + 0xbc]
mov eax, dword [ebx + 4]
mov edi, ecx
push eax
mov dword [esp + 0x4c], edi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.USER32.dll_IsMenu]
test eax, eax
jne 0x472caa
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
mov ecx, ebx
call fcn.005c5c6e
jmp 0x472cc1
mov esi, dword [sym.imp.USER32.dll_RemoveMenu]
mov ecx, dword [ebx + 4]
push 0x400
push 0
push ecx
call esi
test eax, eax
jne 0x472cb0
mov eax, dword [edi + 0x294]
xor esi, esi
test eax, eax
jle 0x472d02
lea ecx, [ecx]
test esi, esi
jl 0x472ec5
cmp esi, dword [edi + 0x294]
jge 0x472ec5
mov edx, dword [edi + 0x290]
lea eax, [edx + esi*4]
mov eax, dword [eax]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
add esi, 1
cmp esi, dword [edi + 0x294]
jl 0x472cd0
push 0xffffffffffffffff
push 0
lea ecx, [edi + 0x28c]
call fcn.004367d0
push 0xffffffffffffffff
lea ecx, [edi + 0x2a0]
push 0
mov dword [esp + 0x68], ecx
call fcn.004695c0
cmp dword [edi + 0x25c], 2
mov eax, dword [edi + 0x168]
mov dword [esp + 0x54], 0
mov dword [esp + 0x30], eax
jne 0x4736d1
xor ebp, ebp
mov dword [esp + 0x44], 0x814c
mov dword [esp + 0x1c], ebp
mov dword [esp + 0xb4], 1
mov esi, dword [esp + 0x48]
mov eax, dword [esi + 0xec]
cmp eax, ebp
je 0x473414
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
test eax, eax
jl 0x473414
mov dword [esp + 0x14], ebp
mov byte [esp + 0xb4], 3
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push ebp
lea edx, [esp + 0x18]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jne 0x4733fc
jmp 0x472db0
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x9c]
push edx
call fcn.00497320
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x90], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x94], edx
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x90]
push 0x634c74
push eax
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xa4], edx
call fcn.00401250
add esp, 0x10
test eax, eax
jne 0x472feb
lea ecx, [esp + 0x88]
push 0x635eac
push ecx
call fcn.00401250
add esp, 8
test eax, eax
jne 0x472feb
lea edx, [esp + 0x88]
push 0x63ccc4
push edx
call fcn.00401250
add esp, 8
test eax, eax
je 0x4733c8
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x50]
call fcn.00465820
mov byte [esp + 0xb4], 0x18
mov eax, dword [esp + 0x4c]
cmp eax, ebp
je 0x472fd5
mov ecx, dword [eax]
lea edx, [esp + 0x74]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
cmp dword [esp + 0x74], ebp
jle 0x472fd5
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
lea edx, [esp + 0x23]
push edx
push eax
mov eax, dword [ecx + 0x24]
call eax
push 0x20
call fcn.005b4633
add esp, 4
mov dword [esp + 0x70], eax
mov byte [esp + 0xb4], 0x19
cmp eax, ebp
je 0x472eca
cmp byte [esp + 0x23], 0
mov ecx, 0x63ccb8
jne 0x472eb5
mov ecx, 0x63ccac
push ebp
push ecx
push 0x8214
mov ecx, eax
call fcn.0046cc40
jmp 0x472ecc
call fcn.005bb967
xor eax, eax
mov byte [esp + 0xb4], 0x18
mov cl, byte [esp + 0x23]
mov edi, dword [esp + 0x18]
neg cl
push ebp
push eax
sbb ecx, ecx
and ecx, 0xfffffff8
add ecx, 8
push ecx
mov ecx, edi
call fcn.0043ac60
mov ecx, edi
call fcn.00439490
mov eax, dword [esp + 0x4c]
mov edx, dword [eax]
mov edx, dword [edx + 0x1c]
lea ecx, [esp + 0x84]
push ecx
push eax
call edx
xor esi, esi
cmp dword [esp + 0x74], ebp
jle 0x472fd5
mov ebx, dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [esp + 0x54], 1
lea ecx, [esp + 0x6c]
call fcn.004019e0
mov byte [esp + 0xb4], 0x1a
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0x68]
push edx
mov dword [esp + 0x6c], ebp
mov ecx, dword [eax]
push esi
push eax
mov eax, dword [ecx + 0x18]
call eax
mov ecx, dword [esp + 0x68]
push ecx
lea ecx, [esp + 0x70]
call fcn.0040d930
mov edx, dword [esp + 0x68]
push edx
call ebx
push 0x20
call fcn.005b4633
add esp, 4
mov dword [esp + 0x70], eax
mov byte [esp + 0xb4], 0x1b
cmp eax, ebp
je 0x472f91
mov ecx, dword [esp + 0x6c]
push ebp
push ecx
lea edx, [esi + 0x8215]
push edx
mov ecx, eax
call fcn.0046cc40
jmp 0x472f93
xor eax, eax
mov byte [esp + 0xb4], 0x1a
push ebp
push eax
xor eax, eax
cmp dword [esp + 0x8c], esi
mov ecx, edi
setne al
sub eax, 1
and eax, 8
push eax
call fcn.0043ac60
mov byte [esp + 0xb4], 0x18
lea ecx, [esp + 0x6c]
call fcn.00401a50
add esi, 1
cmp esi, dword [esp + 0x74]
jl 0x472f25
mov byte [esp + 0xb4], 3
lea ecx, [esp + 0x4c]
call fcn.00465010
jmp 0x4733c8
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [esp + 0x40]
call fcn.004656d0
mov byte [esp + 0xb4], 4
cmp dword [esp + 0x3c], ebp
je 0x4733a1
mov dword [esp + 0x24], ebp
mov dword [esp + 0x80], 0xffffffff
mov dword [esp + 0x40], ebp
mov dword [esp + 0x64], ebp
mov byte [esp + 0xb4], 6
mov dword [esp + 0x58], ebp
mov byte [esp + 0xb4], 8
mov eax, dword [esp + 0x3c]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ecx, [esp + 0x24]
push ecx
push eax
call edx
mov eax, dword [esp + 0x44]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x24]
xor ebx, ebx
cmp eax, ebp
jbe 0x47335b
lea ecx, [ecx]
mov eax, dword [esp + 0x60]
mov esi, dword [eax + 4]
cmp esi, dword [eax + 8]
mov edi, dword [esp + 0x3c]
jb 0x473083
lea ecx, [esi + 1]
push ecx
mov ecx, eax
call fcn.00413b20
test al, al
je 0x473581
mov edx, dword [esp + 0x60]
mov eax, dword [edx]
lea eax, [eax + esi*4]
cmp eax, ebp
mov dword [esp + 0x34], eax
je 0x4730aa
cmp edi, ebp
mov dword [eax], edi
je 0x4730a2
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
push edi
call edx
mov byte [esp + 0xb4], 8
mov eax, dword [esp + 0x60]
add dword [eax + 4], 1
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x58]
push edx
lea edx, [esp + 0x68]
push edx
lea edx, [esp + 0x48]
push edx
lea edx, [esp + 0x84]
push edx
lea edx, [esp + 0x6c]
push edx
lea edx, [esp + 0x90]
push edx
push ebp
mov dword [esp + 0x94], ebp
mov dword [esp + 0x98], ebp
mov dword [esp + 0x5c], ebp
mov ecx, dword [eax]
push ebx
push eax
mov eax, dword [ecx + 0x10]
call eax
mov ecx, dword [esp + 0x78]
cmp ecx, dword [esp + 0x80]
mov edi, dword [esp + 0x44]
je 0x473116
cmp edi, dword [esp + 0x70]
jbe 0x473116
mov ecx, dword [esp + 0x18]
call fcn.00439490
cmp dword [esp + 0x40], ebp
mov edx, dword [esp + 0x78]
mov dword [esp + 0x80], edx
jne 0x47319f
push str.Unknown_Stream
lea ecx, [esp + 0x3c]
call fcn.0041a030
mov byte [esp + 0xb4], 0xb
mov eax, dword [esp + 0x38]
mov eax, dword [eax - 0xc]
lea ecx, [eax + eax + 8]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
lea ecx, [ebx + 1]
cmp ecx, 0x3e7
mov dword [esp + 0x40], eax
jb 0x473163
mov ecx, 0x3e7
mov edx, dword [esp + 0x38]
push ecx
push edx
push 0x63cc80
push eax
call fcn.00461c20
add esp, 0x10
mov byte [esp + 0xb4], 8
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47319f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x40]
push ecx
lea ecx, [esp + 0x30]
call fcn.0041fed0
mov byte [esp + 0xb4], 0xd
mov eax, dword [esp + 0x2c]
mov esi, dword [eax - 0xc]
push 0x2f
push eax
call fcn.005d940c
add esp, 8
cmp eax, ebp
jne 0x4731d0
or eax, 0xffffffff
jmp 0x4731d4
sub eax, dword [esp + 0x2c]
sub esi, eax
sub esi, 1
push esi
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x34]
call fcn.00404820
mov byte [esp + 0xb4], 0xe
push eax
lea ecx, [esp + 0x30]
call fcn.00403020
mov byte [esp + 0xb4], 0xd
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x473222
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [esp + 0x7c]
test al, 2
push 0x20
je 0x473277
call fcn.005b4633
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x10
cmp eax, ebp
je 0x473267
mov ecx, dword [esp + 0x2c]
push ebp
push ecx
push edi
mov ecx, eax
call fcn.0046cc40
add edi, 1
mov dword [esp + 0x44], edi
mov byte [esp + 0xb4], 0xd
push ebp
push eax
push 8
jmp 0x4732e6
xor eax, eax
mov byte [esp + 0xb4], 0xd
push ebp
push eax
push 8
jmp 0x4732e6
test al, 1
je 0x4732aa
call fcn.005b4633
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x11
cmp eax, ebp
je 0x4732d9
mov edx, dword [esp + 0x2c]
push ebp
push edx
push edi
mov ecx, eax
call fcn.0046cc40
add edi, 1
mov dword [esp + 0x44], edi
jmp 0x4732db
call fcn.005b4633
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x12
cmp eax, ebp
je 0x4732d9
mov ecx, dword [esp + 0x2c]
push ebp
push ecx
push edi
mov ecx, eax
call fcn.0046cc40
add edi, 1
mov dword [esp + 0x44], edi
jmp 0x4732db
xor eax, eax
mov byte [esp + 0xb4], 0xd
push ebp
push eax
push ebp
mov ecx, dword [esp + 0x24]
call fcn.0043ac60
mov edx, dword [esp + 0x40]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [esp + 0xb4], 8
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x473322
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x64]
add ebx, 1
cmp eax, ebp
je 0x473339
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x64], ebp
mov eax, dword [esp + 0x58]
cmp eax, ebp
je 0x47334d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x58], ebp
mov eax, dword [esp + 0x24]
cmp ebx, eax
jb 0x473060
cmp eax, ebp
jne 0x473371
mov eax, dword [esp + 0x3c]
cmp eax, ebp
je 0x473371
mov dword [esp + 0x3c], ebp
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xb4], 6
mov eax, dword [esp + 0x58]
cmp eax, ebp
je 0x473389
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0xb4], 4
mov eax, dword [esp + 0x64]
cmp eax, ebp
je 0x4733a1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [esp + 0x30], ebp
je 0x4733b0
mov ecx, dword [esp + 0x18]
call fcn.00439490
mov byte [esp + 0xb4], 3
mov eax, dword [esp + 0x3c]
cmp eax, ebp
je 0x4733c8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x4733dc
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push ebp
lea edx, [esp + 0x18]
push edx
push 1
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
je 0x472db0
mov esi, dword [esp + 0x48]
mov byte [esp + 0xb4], 1
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x473414
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0xb4], 0xffffffff
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x47342f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esi + 0xec]
push eax
push 0x634d24
call fcn.00498a80
add esp, 8
mov dword [esp + 0x28], ebp
mov dword [esp + 0xb4], 0x1f
cmp eax, ebp
je 0x473467
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0x63c5d4
push eax
mov eax, dword [ecx]
call eax
mov dword [esp + 0xb4], 0x20
mov ecx, dword [esp + 0x28]
cmp ecx, ebp
jne 0x4734d1
mov eax, dword [esi + 0xec]
push eax
push str.D3CD7858_971A_4838_ACEC_40CA5D529DC8
call fcn.00498d70
mov ecx, dword [esp + 0x30]
add esp, 8
cmp ecx, eax
je 0x4734c7
mov esi, ecx
xor ecx, ecx
cmp eax, ebp
mov dword [esp + 0x28], ecx
je 0x4734b7
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push 0x63c5d4
push eax
mov eax, dword [ecx]
call eax
mov ecx, dword [esp + 0x28]
cmp esi, ebp
je 0x4734c7
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov ecx, dword [esp + 0x28]
cmp ecx, ebp
je 0x4736b6
xor ebp, ebp
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], ebp
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
push edx
push ecx
call eax
test eax, eax
jl 0x4736b6
cmp dword [esp + 0x1c], 1
jbe 0x4736b6
cmp dword [esp + 0x54], 0
je 0x473505
mov ecx, dword [esp + 0x18]
call fcn.00439490
xor ebp, ebp
cmp dword [esp + 0x1c], ebp
mov edi, 0x68
jle 0x4736b6
mov bl, 0x21
mov eax, dword [esp + 0x28]
xor ecx, ecx
push ecx
push ecx
lea esi, [esp + 0x2c]
push esi
push ecx
push ecx
lea esi, [esp + 0x68]
push esi
push ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x70], ecx
mov edx, dword [eax]
push ebp
push eax
mov eax, dword [edx + 0x10]
call eax
test eax, eax
jl 0x4736b6
mov ecx, dword [esp + 0x24]
push ecx
lea ecx, [esp + 0x18]
call fcn.0041fed0
mov byte [esp + 0xb4], bl
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [esp + 0x14]
mov esi, dword [eax - 0xc]
push 0x2f
push eax
call fcn.005d940c
add esp, 8
test eax, eax
jne 0x47358b
or eax, 0xffffffff
jmp 0x47358f
push 0x8007000e
call fcn.00401470
sub eax, dword [esp + 0x14]
sub esi, eax
sub esi, 1
push esi
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x1c]
call fcn.00404820
mov byte [esp + 0xb4], 0x22
push eax
lea ecx, [esp + 0x18]
call fcn.00403020
mov byte [esp + 0xb4], bl
lea ecx, [esp + 0x50]
call fcn.00401a50
mov al, byte [esp + 0x54]
test al, 2
push 0x20
je 0x473619
call fcn.005b4633
add esp, 4
mov dword [esp + 0x5c], eax
mov byte [esp + 0xb4], 0x23
test eax, eax
je 0x47360a
mov ecx, dword [esp + 0x14]
push 0
push ecx
push edi
mov ecx, eax
call fcn.0046cc40
add edi, 1
mov byte [esp + 0xb4], bl
push 0
push eax
push 8
jmp 0x47368f
xor eax, eax
mov byte [esp + 0xb4], bl
push eax
push eax
push 8
jmp 0x47368f
test al, 1
je 0x473655
call fcn.005b4633
add esp, 4
mov dword [esp + 0x5c], eax
mov byte [esp + 0xb4], 0x24
test eax, eax
je 0x47360a
mov edx, dword [esp + 0x14]
push 0
push edx
push edi
mov ecx, eax
call fcn.0046cc40
add edi, 1
mov byte [esp + 0xb4], bl
push 0
push eax
push 8
jmp 0x47368f
call fcn.005b4633
add esp, 4
mov dword [esp + 0x5c], eax
mov byte [esp + 0xb4], 0x25
test eax, eax
je 0x473681
mov ecx, dword [esp + 0x14]
push 0
push ecx
push edi
mov ecx, eax
call fcn.0046cc40
add edi, 1
jmp 0x473683
xor eax, eax
mov byte [esp + 0xb4], bl
push 0
push eax
push 0
mov ecx, dword [esp + 0x24]
call fcn.0043ac60
mov byte [esp + 0xb4], 0x20
lea ecx, [esp + 0x14]
call fcn.00401a50
add ebp, 1
cmp ebp, dword [esp + 0x1c]
jl 0x473518
mov dword [esp + 0xb4], 0xffffffff
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4736d1
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esp + 0x48]
cmp dword [eax + 0x25c], 2
jne 0x4739d0
cmp byte [eax + 0x272], 0
jne 0x4739d0
cmp dword [eax + 0x188], 0
je 0x4739d0
mov edi, dword [esp + 0x30]
xor ebp, ebp
cmp edi, ebp
mov esi, 0x8214
je 0x4739d0
nop
xor eax, eax
cmp edi, ebp
setne al
cmp eax, ebp
je 0x4739fa
mov eax, edi
mov ebx, dword [eax + 8]
cmp ebx, ebp
mov edi, dword [edi]
mov dword [esp + 0x30], edi
mov dword [esp + 0x5c], ebx
je 0x47373a
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
push ebx
call edx
mov dword [esp + 0xb4], 0x29
cmp ebx, ebp
jne 0x473759
mov dword [esp + 0xb4], 0xffffffff
jmp 0x4739c8
mov eax, dword [ebx]
mov ecx, dword [eax + 0x10]
push ebx
mov dword [esp + 0x3c], ebp
call ecx
cmp eax, ebp
mov dword [esp + 0x50], eax
jle 0x473956
lea edi, [esi - 0x8214]
mov ecx, dword [esp + 0x38]
push ebp
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], ebp
mov edx, dword [ebx]
mov edx, dword [edx + 0x14]
push ecx
push ebx
call edx
test eax, eax
jl 0x47389e
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x20]
call fcn.0041fed0
mov byte [esp + 0xb4], 0x2b
push 0x63cc7c
push 0x6387ec
lea ecx, [esp + 0x24]
call fcn.004166e0
mov ecx, dword [esp + 0x48]
mov eax, dword [ecx + 0x180]
cdq
xor eax, edx
sub eax, edx
cmp eax, edi
push 0x20
jne 0x47381e
call fcn.005b4633
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x2c
cmp eax, ebp
je 0x47380e
mov edx, dword [esp + 0x1c]
push ebp
push edx
push esi
mov ecx, eax
call fcn.0046cc40
add esi, 1
add edi, 1
mov byte [esp + 0xb4], 0x2b
push ebp
push eax
push 8
jmp 0x473859
xor eax, eax
mov byte [esp + 0xb4], 0x2b
push ebp
push eax
push 8
jmp 0x473859
call fcn.005b4633
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x2d
cmp eax, ebp
je 0x47384c
mov ecx, dword [esp + 0x1c]
push ebp
push ecx
push esi
mov ecx, eax
call fcn.0046cc40
add esi, 1
add edi, 1
jmp 0x47384e
xor eax, eax
mov byte [esp + 0xb4], 0x2b
push ebp
push eax
push ebp
mov ecx, dword [esp + 0x24]
call fcn.0043ac60
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [esp + 0xb4], 0x29
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x473941
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x473941
mov ecx, dword [esp + 0x48]
mov eax, dword [ecx + 0x180]
cdq
xor eax, edx
sub eax, edx
cmp eax, edi
push 0x20
jne 0x4738fd
call fcn.005b4633
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x2f
cmp eax, ebp
je 0x4738ed
push ebp
push 0x63cc74
push esi
mov ecx, eax
call fcn.0046cc40
add esi, 1
add edi, 1
mov byte [esp + 0xb4], 0x29
push ebp
push eax
push 8
jmp 0x473938
xor eax, eax
mov byte [esp + 0xb4], 0x29
push ebp
push eax
push 8
jmp 0x473938
call fcn.005b4633
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0xb4], 0x30
cmp eax, ebp
je 0x47392b
push ebp
push 0x63cc74
push esi
mov ecx, eax
call fcn.0046cc40
add esi, 1
add edi, 1
jmp 0x47392d
xor eax, eax
mov byte [esp + 0xb4], 0x29
push ebp
push eax
push ebp
mov ecx, dword [esp + 0x24]
call fcn.0043ac60
mov eax, dword [esp + 0x38]
add eax, 1
cmp eax, dword [esp + 0x50]
mov dword [esp + 0x38], eax
jl 0x473777
cmp dword [esp + 0x30], ebp
je 0x4739b1
mov edx, dword [esp + 0x30]
cmp dword [edx + 8], ebp
je 0x4739b1
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x98]
push ecx
push ebx
call edx
mov eax, dword [esp + 0x30]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
lea edx, [esp + 0x88]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
lea ecx, [esp + 0x88]
push ecx
lea edx, [esp + 0x9c]
push edx
call fcn.00401250
add esp, 8
test eax, eax
jne 0x4739b1
mov ecx, dword [esp + 0x18]
call fcn.00439490
mov dword [esp + 0xb4], 0xffffffff
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
push ebx
call ecx
mov edi, dword [esp + 0x30]
cmp edi, ebp
jne 0x473710
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005d8d34
add esp, 0xa4
ret 4
push 0x80004005
call fcn.00401470
int3