Function at 0x47a270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58fed1
mov eax, dword fs:[0]
push eax
sub esp, 0x358
mov eax, dword [0x600f80]
xor eax, esp
mov dword [esp + 0x350], eax
push ebx
push esi
push edi
mov eax, dword [0x600f80]
xor eax, esp
push eax
lea eax, [esp + 0x368]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x612d98]
mov esi, eax
mov edi, 0x612d9c
mov ebx, 0x612d98
cmp ecx, esi
jne 0x47a2d4
inc dword [0x612d94]
jmp 0x47a2e7
mov ecx, edi
call fcn.00440290
xchg dword [ebx], esi
mov dword [0x612d94], 1
mov ecx, dword [0x611970]
test ecx, ecx
je 0x47a8ca
push str.modules_cfg
call fcn.0049a1dc
test eax, eax
je 0x47a8ca
push str.suspect_rules
mov ecx, eax
call fcn.0049a1dc
mov esi, eax
test esi, esi
jne 0x47a346
push dword [esp + 0x20]
mov edx, dword [0x611b70]
push ecx
mov ecx, dword [0x611b6c]
call fcn.0042ae20
mov eax, dword [0x611b6c]
add esp, 8
mov dword [0x611b70], eax
call fcn.00475730
jmp 0x47a925
cmp dword [esi + 8], 0
je 0x47a319
push 0xa
push 0
push str.count
mov ecx, esi
call fcn.0049a3f2
push eax
call fcn.00542e47
mov ebx, dword [esi + 0xc]
add esp, 0xc
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 0
mov byte [esp + 0x1f], 0
test ebx, ebx
je 0x47a889
lea ecx, [ecx]
lea ecx, [esp + 0xc4]
call fcn.00453540
mov dword [esp + 0x370], 0
mov edi, dword [ebx]
mov esi, dword [edi + 8]
test esi, esi
je 0x47a492
push 0x5e5e6c
push dword [esi]
call fcn.0053cde2
add esp, 8
test eax, eax
je 0x47a3d0
mov esi, dword [esi + 8]
test esi, esi
jne 0x47a3b4
jmp 0x47a3f3
cmp dword [esi + 4], 0
je 0x47a3f3
push 0xa
push 0
push 0x5e5e6c
mov ecx, edi
call fcn.0049a3f2
push eax
call fcn.00542e47
add esp, 0xc
mov dword [esp + 0x2c], eax
mov esi, dword [edi + 8]
test esi, esi
je 0x47a43f
lea ebx, [ebx]
push str.threshold
push dword [esi]
call fcn.0053cde2
add esp, 8
test eax, eax
je 0x47a41c
mov esi, dword [esi + 8]
test esi, esi
jne 0x47a400
jmp 0x47a43f
cmp dword [esi + 4], 0
je 0x47a43f
push 0xa
push 0
push str.threshold
mov ecx, edi
call fcn.0049a3f2
push eax
call fcn.00542e47
add esp, 0xc
mov dword [esp + 0x24], eax
mov esi, dword [edi + 8]
test esi, esi
je 0x47a492
jmp 0x47a450
push str.kill_enabled
push dword [esi]
call fcn.0053cde2
add esp, 8
test eax, eax
je 0x47a46c
mov esi, dword [esi + 8]
test esi, esi
jne 0x47a450
jmp 0x47a492
cmp dword [esi + 4], 0
je 0x47a492
push 0xa
push 0
push str.kill_enabled
mov ecx, edi
call fcn.0049a3f2
push eax
call fcn.00542e47
add esp, 0xc
test eax, eax
setne byte [esp + 0x1f]
mov eax, dword [esp + 0x2c]
mov edx, str.window_style
mov dword [esp + 0x140], eax
mov ecx, edi
mov eax, dword [esp + 0x24]
mov dword [esp + 0x144], eax
mov al, byte [esp + 0x1f]
mov byte [esp + 0x148], al
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0047a0d0
add esp, 0xc
test al, al
je 0x47a4ff
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], eax
movq xmm0, qword [esp + 0x48]
movq qword [esp + 0xc4], xmm0
mov dword [esp + 0xcc], ecx
lea eax, [esp + 0x14]
mov edx, str.window_style_ex
push eax
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
lea eax, [esp + 0x44]
push eax
call fcn.0047a0d0
add esp, 0xc
test al, al
je 0x47a54b
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x6c], eax
movq xmm0, qword [esp + 0x6c]
movq qword [esp + 0xd0], xmm0
mov dword [esp + 0xd8], ecx
lea eax, [esp + 0x14]
mov edx, str.path
push eax
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.0047a1c0
add esp, 0xc
test al, al
je 0x47a63c
push 0x103
lea eax, [esp + 0x151]
mov byte [esp + 0x150], 0
push 0
push eax
call fcn.00540250
mov esi, dword [esp + 0x50]
add esp, 0xc
test esi, esi
jne 0x47a59c
xor eax, eax
jmp 0x47a5aa
push 0x104
push esi
call fcn.0054ac07
add esp, 8
test al, 3
jne 0x47a5c0
push eax
lea edx, [esp + 0x150]
mov ecx, esi
call fcn.00498e83
add esp, 4
push dword [esp + 0x14]
lea eax, [esp + 0x150]
push dword [esp + 0x1c]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00407be0
lea ecx, [esp + 0xa4]
call fcn.0047a040
mov esi, eax
mov byte [esp + 0x370], 1
lea eax, [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 0xdc], ecx
lea ecx, [esp + 0xe0]
cmp ecx, eax
je 0x47a611
push 0xffffffffffffffff
push 0
push eax
call fcn.004083b0
mov eax, dword [esi + 0x1c]
mov byte [esp + 0x370], 0
cmp dword [esp + 0x9c], 0x10
mov dword [esp + 0xf8], eax
jb 0x47a63c
push dword [esp + 0x88]
call fcn.0053e195
add esp, 4
lea eax, [esp + 0x14]
mov edx, str.compiler
push eax
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0047a1c0
add esp, 0xc
test al, al
je 0x47a72d
push 0x103
lea eax, [esp + 0x259]
mov byte [esp + 0x258], 0
push 0
push eax
call fcn.00540250
mov esi, dword [esp + 0x3c]
add esp, 0xc
test esi, esi
jne 0x47a68d
xor eax, eax
jmp 0x47a69b
push 0x104
push esi
call fcn.0054ac07
add esp, 8
test al, 3
jne 0x47a6b1
push eax
lea edx, [esp + 0x258]
mov ecx, esi
call fcn.00498e83
add esp, 4
push dword [esp + 0x14]
lea eax, [esp + 0x258]
push dword [esp + 0x1c]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00407be0
lea ecx, [esp + 0xc4]
call fcn.0047a040
mov esi, eax
mov byte [esp + 0x370], 2
lea eax, [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 0xfc], ecx
lea ecx, [esp + 0x100]
cmp ecx, eax
je 0x47a702
push 0xffffffffffffffff
push 0
push eax
call fcn.004083b0
mov eax, dword [esi + 0x1c]
mov byte [esp + 0x370], 0
cmp dword [esp + 0xbc], 0x10
mov dword [esp + 0x118], eax
jb 0x47a72d
push dword [esp + 0xa8]
call fcn.0053e195
add esp, 4
lea eax, [esp + 0x14]
mov edx, str.bmp_count
push eax
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
lea eax, [esp + 0x48]
push eax
call fcn.0047a0d0
add esp, 0xc
test al, al
je 0x47a779
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x54], eax
movq xmm0, qword [esp + 0x54]
movq qword [esp + 0x11c], xmm0
mov dword [esp + 0x124], ecx
lea eax, [esp + 0x14]
mov edx, str.jpg_count
push eax
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0047a0d0
add esp, 0xc
test al, al
je 0x47a7c5
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x60], eax
movq xmm0, qword [esp + 0x60]
movq qword [esp + 0x128], xmm0
mov dword [esp + 0x130], ecx
lea eax, [esp + 0x14]
mov edx, str.exe_count
push eax
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0047a0d0
add esp, 0xc
test al, al
je 0x47a811
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x78], eax
movq xmm0, qword [esp + 0x78]
movq qword [esp + 0x134], xmm0
mov dword [esp + 0x13c], ecx
lea eax, [esp + 0xc4]
push eax
call fcn.0047b520
mov dword [esp + 0x370], 0xffffffff
cmp dword [esp + 0x114], 0x10
jb 0x47a842
push dword [esp + 0x100]
call fcn.0053e195
add esp, 4
cmp dword [esp + 0xf4], 0x10
mov dword [esp + 0x114], 0xf
mov dword [esp + 0x110], 0
mov byte [esp + 0x100], 0
jb 0x47a879
push dword [esp + 0xe0]
call fcn.0053e195
add esp, 4
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x47a390
mov edi, 0x612d9c
dec dword [0x612d94]
jne 0x47a8c6
xor eax, eax
mov ecx, 0x612d98
xchg dword [ecx], eax
mov eax, bind
lock xadd dword [edi], eax
test eax, 0x40000000
jne 0x47a8c6
cmp eax, 0x80000000
jle 0x47a8c6
lock bts dword [edi], 0x1e
jb 0x47a8c6
mov ecx, edi
call fcn.00406700
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
xor eax, eax
jmp 0x47a928
push dword [esp + 0x28]
mov edx, dword [0x611b70]
push ecx
mov ecx, dword [0x611b6c]
call fcn.0042ae20
mov eax, dword [0x611b6c]
add esp, 8
dec dword [0x612d94]
mov dword [0x611b70], eax
jne 0x47a925
xor eax, eax
xchg dword [ebx], eax
mov eax, bind
lock xadd dword [edi], eax
test eax, 0x40000000
jne 0x47a925
cmp eax, 0x80000000
jle 0x47a925
lock bts dword [edi], 0x1e
jb 0x47a925
mov ecx, edi
call fcn.00406700
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
or eax, 0xffffffff
mov ecx, dword [esp + 0x368]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x350]
xor ecx, esp
call fcn.0053cd12
mov esp, ebp
pop ebp
ret