Function at 0x475900
Capabilities:
Check if file exists
Delete registry key
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x560fc5
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5a6124]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x224], ecx
mov dword [ebp - 4], 0
movups xmm0, xmmword [str.MasterPDF]
mov eax, dword [0x584c84]
mov dword [ebp - 0x38], eax
mov ax, word [0x584ca0]
movups xmmword [ebp - 0x48], xmm0
mov word [ebp - 0x68], ax
movups xmm0, xmmword [str.PdfRecommand]
movups xmmword [ebp - 0x80], xmm0
movq xmm0, qword [0x584c98]
movq qword [ebp - 0x70], xmm0
call fcn.00408130
mov ecx, eax
test ecx, ecx
jne 0x47598b
push 0x80004005
call fcn.00407c80
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4759a0
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x4759a2
call edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0x230], ebx
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [eax - 0xc], 0
je 0x475a26
lea ecx, [eax - 0x10]
lea esi, [ebx - 0x10]
cmp ecx, esi
je 0x4759f2
cmp dword [esi + 0xc], 0
jl 0x475a0f
mov edx, dword [ecx]
cmp edx, dword [esi]
jne 0x475a0f
push ecx
call fcn.00407010
add esp, 4
mov ecx, esi
mov ebx, eax
call fcn.004081d0
add ebx, 0x10
mov dword [ebp - 0x230], ebx
or esi, 0xffffffff
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x475aa7
mov dword [ebp - 0x224], eax
jmp 0x4764c8
push dword [eax - 0xc]
lea ecx, [ebp - 0x230]
push eax
call fcn.00407990
mov ebx, dword [ebp - 0x230]
jmp 0x4759f2
lea ecx, [ebp - 0x238]
call fcn.00473610
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
push ecx
push dword [eax]
lea eax, [ebp - 0x230]
push str._s_s.exe
push eax
call fcn.0042ff80
mov byte [ebp - 4], 1
add esp, 0x10
mov ecx, dword [ebp - 0x238]
mov eax, esi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x475a9c
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x475a98
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x475a98
push 0
push dword [edx + 4]
call edi
mov ebx, dword [ebp - 0x230]
jmp 0x4759f5
mov ecx, edx
call ebx
mov ebx, dword [ebp - 0x230]
jmp 0x4759f5
movups xmm0, xmmword [str.SoftwareClasses_]
mov eax, dword [0x584ce4]
lea ecx, [ebp - 0x80]
cmp dword [ebp - 0x22c], 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x48]
movups xmmword [ebp - 0x34], xmm0
cmove eax, ecx
lea ecx, [ebp - 0x240]
movups xmm0, xmmword [0x584cd4]
push eax
movups xmmword [ebp - 0x24], xmm0
call fcn.00407b50
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x234]
call fcn.0047c1a0
add esp, 4
mov byte [ebp - 4], 4
call fcn.00408130
mov ecx, eax
test ecx, ecx
jne 0x475b16
push 0x80004005
call fcn.00407c80
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x475b2b
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x475b2d
call edx
add eax, 0x10
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0x224]
lea edx, [ebp - 0xac]
mov byte [ebp - 4], 5
movups xmm0, xmmword [str.SoftwareClasses.pdf]
mov eax, dword [0x584d10]
push 0
movups xmmword [ebp - 0xac], xmm0
mov dword [ebp - 0x84], eax
movups xmm0, xmmword [0x584cf8]
movups xmmword [ebp - 0x9c], xmm0
movq xmm0, qword [0x584d08]
movq qword [ebp - 0x8c], xmm0
call fcn.00477910
mov edx, eax
add esp, 4
test edx, edx
jne 0x475b91
xor ecx, ecx
jmp 0x475ba5
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x475b96
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x228]
call fcn.00407990
mov esi, dword [ebp - 0x228]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [esi - 0xc], 0
je 0x475c38
mov eax, dword [ebp - 0x240]
test eax, eax
jne 0x475bd8
push 0x80004005
call fcn.00407c80
push eax
push esi
call fcn.00533c15
add esp, 8
test eax, eax
je 0x475c38
movups xmm0, xmmword [str.previous.pdf]
mov ax, word [0x584d2c]
mov ecx, esi
mov word [ebp - 0x14], ax
movups xmmword [ebp - 0x2c], xmm0
movq xmm0, qword [0x584d24]
lea edx, [ecx + 2]
movq qword [ebp - 0x1c], xmm0
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x475c10
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push esi
push 1
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x234]
push dword [ebp - 0x224]
call edi
movups xmm0, xmmword [str.PDF_Document]
mov ax, word [0x584d48]
lea ecx, [ebp - 0x64]
mov word [ebp - 0x4c], ax
lea edx, [ecx + 2]
movups xmmword [ebp - 0x64], xmm0
movq xmm0, qword [0x584d40]
movq qword [ebp - 0x54], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x475c60
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x64]
push eax
push 1
push 0
push dword [ebp - 0x234]
push dword [ebp - 0x224]
call edi
call fcn.00408130
mov ecx, eax
test ecx, ecx
jne 0x475c9e
push 0x80004005
call fcn.00407c80
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x475cb3
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x475cb5
call edx
add eax, 0x10
mov dword [ebp - 0x238], eax
push ebx
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 6
push str._s_1
push eax
call fcn.0042ff80
push str.DefaultIcon
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x218]
call fcn.00450190
mov edi, dword [ebp - 0x238]
add esp, 0x10
mov ecx, edi
mov edx, dword [eax]
lea eax, [ecx + 2]
mov dword [ebp - 0x220], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x475d00
sub ecx, dword [ebp - 0x220]
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
push 0
push edx
push dword [ebp - 0x224]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x218]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x475d94
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x220], esi
mov esi, dword [ebp - 0x228]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x475d8c
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x220], esi
mov esi, dword [ebp - 0x228]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x475d82
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x475d94
mov ecx, edx
call dword [ebp - 0x220]
jmp 0x475d94
mov ecx, edx
call dword [ebp - 0x220]
push str._shell
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x218]
call fcn.00450190
add esp, 4
push 8
push str.open
push 1
push 0
push dword [eax]
push dword [ebp - 0x224]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x218]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x475e31
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x220], edi
mov edi, dword [ebp - 0x238]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x475e29
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x220], esi
mov esi, dword [ebp - 0x228]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x475e1f
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x475e31
mov ecx, edx
call dword [ebp - 0x220]
jmp 0x475e31
mov ecx, edx
call dword [ebp - 0x220]
call fcn.00408130
mov ecx, eax
test ecx, ecx
jne 0x475e46
push 0x80004005
call fcn.00407c80
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x475e5b
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x475e5d
call edx
add eax, 0x10
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 7
lea eax, [ebp - 0x220]
cmp dword [ebp - 0x22c], 0
push ebx
je 0x475e81
push str.__s_____1____
jmp 0x475e86
push str.__s__tryfirstsel____1_
push eax
call fcn.0042ff80
add esp, 0xc
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x21c]
push str._shellopencommand
call fcn.00450190
add esp, 4
mov eax, dword [eax]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x220]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x218], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x475ec1
sub edx, dword [ebp - 0x218]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
push dword [ebp - 0x22c]
push dword [ebp - 0x224]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x21c]
test eax, eax
sete byte [ebp - 0x239]
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x475f63
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x218], esi
mov esi, dword [ebp - 0x228]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x475f5b
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x218], esi
mov esi, dword [ebp - 0x228]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x475f51
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x475f63
mov ecx, edx
call dword [ebp - 0x218]
jmp 0x475f63
mov ecx, edx
call dword [ebp - 0x218]
push ebx
lea eax, [ebp - 0x220]
push str.__s___print_to_default____1_
push eax
call fcn.0042ff80
push str._shellprintcommand
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x22c]
call fcn.00450190
add esp, 0x10
mov eax, dword [eax]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x220]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x21c], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x475fa7
sub edx, dword [ebp - 0x21c]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
push dword [ebp - 0x218]
push dword [ebp - 0x224]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x22c]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x476040
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x21c], edi
mov edi, dword [ebp - 0x238]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x476038
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x21c], esi
mov esi, dword [ebp - 0x228]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x47602e
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x476040
mov ecx, edx
call dword [ebp - 0x21c]
jmp 0x476040
mov ecx, edx
call dword [ebp - 0x21c]
push ebx
lea eax, [ebp - 0x220]
push str.__s___print_to____2_____1_
push eax
call fcn.0042ff80
push str._shellprinttocommand
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x22c]
call fcn.00450190
add esp, 0x10
mov eax, dword [eax]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x220]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x21c], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x476084
sub edx, dword [ebp - 0x21c]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
push dword [ebp - 0x218]
push dword [ebp - 0x224]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x22c]
or eax, 0xffffffff
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x47611d
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x21c], edi
mov edi, dword [ebp - 0x238]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x476115
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x21c], esi
mov esi, dword [ebp - 0x228]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x47610b
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x47611d
mov ecx, edx
call dword [ebp - 0x21c]
jmp 0x47611d
mov ecx, edx
call dword [ebp - 0x21c]
cmp byte [ebp - 0x239], 0
je 0x4762ec
movups xmm0, xmmword [str.SoftwareClasses.pdfOpenWithProgids]
mov eax, dword [0x584f20]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x240]
mov edx, eax
movups xmmword [ebp - 0xf8], xmm0
movups xmm0, xmmword [0x584ee8]
lea esi, [edx + 2]
movups xmmword [ebp - 0xe8], xmm0
movups xmm0, xmmword [0x584ef8]
movups xmmword [ebp - 0xd8], xmm0
movups xmm0, xmmword [0x584f08]
movups xmmword [ebp - 0xc8], xmm0
movq xmm0, qword [0x584f18]
movq qword [ebp - 0xb8], xmm0
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x476190
mov edi, dword [ebp - 0x224]
sub edx, esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
lea eax, [ebp - 0xac]
push eax
push edi
call esi
push 0
push 0x57f940
push 1
push dword [ebp - 0x240]
lea eax, [ebp - 0xf8]
push eax
push edi
call esi
cmp dword [ebp - 0x224], 0x80000001
lea edi, [ebp - 0x17c]
mov ecx, 0x20
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdf
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x26
movsw word es:[edi], word [esi]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfUserChoice
lea edi, [ebp - 0x214]
rep movsd dword es:[edi], dword [esi]
jne 0x4762d4
mov eax, dword [ebp - 0x240]
mov edx, eax
lea esi, [edx + 2]
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x476220
sub edx, esi
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push str.Progid
lea eax, [ebp - 0x17c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.Application
lea eax, [ebp - 0x17c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea eax, [ebp - 0x22c]
push eax
push 0x40000
push 0
lea eax, [ebp - 0x214]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4762c2
push 1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 1
push 0
push 1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x24]
push eax
push 4
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x214]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, dword [ebp - 0x228]
mov edi, dword [ebp - 0x238]
mov dword [ebp - 0x224], 1
jmp 0x4762f6
mov dword [ebp - 0x224], 0
mov byte [ebp - 4], 6
or eax, 0xffffffff
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x476365
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x21c], esi
mov esi, dword [ebp - 0x228]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x47635d
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x21c], esi
mov esi, dword [ebp - 0x228]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x476353
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x476365
mov ecx, edx
call dword [ebp - 0x21c]
jmp 0x476365
mov ecx, edx
call dword [ebp - 0x21c]
mov byte [ebp - 4], 5
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4763a8
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4763a6
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4763a6
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [ecx + 4]
call edi
jmp 0x4763ae
call edx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4763eb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4763e9
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4763e9
push 0
push dword [ecx + 4]
call edi
jmp 0x4763eb
call edx
mov byte [ebp - 4], 3
or esi, 0xffffffff
mov ecx, dword [ebp - 0x234]
mov eax, esi
add ecx, 0xfffffff0
mov dword [ebp - 0x21c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x47645b
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x218], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x476452
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x218], ecx
mov ecx, dword [ebp - 0x21c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x476448
push 0
push dword [edx + 4]
call edi
jmp 0x47645b
mov ecx, edx
call dword [ebp - 0x218]
jmp 0x47645b
push ecx
mov ecx, edx
call dword [ebp - 0x218]
mov byte [ebp - 4], 1
mov eax, esi
mov ecx, dword [ebp - 0x240]
add ecx, 0xfffffff0
mov dword [ebp - 0x21c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4764c8
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x218], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4764bf
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x218], ecx
mov ecx, dword [ebp - 0x21c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4764b5
push 0
push dword [edx + 4]
call edi
jmp 0x4764c8
mov ecx, edx
call dword [ebp - 0x218]
jmp 0x4764c8
push ecx
mov ecx, edx
call dword [ebp - 0x218]
mov byte [ebp - 4], 0
add ebx, 0xfffffff0
mov eax, esi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x476504
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x476502
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x476502
push 0
push dword [ecx + 4]
call edi
jmp 0x476504
call edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], esi
dec esi
test esi, esi
jg 0x476546
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x476542
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x476542
push 0
push dword [edx + 4]
call edi
jmp 0x476546
mov ecx, edx
call esi
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00502bf3
mov esp, ebp
pop ebp
ret