Function at 0x47b670
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x47b678
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x47c19d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x30c]
mov edx, dword [eax]
call dword [edx + 0xd8]
mov word [ebp - 6], 0
mov dl, 1
mov eax, dword [0x432bf8]
call fcn.00432ccc
mov dword [ebp - 0xc], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00432d6c
mov cl, 1
mov edx, 0x47c1b4
mov eax, dword [ebp - 0xc]
call fcn.00432dd4
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x308]
mov edx, dword [eax + 0x218]
mov eax, dword [ebp - 0xc]
call fcn.00433358
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
cmp si, 0
jl 0x47b752
lea ecx, [ebp - 0x14]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
mov edx, 0x47c1ec
call fcn.004045d0
jne 0x47b74a
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec esi
cmp si, 0xffff
jne 0x47b710
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
cmp si, 0
jl 0x47b7ae
lea ecx, [ebp - 0x18]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
mov edx, 0x47c200
call fcn.004045d0
jne 0x47b7a6
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec esi
cmp si, 0xffff
jne 0x47b76c
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test ax, ax
jl 0x47b89f
inc eax
mov word [ebp - 0xe], ax
lea ecx, [ebp - 0x1c]
movsx esi, word [ebp - 6]
mov edx, esi
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439ed8
pop edx
call fcn.00439978
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00404684
push eax
lea eax, [ebp - 4]
push eax
mov ecx, 0x47c210
mov edx, 0x80000002
mov eax, ebx
call fcn.0047b370
mov edx, esi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, esi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, 0x47c248
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, esi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
xor ecx, ecx
xor edx, edx
call fcn.00439b30
inc word [ebp - 6]
dec word [ebp - 0xe]
jne 0x47b7ce
mov eax, dword [ebp - 0xc]
call fcn.00432d3c
mov eax, dword [ebp - 0xc]
call fcn.004033b0
mov dl, 1
mov eax, dword [0x432bf8]
call fcn.00432ccc
mov dword [ebp - 0xc], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00432d6c
mov cl, 1
mov edx, 0x47c25c
mov eax, dword [ebp - 0xc]
call fcn.00432dd4
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x308]
mov edx, dword [eax + 0x218]
mov eax, dword [ebp - 0xc]
call fcn.00433358
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
cmp si, 0
jl 0x47b95b
lea ecx, [ebp - 0x24]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x24]
mov edx, 0x47c1ec
call fcn.004045d0
jne 0x47b953
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec esi
cmp si, 0xffff
jne 0x47b919
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
cmp si, 0
jl 0x47b9b7
lea ecx, [ebp - 0x28]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
mov edx, 0x47c200
call fcn.004045d0
jne 0x47b9af
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec esi
cmp si, 0xffff
jne 0x47b975
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test ax, ax
jl 0x47bab0
inc eax
mov word [ebp - 0xe], ax
xor esi, esi
lea ecx, [ebp - 0x2c]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439ed8
pop edx
call fcn.00439978
lea ecx, [ebp - 0x30]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x30]
call fcn.00404684
push eax
lea eax, [ebp - 4]
push eax
mov ecx, 0x47c290
mov edx, 0x80000002
mov eax, ebx
call fcn.0047b370
movsx edi, word [ebp - 6]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, 0x47c2cc
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov ecx, 1
xor edx, edx
call fcn.00439b30
inc word [ebp - 6]
inc esi
dec word [ebp - 0xe]
jne 0x47b9d9
mov eax, dword [ebp - 0xc]
call fcn.00432d3c
mov eax, dword [ebp - 0xc]
call fcn.004033b0
mov dl, 1
mov eax, dword [0x432bf8]
call fcn.00432ccc
mov dword [ebp - 0xc], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00432d6c
mov cl, 1
mov edx, 0x47c2e4
mov eax, dword [ebp - 0xc]
call fcn.00432dd4
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x308]
mov edx, dword [eax + 0x218]
mov eax, dword [ebp - 0xc]
call fcn.00433358
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test ax, ax
jl 0x47bc09
inc eax
mov word [ebp - 0xe], ax
xor esi, esi
lea ecx, [ebp - 0x34]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439ed8
pop edx
call fcn.00439978
lea ecx, [ebp - 0x38]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x38]
call fcn.00404684
push eax
lea eax, [ebp - 4]
push eax
mov ecx, 0x47c318
mov edx, 0x80000002
mov eax, ebx
call fcn.0047b370
movsx edi, word [ebp - 6]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, 0x47c354
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov ecx, 1
xor edx, edx
call fcn.00439b30
inc word [ebp - 6]
inc esi
dec word [ebp - 0xe]
jne 0x47bb32
mov eax, dword [ebp - 0xc]
call fcn.00432d3c
mov eax, dword [ebp - 0xc]
call fcn.004033b0
mov dl, 1
mov eax, dword [0x432bf8]
call fcn.00432ccc
mov dword [ebp - 0xc], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00432d6c
mov cl, 1
mov edx, 0x47c36c
mov eax, dword [ebp - 0xc]
call fcn.00432dd4
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x308]
mov edx, dword [eax + 0x218]
mov eax, dword [ebp - 0xc]
call fcn.00433358
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test ax, ax
jl 0x47bd62
inc eax
mov word [ebp - 0xe], ax
xor esi, esi
lea ecx, [ebp - 0x3c]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439ed8
pop edx
call fcn.00439978
lea ecx, [ebp - 0x40]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x40]
call fcn.00404684
push eax
lea eax, [ebp - 4]
push eax
mov ecx, 0x47c3a4
mov edx, 0x80000002
mov eax, ebx
call fcn.0047b370
movsx edi, word [ebp - 6]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, 0x47c3e4
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov ecx, 2
xor edx, edx
call fcn.00439b30
inc word [ebp - 6]
inc esi
dec word [ebp - 0xe]
jne 0x47bc8b
mov eax, dword [ebp - 0xc]
call fcn.00432d3c
mov eax, dword [ebp - 0xc]
call fcn.004033b0
mov dl, 1
mov eax, dword [0x432bf8]
call fcn.00432ccc
mov dword [ebp - 0xc], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.00432d6c
mov cl, 1
mov edx, 0x47c400
mov eax, dword [ebp - 0xc]
call fcn.00432dd4
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x308]
mov edx, dword [eax + 0x218]
mov eax, dword [ebp - 0xc]
call fcn.00433358
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test ax, ax
jl 0x47bebb
inc eax
mov word [ebp - 0xe], ax
xor esi, esi
lea ecx, [ebp - 0x44]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x44]
push eax
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439ed8
pop edx
call fcn.00439978
lea ecx, [ebp - 0x48]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x48]
call fcn.00404684
push eax
lea eax, [ebp - 4]
push eax
mov ecx, 0x47c43c
mov edx, 0x80000002
mov eax, ebx
call fcn.0047b370
movsx edi, word [ebp - 6]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, 0x47c480
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov ecx, 2
xor edx, edx
call fcn.00439b30
inc word [ebp - 6]
inc esi
dec word [ebp - 0xe]
jne 0x47bde4
mov eax, dword [ebp - 0xc]
call fcn.00432d3c
mov eax, dword [ebp - 0xc]
call fcn.004033b0
mov dl, 1
mov eax, dword [0x432bf8]
call fcn.00432ccc
mov dword [ebp - 0xc], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.00432d6c
mov cl, 1
mov edx, 0x47c1b4
mov eax, dword [ebp - 0xc]
call fcn.00432dd4
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x308]
mov edx, dword [eax + 0x218]
mov eax, dword [ebp - 0xc]
call fcn.00433358
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test ax, ax
jl 0x47c011
inc eax
mov word [ebp - 0xe], ax
xor esi, esi
lea ecx, [ebp - 0x4c]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x4c]
push eax
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439ed8
pop edx
call fcn.00439978
lea ecx, [ebp - 0x50]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x50]
call fcn.00404684
push eax
lea eax, [ebp - 4]
push eax
mov ecx, 0x47c498
mov edx, 0x80000001
mov eax, ebx
call fcn.0047b370
movsx edi, word [ebp - 6]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, 0x47c4d0
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
xor ecx, ecx
xor edx, edx
call fcn.00439b30
inc word [ebp - 6]
inc esi
dec word [ebp - 0xe]
jne 0x47bf3d
mov eax, dword [ebp - 0xc]
call fcn.00432d3c
mov eax, dword [ebp - 0xc]
call fcn.004033b0
mov dl, 1
mov eax, dword [0x432bf8]
call fcn.00432ccc
mov dword [ebp - 0xc], eax
mov edx, 0x80000001
mov eax, dword [ebp - 0xc]
call fcn.00432d6c
mov cl, 1
mov edx, 0x47c25c
mov eax, dword [ebp - 0xc]
call fcn.00432dd4
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, dword [ebx + 0x308]
mov edx, dword [eax + 0x218]
mov eax, dword [ebp - 0xc]
call fcn.00433358
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test ax, ax
jl 0x47c16a
inc eax
mov word [ebp - 0xe], ax
xor esi, esi
lea ecx, [ebp - 0x54]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439ed8
pop edx
call fcn.00439978
lea ecx, [ebp - 0x58]
movsx edx, si
mov eax, dword [ebx + 0x308]
mov eax, dword [eax + 0x218]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x58]
call fcn.00404684
push eax
lea eax, [ebp - 4]
push eax
mov ecx, 0x47c4dc
mov edx, 0x80000001
mov eax, ebx
call fcn.0047b370
movsx edi, word [ebp - 6]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov eax, dword [eax + 8]
mov edx, 0x47c518
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov edx, edi
mov eax, dword [ebx + 0x30c]
mov eax, dword [eax + 0x22c]
call fcn.00439f64
mov ecx, 1
xor edx, edx
call fcn.00439b30
inc word [ebp - 6]
inc esi
dec word [ebp - 0xe]
jne 0x47c093
mov eax, dword [ebp - 0xc]
call fcn.00432d3c
mov eax, dword [ebp - 0xc]
call fcn.004033b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c1a4
lea eax, [ebp - 0x58]
mov edx, 0x12
call fcn.004041e8
lea eax, [ebp - 4]
call fcn.004041c4
ret