Function at 0x47cf4c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x3a
push 0
push 0
dec ecx
jne 0x47cf54
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47dba5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x168]
mov ecx, 0x47dbbc
call fcn.00404ac8
mov eax, dword [ebp - 0x168]
call fcn.00408fa0
test al, al
jne 0x47cfc7
push 0
mov ecx, 0x47dbc8
mov edx, 0x47dbd0
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
jmp 0x47db7a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 0xe0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov edx, 0x47dbf8
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x16c]
mov ecx, 0x47dbbc
call fcn.00404ac8
mov ecx, dword [ebp - 0x16c]
mov dl, 1
mov eax, dword [0x4286d8]
call fcn.00428788
mov ebx, eax
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x47dc18
mov edx, 0x47dc28
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x47dc38
mov edx, 0x47dc28
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
push 0
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x47dc48
mov edx, 0x47dc28
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
push 0
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x47dc58
mov edx, 0x47dc28
mov eax, ebx
mov esi, dword [eax]
call dword [esi]
mov eax, ebx
call fcn.00403a00
cmp dword [ebp - 0x1c], 0
je 0x47d095
cmp dword [ebp - 0x20], 0
je 0x47d095
cmp dword [ebp - 0x24], 0
je 0x47d095
cmp dword [ebp - 0x28], 0
jne 0x47d0b2
push 0
mov ecx, 0x47dbc8
mov edx, 0x47dc60
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
jmp 0x47db7a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x170]
mov ecx, dword [ebp - 0x24]
call fcn.00404ac8
mov eax, dword [ebp - 0x170]
call fcn.00408fa0
test al, al
jne 0x47d110
push 0
lea eax, [ebp - 0x174]
mov ecx, dword [ebp - 0x24]
mov edx, 0x47dc88
call fcn.00404ac8
mov eax, dword [ebp - 0x174]
call fcn.00404c7c
mov edx, eax
mov ecx, 0x47dbc8
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
jmp 0x47db7a
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x178]
mov ecx, 0x47dca4
call fcn.00404ac8
mov eax, dword [ebp - 0x178]
call fcn.004029e8
call fcn.004029c8
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x3039
jne 0x47d14f
mov eax, 0x47dcb4
call fcn.004090c8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x17c]
mov ecx, 0x47dca4
call fcn.00404ac8
mov eax, dword [ebp - 0x17c]
call fcn.004620ac
test al, al
jne 0x47d194
push 0
mov ecx, 0x47dbc8
mov edx, 0x47dcb8
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
jmp 0x47db7a
mov eax, dword [ebp - 4]
mov byte [eax + 0x324], 1
lea eax, [ebp - 0x180]
mov ecx, 0x47dcd4
mov edx, dword [ebp - 0x28]
call fcn.00404ac8
mov edx, dword [ebp - 0x180]
mov eax, dword [ebp - 4]
call fcn.00438390
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov edx, 0x47dcec
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x14]
mov ecx, 0x47dd10
call fcn.00404ac8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov byte [eax + 0x324], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
xor edx, edx
call fcn.0042a238
mov dl, 1
mov eax, dword [0x413314]
call fcn.004039d0
mov dword [ebp - 0x38], eax
xor edx, edx
push ebp
push 0x47d27a
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x318]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x1c]
call fcn.00479e20
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
call fcn.00417ed4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d2b1
mov eax, dword [ebp - 0x38]
call fcn.00403a00
mov eax, dword [ebp - 4]
cmp byte [eax + 0x324], 0
jne 0x47d302
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov ecx, 0x47dbc8
mov edx, 0x47dd20
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
jmp 0x47db7a
mov eax, dword [ebp - 0x14]
call fcn.00408fa0
test al, al
jne 0x47d34b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov ecx, 0x47dbc8
mov edx, 0x47dd48
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
jmp 0x47db7a
mov dl, 1
mov eax, dword [0x413000]
call fcn.004039d0
mov ebx, eax
mov edx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jne 0x47d37b
lea ecx, [ebp - 0x30]
xor edx, edx
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
jmp 0x47d383
lea eax, [ebp - 0x30]
call fcn.004047bc
mov eax, ebx
call fcn.00403a00
mov eax, dword [ebp - 0x14]
call fcn.004090c8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x184]
mov ecx, dword [ebp - 0x24]
call fcn.00404ac8
mov eax, dword [ebp - 0x184]
lea edx, [ebp - 0x2c]
call fcn.0047cd34
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
call fcn.00404bc8
jne 0x47d456
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x188]
mov ecx, 0x47dbbc
call fcn.00404ac8
mov eax, dword [ebp - 0x188]
call fcn.0047ce80
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov ecx, 0x47dbc8
mov edx, 0x47dd5c
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
call fcn.00402b40
dec eax
jne 0x47d449
lea edx, [ebp - 0xc]
mov eax, 1
call fcn.00402ba0
mov eax, dword [ebp - 0xc]
call fcn.00408bf4
push 1
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
call fcn.004543b8
jmp 0x47db7a
call fcn.00402b40
dec eax
jne 0x47d47f
lea edx, [ebp - 0xc]
mov eax, 1
call fcn.00402ba0
mov eax, dword [ebp - 0xc]
call fcn.00408bf4
push 0
push 0
push 0x10
push eax
call sub.user32.dll_PostMessageA
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov byte [eax + 0x32c], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x324], 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x18]
mov ecx, 0x47dd74
call fcn.00404ac8
push 0x47dd8c
push dword [ebp - 0x20]
push 0x47dda4
lea eax, [ebp - 0x18c]
mov edx, 3
call fcn.00404b3c
mov edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
xor edx, edx
call fcn.0042a238
mov dl, 1
mov eax, dword [0x413314]
call fcn.004039d0
mov dword [ebp - 0x38], eax
xor edx, edx
push ebp
push 0x47d55e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x318]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x20]
call fcn.00479e20
mov eax, dword [ebp - 4]
cmp byte [eax + 0x32c], 0
jne 0x47d554
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
call fcn.00417ed4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d595
mov eax, dword [ebp - 0x38]
call fcn.00403a00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x320]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x32c], 0
je 0x47d609
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov ecx, 0x47dbc8
mov edx, 0x47dda8
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
jmp 0x47db7a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x324], 0
jne 0x47d652
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov ecx, 0x47dbc8
mov edx, 0x47dd20
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
jmp 0x47db7a
mov eax, dword [ebp - 0x18]
call fcn.00408fa0
test al, al
jne 0x47d69b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov ecx, 0x47dbc8
mov edx, 0x47dd48
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
jmp 0x47db7a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x220]
mov edx, 0x47ddc0
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x190]
mov ecx, 0x47dca4
call fcn.00404ac8
mov edx, dword [ebp - 0x190]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov ecx, dword [eax]
call dword [ecx + 0x110]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
call fcn.004614d8
mov dl, 1
mov eax, dword [0x413000]
call fcn.004039d0
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov edx, dword [eax + 0x218]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x47d7c0
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x194]
mov edx, dword [ebp - 0x34]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x194]
mov edx, 0x47ddd4
call fcn.00404bc8
je 0x47d7b4
lea ecx, [ebp - 0x198]
mov edx, dword [ebp - 0x34]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x198]
mov edx, 0x47dde4
call fcn.00404bc8
je 0x47d7b4
mov eax, dword [ebp - 4]
push dword [eax + 0x328]
push 0x47ddf4
lea ecx, [ebp - 0x1a0]
mov edx, dword [ebp - 0x34]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x19c]
mov edx, 3
call fcn.00404b3c
mov eax, dword [ebp - 0x19c]
call fcn.004090c8
inc dword [ebp - 0x34]
dec dword [ebp - 0x3c]
jne 0x47d731
mov eax, ebx
call fcn.00403a00
xor ebx, ebx
xor edx, edx
mov eax, 2
call fcn.0045928c
mov esi, eax
mov dword [ebp - 0x164], 0x128
lea edx, [ebp - 0x164]
mov eax, esi
call fcn.004592ac
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x47d85a
lea eax, [ebp - 0x1a4]
lea edx, [ebp - 0x140]
mov ecx, 0x104
call fcn.00404a2c
mov eax, dword [ebp - 0x1a4]
lea edx, [ebp - 8]
call fcn.004084d4
lea edx, [ebp - 0x1a8]
mov eax, dword [ebp - 8]
call fcn.00409228
mov edx, dword [ebp - 0x1a8]
lea eax, [ebp - 8]
call fcn.00404854
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
call fcn.00404bc8
jne 0x47d847
mov bl, 1
jmp 0x47d85e
lea edx, [ebp - 0x164]
mov eax, esi
call fcn.004592cc
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x47d7f6
push esi
call sub.kernel32.dll_CloseHandle_1
test bl, bl
je 0x47d8a0
push 0
lea eax, [ebp - 0x1ac]
mov ecx, 0x47de04
mov edx, dword [ebp - 0x28]
call fcn.00404ac8
mov eax, dword [ebp - 0x1ac]
call fcn.00404c7c
mov edx, eax
mov ecx, 0x47dbc8
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
jmp 0x47db7a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
mov edx, dword [ebp - 0x18]
call fcn.00460300
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x1b0]
mov ecx, 0x47ddf4
call fcn.00404ac8
mov edx, dword [ebp - 0x1b0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
call fcn.00460678
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
call fcn.00460210
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x1b4]
mov ecx, 0x47dd10
call fcn.00404ac8
mov eax, dword [ebp - 0x1b4]
call fcn.004090c8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x1b8]
mov ecx, 0x47dd74
call fcn.00404ac8
mov eax, dword [ebp - 0x1b8]
call fcn.004090c8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
call fcn.004614d8
mov dl, 1
mov eax, dword [0x413000]
call fcn.004039d0
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x310]
mov edx, dword [eax + 0x218]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x47daac
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 4]
push dword [eax + 0x328]
push 0x47ddf4
lea ecx, [ebp - 0x1bc]
mov edx, dword [ebp - 0x34]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
push dword [ebp - 0x1bc]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404b3c
lea ecx, [ebp - 0x1c0]
mov edx, dword [ebp - 0x34]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov ecx, dword [ebp - 0x1c0]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x10]
call fcn.00404ac8
lea ecx, [ebp - 0x1c4]
mov edx, dword [ebp - 0x34]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x1c4]
mov edx, 0x47de34
call fcn.00404bc8
jne 0x47da11
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x10]
mov ecx, 0x47de48
call fcn.00404ac8
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404c7c
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404c7c
mov esi, eax
push esi
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x47da98
push 4
push 0x47de60
push dword [ebp - 0x10]
push 0x47de74
lea eax, [ebp - 0x1c8]
mov edx, 3
call fcn.00404b3c
mov eax, dword [ebp - 0x1c8]
call fcn.00404c7c
mov edx, eax
mov ecx, 0x47dbc8
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
cmp eax, 6
jne 0x47da11
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404c7c
push eax
push esi
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x47da98
jmp 0x47da11
mov eax, dword [ebp - 0xc]
call fcn.004090c8
inc dword [ebp - 0x34]
dec dword [ebp - 0x3c]
jne 0x47d981
mov eax, ebx
call fcn.00403a00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x304]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x1cc]
mov ecx, 0x47dca4
call fcn.00404ac8
mov eax, dword [ebp - 0x1cc]
call fcn.00402c00
call fcn.004029c8
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x3039
jne 0x47db12
mov eax, 0x47dcb4
call fcn.004090c8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0x1d0]
mov ecx, 0x47dbbc
call fcn.00404ac8
mov eax, dword [ebp - 0x1d0]
call fcn.0047ce80
push 0
mov ecx, 0x47dbc8
mov edx, 0x47dea8
mov eax, dword [0x481ce0]
mov eax, dword [eax]
call fcn.00457c88
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x328]
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
call fcn.00404ac8
push 5
mov eax, dword [ebp - 0xc]
call fcn.00404c7c
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [ebp - 4]
call fcn.004543b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47dbac
lea eax, [ebp - 0x1d0]
mov edx, 0x1b
call fcn.004047e0
lea eax, [ebp - 0x30]
mov edx, 0xb
call fcn.004047e0
ret