Function at 0x4701d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4c9462
mov eax, dword fs:[0]
push eax
sub esp, 0x514
mov eax, dword [0x4f55dc]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f55dc]
xor eax, esp
push eax
lea eax, [esp + 0x528]
mov dword fs:[0], eax
push 0x37
xor eax, eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
lea ecx, [esp + 0x4c]
push str.SOFTWAREClasses_shellexContextMenuHandlers_
mov dword [esp + 0x4c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], 0
mov word [esp + 0x50], ax
call fcn.004024a0
mov dword [esp + 0x530], 0
xor eax, eax
push 0x32
mov dword [esp + 0x78], 0
lea ecx, [esp + 0x68]
mov dword [esp + 0x7c], 0
push str.SOFTWAREClasses_shellexDragDropHandlersHaoZip
mov dword [esp + 0x68], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
call fcn.004024a0
mov byte [esp + 0x530], 1
xor eax, eax
push 0x37
mov dword [esp + 0x94], 0
lea ecx, [esp + 0x84]
mov dword [esp + 0x98], 0
push str.SOFTWAREClasses_shellexPropertySheetHandlersHaoZip
mov dword [esp + 0x84], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x9c], 7
mov dword [esp + 0x98], 0
mov word [esp + 0x88], ax
call fcn.004024a0
mov byte [esp + 0x530], 2
xor eax, eax
push 0x3d
mov dword [esp + 0xb0], 0
lea ecx, [esp + 0xa0]
mov dword [esp + 0xb4], 0
push str.SOFTWAREClassesCLSID5FED836A_C96C_4d88_A91E_F63F07726585
mov dword [esp + 0xa0], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0xb8], 7
mov dword [esp + 0xb4], 0
mov word [esp + 0xa4], ax
call fcn.004024a0
mov byte [esp + 0x530], 3
xor eax, eax
push 0x4c
mov dword [esp + 0xcc], 0
lea ecx, [esp + 0xbc]
mov dword [esp + 0xd0], 0
push str.SOFTWAREClassesCLSID5FED836A_C96C_4d88_A91E_F63F07726585InprocServer32
mov dword [esp + 0xbc], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0xd4], 7
mov dword [esp + 0xd0], 0
mov word [esp + 0xc0], ax
call fcn.004024a0
mov byte [esp + 0x530], 4
xor eax, eax
push 0x3f
mov dword [esp + 0xe8], 0
lea ecx, [esp + 0xd8]
mov dword [esp + 0xec], 0
push str.SOFTWAREClassesDirectory_shellexContextMenuHandlers_
mov dword [esp + 0xd8], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0xf0], 7
mov dword [esp + 0xec], 0
mov word [esp + 0xdc], ax
call fcn.004024a0
mov byte [esp + 0x530], 5
mov dword [esp + 0xec], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0
push 0x3a
xor eax, eax
mov dword [esp + 0x108], 7
push str.SOFTWAREClassesDirectory_shellexDragDropHandlersHaoZip
lea ecx, [esp + 0xf8]
mov dword [esp + 0x108], 0
mov word [esp + 0xf8], ax
call fcn.004024a0
mov byte [esp + 0x530], 6
xor eax, eax
push 0x3b
mov dword [esp + 0x120], 0
lea ecx, [esp + 0x110]
mov dword [esp + 0x124], 0
push str.SOFTWAREClassesDrive_shellexContextMenuHandlers_
mov dword [esp + 0x110], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x128], 7
mov dword [esp + 0x124], 0
mov word [esp + 0x114], ax
call fcn.004024a0
mov byte [esp + 0x530], 7
xor eax, eax
push 0x36
mov dword [esp + 0x13c], 0
lea ecx, [esp + 0x12c]
mov dword [esp + 0x140], 0
push str.SOFTWAREClassesDrive_shellexDragDropHandlersHaoZip
mov dword [esp + 0x12c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x144], 7
mov dword [esp + 0x140], 0
mov word [esp + 0x130], ax
call fcn.004024a0
mov byte [esp + 0x530], 8
xor eax, eax
push 0x3c
mov dword [esp + 0x158], 0
lea ecx, [esp + 0x148]
mov dword [esp + 0x15c], 0
push str.SOFTWAREClassesFolderShellExContextMenuHandlers_
mov dword [esp + 0x148], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x160], 7
mov dword [esp + 0x15c], 0
mov word [esp + 0x14c], ax
call fcn.004024a0
mov byte [esp + 0x530], 9
xor eax, eax
push 0x37
mov dword [esp + 0x174], 0
lea ecx, [esp + 0x164]
mov dword [esp + 0x178], 0
push str.SOFTWAREClassesFolderShellExDragDropHandlersHaoZip
mov dword [esp + 0x164], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x17c], 7
mov dword [esp + 0x178], 0
mov word [esp + 0x168], ax
call fcn.004024a0
mov byte [esp + 0x530], 0xa
xor eax, eax
push 0x3d
mov dword [esp + 0x190], 0
lea ecx, [esp + 0x180]
mov dword [esp + 0x194], 0
push str.SOFTWAREClasseslnkfile_shellexContextMenuHandlers_
mov dword [esp + 0x180], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x198], 7
mov dword [esp + 0x194], 0
mov word [esp + 0x184], ax
call fcn.004024a0
mov byte [esp + 0x530], 0xb
xor eax, eax
mov dword [esp + 0x1a8], 0
mov dword [esp + 0x1ac], 0
mov dword [esp + 0x194], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1ac], 7
mov dword [esp + 0x1a8], 0
push 0x38
push str.SOFTWAREClasseslnkfile_shellexDragDropHandlersHaoZip
lea ecx, [esp + 0x1a0]
mov word [esp + 0x1a0], ax
call fcn.004024a0
mov byte [esp + 0x530], 0xc
xor eax, eax
push 0x26
mov dword [esp + 0x1c8], 0
lea ecx, [esp + 0x1b8]
mov dword [esp + 0x1cc], 0
push str._shellexContextMenuHandlers_
mov dword [esp + 0x1b8], VariantClear
mov dword [esp + 0x1d0], 7
mov dword [esp + 0x1cc], 0
mov word [esp + 0x1bc], ax
call fcn.004024a0
mov byte [esp + 0x530], 0xd
xor eax, eax
push 0x21
mov dword [esp + 0x1e4], 0
lea ecx, [esp + 0x1d4]
mov dword [esp + 0x1e8], 0
push str._shellexDragDropHandlersHaoZip
mov dword [esp + 0x1d4], VariantClear
mov dword [esp + 0x1ec], 7
mov dword [esp + 0x1e8], 0
mov word [esp + 0x1d8], ax
call fcn.004024a0
mov byte [esp + 0x530], 0xe
xor eax, eax
push 0x26
mov dword [esp + 0x200], 0
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x204], 0
push str._shellexPropertySheetHandlersHaoZip
mov dword [esp + 0x1f0], VariantClear
mov dword [esp + 0x208], 7
mov dword [esp + 0x204], 0
mov word [esp + 0x1f4], ax
call fcn.004024a0
mov byte [esp + 0x530], 0xf
xor eax, eax
push 0x2c
mov dword [esp + 0x21c], 0
lea ecx, [esp + 0x20c]
mov dword [esp + 0x220], 0
push str.CLSID5FED836A_C96C_4d88_A91E_F63F07726585
mov dword [esp + 0x20c], VariantClear
mov dword [esp + 0x224], 7
mov dword [esp + 0x220], 0
mov word [esp + 0x210], ax
call fcn.004024a0
mov byte [esp + 0x530], 0x10
xor eax, eax
push 0x3b
mov dword [esp + 0x238], 0
lea ecx, [esp + 0x228]
mov dword [esp + 0x23c], 0
push str.CLSID5FED836A_C96C_4d88_A91E_F63F07726585InprocServer32
mov dword [esp + 0x228], VariantClear
mov dword [esp + 0x240], 7
mov dword [esp + 0x23c], 0
mov word [esp + 0x22c], ax
call fcn.004024a0
mov byte [esp + 0x530], 0x11
xor eax, eax
push 0x2e
mov dword [esp + 0x254], 0
mov dword [esp + 0x258], 0
mov dword [esp + 0x240], VariantClear
mov dword [esp + 0x258], 7
mov dword [esp + 0x254], 0
mov word [esp + 0x244], ax
push str.Directory_shellexContextMenuHandlers_
lea ecx, [esp + 0x248]
call fcn.004024a0
mov byte [esp + 0x530], 0x12
xor eax, eax
push 0x29
mov dword [esp + 0x270], 0
lea ecx, [esp + 0x260]
mov dword [esp + 0x274], 0
push str.Directory_shellexDragDropHandlersHaoZip
mov dword [esp + 0x260], VariantClear
mov dword [esp + 0x278], 7
mov dword [esp + 0x274], 0
mov word [esp + 0x264], ax
call fcn.004024a0
mov byte [esp + 0x530], 0x13
xor eax, eax
push 0x2a
mov dword [esp + 0x28c], 0
lea ecx, [esp + 0x27c]
mov dword [esp + 0x290], 0
push str.Drive_shellexContextMenuHandlers_
mov dword [esp + 0x27c], VariantClear
mov dword [esp + 0x294], 7
mov dword [esp + 0x290], 0
mov word [esp + 0x280], ax
call fcn.004024a0
mov byte [esp + 0x530], 0x14
xor eax, eax
push 0x25
mov dword [esp + 0x2a8], 0
lea ecx, [esp + 0x298]
mov dword [esp + 0x2ac], 0
push str.Drive_shellexDragDropHandlersHaoZip
mov dword [esp + 0x298], VariantClear
mov dword [esp + 0x2b0], 7
mov dword [esp + 0x2ac], 0
mov word [esp + 0x29c], ax
call fcn.004024a0
mov byte [esp + 0x530], 0x15
xor eax, eax
push 0x2b
mov dword [esp + 0x2c4], 0
lea ecx, [esp + 0x2b4]
mov dword [esp + 0x2c8], 0
push str.FolderShellExContextMenuHandlers_
mov dword [esp + 0x2b4], VariantClear
mov dword [esp + 0x2cc], 7
mov dword [esp + 0x2c8], 0
mov word [esp + 0x2b8], ax
call fcn.004024a0
mov byte [esp + 0x530], 0x16
xor eax, eax
push 0x26
mov dword [esp + 0x2e0], 0
lea ecx, [esp + 0x2d0]
mov dword [esp + 0x2e4], 0
push str.FolderShellExDragDropHandlersHaoZip
mov dword [esp + 0x2d0], VariantClear
mov dword [esp + 0x2e8], 7
mov dword [esp + 0x2e4], 0
mov word [esp + 0x2d4], ax
call fcn.004024a0
mov byte [esp + 0x530], 0x17
xor eax, eax
push 0x2c
mov dword [esp + 0x2fc], 0
lea ecx, [esp + 0x2ec]
mov dword [esp + 0x300], 0
push str.lnkfile_shellexContextMenuHandlers_
mov dword [esp + 0x2ec], VariantClear
mov dword [esp + 0x304], 7
mov dword [esp + 0x300], 0
mov word [esp + 0x2f0], ax
call fcn.004024a0
mov byte [esp + 0x530], 0x18
xor eax, eax
push 0x27
mov dword [esp + 0x318], 0
lea ecx, [esp + 0x308]
mov dword [esp + 0x31c], 0
push str.lnkfile_shellexDragDropHandlersHaoZip
mov dword [esp + 0x308], VariantClear
mov dword [esp + 0x320], 7
mov dword [esp + 0x31c], 0
mov word [esp + 0x30c], ax
call fcn.004024a0
mov dword [esp + 0x530], 0x19
xor eax, eax
push 0xc
mov dword [esp + 0x34], 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0
push str.Advapi32.dll
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
call fcn.004024a0
mov byte [esp + 0x530], 0x1a
mov eax, dword [0x4f8910]
test al, 1
jne 0x470bbe
or eax, 1
mov dword [0x4f8910], eax
mov byte [esp + 0x530], 0x1b
mov dword [0x4f890c], 0
call fcn.00407db0
push 0x4cdb80
call fcn.0049c72f
add esp, 4
mov byte [esp + 0x530], 0x1a
lea eax, [esp + 0x20]
mov ecx, 0x4f890c
push eax
call fcn.00407f70
mov ebx, eax
mov byte [esp + 0x530], 0x19
cmp dword [esp + 0x34], 8
jb 0x470bea
push dword [esp + 0x20]
call fcn.0049c766
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
test ebx, ebx
je 0x470ddc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4db1a0
push ebx
call esi
push 0x4db1b0
mov ebp, eax
push ebx
mov dword [esp + 0x24], ebp
call esi
push 0x4db25c
mov edi, eax
push ebx
mov dword [esp + 0x20], edi
call esi
mov ebx, eax
test ebp, ebp
je 0x470ddc
test edi, edi
je 0x470ddc
test ebx, ebx
je 0x470ddc
push 0x206
lea eax, [esp + 0x322]
mov byte [esp + 0x1b], 1
push 0
push eax
call fcn.004a1910
add esp, 0xc
lea esi, [esp + 0x48]
xor ebp, ebp
nop
xor eax, eax
mov dword [esp + 0x38], 0
mov word [esp + 0x31c], ax
mov eax, dword [esi - 4]
mov dword [esp + 0x40], 1
mov dword [esp + 0x3c], 0x103
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x470cf8
mov edi, 0x20019
call fcn.00408800
test al, al
mov eax, 0x20119
cmovne edi, eax
cmp dword [esi + 0x14], 8
jb 0x470cba
mov eax, dword [esi]
jmp 0x470cbc
mov eax, esi
lea ecx, [esp + 0x38]
push ecx
push edi
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [esp + 0x30]
test eax, eax
jne 0x470db3
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x320]
push eax
lea eax, [esp + 0x48]
push eax
push 0
push 0
push dword [esp + 0x4c]
call edi
jmp 0x470d57
cmp eax, 0x80000000
jne 0x470d99
mov edi, 0x20019
call fcn.00408800
test al, al
mov eax, 0x20119
cmovne edi, eax
cmp dword [esi + 0x14], 8
jb 0x470d21
mov eax, dword [esi]
jmp 0x470d23
mov eax, esi
lea ecx, [esp + 0x38]
push ecx
push edi
push 0
push eax
push SysReAllocString
call dword [esp + 0x30]
test eax, eax
jne 0x470db3
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x320]
push eax
lea eax, [esp + 0x48]
push eax
push 0
push 0
push dword [esp + 0x4c]
call dword [esp + 0x30]
test eax, eax
jne 0x470dad
mov eax, dword [esp + 0x3c]
mov ecx, 0x103
cmp eax, 0x103
cmovae eax, ecx
mov dword [esp + 0x3c], eax
add eax, eax
cmp eax, 0x208
jae 0x470da8
xor ecx, ecx
mov word [esp + eax + 0x31c], cx
lea ecx, [esp + 0x31c]
call fcn.00406de0
push dword [esp + 0x38]
test eax, eax
je 0x470db1
call ebx
inc ebp
add esi, 0x1c
cmp ebp, 0x1a
jb 0x470c70
jmp 0x470db8
call fcn.0049cf59
push dword [esp + 0x38]
call ebx
mov byte [esp + 0x17], 0
mov dword [esp + 0x530], 0xffffffff
lea eax, [esp + 0x44]
push 0x470e30
push 0x1a
push 0x1c
push eax
call fcn.0049e6f1
mov al, byte [esp + 0x17]
jmp 0x470dfc
mov dword [esp + 0x530], 0xffffffff
lea eax, [esp + 0x44]
push 0x470e30
push 0x1a
push 0x1c
push eax
call fcn.0049e6f1
xor al, al
mov ecx, dword [esp + 0x528]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.0049bfa3
add esp, 0x520
ret