Function at 0x48b460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5cf7f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
push 0x2bd
lea ecx, [ebx + 0x3c]
push str.D:Backup_
push esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], ecx
mov dword [esp + 0x6c], 1
call fcn.00561080
mov ebp, eax
mov dword [esp + 0x64], ebp
mov eax, dword [ebx + 0xc]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x84], edi
jne 0x48b4d2
mov dword [ebx + 4], 0xf002
mov dword [ebx + 8], 0x2c0
jmp 0x48b56a
call fcn.004aa8f0
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
mov eax, 1
mov dword [esp + 0x30], edi
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], eax
mov ecx, dword [edx - 8]
xor eax, eax
cmp ecx, edi
setne al
mov dword [esp + 0x74], eax
mov eax, dword [ebx + 0x18]
cmp eax, 0x2710
mov byte [esp + 0x84], 1
mov dword [esp + 0x78], eax
jbe 0x48b51e
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0x30]
lea edx, [esp + 0x68]
push ecx
push 0x14
lea eax, [esp + 0x20]
push edx
push eax
call fcn.00489410
add esp, 0x10
lea ecx, [esp + 0x18]
mov byte [esp + 0x84], 2
call fcn.0047d330
test eax, eax
jne 0x48b585
lea ecx, [esp + 0x18]
mov byte [esp + 0x84], 1
call fcn.0047d290
mov byte [esp + 0x84], 0
call fcn.004aaaf0
cmp ebp, edi
mov dword [esp + 0x84], 0xffffffff
je 0x48bb11
push edi
push edi
push esi
jmp 0x48bb08
lea ecx, [esp + 0x10]
call fcn.0047d160
mov esi, 0xc
push 0xffffffffffffffff
push 0x1c
lea ecx, [esp + 0x18]
mov byte [esp + 0x8c], 3
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], esi
call fcn.0047d340
lea ecx, [esp + 0x10]
call fcn.0047da50
lea ecx, [ebx + 0x1c]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], esi
mov edx, dword [ecx]
add eax, 0x10
mov dword [esp + 0x1c], edi
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov ecx, dword [ecx + 8]
mov dword [eax + 8], ecx
mov eax, dword [ebx + 0x30]
cmp eax, edi
jle 0x48b6f2
mov dword [esp + 0x20], edi
jmp 0x48b5f2
xor edi, edi
mov esi, dword [esp + 0x20]
mov edx, dword [ebx + 0x2c]
add esi, edx
mov edx, dword [esi]
lea ebp, [esi + 8]
mov ecx, ebp
mov eax, dword [edx - 8]
mov dword [esp + 0x40], eax
mov eax, dword [esi + 4]
mov eax, dword [eax - 8]
mov dword [esp + 0x44], eax
call fcn.0047d330
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
add ecx, edx
mov dword [esp + 0x48], eax
push edi
lea eax, [eax + ecx*2 + 0x10]
lea ecx, [esp + 0x30]
push eax
call fcn.0047d170
lea ecx, [esp + 0x2c]
mov byte [esp + 0x84], 4
call fcn.0047da50
mov ecx, dword [esi]
mov edi, eax
mov eax, dword [ecx - 8]
mov ecx, ebp
mov dword [edi], eax
mov edx, dword [esi + 4]
mov eax, dword [edx - 8]
mov dword [edi + 4], eax
call fcn.0047d330
mov dword [edi + 8], eax
mov eax, dword [esi]
push eax
lea eax, [edi + 0xc]
push eax
call fcn.00451fd7
mov ecx, dword [edi]
mov esi, dword [esi + 4]
push esi
lea edx, [edi + ecx*2 + 0xe]
push edx
call fcn.00451fd7
mov eax, dword [edi + 4]
mov ecx, dword [edi]
add eax, ecx
add esp, 0x10
mov ecx, ebp
lea edi, [edi + eax*2 + 0x10]
call fcn.0047d330
mov ecx, ebp
mov esi, eax
call fcn.0047da50
mov ecx, esi
mov edx, ecx
mov esi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x2c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call fcn.0047d6b0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x84], 3
call fcn.0047d290
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ecx, dword [ebx + 0x30]
inc eax
add edx, 0xc
cmp eax, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
jl 0x48b5f0
mov ebp, dword [esp + 0x64]
xor edi, edi
push str.308204A40201000282010100D173017BEF375E300672DFCF0146ECFFA2A0FB65FBCAA09F0D7D89ED0D32CBD22A05BB0E384C98B04602823F2A3740212BA3E1D9DC75DDF058943CCBE1592B587533B2ECCDFB7A2AF1C0AEB0F797C92B8C912EC0CD8D30359A450E0F85FFFEA6C2339B3887321AC13413FACAF24F0006487374C2084A54A61F00EF04B6420C6F6C5874F34DBEB16BFA4F651A1BD89D8BECE6DD0C98DA38E9F18347E6FDFF98938232389B3AFB5DF1E6F76CBC8D78BC152FC090A9996D0C23495DBF5A15BAF7F9E6DEFD2C987F0A7EBD506DE9141E603D0B405F93DA01E6223C9024CC9A438949AEDFFEDDCFECEF1E2D7328CD7B08B3F1CD783B9F0A4E1340A25811338BE5E3050203010001028201004CE7EDA39432C062E1FB4C32B64554C088F69358DF1B87DEDF15398FD148D58E55DFC4CF73DCAC340D80DE52532DF65E37A7F54609AD3DD102B56B9D71214CC92E3FCD73262F30AC94182C0CCEDCED01109C3E8E8CEB4AC863DCF74CBBE74399F7B4FB49C65A9F7851A7046F80898178CD2197BDA74DA3C75B9AFC28BEC381CCBDD82C302290989C5C6556182FF7303AA73E13AC30195938DE7F5F5B051B750305584DA817DA924B377AC24756EB3621DD60058332CBC5FF3A39C160D9527B57ABCBED1565FF61383F8B8D01D6A78B4F3F823D1CF8EE2BD3ED18A0BED0E8C02102EB514CB3A50066A53DDDDE30D8339E65C38379E16ED3E1214A72CD2BC8000102818100EF286EEC0B21D177988AC5223E7B3493B60B9A73DBF7B8DE86E0E0E58AB6DFC7607F9026935CB04C9BD81BCC76645995B930876D5C5B9BB9F2378574E8381A619581F64DC7AA8378147C7CB242EB3139684CFA784FBAFA393A2BBEB55C28CF2F217FB2D0B39DD5C4B71F8E24573A8C546AB074AF4D31B80A4C7DC50D98C891A502818100E032FB0BDE8518AAF78988D87B28A45AB0201487AD2A923BD8557D3167214B8977E012AA0AFEE92897FEB3A3911854BDE4D7277FB9812CE3E428FF0F1B43539D5927A7E0A7C21153ED8DAE592945348F188D4DA0697A4670EA16A26FE7E57077CBE21FE17BC7BCA13B628CBEC544EA702DFE7CC05E0A1646CA7ED98394EE8DE102818100BB3179C8F659AD1C206116365C93912EC1024A0DBFB22198C41806D08487E996A458949B2D2312B794104E89F66D4B959ED3765D4A3A4625008B26C1BFF611E829DF04CC12A9CBA7D4D92FBD5415C57CBABFEE18F7C7518E339303FDEEB9DE99746E00A7CCBF91101D89EC775373775DA7F8A00C8AAE8CF03AB902E146A24F2502818100AD51BC11E8EC2BADBFBF6B332FC2B38C082C44B2BE83F298A11D35B3436ED1DE6BF5A5781F180157886936A6743CC3062A2ACA364B4A3951D3C87DA548063C559FDEB041546F0AC63F1710798D161B13A47F584B723F3CC57DB211D1410C766DA608216D472B99FF6AD13CCD1DE3B0F918156C8BAA27522157D9C87D985CF3010281800B0E38FB96C17C92B8A02E77B386561D624A32BB24F5C8E9B5D508A5D2A88DBA46AE884C1BC67B1AB6D8B4DC34389AA01FC1D4D0A2825136F80AF2C071E511F585D55FDBACA54339733304C6F7F0504E84CC135715324821492AF50CAC44D77877B6B24573FB038E30C3C9FC8974A936B0D1387416B2D69C4E1BCE90A4B5B7D3
lea ecx, [esp + 0x30]
call fcn.004652a0
mov ecx, dword [esp + 0x2c]
push edi
mov byte [esp + 0x88], 5
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x24]
push eax
call fcn.0047d170
mov esi, dword [esp + 0x2c]
push edi
lea ecx, [esp + 0x24]
mov byte [esp + 0x88], 6
call fcn.0047da70
push eax
push esi
call fcn.0047c900
add esp, 0xc
lea ecx, [esp + 0x20]
push 0xffffffffffffffff
push eax
call fcn.0047d340
lea ecx, [esp + 0x14]
call fcn.0047d160
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
push edx
mov byte [esp + 0x88], 7
call fcn.0047d330
push eax
lea ecx, [esp + 0x18]
call fcn.0047da50
push eax
lea ecx, [esp + 0x2c]
call fcn.0047d330
push eax
lea ecx, [esp + 0x30]
call fcn.0047da50
push eax
call fcn.004ab6e0
test eax, eax
jne 0x48b7c5
lea ecx, [esp + 0x14]
mov byte [esp + 0x84], 6
call fcn.0047d290
lea ecx, [esp + 0x20]
mov byte [esp + 0x84], 5
call fcn.0047d290
lea ecx, [esp + 0x2c]
mov byte [esp + 0x84], 3
call fcn.00465c50
jmp 0x48b90e
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 1
call fcn.0047d330
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], eax
call fcn.0047d160
lea ecx, [esp + 0x34]
push 4
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x8c], 8
call fcn.0047d670
lea edx, [esp + 0x38]
push 4
push edx
lea ecx, [esp + 0x24]
call fcn.0047d670
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
call fcn.0047d6b0
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
call fcn.0047d2c0
lea ecx, [esp + 0x1c]
call fcn.0047d330
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0047d330
lea edx, [esi + eax + 4]
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], edx
call fcn.0047d630
lea eax, [esp + 0x3c]
push 4
push eax
lea ecx, [esp + 0x18]
call fcn.0047d670
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call fcn.0047d6b0
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
push edx
call fcn.0047d6b0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x84], 7
call fcn.0047d290
lea ecx, [esp + 0x14]
mov byte [esp + 0x84], 6
call fcn.0047d290
lea ecx, [esp + 0x20]
mov byte [esp + 0x84], 5
call fcn.0047d290
lea ecx, [esp + 0x2c]
mov byte [esp + 0x84], 3
call fcn.00465c50
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x14]
lea ecx, [esp + 0x30]
push ecx
push edx
push eax
mov eax, dword [ebx + 0x10]
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.004898e0
add esp, 0x14
lea ecx, [esp + 0x24]
mov byte [esp + 0x84], 9
call fcn.0047d330
test eax, eax
jne 0x48b95c
mov edx, dword [esp + 0x30]
lea ecx, [esp + 0x24]
mov dword [ebx + 4], 0xf008
mov dword [ebx + 8], edx
mov byte [esp + 0x84], 3
call fcn.0047d290
lea ecx, [esp + 0x10]
mov byte [esp + 0x84], 2
call fcn.0047d290
lea ecx, [esp + 0x18]
mov byte [esp + 0x84], 1
call fcn.0047d290
mov byte [esp + 0x84], 0
call fcn.004aaaf0
cmp ebp, edi
mov dword [esp + 0x84], 0xffffffff
je 0x48bb11
mov eax, dword [esp + 0x58]
push edi
push edi
push eax
jmp 0x48bb08
push edi
lea ecx, [esp + 0x14]
call fcn.0047d330
add eax, 0x40
lea ecx, [esp + 0x2c]
push eax
call fcn.0047d170
lea ecx, [esp + 0x28]
mov byte [esp + 0x84], 0xa
call fcn.0047da70
push eax
lea ecx, [esp + 0x14]
call fcn.0047d330
push eax
lea ecx, [esp + 0x18]
call fcn.0047da50
push eax
lea ecx, [esp + 0x30]
call fcn.0047d330
push eax
lea ecx, [esp + 0x34]
call fcn.0047da50
push eax
push 2
call fcn.004aab20
cmp eax, edi
je 0x48ba93
cmp eax, 0xffffffff
je 0x48ba93
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x30]
call fcn.0047d340
mov esi, dword [esp + 0x8c]
mov ecx, esi
call fcn.0047d630
lea eax, [ebx + 0x10]
push 4
push eax
mov ecx, esi
call fcn.0047d670
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0047d6b0
lea edx, [esp + 0x28]
mov ecx, esi
push edx
call fcn.0047d6b0
push 1
push esi
call fcn.00489a90
add esp, 8
lea ecx, [esp + 0x28]
mov dword [ebx + 4], 1
mov dword [ebx + 8], edi
mov byte [esp + 0x84], 9
call fcn.0047d290
lea ecx, [esp + 0x24]
mov byte [esp + 0x84], 3
call fcn.0047d290
lea ecx, [esp + 0x10]
mov byte [esp + 0x84], 2
call fcn.0047d290
lea ecx, [esp + 0x18]
mov byte [esp + 0x84], 1
call fcn.0047d290
mov byte [esp + 0x84], 0
call fcn.004aaaf0
cmp ebp, edi
mov dword [esp + 0x84], 0xffffffff
je 0x48ba89
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x5c]
push edi
push edi
push eax
call fcn.005612c0
mov eax, 1
jmp 0x48bb13
lea ecx, [esp + 0x28]
mov dword [ebx + 4], 0xf008
mov dword [ebx + 8], 0x352
mov byte [esp + 0x84], 9
call fcn.0047d290
lea ecx, [esp + 0x24]
mov byte [esp + 0x84], 3
call fcn.0047d290
lea ecx, [esp + 0x10]
mov byte [esp + 0x84], 2
call fcn.0047d290
lea ecx, [esp + 0x18]
mov byte [esp + 0x84], 1
call fcn.0047d290
mov byte [esp + 0x84], 0
call fcn.004aaaf0
cmp ebp, edi
mov dword [esp + 0x84], 0xffffffff
je 0x48bb11
mov ecx, dword [esp + 0x58]
push edi
push edi
push ecx
mov ecx, dword [esp + 0x68]
call fcn.005612c0
xor eax, eax
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x78
ret 4