Function at 0x476e1c
Capabilities:
Persist via run registry key
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x46
push 0
push 0
dec ecx
jne 0x476e24
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov esi, eax
mov edi, 0x482944
xor eax, eax
push ebp
push 0x477cee
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x482941], 0
je 0x476e76
lea eax, [ebp - 0x134]
mov ecx, 0x477d04
mov edx, dword [0x48294c]
call fcn.004053c4
mov eax, dword [ebp - 0x134]
mov edx, 0x477d20
call fcn.0047456c
mov byte [0x482941], 0
mov dl, 1
mov eax, dword [0x425b10]
call fcn.00425be0
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00425c80
mov edx, 0x477d40
mov eax, ebx
call fcn.00425ce4
test al, al
je 0x476ef3
mov eax, ebx
call fcn.00425c50
mov byte [0x482940], 1
mov eax, 0x48293c
mov edx, 0x477d74
call fcn.00405108
cmp byte [0x482942], 0
je 0x476f21
xor edx, edx
mov eax, dword [0x482604]
call fcn.0045b8e4
xor edx, edx
mov eax, dword [0x482604]
call fcn.0045ed0c
xor edx, edx
mov eax, dword [0x482604]
call fcn.0045ed48
jmp 0x476f21
mov byte [0x482940], 0
mov eax, 0x48293c
mov edx, 0x477d94
call fcn.00405108
cmp byte [0x482942], 0
jne 0x476f21
mov eax, 0x48293c
mov edx, 0x477d74
call fcn.00405108
mov eax, dword [0x48293c]
mov edx, 0x477d94
call fcn.004054c4
jne 0x476f83
mov byte [ebp - 0x130], 0
push pe_nt_image_headers32
lea eax, [ebp - 0x130]
push eax
push 0x477db0
call sub.KERNEL32.DLL_GetEnvironmentVariableA
lea edx, [ebp - 0x138]
lea eax, [ebp - 0x130]
call fcn.00409e08
mov edx, dword [ebp - 0x138]
mov eax, edi
call fcn.00405108
mov eax, 0x482948
mov ecx, 0x477dc0
mov edx, dword [edi]
call fcn.004053c4
jmp 0x4772e6
mov byte [ebp - 0x130], 0
push pe_nt_image_headers32
lea eax, [ebp - 0x130]
push eax
push 0x477dcc
call sub.KERNEL32.DLL_GetEnvironmentVariableA
lea edx, [ebp - 0x13c]
lea eax, [ebp - 0x130]
call fcn.00409e08
mov edx, dword [ebp - 0x13c]
mov eax, edi
call fcn.00405108
mov byte [ebp - 0x130], 0
push pe_nt_image_headers32
lea eax, [ebp - 0x130]
push eax
push 0x477db0
call sub.KERNEL32.DLL_GetEnvironmentVariableA
lea edx, [ebp - 0x140]
lea eax, [ebp - 0x130]
call fcn.00409e08
mov edx, dword [ebp - 0x140]
mov eax, 0x48294c
call fcn.00405108
cmp dword [edi], 0
je 0x477051
push 4
push 0x477dd8
push 0x477dec
push dword [edi]
push 0x477e20
push 0x477e2c
lea eax, [ebp - 0x144]
mov edx, 4
call fcn.00405438
mov eax, dword [ebp - 0x144]
call fcn.00405578
push eax
mov eax, dword [0x482604]
call fcn.0044c9d4
push eax
call sub.user32.dll_MessageBoxA
cmp eax, 7
jne 0x477051
mov eax, edi
call fcn.004050b4
cmp dword [edi], 0
jne 0x47717d
mov eax, 0x482948
call fcn.004050b4
xor ebx, ebx
jmp 0x47716e
mov eax, 0x477e54
call fcn.00472e4c
test al, al
je 0x4770ad
push 0x477e54
lea eax, [ebp - 0x148]
push eax
mov eax, dword [0x482604]
call fcn.0044c9d4
mov ecx, 1
mov edx, 0x477e68
call fcn.00473bb0
mov edx, dword [ebp - 0x148]
mov eax, edi
call fcn.00405108
jmp 0x4770df
push 0x477e94
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [0x482604]
call fcn.0044c9d4
mov ecx, 1
mov edx, 0x477e68
call fcn.00473bb0
mov edx, dword [ebp - 0x14c]
mov eax, edi
call fcn.00405108
cmp dword [edi], 0
je 0x477146
mov eax, 0x482948
mov ecx, 0x477dc0
mov edx, dword [edi]
call fcn.004053c4
lea eax, [ebp - 0x150]
mov ecx, 0x477ea0
mov edx, dword [0x482948]
call fcn.004053c4
mov eax, dword [ebp - 0x150]
call fcn.00409874
test al, al
jne 0x477146
lea eax, [ebp - 0x154]
mov ecx, 0x477eb8
mov edx, dword [0x482948]
call fcn.004053c4
mov eax, dword [ebp - 0x154]
call fcn.00409874
test al, al
jne 0x477146
mov eax, edi
call fcn.004050b4
cmp dword [edi], 0
jne 0x47716e
push 4
push 0x477ec8
push 0x477ed0
mov eax, dword [0x482604]
call fcn.0044c9d4
push eax
call sub.user32.dll_MessageBoxA
cmp eax, 7
jne 0x47716e
mov bl, 1
test bl, bl
jne 0x47718e
cmp dword [edi], 0
je 0x47706b
jmp 0x47718e
mov eax, 0x482948
mov ecx, 0x477dc0
mov edx, dword [edi]
call fcn.004053c4
mov byte [ebp - 0x130], 0
push pe_nt_image_headers32
lea eax, [ebp - 0x130]
push eax
push 0x477db0
call sub.KERNEL32.DLL_GetEnvironmentVariableA
lea edx, [ebp - 0x158]
lea eax, [ebp - 0x130]
call fcn.00409e08
mov edx, dword [ebp - 0x158]
mov eax, 0x48294c
call fcn.00405108
cmp dword [0x482948], 0
je 0x4772e6
lea edx, [ebp - 0x15c]
mov eax, dword [0x48294c]
call fcn.00408eac
mov eax, dword [ebp - 0x15c]
push eax
lea edx, [ebp - 0x160]
mov eax, dword [edi]
call fcn.00408eac
mov edx, dword [ebp - 0x160]
pop eax
call fcn.004054c4
jne 0x47721f
mov eax, 0x48293c
mov edx, 0x477d94
call fcn.00405108
jmp 0x4772e6
lea eax, [ebp - 0x164]
mov ecx, 0x477ea0
mov edx, dword [0x482948]
call fcn.004053c4
mov eax, dword [ebp - 0x164]
call fcn.00409874
test al, al
je 0x477296
push 0x477f10
push dword [0x482948]
push 0x477ea0
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00405438
mov eax, dword [ebp - 0x168]
push eax
lea eax, [ebp - 0x16c]
mov ecx, 0x477d04
mov edx, dword [0x48294c]
call fcn.004053c4
mov eax, dword [ebp - 0x16c]
pop edx
call fcn.0047456c
mov byte [0x482941], 1
jmp 0x4772e6
push 0x477f10
push dword [0x482948]
push 0x477eb8
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00405438
mov eax, dword [ebp - 0x170]
push eax
lea eax, [ebp - 0x174]
mov ecx, 0x477d04
mov edx, dword [0x48294c]
call fcn.004053c4
mov eax, dword [ebp - 0x174]
pop edx
call fcn.0047456c
mov byte [0x482941], 1
mov dl, 1
mov eax, esi
call fcn.00474640
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.0047b728
mov byte [0x482942], 0
mov eax, 0x48296c
call fcn.004050b4
mov eax, 0x482970
call fcn.004050b4
mov eax, 0x482974
call fcn.004050b4
mov eax, 0x482978
call fcn.004050b4
mov eax, 0x48297c
call fcn.004050b4
mov eax, 0x482980
call fcn.004050b4
mov eax, 0x482984
call fcn.004050b4
mov eax, 0x482988
call fcn.004050b4
mov eax, 0x48298c
call fcn.004050b4
mov eax, 0x482990
call fcn.004050b4
mov dl, 1
mov eax, dword [0x425b10]
call fcn.00425be0
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00425c80
mov dl, 1
mov eax, dword [0x417ab8]
call fcn.00404218
mov esi, eax
cmp byte [0x482941], 0
je 0x477b2d
push 0x477f2c
push dword [0x482948]
push 0x477f4c
lea eax, [ebp - 0x178]
mov edx, 3
call fcn.00405438
mov eax, dword [ebp - 0x178]
push eax
lea eax, [ebp - 0x17c]
mov ecx, 0x477d04
mov edx, dword [0x48294c]
call fcn.004053c4
mov eax, dword [ebp - 0x17c]
pop edx
call fcn.0047456c
lea eax, [ebp - 4]
call fcn.004050b4
lea eax, [ebp - 8]
call fcn.004050b4
mov edx, 0x477f68
mov eax, ebx
call fcn.00425ce4
test al, al
je 0x4774bd
lea ecx, [ebp - 8]
mov edx, 0x477fa0
mov eax, ebx
call fcn.0042606c
lea edx, [ebp - 0x180]
mov eax, dword [edi]
call fcn.00408eac
mov eax, dword [ebp - 0x180]
push eax
lea edx, [ebp - 0x184]
mov eax, dword [ebp - 8]
call fcn.00408eac
mov edx, dword [ebp - 0x184]
pop eax
call fcn.004054c4
je 0x47745a
lea eax, [ebp - 4]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [edi]
call fcn.004055d8
mov edx, 0x477fb4
mov eax, ebx
call fcn.00425ce4
test al, al
je 0x4774bd
lea ecx, [ebp - 0xc]
mov edx, 0x477ff8
mov eax, ebx
call fcn.0042606c
lea eax, [ebp - 0x18c]
push eax
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.004055d8
mov eax, dword [ebp - 0x18c]
lea edx, [ebp - 0x188]
call fcn.00408eac
mov eax, dword [ebp - 0x188]
mov edx, 0x478014
call fcn.004054c4
je 0x4774bd
lea eax, [ebp - 4]
call fcn.004050b4
mov edx, 0x47802c
mov eax, ebx
call fcn.00425ce4
test al, al
je 0x4778b1
lea ecx, [ebp - 0x190]
mov edx, 0x478078
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x190]
mov eax, 0x48296c
call fcn.00405108
cmp dword [ebp - 4], 0
je 0x47754d
mov eax, dword [0x48296c]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47751e
mov eax, dword [ebp - 0x14]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x198]
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 2
mov edx, 3
mov eax, dword [0x48296c]
call fcn.004055d8
mov ecx, dword [ebp - 0x198]
mov eax, 0x48296c
mov edx, dword [ebp - 4]
call fcn.004053c4
lea ecx, [ebp - 0x19c]
mov edx, 0x478094
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x19c]
mov eax, 0x482970
call fcn.00405108
cmp dword [ebp - 4], 0
je 0x4775c9
mov eax, dword [0x482970]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x47759a
mov eax, dword [ebp - 0x18]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1a0]
push eax
mov ecx, dword [ebp - 0x18]
sub ecx, 2
mov edx, 3
mov eax, dword [0x482970]
call fcn.004055d8
mov ecx, dword [ebp - 0x1a0]
mov eax, 0x482970
mov edx, dword [ebp - 4]
call fcn.004053c4
lea ecx, [ebp - 0x1a4]
mov edx, 0x4780ac
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x1a4]
mov eax, 0x482974
call fcn.00405108
cmp dword [ebp - 4], 0
je 0x477645
mov eax, dword [0x482974]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x477616
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1a8]
push eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 2
mov edx, 3
mov eax, dword [0x482974]
call fcn.004055d8
mov ecx, dword [ebp - 0x1a8]
mov eax, 0x482974
mov edx, dword [ebp - 4]
call fcn.004053c4
lea ecx, [ebp - 0x1ac]
mov edx, 0x4780c4
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x1ac]
mov eax, 0x482978
call fcn.00405108
cmp dword [ebp - 4], 0
je 0x4776c1
mov eax, dword [0x482978]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x477692
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1b0]
push eax
mov ecx, dword [ebp - 0x20]
sub ecx, 2
mov edx, 3
mov eax, dword [0x482978]
call fcn.004055d8
mov ecx, dword [ebp - 0x1b0]
mov eax, 0x482978
mov edx, dword [ebp - 4]
call fcn.004053c4
lea ecx, [ebp - 0x1b4]
mov edx, 0x4780dc
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x1b4]
mov eax, 0x48297c
call fcn.00405108
cmp dword [ebp - 4], 0
je 0x47773d
mov eax, dword [0x48297c]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x47770e
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1b8]
push eax
mov ecx, dword [ebp - 0x24]
sub ecx, 2
mov edx, 3
mov eax, dword [0x48297c]
call fcn.004055d8
mov ecx, dword [ebp - 0x1b8]
mov eax, 0x48297c
mov edx, dword [ebp - 4]
call fcn.004053c4
lea ecx, [ebp - 0x1bc]
mov edx, 0x4780f8
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x1bc]
mov eax, 0x482980
call fcn.00405108
cmp dword [ebp - 4], 0
je 0x4777b9
mov eax, dword [0x482980]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x47778a
mov eax, dword [ebp - 0x28]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x1c0]
push eax
mov ecx, dword [ebp - 0x28]
sub ecx, 2
mov edx, 3
mov eax, dword [0x482980]
call fcn.004055d8
mov ecx, dword [ebp - 0x1c0]
mov eax, 0x482980
mov edx, dword [ebp - 4]
call fcn.004053c4
lea ecx, [ebp - 0x1c4]
mov edx, 0x478110
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x1c4]
mov eax, 0x482984
call fcn.00405108
cmp dword [ebp - 4], 0
je 0x477835
mov eax, dword [0x482984]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x477806
mov eax, dword [ebp - 0x2c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1c8]
push eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 2
mov edx, 3
mov eax, dword [0x482984]
call fcn.004055d8
mov ecx, dword [ebp - 0x1c8]
mov eax, 0x482984
mov edx, dword [ebp - 4]
call fcn.004053c4
lea ecx, [ebp - 0x1cc]
mov edx, 0x47812c
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x1cc]
mov eax, 0x482988
call fcn.00405108
cmp dword [ebp - 4], 0
je 0x4778b1
mov eax, dword [0x482988]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x477882
mov eax, dword [ebp - 0x30]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x1d0]
push eax
mov ecx, dword [ebp - 0x30]
sub ecx, 2
mov edx, 3
mov eax, dword [0x482988]
call fcn.004055d8
mov ecx, dword [ebp - 0x1d0]
mov eax, 0x482988
mov edx, dword [ebp - 4]
call fcn.004053c4
mov edx, 0x477f68
mov eax, ebx
call fcn.00425ce4
test al, al
je 0x477b02
lea eax, [ebp - 4]
call fcn.004050b4
lea edx, [ebp - 0x1d4]
mov eax, dword [edi]
call fcn.00408eac
mov eax, dword [ebp - 0x1d4]
push eax
lea edx, [ebp - 0x1d8]
mov eax, dword [ebp - 8]
call fcn.00408eac
mov edx, dword [ebp - 0x1d8]
pop eax
call fcn.004054c4
je 0x477912
lea eax, [ebp - 4]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [edi]
call fcn.004055d8
lea ecx, [ebp - 0x1dc]
mov edx, 0x478148
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x1dc]
mov eax, 0x48298c
call fcn.00405108
mov eax, dword [0x48298c]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
test eax, eax
je 0x47794e
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jl 0x477a0a
lea eax, [ebp - 0x1e4]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [0x48298c]
call fcn.004055d8
mov eax, dword [ebp - 0x1e4]
lea edx, [ebp - 0x1e0]
call fcn.00408eac
mov eax, dword [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x1ec]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004055d8
mov eax, dword [ebp - 0x1ec]
lea edx, [ebp - 0x1e8]
call fcn.00408eac
mov edx, dword [ebp - 0x1e8]
pop eax
call fcn.004054c4
jne 0x477a0a
mov eax, dword [0x48298c]
mov dword [ebp - 0x194], eax
mov edi, dword [ebp - 0x194]
test edi, edi
je 0x4779dc
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x1f0]
push eax
mov ecx, edi
sub ecx, 2
mov edx, 3
mov eax, dword [0x48298c]
call fcn.004055d8
mov ecx, dword [ebp - 0x1f0]
mov eax, 0x48298c
mov edx, dword [ebp - 4]
call fcn.004053c4
lea ecx, [ebp - 0x1f4]
mov edx, 0x478160
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x1f4]
mov eax, 0x482990
call fcn.00405108
mov eax, dword [0x482990]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
test eax, eax
je 0x477a46
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jl 0x477b02
lea eax, [ebp - 0x1fc]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [0x482990]
call fcn.004055d8
mov eax, dword [ebp - 0x1fc]
lea edx, [ebp - 0x1f8]
call fcn.00408eac
mov eax, dword [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x204]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.004055d8
mov eax, dword [ebp - 0x204]
lea edx, [ebp - 0x200]
call fcn.00408eac
mov edx, dword [ebp - 0x200]
pop eax
call fcn.004054c4
jne 0x477b02
mov eax, dword [0x482990]
mov dword [ebp - 0x194], eax
mov edi, dword [ebp - 0x194]
test edi, edi
je 0x477ad4
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x208]
push eax
mov ecx, edi
sub ecx, 2
mov edx, 3
mov eax, dword [0x482990]
call fcn.004055d8
mov ecx, dword [ebp - 0x208]
mov eax, 0x482990
mov edx, dword [ebp - 4]
call fcn.004053c4
lea eax, [ebp - 0x20c]
mov ecx, 0x477d04
mov edx, dword [0x48294c]
call fcn.004053c4
mov eax, dword [ebp - 0x20c]
mov edx, 0x478178
call fcn.0047456c
jmp 0x477ca5
mov edx, 0x478198
mov eax, ebx
call fcn.00425ce4
test al, al
je 0x477c51
lea ecx, [ebp - 0x210]
mov edx, 0x478078
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x210]
mov eax, 0x48296c
call fcn.00405108
lea ecx, [ebp - 0x214]
mov edx, 0x478094
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x214]
mov eax, 0x482970
call fcn.00405108
lea ecx, [ebp - 0x218]
mov edx, 0x4780ac
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x218]
mov eax, 0x482974
call fcn.00405108
lea ecx, [ebp - 0x21c]
mov edx, 0x4780c4
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x21c]
mov eax, 0x482978
call fcn.00405108
lea ecx, [ebp - 0x220]
mov edx, 0x4780dc
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x220]
mov eax, 0x48297c
call fcn.00405108
lea ecx, [ebp - 0x224]
mov edx, 0x4780f8
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x224]
mov eax, 0x482980
call fcn.00405108
lea ecx, [ebp - 0x228]
mov edx, 0x478110
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x228]
mov eax, 0x482984
call fcn.00405108
lea ecx, [ebp - 0x22c]
mov edx, 0x47812c
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x22c]
mov eax, 0x482988
call fcn.00405108
mov edx, 0x4781e4
mov eax, ebx
call fcn.00425ce4
test al, al
je 0x477ca5
lea ecx, [ebp - 0x230]
mov edx, 0x478148
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x230]
mov eax, 0x48298c
call fcn.00405108
lea ecx, [ebp - 0x234]
mov edx, 0x478160
mov eax, ebx
call fcn.0042606c
mov edx, dword [ebp - 0x234]
mov eax, 0x482990
call fcn.00405108
mov eax, esi
call fcn.00404248
mov eax, ebx
call fcn.00404248
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477cf5
lea eax, [ebp - 0x234]
mov edx, 0x28
call fcn.004050d8
lea eax, [ebp - 0x190]
mov edx, 0x18
call fcn.004050d8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004050d8
ret