Function at 0x473ea0
Capabilities:
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4eb158
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
push 2
mov dword [esp + 0x40], esi
mov dword [esp + 0x64], edi
call fcn.00449130
add esp, 4
cmp eax, edi
mov dword [esp + 0x60], eax
je 0x473edd
mov word [eax], di
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], edi
lea eax, [esp + 0x7c]
push eax
mov dword [esp + 0x78], edi
call fcn.00443850
push 2
call fcn.00449130
add esp, 8
cmp eax, edi
mov dword [esp + 0x24], eax
je 0x473f08
mov word [eax], di
push 2
call fcn.00449130
add esp, 4
cmp eax, edi
mov dword [esp + 0x1c], eax
je 0x473f1d
mov word [eax], di
push 2
call fcn.00449130
add esp, 4
cmp eax, edi
mov dword [esp + 0x28], eax
je 0x473f32
mov word [eax], di
push 2
call fcn.00449130
add esp, 4
cmp eax, edi
mov dword [esp + 0x18], eax
je 0x473f47
mov word [eax], di
mov ecx, dword [esp + 0x7c]
push 1
push 0x2c
lea edx, [esp + 0x40]
mov dword [esp + 0x40], ecx
push edx
lea ecx, [esp + 0x6c]
mov byte [esp + 0x80], 4
call fcn.00459430
push edi
lea ecx, [esp + 0x28]
push ecx
push eax
call fcn.0044c770
mov edx, dword [esp + 0x30]
xor eax, eax
mov ax, word [edx]
add esp, 0xc
xor esi, esi
cmp ax, di
mov byte [esp + 0x13], 0
mov byte [esp + 0x16], 0
mov ecx, edx
je 0x473fbe
cmp ax, 9
jb 0x473fa0
cmp ax, 0xd
jbe 0x473fa6
cmp ax, 0x20
jne 0x473fa8
mov esi, ecx
mov ax, word [ecx + 2]
add ecx, 2
cmp ax, di
jne 0x473f94
cmp esi, edi
je 0x473fbe
mov word [esi], di
add esi, 2
cmp esi, edi
mov ecx, edx
je 0x474046
cmp word [edx], 0x2a
jne 0x474046
mov edi, edi
cmp word [ecx + 2], 0x2d
je 0x474046
mov eax, ecx
mov edx, str.nobom
mov edi, 5
movzx ebx, word [eax]
movsx ebp, byte [edx]
or ebx, 0x20
or ebp, 0x20
add eax, 2
inc edx
cmp ebp, ebx
jne 0x474247
dec edi
jns 0x473fe3
mov ax, word [eax]
cmp ax, 9
jb 0x47400d
cmp ax, 0xd
jbe 0x47401c
cmp ax, 0x20
je 0x47401c
test ax, ax
jne 0x474247
add ecx, 0xc
je 0x47403b
mov ax, word [ecx]
cmp ax, 9
jb 0x474030
cmp ax, 0xd
jbe 0x474036
cmp ax, 0x20
jne 0x47403b
add ecx, 2
jmp 0x474021
mov byte [esp + 0x16], 1
cmp word [ecx], 0x2a
je 0x473fd0
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
xor bl, bl
test esi, esi
mov byte [esp + 0x15], 0
mov byte [esp + 0x11], bl
mov byte [esp + 0x17], bl
mov byte [esp + 0x10], bl
mov byte [esp + 0x12], bl
mov byte [esp + 0x14], bl
je 0x4740ae
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
lea edx, [edi + 2]
push edx
call fcn.00449130
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x28]
add esp, 4
test ecx, ecx
mov dword [esp + 0x24], eax
je 0x4740ae
mov eax, dword [0x51d3c8]
add ecx, 0xfffffff8
push ecx
push 0
push eax
call ebp
mov eax, dword [esp + 0x38]
cmp word [eax], 0x2c
lea ecx, [eax + 2]
mov dword [esp + 0x5c], ecx
jne 0x4741bf
push 1
mov edx, ecx
push 0x2c
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x44], edx
call fcn.00459430
mov ecx, dword [eax]
cmp word [ecx], 0
mov esi, ecx
je 0x4740f8
mov ecx, dword [eax]
cmp word [ecx], 0
je 0x4740f8
add ecx, 2
mov dword [eax], ecx
cmp word [ecx], 0
jne 0x4740e5
mov ebx, dword [eax]
sub ebx, esi
sar ebx, 1
lea edi, [ebx + 1]
test edi, edi
jge 0x47410e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov edx, dword [esp + 0x1c]
lea eax, [edi + edi + 4]
push edx
call fcn.00449190
add esp, 4
test eax, eax
mov dword [esp + 0x1c], eax
je 0x47412e
mov word [eax + edi*2 + 2], 0
lea eax, [edi + edi]
mov edi, dword [esp + 0x1c]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
mov word [eax + ecx], 0
mov eax, dword [esp + 0x38]
mov word [ecx + ebx*2], 0
cmp word [eax], 0x2c
mov bl, byte [esp + 0x11]
jne 0x4741bf
add eax, 2
push 1
mov dword [esp + 0x3c], eax
push 0x2c
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x6c]
call fcn.00459430
push 0
lea ecx, [esp + 0x2c]
push ecx
push eax
call fcn.0044c770
mov eax, dword [esp + 0x44]
add esp, 0xc
cmp word [eax], 0x2c
jne 0x4741bf
push 1
push 0x2c
lea edx, [esp + 0x40]
add eax, 2
push edx
lea ecx, [esp + 0x6c]
mov dword [esp + 0x44], eax
call fcn.00459430
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.0044c770
add esp, 0xc
mov edi, dword [esp + 0x24]
mov ax, word [edi]
test ax, ax
mov esi, dword [esp + 0x1c]
je 0x474f0e
cmp word [esi], 0
je 0x474f0e
mov edx, dword [esp + 0x28]
cmp word [edx], 0
je 0x474f0e
mov ecx, dword [esp + 0x18]
cmp word [ecx], 0
je 0x474f0e
mov esi, dword [esp + 0x24]
xor ecx, ecx
cmp ax, 0x2a
mov dword [esp + 0x34], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x48], ecx
mov edi, edx
mov byte [esp + 0x11], cl
jne 0x47430f
cmp word [esi + 2], ax
jne 0x4742fe
mov al, byte [esi]
mov byte [esp + 0x17], al
add esi, 4
jmp 0x474309
mov eax, ecx
mov edx, str.transonly
mov edi, 9
movzx ebx, word [eax]
movsx ebp, byte [edx]
or ebx, 0x20
or ebp, 0x20
add eax, 2
inc edx
cmp ebp, ebx
jne 0x4742b4
dec edi
jns 0x474253
mov ax, word [eax]
cmp ax, 9
jb 0x474279
cmp ax, 0xd
jbe 0x474284
cmp ax, 0x20
je 0x474284
test ax, ax
jne 0x4742b4
add ecx, 0x14
je 0x4742aa
lea esp, [esp]
mov ax, word [ecx]
cmp ax, 9
jb 0x47429f
cmp ax, 0xd
jbe 0x4742a5
cmp ax, 0x20
jne 0x4742aa
add ecx, 2
jmp 0x474290
mov byte [esp + 0x13], 1
jmp 0x474040
mov ax, word [ecx]
test ax, ax
je 0x4742e0
lea esp, [esp]
cmp ax, 9
jb 0x4742cc
cmp ax, 0xd
jbe 0x4742e0
cmp ax, 0x20
je 0x4742e0
mov ax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x4742c0
mov edi, edi
mov ax, word [ecx]
cmp ax, 9
jb 0x4742ef
cmp ax, 0xd
jbe 0x4742f9
cmp ax, 0x20
jne 0x474040
add ecx, 2
jmp 0x4742e0
cmp ax, 0x2a
jne 0x47430f
mov al, byte [esi]
add esi, 2
mov byte [esp + 0x15], al
mov bl, al
cmp word [esi], 0x2d
jne 0x47431a
mov bl, byte [esi]
add esi, 2
test bl, bl
jne 0x47439d
mov edx, dword [esp + 0x18]
mov eax, dword [0x51d3c8]
add edx, 0xfffffff8
push edx
push 0
push eax
call ebp
mov ecx, dword [esp + 0x28]
mov edx, dword [0x51d3c8]
add ecx, 0xfffffff8
push ecx
push 0
push edx
call ebp
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call ebp
mov edx, dword [esp + 0x24]
mov eax, dword [0x51d3c8]
add edx, 0xfffffff8
push edx
push 0
push eax
call ebp
mov eax, dword [esp + 0x60]
test eax, eax
je 0x474383
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call ebp
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
push esi
push 0x4fa574
call fcn.00444a10
add esp, 8
test al, al
mov ebx, 0x4b0
mov ebp, 0x4b1
je 0x4743c3
mov byte [esp + 0x11], 1
jmp 0x4744f6
push esi
push str.ANSI
call fcn.00444a10
add esp, 8
test al, al
je 0x4743e2
mov dword [esp + 0x34], 0
jmp 0x4744f6
push esi
push 0x4fa570
call fcn.00444a10
add esp, 8
test al, al
je 0x474401
mov dword [esp + 0x34], 0x3a8
jmp 0x4744f6
push esi
push str.BIG5
call fcn.00444a10
add esp, 8
test al, al
je 0x474420
mov dword [esp + 0x34], 0x3b6
jmp 0x4744f6
push esi
push str.UTF8
call fcn.00444a10
add esp, 8
test al, al
je 0x47443f
mov dword [esp + 0x34], 0xfde9
jmp 0x4744f6
push esi
push str.UTF7
call fcn.00444a10
add esp, 8
test al, al
je 0x47445e
mov dword [esp + 0x34], 0xfde8
jmp 0x4744f6
push esi
push str.UNICODE
call fcn.00444a10
add esp, 8
test al, al
je 0x474479
mov dword [esp + 0x30], ebx
jmp 0x4744f6
push esi
push 0x4f42e0
call fcn.00444a10
add esp, 8
test al, al
je 0x474491
mov dword [esp + 0x30], ebx
jmp 0x4744f6
push esi
push str.UNICODEB
call fcn.00444a10
add esp, 8
test al, al
je 0x4744a9
mov dword [esp + 0x30], ebp
jmp 0x4744f6
push esi
push str.UNIB
call fcn.00444a10
add esp, 8
test al, al
je 0x4744c1
mov dword [esp + 0x30], ebp
jmp 0x4744f6
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.0043af40
test al, al
je 0x4744e0
push esi
call fcn.0044a460
add esp, 4
mov dword [esp + 0x34], eax
jmp 0x4744f6
test cx, cx
jne 0x474ec7
mov eax, 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x58], eax
mov ecx, dword [esp + 0x28]
mov ax, word [ecx]
cmp ax, 0x2a
jne 0x474525
cmp word [ecx + 2], ax
jne 0x474512
mov byte [esp + 0x14], al
lea edi, [ecx + 4]
jmp 0x47451d
cmp ax, 0x2a
jne 0x474525
mov al, byte [ecx]
lea edi, [ecx + 2]
mov byte [esp + 0x10], al
mov byte [esp + 0x12], al
cmp word [edi], 0x2d
mov ebp, 2
jne 0x474538
mov dl, byte [edi]
mov byte [esp + 0x12], dl
add edi, ebp
mov al, byte [esp + 0x12]
test al, al
je 0x474ec7
push edi
push str.ANSI
call fcn.00444a10
add esp, 8
test al, al
mov esi, 0x4f7ae0
mov ebx, 0x4f7ae4
je 0x47456d
mov dword [esp + 0x44], 0
jmp 0x4746c4
push edi
push 0x4fa570
call fcn.00444a10
add esp, 8
test al, al
je 0x47458c
mov dword [esp + 0x44], 0x3a8
jmp 0x4746c4
push edi
push str.BIG5
call fcn.00444a10
add esp, 8
test al, al
je 0x4745ab
mov dword [esp + 0x44], 0x3b6
jmp 0x4746c4
push edi
push str.UTF8
call fcn.00444a10
add esp, 8
test al, al
je 0x4745da
mov dword [esp + 0x44], 0xfde9
mov dword [esp + 0x48], 0x4f7ae8
mov dword [esp + 0x50], 3
jmp 0x4746c4
push edi
push str.UTF7
call fcn.00444a10
add esp, 8
test al, al
je 0x4745f9
mov dword [esp + 0x44], 0xfde8
jmp 0x4746c4
push edi
push str.UNICODE
call fcn.00444a10
add esp, 8
test al, al
je 0x474620
mov dword [esp + 0x4c], 0x4b0
mov dword [esp + 0x48], esi
mov dword [esp + 0x50], ebp
jmp 0x4746c4
push edi
push 0x4f42e0
call fcn.00444a10
add esp, 8
test al, al
je 0x474647
mov dword [esp + 0x4c], 0x4b0
mov dword [esp + 0x48], esi
mov dword [esp + 0x50], ebp
jmp 0x4746c4
push edi
push str.UNICODEB
call fcn.00444a10
add esp, 8
test al, al
je 0x47466b
mov dword [esp + 0x4c], 0x4b1
mov dword [esp + 0x48], ebx
mov dword [esp + 0x50], ebp
jmp 0x4746c4
push edi
push str.UNIB
call fcn.00444a10
add esp, 8
test al, al
je 0x47468f
mov dword [esp + 0x4c], 0x4b1
mov dword [esp + 0x48], ebx
mov dword [esp + 0x50], ebp
jmp 0x4746c4
xor ecx, ecx
mov cx, word [edi]
mov eax, ecx
call fcn.0043af40
test al, al
je 0x4746ae
push edi
call fcn.0044a460
add esp, 4
mov dword [esp + 0x44], eax
jmp 0x4746c4
test cx, cx
jne 0x474ec7
mov eax, 1
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], eax
mov al, byte [esp + 0x16]
test al, al
je 0x4746d4
mov dword [esp + 0x48], 0
xor ebx, ebx
mov dword [esp + 0x2c], ebx
push ebp
call fcn.00449130
add esp, 4
cmp eax, ebx
mov dword [esp + 0x20], eax
je 0x4746ed
mov byte [eax], bl
mov al, byte [esp + 0x15]
test al, al
mov byte [esp + 0x74], 6
mov byte [esp + 0x12], 0
jne 0x4748bb
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x5c]
push 1
push 0x2c
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x6c]
mov byte [esp + 0x80], 7
mov dword [esp + 0x44], eax
call fcn.00459430
push 0
lea edx, [esp + 0x20]
push edx
push eax
call fcn.0044c770
mov eax, dword [esp + 0x28]
push eax
call fcn.00422077
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 7
push SysReAllocStringLen
push eax
lea ecx, [esp + 0x5c]
call fcn.00417e55
mov esi, dword [esp + 0x40]
test esi, esi
lea ecx, [esp + 0x40]
je 0x4747d5
push 2
push 0
push 0
call fcn.00449070
lea ecx, [esp + 0x40]
call fcn.004490b0
push 0
push 0
push 0
lea ecx, [esp + 0x4c]
mov edi, eax
call fcn.00449070
lea ecx, [edi + 0xa]
push ecx
lea ecx, [esp + 0x24]
call fcn.004492e0
mov ebp, dword [esp + 0x20]
push 0
lea edx, [esp + 0x60]
push edx
push edi
mov byte [ebp + 2], 0
mov byte [ebp + 1], 0
push ebp
mov byte [ebp], 0
push esi
mov dword [esp + 0x70], 0xffffffff
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [esp + 0x5c]
test ebx, ebx
jge 0x4747df
lea ecx, [esp + 0x40]
call fcn.00417e50
jmp 0x474b7a
lea eax, [ebx + ebp]
mov byte [eax + 2], 0
mov byte [eax + 1], 0
mov byte [eax], 0
mov al, byte [esp + 0x11]
xor esi, esi
test al, al
jne 0x474801
cmp dword [esp + 0x30], 0x4b0
jne 0x47482d
mov eax, 2
mov edx, 0x4f7ae0
mov ecx, ebp
call fcn.00449820
test eax, eax
je 0x474825
mov dword [esp + 0x30], 0x4b0
mov esi, 2
jmp 0x47488f
mov al, byte [esp + 0x11]
test al, al
jne 0x474837
cmp dword [esp + 0x30], 0x4b1
jne 0x474863
mov eax, 2
mov edx, 0x4f7ae4
mov ecx, ebp
call fcn.00449820
test eax, eax
je 0x47485b
mov dword [esp + 0x30], 0x4b1
mov esi, 2
jmp 0x47488f
mov al, byte [esp + 0x11]
test al, al
jne 0x47486d
cmp dword [esp + 0x34], 0xfde9
jne 0x4748a2
mov eax, 3
mov edx, 0x4f7ae8
mov ecx, ebp
call fcn.00449820
test eax, eax
je 0x4748a2
mov dword [esp + 0x34], 0xfde9
mov esi, 3
sub edi, esi
add edi, 3
push edi
lea eax, [esi + ebp]
push eax
push ebp
call fcn.004b3b10
add esp, 0xc
sub ebx, esi
jns 0x4748a8
xor ebx, ebx
lea ecx, [esp + 0x40]
mov byte [esp + 0x74], 6
call fcn.00417e50
jmp 0x47499b
mov al, byte [esp + 0x17]
test al, al
je 0x474950
mov esi, dword [esp + 0x3c]
push 0
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.004166b6
mov edx, dword [esp + 0x1c]
push 0xffffffffffffffff
push 0
push edx
mov ecx, esi
call fcn.0041ff6a
mov esi, eax
test esi, esi
lea ecx, [esp + 0x20]
je 0x474939
mov ebx, dword [esi + 0xc]
and ebx, 0x3fffffff
lea eax, [ebx + 8]
push eax
call fcn.004492e0
mov ebp, dword [esp + 0x20]
xor ecx, ecx
lea edx, [ebx + ebp]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov esi, dword [esi + 4]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebx + ebp]
xor ecx, ecx
mov dword [edx], ecx
mov byte [esp + 0x12], 1
mov dword [edx + 4], ecx
jmp 0x47499b
push 8
call fcn.004492e0
mov ebp, dword [esp + 0x20]
lea edx, [ebx + ebp]
xor ecx, ecx
mov dword [edx], ecx
mov dword [edx + 4], ecx
jmp 0x47499b
cmp dword [esp + 0x58], ebx
je 0x47497e
mov esi, dword [esp + 0x1c]
push esi
lea ecx, [esp + 0x24]
call fcn.004566f0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
shl ebx, 1
lea eax, [ebx + 8]
push eax
lea ecx, [esp + 0x24]
call fcn.004492e0
jmp 0x474992
mov ecx, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.0044e460
add esp, 8
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov byte [esp + 0x12], 2
test ebx, ebx
jl 0x474b7a
mov al, byte [esp + 0x11]
test al, al
je 0x474a42
mov al, byte [esp + 0x12]
test al, al
je 0x474a42
mov eax, 2
mov edx, 0x4f7ae0
mov ecx, ebp
xor esi, esi
call fcn.00449820
test eax, eax
je 0x4749e1
mov dword [esp + 0x30], 0x4b0
mov esi, 2
jmp 0x474a27
mov eax, 2
mov edx, 0x4f7ae4
mov ecx, ebp
call fcn.00449820
test eax, eax
je 0x474a05
mov dword [esp + 0x30], 0x4b1
mov esi, 2
jmp 0x474a27
mov eax, 3
mov edx, 0x4f7ae8
mov ecx, ebp
call fcn.00449820
test eax, eax
je 0x474a3c
mov dword [esp + 0x34], 0xfde9
mov esi, 3
mov eax, ebx
sub eax, esi
add eax, 4
push eax
lea ecx, [esi + ebp]
push ecx
push ebp
call fcn.004b3b10
add esp, 0xc
sub ebx, esi
jns 0x474a42
xor ebx, ebx
lea ecx, [esp + 0x38]
mov edi, ebp
mov dword [esp + 0x5c], ebp
call fcn.00449480
mov esi, dword [esp + 0x44]
cmp esi, dword [esp + 0x34]
mov byte [esp + 0x74], 8
jne 0x474b15
mov edx, dword [esp + 0x4c]
cmp edx, dword [esp + 0x30]
jne 0x474b15
mov al, byte [esp + 0x14]
test al, al
je 0x474a9a
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x3c]
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
push ebp
push ecx
push edx
call fcn.0045e250
add esp, 0x18
jmp 0x474e68
mov al, byte [esp + 0x10]
test al, al
jne 0x474ab2
push ebx
push ebp
lea ecx, [esp + 0x34]
call fcn.00443780
jmp 0x474e68
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x474ae1
push ebx
lea eax, [esp + 0x3c]
push ebp
push eax
call fcn.0044e3b0
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x24]
add esp, 0xc
push ecx
mov ecx, dword [esp + 0x40]
push edx
call fcn.00448be0
jmp 0x474e68
mov eax, dword [esp + 0x58]
test eax, eax
je 0x474b01
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov ecx, dword [esp + 0x44]
call fcn.00448be0
jmp 0x474e68
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
push ebp
push edx
call fcn.00448be0
jmp 0x474e68
cmp dword [esp + 0x30], 0x4b1
jne 0x474b34
push ebx
push ebp
mov dword [esp + 0x38], 0x4b0
call fcn.00447900
add esp, 8
and ebx, 0xfffffffe
mov al, byte [esp + 0x10]
test al, al
jne 0x474bbe
mov eax, dword [esp + 0x18]
push eax
call fcn.00422077
add esp, 4
push 0
push 0x80
push 4
push 0
push 7
push 0x40000000
push eax
lea ecx, [esp + 0x48]
call fcn.00417e55
mov eax, dword [esp + 0x2c]
test eax, eax
jne 0x474bbe
lea ecx, [esp + 0x38]
call fcn.00443880
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x2c]
call fcn.00417e50
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x24]
call fcn.00443880
lea ecx, [esp + 0x60]
call fcn.00443880
jmp 0x474f74
mov dword [esp + 0x58], 0
cmp esi, 0x3a8
mov byte [esp + 0x74], 9
jne 0x474bdd
cmp dword [esp + 0x34], 0x3b6
je 0x474bf7
cmp dword [esp + 0x34], 0x3a8
jne 0x474c75
cmp esi, 0x3b6
jne 0x474c75
mov al, byte [esp + 0x13]
test al, al
je 0x474c04
mov byte [esp + 0x13], 3
lea ecx, [esp + 0x40]
call fcn.00449290
xor ecx, ecx
cmp esi, 0x3b6
sete cl
lea edx, [esp + 0x40]
push ecx
push edx
push ebp
call fcn.0044e520
mov eax, ebp
mov ebp, dword [esp + 0x4c]
add esp, 0xc
push ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
cmp byte [esp + 0x13], 3
mov edi, ebp
jne 0x474c6c
mov al, byte [esp + 0x10]
test al, al
jne 0x474c6c
test ebx, ebx
jle 0x474c5e
push ebx
push ebp
lea ecx, [esp + 0x34]
call fcn.00443780
lea ecx, [esp + 0x40]
call fcn.00443880
jmp 0x474e50
lea ecx, [esp + 0x40]
call fcn.00443880
mov eax, dword [esp + 0x30]
mov esi, ebx
shr esi, 1
test eax, eax
jne 0x474cbb
lea esi, [ebx + 0xa]
lea eax, [esi + 0xa]
push eax
lea ecx, [esp + 0x3c]
call fcn.004494e0
mov edi, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push esi
push edi
push ebx
push ebp
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jge 0x474cae
xor esi, esi
lea ebx, [esi + esi]
mov dword [esp + 0x5c], edi
mov word [ebx + edi], 0
mov eax, dword [esp + 0x4c]
cmp eax, 0x4b1
jne 0x474cd2
push ebx
push edi
call fcn.00447900
add esp, 8
jmp 0x474cda
test eax, eax
jle 0x474d82
mov al, byte [esp + 0x14]
test al, al
je 0x474d02
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
push 0
lea edx, [esp + 0x1c]
push edx
push ebx
push edi
push eax
push ecx
call fcn.0045e250
add esp, 0x18
jmp 0x474e5f
mov al, byte [esp + 0x10]
test al, al
jne 0x474d39
test ebx, ebx
jle 0x474e50
mov eax, dword [esp + 0x48]
test eax, eax
je 0x474d29
mov edx, dword [esp + 0x50]
push edx
push eax
lea ecx, [esp + 0x34]
call fcn.00443780
push ebx
push edi
lea ecx, [esp + 0x34]
call fcn.00443780
jmp 0x474e50
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x474d8a
lea ecx, [esp + 0x54]
call fcn.00449480
push esi
lea eax, [esp + 0x58]
push edi
push eax
mov byte [esp + 0x80], 0xa
call fcn.0044e430
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x24]
add esp, 0xc
push ecx
mov ecx, dword [esp + 0x40]
push edx
call fcn.00448be0
lea ecx, [esp + 0x54]
call fcn.00443880
jmp 0x474e50
mov eax, dword [esp + 0x54]
test eax, eax
je 0x474d93
mov eax, dword [esp + 0x5c]
jmp 0x474e41
shr ebx, 1
lea esi, [ebx + ebx*2]
lea esi, [esi + esi + 0xa]
lea edx, [esi + 1]
push edx
lea ecx, [esp + 0x5c]
call fcn.004492e0
mov ebp, dword [esp + 0x58]
mov eax, dword [esp + 0x44]
push 0
push 0
push esi
push ebp
push ebx
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jge 0x474dca
xor esi, esi
mov al, byte [esp + 0x10]
test al, al
mov byte [esi + ebp], 0
jne 0x474e02
test esi, esi
jle 0x474e50
mov eax, dword [esp + 0x48]
test eax, eax
je 0x474df5
mov ecx, dword [esp + 0x50]
push ecx
push eax
lea ecx, [esp + 0x34]
call fcn.00443780
push esi
push ebp
lea ecx, [esp + 0x34]
call fcn.00443780
jmp 0x474e50
mov al, byte [esp + 0x14]
test al, al
je 0x474e2e
push 0
lea edx, [esp + 0x1c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x24]
push ebp
push eax
push ecx
call fcn.0045e250
add esp, 0x18
jmp 0x474e50
push esi
lea edx, [esp + 0x3c]
push ebp
push edx
call fcn.0044e3b0
mov eax, dword [esp + 0x44]
add esp, 0xc
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov ecx, dword [esp + 0x44]
call fcn.00448be0
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x474e5f
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea ecx, [esp + 0x58]
call fcn.00443880
lea ecx, [esp + 0x38]
call fcn.00443880
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x2c]
call fcn.00417e50
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x24]
call fcn.00443880
lea ecx, [esp + 0x60]
call fcn.00443880
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x24]
call fcn.00443880
lea ecx, [esp + 0x60]
call fcn.00443880
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x474f25
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call ebp
mov eax, dword [esp + 0x28]
test eax, eax
je 0x474f3c
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call ebp
test esi, esi
je 0x474f4f
mov edx, dword [0x51d3c8]
add esi, 0xfffffff8
push esi
push 0
push edx
call ebp
mov eax, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push 0
push eax
call ebp
mov eax, dword [esp + 0x60]
test eax, eax
je 0x474f74
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call ebp
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret 8