Function at 0x72d6e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x7451e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x188
push ebx
xor ebx, ebx
push ebp
mov dword [esp + 0x30], ebx
push esi
mov dword [esp + 0xc], ebx
push str.SpellCheckerController
lea ecx, [esp + 0x18]
mov dword [esp + 0x1a0], ebx
call fcn.006c2d50
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x1a4], 1
call sym.MUICoreLib.dll_long_int___cdecl_MNUIHelpers::GetAppService_class_ATL::CStringT_unsigned_short_int__class_ATL::StrTraitATL_unsigned_short_int__class_ATL::ChTraitsCRT_unsigned_short_int____const___struct_IUnknown___
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
or ebp, 0xffffffff
add esp, 8
mov byte [esp + 0x19c], bl
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x72d75e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, ebx
mov dword [esp + 0x10], eax
je 0x72d77f
mov eax, dword [ecx]
lea edx, [esp + 0x10]
push edx
push 0x752168
push ecx
call dword [eax]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0x19c], 2
jne 0x72d7a6
mov eax, dword [0x781690]
mov ecx, 0x781690
call dword [eax + 0xc]
mov esi, dword [esp + 0x1a4]
add eax, 0x10
mov dword [esi], eax
jmp 0x72d7fc
push ebx
push eax
lea ecx, [esp + 0x24]
call fcn.006c4e70
cmp dword [esp + 0x1c], ebx
mov byte [esp + 0x19c], 3
jne 0x72d82e
mov eax, dword [0x781690]
mov ecx, 0x781690
call dword [eax + 0xc]
mov esi, dword [esp + 0x1a4]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov byte [esp + 0x19c], 2
je 0x72d7ee
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x72d7fc
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov byte [esp + 0x19c], 0
je 0x72d812
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0xc]
cmp eax, ebx
mov dword [esp + 0x19c], ebp
je 0x72d827
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, esi
jmp 0x72dbdd
push str.Dictionaries
lea eax, [esp + 0xd8]
push eax
lea ecx, [esp + 0x24]
call fcn.006c33b0
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x1a0], 4
call fcn.006c1b20
mov dword [esp + 0x6c], ebx
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0xec]
push ecx
mov byte [esp + 0x1a0], 6
call esi
lea edx, [esp + 0xdc]
push edx
call esi
mov eax, dword [esp + 0xd4]
cmp eax, ebx
je 0x72d88d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esp + 0x3c], ebx
push edi
je 0x72db3f
lea ecx, [esp + 0x40]
mov dword [esp + 0x3c], ebx
call fcn.006d8660
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], ebx
mov edx, dword [eax]
push eax
call dword [edx + 0x10]
cmp dword [esp + 0x1c], ebx
jle 0x72db3f
mov bl, 0xd
mov edx, dword [esp + 0x3c]
push edx
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x48]
call fcn.00725cf0
push 0
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x1a8], 7
call fcn.006e0140
lea ecx, [esp + 0x180]
push ecx
mov byte [esp + 0x1a4], 9
call esi
lea edx, [esp + 0x170]
push edx
call esi
mov eax, dword [esp + 0x168]
test eax, eax
je 0x72d91b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x72dbf7
push str.LangId
lea edx, [esp + 0x7c]
push edx
lea ecx, [esp + 0x34]
call fcn.006c33b0
mov ecx, eax
mov byte [esp + 0x1a0], 0xa
call fcn.006cbc20
mov ebp, eax
lea eax, [esp + 0x90]
push eax
mov byte [esp + 0x1a4], 9
call esi
lea ecx, [esp + 0x80]
push ecx
call esi
mov eax, dword [esp + 0x78]
test eax, eax
je 0x72d975
mov edx, dword [eax]
push eax
call dword [edx + 8]
push str.LangName
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x34]
call fcn.006c33b0
mov ecx, eax
mov byte [esp + 0x1a0], 0xb
call fcn.006c6560
push eax
lea ecx, [esp + 0x3c]
call fcn.006c2d50
lea ecx, [esp + 0x150]
push ecx
mov byte [esp + 0x1a4], bl
call esi
lea edx, [esp + 0x140]
push edx
call esi
mov eax, dword [esp + 0x138]
test eax, eax
je 0x72d9d0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push str.Type
lea edx, [esp + 0xac]
push edx
lea ecx, [esp + 0x34]
call fcn.006c33b0
mov ecx, eax
mov byte [esp + 0x1a0], 0xe
call fcn.006cbc20
mov edi, eax
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x1a4], bl
call esi
lea ecx, [esp + 0xb0]
push ecx
call esi
mov eax, dword [esp + 0xa8]
test eax, eax
je 0x72da23
mov edx, dword [eax]
push eax
call dword [edx + 8]
push str.Path
lea eax, [esp + 0x10c]
push eax
lea ecx, [esp + 0x34]
call fcn.006c33b0
mov ecx, eax
mov byte [esp + 0x1a0], 0xf
call fcn.006c6560
push eax
lea ecx, [esp + 0x1c]
call fcn.006c2d50
lea ecx, [esp + 0x120]
push ecx
mov byte [esp + 0x1a4], 0x11
call esi
lea edx, [esp + 0x110]
push edx
call esi
mov eax, dword [esp + 0x108]
test eax, eax
je 0x72da7f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
movsx edx, word [esp + 0x1ac]
cmp ebp, edx
jne 0x72da98
cmp dword [esp + 0x1b0], edi
je 0x72dc12
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x1a0], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x72dabd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
mov byte [esp + 0x1a0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x72dae3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x30]
test eax, eax
mov byte [esp + 0x1a0], 6
je 0x72daf9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x72db07
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov edi, dword [esp + 0x3c]
inc edi
lea ecx, [esp + 0x40]
mov dword [esp + 0x3c], edi
call fcn.006d8660
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
cmp edi, dword [esp + 0x1c]
jl 0x72d8c4
or ebp, 0xffffffff
xor ebx, ebx
mov edx, dword [0x781690]
mov ecx, 0x781690
call dword [edx + 0xc]
mov edi, dword [esp + 0x1a8]
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x70]
cmp eax, ebx
mov byte [esp + 0x1a0], 3
je 0x72db6f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [esp + 0x58]
push edx
call esi
lea eax, [esp + 0x48]
push eax
call esi
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x72db8b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov byte [esp + 0x1a0], 2
je 0x72dba1
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x72dbaf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov byte [esp + 0x1a0], 0
je 0x72dbc5
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1a0], ebp
cmp eax, ebx
je 0x72dbda
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
pop edi
mov ecx, dword [esp + 0x194]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x194
ret 0xc
mov eax, dword [0x781690]
mov ecx, 0x781690
call dword [eax + 0xc]
mov edi, dword [esp + 0x1a8]
add eax, 0x10
mov dword [edi], eax
jmp 0x72dc79
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
push eax
call fcn.006c3180
mov edi, dword [esp + 0x1ac]
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 4
mov byte [esp + 0x1a0], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x72dc53
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
mov byte [esp + 0x1a0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x72dc79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x30]
test eax, eax
mov byte [esp + 0x1a0], 6
je 0x72dc8f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x72dc9d
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x70]
test eax, eax
mov byte [esp + 0x1a0], 3
je 0x72dcb3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [esp + 0x58]
push edx
call esi
lea eax, [esp + 0x48]
push eax
call esi
mov eax, dword [esp + 0x40]
test eax, eax
je 0x72dccf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x24]
test eax, eax
mov byte [esp + 0x1a0], 2
je 0x72dce5
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x72dcf3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
test eax, eax
mov byte [esp + 0x1a0], 0
je 0x72dd09
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1a0], 0xffffffff
test eax, eax
jmp 0x72dbd2