Function at 0x47c370
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get session user name
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x609b1d
mov eax, dword fs:[0]
push eax
sub esp, 0x964
mov eax, dword [0x6687b8]
xor eax, esp
mov dword [esp + 0x960], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6687b8]
xor eax, esp
push eax
lea eax, [esp + 0x978]
mov dword fs:[0], eax
mov eax, dword [esp + 0x98c]
mov ebp, dword [esp + 0x988]
xor ebx, ebx
push 0x20a
lea ecx, [esp + 0x35a]
push ebx
push ecx
mov dword [esp + 0x60], eax
mov word [esp + 0x360], bx
call fcn.005da970
add esp, 0xc
push str.SOFTWARETencentRTXC
lea esi, [esp + 0x358]
mov edi, str.INSTDIR
call fcn.00479730
add esp, 4
test eax, eax
je 0x47cef6
lea edx, [esp + 0x34]
push edx
mov ecx, 0x6244e0
call fcn.00409dd0
mov eax, esi
push eax
push str._sAccounts
lea edi, [esp + 0x3c]
mov dword [esp + 0x988], ebx
call fcn.0040ac80
mov edx, dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esp, 8
lea ecx, [esp + 0x104]
push ecx
push edx
call esi
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push eax
mov ecx, 0x6244e0
mov dword [esp + 0x28], ebx
call fcn.00409dd0
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x984], 1
mov ecx, 0x6244e0
mov dword [esp + 0x84], 0x100
call fcn.00409dd0
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x778]
push eax
mov byte [esp + 0x988], 2
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x47c4a8
lea edx, [esp + 0x774]
lea edi, [esp + 0x30]
call fcn.00403760
mov ecx, dword [esp + 0x30]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x47c540
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x134]
call fcn.00409dd0
mov byte [esp + 0x980], 3
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esp + 0x358]
push ecx
push str._sAccounts_sRTXProfile.xml
lea edi, [esp + 0x28]
call fcn.0040ac80
mov edx, dword [esp + 0x28]
add esp, 0xc
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47c518
lea edi, [ebp + 0x14b4]
lea eax, [esp + 0x1c]
call fcn.0040ab90
mov dword [esp + 0x24], 1
mov ebx, dword [esp + 0x24]
mov byte [esp + 0x980], 2
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47c540
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x47c64c
test ebx, ebx
jne 0x47c95f
lea ecx, [esp + 0x104]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x47c654
lea esp, [esp]
test byte [esp + 0x104], 0x10
je 0x47c602
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x134]
call fcn.00409dd0
mov byte [esp + 0x980], 4
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x358]
push ecx
push str._sAccounts_sRTXProfile.xml
lea edi, [esp + 0x28]
call fcn.0040ac80
lea edx, [esp + 0x24]
add esp, 0xc
push edx
mov ecx, 0x62693c
call fcn.00422360
add esp, 4
test al, al
je 0x47c5da
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47c61f
mov byte [esp + 0x980], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47c602
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x104]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x47c570
jmp 0x47c654
lea edi, [ebp + 0x14b4]
lea eax, [esp + 0x1c]
call fcn.0040ab90
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 1
mov byte [esp + 0x980], 2
call fcn.00403870
jmp 0x47c95f
test ebx, ebx
jne 0x47c95f
push 0x20a
lea eax, [esp + 0x56a]
push 0
push eax
mov word [esp + 0x570], 0
call fcn.005da970
add esp, 0xc
push 0
push 5
lea ecx, [esp + 0x56c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x358]
call fcn.00409dd0
mov byte [esp + 0x980], 5
mov eax, dword [esp + 0x18]
mov eax, dword [eax - 0xc]
add eax, 0xffffffff
lea ecx, [esp + 0x28]
lea edx, [esp + 0x18]
call fcn.0041a270
lea edi, [esp + 0x18]
mov byte [esp + 0x980], 6
call fcn.0040ab90
mov byte [esp + 0x980], 5
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47c6f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x6244e0
push 0x62ac30
lea ecx, [esp + 0x20]
push ecx
call fcn.00427850
push 0x628e5c
push 0x62454c
lea edx, [esp + 0x20]
push edx
call fcn.00427850
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x568]
push ecx
push str._sRTXC_File_List_sAccounts
lea edi, [esp + 0x40]
call fcn.0040ac80
mov edx, dword [esp + 0x2c]
add esp, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x30]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x47c7dc
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x134]
call fcn.00409dd0
mov byte [esp + 0x980], 7
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x56c]
push ecx
push str._sRTXC_File_List_sAccounts_sRTXProfile.xml
lea edi, [esp + 0x2c]
call fcn.0040ac80
mov edx, dword [esp + 0x2c]
add esp, 0x10
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47c7b4
lea edi, [ebp + 0x14b4]
lea eax, [esp + 0x1c]
call fcn.0040ab90
mov dword [esp + 0x24], 1
mov byte [esp + 0x980], 5
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47c7dc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x104]
push ecx
push edx
call esi
lea ecx, [esp + 0x104]
push ecx
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x47c937
mov esi, dword [esp + 0x24]
mov bl, 8
lea esp, [esp]
test esi, esi
jne 0x47c937
test byte [esp + 0x104], 0x10
je 0x47c8db
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x134]
call fcn.00409dd0
mov byte [esp + 0x980], bl
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x56c]
push edx
push str._sRTXC_File_List_sAccounts_sRTXProfile.xml
lea edi, [esp + 0x2c]
call fcn.0040ac80
mov eax, dword [esp + 0x24]
add esp, 0x10
mov ecx, 0x62693c
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x47c896
test dx, dx
je 0x47c892
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x47c896
add eax, 4
add ecx, 4
test dx, dx
jne 0x47c870
xor eax, eax
jmp 0x47c89b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x47c8b3
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47c8f8
mov byte [esp + 0x980], 5
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47c8db
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x104]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x47c810
jmp 0x47c937
lea edi, [ebp + 0x14b4]
lea eax, [esp + 0x1c]
call fcn.0040ab90
mov byte [esp + 0x980], 5
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x24], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47c937
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 2
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47c95f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea edi, [esp + 0x20]
call fcn.0047ac70
mov byte [esp + 0x980], 9
mov esi, dword [esp + 0x20]
mov eax, dword [esi - 0xc]
test eax, eax
jle 0x47c9ae
lea ecx, [eax - 1]
test ecx, ecx
jl 0x47cace
cmp ecx, eax
jg 0x47cace
movzx eax, word [esi + ecx*2]
cmp ax, 0x5c
je 0x47c9ae
push 0x5c
call fcn.0040af90
mov esi, dword [esp + 0x20]
mov dword [esp + 0x38], 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x2c]
push eax
mov ebx, str.nick.dat
mov byte [esp + 0x988], 0xa
call fcn.0040aab0
mov ecx, dword [eax]
add esp, 8
push 1
lea edx, [esp + 0x3c]
push edx
mov edx, 2
lea eax, [edx - 1]
call fcn.0050e580
mov edi, eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov dword [esp + 0x2c], edi
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47ca11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
jge 0x47cad8
mov eax, dword [esp + 0x38]
test eax, eax
je 0x47ca28
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
mov byte [esp + 0x980], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47ca4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 1
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47ca74
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47ca9c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x980], 0xffffffff
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47cac7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x47d39a
push 0x80070057
call fcn.00403650
mov edx, dword [0x677600]
mov eax, dword [edx + 0xc]
mov ecx, 0x677600
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x980], 0xb
cmp dword [esp + 0x24], 0
je 0x47ce1e
lea ecx, [esp + 0x84]
call fcn.005ce210
push 0
lea ecx, [esp + 0x88]
mov byte [esp + 0x984], 0xc
mov eax, dword [esp + 0x20]
push ecx
call fcn.004405f0
test al, al
je 0x47cdde
lea ecx, [esp + 0x84]
call fcn.005cd730
push str.Root
mov ecx, eax
call fcn.005cd6c0
test eax, eax
je 0x47cdde
mov ecx, eax
call fcn.005cd690
test eax, eax
mov dword [esp + 0x14], eax
je 0x47cdc0
jmp 0x47cb70
mov edx, dword [0x677600]
mov eax, dword [edx + 0xc]
mov ecx, 0x677600
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov byte [esp + 0x980], 0xd
mov ecx, dword [esp + 0x14]
push str.NAME
call fcn.005cdf40
push eax
lea ecx, [esp + 0xd0]
call fcn.00401ca0
mov byte [esp + 0x980], 0xe
cmp dword [esp + 0xe4], 0x10
mov ebx, dword [esp + 0xd0]
jae 0x47cbca
lea ebx, [esp + 0xd0]
lea eax, [esp + 0x24]
call fcn.004173d0
mov esi, dword [esp + 0x24]
push esi
lea eax, [ebp + 0x14d8]
push eax
call fcn.00472e70
cmp dword [esi - 0xc], 0
je 0x47cd52
mov ecx, dword [esp + 0x14]
push str.NICK
call fcn.005cdf40
push eax
lea ecx, [esp + 0xec]
call fcn.00401ca0
mov byte [esp + 0x980], 0xf
mov ecx, dword [esp + 0xec]
mov ebx, 0x10
cmp dword [esp + 0x100], ebx
jae 0x47cc2d
lea ecx, [esp + 0xec]
lea edx, [esp + 0x28]
push edx
call fcn.00426330
lea eax, [esp + 0x40]
push eax
mov ecx, 0x62ab30
mov byte [esp + 0x984], bl
call fcn.00426330
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x6c]
push edx
lea ebx, [esp + 0x2c]
mov byte [esp + 0x988], 0x11
call fcn.0041eb50
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x88]
push edx
mov ebx, eax
mov byte [esp + 0x990], 0x12
call fcn.0041eb50
add esp, 0x10
lea edi, [esp + 0x18]
mov byte [esp + 0x980], 0x13
call fcn.0040ab90
mov byte [esp + 0x980], 0x12
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47ccc0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 0x11
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47cce8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 0x10
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47cd10
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 0xf
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47cd38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x38]
push ecx
call fcn.0040aff0
lea ecx, [esp + 0xe8]
call fcn.00401ce0
cmp dword [esp + 0xe4], 0x10
jb 0x47cd6c
mov edx, dword [esp + 0xd0]
push edx
call fcn.005d2367
add esp, 4
xor ebx, ebx
lea eax, [esi - 0x10]
mov dword [esp + 0xe4], 0xf
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
mov byte [esp + 0x980], 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47cdab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
call fcn.005cd700
cmp eax, ebx
mov dword [esp + 0x14], eax
jne 0x47cb70
cmp dword [esp + 0x2c], 0
jne 0x47cdde
mov edi, dword [esp + 0x38]
test edi, edi
je 0x47cde2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov dword [esp + 0x38], edi
jmp 0x47cde2
mov edi, dword [esp + 0x38]
mov byte [esp + 0x980], 0xb
mov eax, dword [esp + 0xb8]
cmp eax, 0x677580
mov dword [esp + 0x84], vtable.TiXmlDocument.0
je 0x47ce0c
push eax
call fcn.005d28c2
add esp, 4
lea ecx, [esp + 0x84]
call fcn.005cddb0
mov esi, dword [esp + 0x20]
jmp 0x47ce22
mov edi, dword [esp + 0x38]
mov byte [esp + 0x980], 0xa
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47ce4a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test edi, edi
je 0x47ce55
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi - 0x10]
mov byte [esp + 0x980], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47ce79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 1
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47cea1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x980], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47cec9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x980], 0xffffffff
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47cef4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor ebx, ebx
mov edx, dword [ebp + 0x14bc]
push ebp
mov ecx, 0x62ab34
call fcn.0047dbd0
lea ecx, [ebp + 0x1550]
push ecx
call fcn.00517380
cmp eax, ebx
jge 0x47cf2f
mov edx, dword [esp + 0x54]
mov byte [ebp + 0x14b8], 1
mov dword [edx], 1
xor eax, eax
jmp 0x47d39a
push ebx
push 1
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x11b
call fcn.00487410
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x980], 0x14
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov byte [esp + 0x980], 0x16
xor esi, esi
cmp dword [ebp + 0x14dc], ebx
mov dword [esp + 0x14], esi
jbe 0x47d0c2
cmp esi, dword [ebp + 0x14dc]
jae 0x47cace
mov eax, dword [ebp + 0x14d8]
lea edi, [esi*4]
add eax, edi
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x30], esp
mov ebx, esp
call fcn.0040a210
add eax, 0x10
mov dword [ebx], eax
call fcn.0047e170
test eax, eax
je 0x47d004
cmp esi, dword [ebp + 0x14dc]
jae 0x47cace
mov eax, dword [ebp + 0x14d8]
add eax, edi
mov eax, dword [eax]
cmp dword [eax - 0xc], 3
jl 0x47d004
cmp esi, dword [ebp + 0x14dc]
jae 0x47cace
mov ebx, dword [ebp + 0x14d8]
add ebx, edi
lea esi, [esp + 0x6c]
call fcn.00427a70
jmp 0x47d0a9
cmp esi, dword [ebp + 0x14dc]
jae 0x47cace
mov eax, dword [ebp + 0x14d8]
add eax, edi
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x30], esp
mov ebx, esp
call fcn.0040a210
add eax, 0x10
mov dword [ebx], eax
call fcn.0047e260
test eax, eax
je 0x47d0ad
cmp esi, dword [ebp + 0x14dc]
jae 0x47cace
mov eax, dword [ebp + 0x14d8]
mov ecx, dword [eax + edi]
add eax, edi
cmp dword [ecx - 0xc], 2
jl 0x47d0ad
cmp esi, dword [ebp + 0x14dc]
jae 0x47cace
mov ebx, dword [ebp + 0x14d8]
add ebx, edi
lea esi, [esp + 0x44]
call fcn.00427a70
mov edx, dword [esp + 0x14]
mov eax, 1
add dword [ebp + 0x14c8], eax
add dword [ebp + 0x14d0], eax
cmp edx, dword [ebp + 0x14dc]
jae 0x47cace
mov eax, dword [ebp + 0x14d8]
add eax, edi
mov eax, dword [eax]
push eax
lea eax, [ebp + 0x1510]
push eax
call fcn.00472e70
mov esi, dword [esp + 0x14]
add esi, 1
cmp esi, dword [ebp + 0x14dc]
mov dword [esp + 0x14], esi
jb 0x47cf98
xor ebx, ebx
xor esi, esi
cmp dword [ebp + 0x14ec], ebx
mov dword [esp + 0x14], esi
jbe 0x47d20b
cmp esi, dword [ebp + 0x14ec]
jae 0x47cace
mov eax, dword [ebp + 0x14e8]
lea edi, [esi*4]
add eax, edi
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x30], esp
mov ebx, esp
call fcn.0040a210
add eax, 0x10
mov dword [ebx], eax
call fcn.0047e170
test eax, eax
je 0x47d14d
cmp esi, dword [ebp + 0x14ec]
jae 0x47cace
mov eax, dword [ebp + 0x14e8]
mov ecx, dword [eax + edi]
add eax, edi
cmp dword [ecx - 0xc], 3
jl 0x47d14d
cmp esi, dword [ebp + 0x14ec]
jae 0x47cace
mov ebx, dword [ebp + 0x14e8]
add ebx, edi
lea esi, [esp + 0x58]
call fcn.00427a70
jmp 0x47d1f2
cmp esi, dword [ebp + 0x14ec]
jae 0x47cace
mov eax, dword [ebp + 0x14e8]
add eax, edi
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x30], esp
mov ebx, esp
call fcn.0040a210
add eax, 0x10
mov dword [ebx], eax
call fcn.0047e260
test eax, eax
je 0x47d1f6
cmp esi, dword [ebp + 0x14ec]
jae 0x47cace
mov eax, dword [ebp + 0x14e8]
mov edx, dword [eax + edi]
add eax, edi
cmp dword [edx - 0xc], 2
jl 0x47d1f6
cmp esi, dword [ebp + 0x14ec]
jae 0x47cace
mov ebx, dword [ebp + 0x14e8]
add ebx, edi
lea esi, [esp + 0x44]
call fcn.00427a70
mov eax, 1
add dword [ebp + 0x14cc], eax
add dword [ebp + 0x14d0], eax
mov eax, dword [esp + 0x14]
cmp eax, dword [ebp + 0x14ec]
jae 0x47cace
mov eax, dword [ebp + 0x14e8]
add eax, edi
mov eax, dword [eax]
push eax
lea ecx, [ebp + 0x1520]
push ecx
call fcn.00472e70
mov esi, dword [esp + 0x14]
add esi, 1
cmp esi, dword [ebp + 0x14ec]
mov dword [esp + 0x14], esi
jb 0x47d0e0
xor ebx, ebx
push ebx
push ebp
lea ecx, [esp + 0x74]
call fcn.0047d3d0
mov esi, 1
push esi
push ebp
lea ecx, [esp + 0x60]
call fcn.0047d3d0
lea ecx, [esp + 0x44]
call fcn.0047d550
cmp dword [0x671f10], ebx
je 0x47d278
test byte [0x6809d0], 1
jne 0x47d26d
or dword [0x6809d0], esi
cmp dword [0x678ec4], ebx
jne 0x47d260
cmp dword [0x678ec8], ebx
jne 0x47d260
mov dword [0x678ec4], 0x6790b8
push 0x6131e0
call fcn.005d268a
add esp, 4
mov eax, dword [0x678ec4]
add dword [eax + 0xc34], esi
mov edx, dword [esp + 0x54]
mov byte [ebp + 0x14b8], 1
mov byte [ebp + 0x14b9], 1
mov dword [ebp + 0x14bc], 0x64
mov dword [edx], esi
mov byte [esp + 0x980], 0x15
mov esi, dword [esp + 0x48]
cmp esi, ebx
je 0x47d2e2
mov eax, dword [esp + 0x4c]
cmp esi, eax
mov edi, eax
je 0x47d2d9
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47d2ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
cmp esi, edi
jne 0x47d2b0
mov esi, dword [esp + 0x48]
push esi
call fcn.005d2367
add esp, 4
mov byte [esp + 0x980], 0x14
mov esi, dword [esp + 0x5c]
cmp esi, ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
je 0x47d33a
mov eax, dword [esp + 0x60]
cmp esi, eax
mov edi, eax
je 0x47d331
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47d326
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
cmp esi, edi
jne 0x47d308
mov esi, dword [esp + 0x5c]
push esi
call fcn.005d2367
add esp, 4
mov dword [esp + 0x980], 0xffffffff
mov esi, dword [esp + 0x70]
cmp esi, ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
je 0x47d395
mov eax, dword [esp + 0x74]
cmp esi, eax
mov edi, eax
je 0x47d38c
mov eax, dword [esi]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47d381
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add esi, 4
cmp esi, edi
jne 0x47d363
mov esi, dword [esp + 0x70]
push esi
call fcn.005d2367
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x978]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x960]
xor ecx, esp
call fcn.005d28b3
add esp, 0x970
ret 8