Function at 0x4324c0
Capabilities:
Persist via windows service
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49f2d0
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x4c13e0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
xor edi, edi
push ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], 4
call fcn.0043d730
push eax
call fcn.0043d860
test eax, eax
jne 0x43252d
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [esi + 0x468]
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, esi
mov dword [esp + 0x60], edi
call fcn.004317f0
mov ebx, 1
cmp dword [0x4c9400], edi
jne 0x43287a
mov byte [esp + 0x13], 0
mov dword [esi + 0x464], ebx
mov dword [esp + 0x14], 0
call fcn.004589d0
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test al, al
jne 0x4325d5
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push str.i18n
push str.SYSTEMCurrentControlSet_services360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x4325ad
push 4
lea edx, [esp + 0x18]
push edx
jmp 0x4325ba
cmp dword [esp + 0x14], ebx
je 0x4325d5
push 4
lea eax, [esp + 0x18]
push eax
push 4
push str.i18n
push str.SYSTEMCurrentControlSet_services360SelfProtection
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.00454df0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push str.AppMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], ebx
call edi
test eax, eax
je 0x432613
push ebx
push esi
mov dword [esp + 0x1c], ebx
call fcn.00433f20
mov byte [esp + 0x13], bl
jmp 0x43262e
cmp dword [esp + 0x14], ebx
jne 0x432626
push ebx
push esi
call fcn.00433f20
mov byte [esp + 0x13], bl
jmp 0x43262e
push 0
push esi
call fcn.00433f20
cmp dword [esp + 0x14], ebx
je 0x43263a
mov dword [0x4c8f74], ebx
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push str.DrvFWAccess2
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x43266f
push ebx
push esi
mov dword [esp + 0x1c], ebx
call fcn.00433bc0
mov byte [esp + 0x13], bl
jmp 0x43268a
cmp dword [esp + 0x14], ebx
jne 0x432682
push ebx
push esi
call fcn.00433bc0
mov byte [esp + 0x13], bl
jmp 0x43268a
push 0
push esi
call fcn.00433bc0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push str.NetMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x4326e4
lea ecx, [esp + 0x20]
push ecx
push str.mode
mov ecx, str.SOFTWARE360TotalSecurityActiveProtection
mov dword [esp + 0x28], 2
call fcn.0042c6f0
add esp, 8
test al, al
jne 0x4326d7
mov dword [esp + 0x14], ebx
jmp 0x4326ea
xor edx, edx
cmp dword [esp + 0x20], ebx
setne dl
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
jne 0x432702
mov ecx, esi
call fcn.00435f40
test al, al
jne 0x432702
push ebx
push esi
call fcn.00434700
mov byte [esp + 0x13], bl
jmp 0x43270a
push 0
push esi
call fcn.00434700
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push str.FileMonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x43273f
push ebx
push esi
mov dword [esp + 0x1c], ebx
call fcn.00434ae0
mov byte [esp + 0x13], bl
jmp 0x43275a
cmp dword [esp + 0x14], ebx
jne 0x432752
push ebx
push esi
call fcn.00434ae0
mov byte [esp + 0x13], bl
jmp 0x43275a
push 0
push esi
call fcn.00434ae0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push str.MonAccess
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x43278f
push ebx
push esi
mov dword [esp + 0x1c], ebx
call fcn.00434f80
mov byte [esp + 0x13], bl
jmp 0x4327aa
cmp dword [esp + 0x14], ebx
jne 0x4327a2
push ebx
push esi
call fcn.00434f80
mov byte [esp + 0x13], bl
jmp 0x4327aa
push 0
push esi
call fcn.00434f80
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x24]
push edx
push str.AVEnable
push str.SOFTWARE360Safe_filemon
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x4327d4
mov dword [esp + 0x14], ebx
jmp 0x4327da
cmp dword [esp + 0x14], ebx
jne 0x4327df
call fcn.0040e750
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x2c]
push eax
push str.AVWriteProtectEnable
mov ecx, str.SOFTWARE360Safe_filemon
call fcn.0042c6f0
lea ecx, [esp + 0x30]
push ecx
push str.AVReadProtectEnable
mov ecx, str.SOFTWARE360Safe_filemon
call fcn.0042c6f0
add esp, 0x10
cmp dword [esp + 0x28], 0
jne 0x432822
cmp dword [esp + 0x2c], 0
je 0x432826
mov byte [esp + 0x13], bl
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
push str.upref
push str.SOFTWARE360Safe_safemon_safecamera
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x432850
mov dword [esp + 0x14], ebx
jmp 0x432856
cmp dword [esp + 0x14], ebx
jne 0x43285e
push esi
mov ecx, ebx
call fcn.00435420
movzx ecx, byte [esp + 0x13]
cmp byte [0x4c8f69], bl
je 0x43287a
push 0xbd3
xor edx, edx
call fcn.00424fa0
add esp, 4
mov eax, dword [0x4c8f78]
add dword [0x4c9400], ebx
mov dword [esp + 0x20], 0
test eax, eax
je 0x4328b4
cmp dword [eax + 0xc], 0
je 0x4328b4
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
mov edx, dword [edx + 0x20]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
push 0x40a
push eax
call edx
cmp dword [esi + 0xc0], 0
mov dword [esp + 0x24], 0x80004005
jne 0x432c83
mov esi, 0x4c9470
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0
mov byte [esp + 0x60], 1
call fcn.0040b920
cmp dword [ebp + 0xc], 0xce
jne 0x432904
mov dword [0x4c8f74], ebx
test eax, eax
jne 0x4329e4
mov byte [esp + 0x60], al
jmp 0x432c90
call fcn.004298b0
lea ecx, [esp + 0x3c]
push ecx
mov dword [esp + 0x34], eax
call fcn.00436940
mov eax, dword [ebp + 8]
lea edx, [esp + 0x3c]
push edx
push 0x77a
add eax, 0x78
push eax
mov byte [esp + 0x6c], 3
call fcn.00409080
mov edi, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
cmp edi, eax
jbe 0x432947
call fcn.00477ad6
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
jmp 0x432950
mov esi, eax
cmp dword [esp + 0x48], eax
jbe 0x43295d
call fcn.00477ad6
test ebx, ebx
je 0x432967
cmp ebx, dword [esp + 0x3c]
je 0x43296c
call fcn.00477ad6
cmp edi, esi
je 0x432c35
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xc0], 0
jne 0x432bfe
test ebx, ebx
jne 0x432bf0
call fcn.00477ad6
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x43299d
call fcn.00477ad6
mov ecx, dword [edi]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x24]
push eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push esi
push eax
push 0x77a
call edx
cmp eax, esi
jne 0x432c1b
cmp ebx, esi
jne 0x432bf7
call fcn.00477ad6
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x4329d8
call fcn.00477ad6
mov eax, dword [esp + 0x4c]
add edi, 4
jmp 0x432950
call fcn.0040bb00
lea eax, [esp + 0x3c]
push eax
call fcn.00436940
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x3c]
push ecx
push 0x77a
add edx, 0x78
push edx
mov byte [esp + 0x6c], 2
call fcn.00409080
mov dword [esp + 0x20], 0x4c8e80
jmp 0x432a20
mov eax, dword [esp + 0x20]
cmp dword [eax], 0
je 0x432b10
cmp dword [esp + 0x30], 0
je 0x432a51
mov eax, dword [0x4c9484]
test eax, eax
je 0x432a49
call eax
push 0x4c9470
call fcn.00429ab0
mov dword [esp + 0x30], 0
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx]
mov esi, 0x4c9470
call fcn.004298b0
mov edi, dword [esp + 0x48]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x4c]
cmp edi, eax
jbe 0x432a7a
call fcn.00477ad6
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov edi, edi
mov esi, eax
cmp dword [esp + 0x48], eax
jbe 0x432a8d
call fcn.00477ad6
test ebx, ebx
je 0x432a97
cmp ebx, dword [esp + 0x3c]
je 0x432a9c
call fcn.00477ad6
cmp edi, esi
je 0x432b10
mov edx, dword [ebp + 8]
cmp dword [edx + 0xc0], 0
jne 0x432b57
test ebx, ebx
jne 0x432b08
call fcn.00477ad6
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x432ac5
call fcn.00477ad6
mov ecx, dword [edi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [esp + 0x24]
push edx
push 0
push 0xce
push 0x77a
call eax
test eax, eax
jne 0x432b9e
test ebx, ebx
jne 0x432b0c
call fcn.00477ad6
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x432afc
call fcn.00477ad6
mov eax, dword [esp + 0x4c]
add edi, 4
jmp 0x432a80
mov eax, dword [ebx]
jmp 0x432abb
mov eax, dword [ebx]
jmp 0x432af2
mov eax, dword [esp + 0x20]
add eax, 4
cmp eax, 0x4c8ebc
mov dword [esp + 0x20], eax
jl 0x432a20
mov eax, dword [esp + 0x48]
test eax, eax
je 0x432b37
push eax
call fcn.00476df2
add esp, 4
mov eax, dword [esp + 0x3c]
xor esi, esi
push eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
call fcn.00476df2
add esp, 4
jmp 0x432c63
mov eax, dword [esp + 0x48]
test eax, eax
je 0x432b68
push eax
call fcn.00476df2
add esp, 4
xor esi, esi
mov ecx, dword [esp + 0x3c]
push ecx
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], esi
call fcn.00476df2
add esp, 4
mov byte [esp + 0x60], 0
cmp dword [esp + 0x30], esi
je 0x432c83
mov eax, dword [0x4c9484]
test eax, eax
jmp 0x432c75
mov eax, dword [esp + 0x48]
test eax, eax
je 0x432baf
push eax
call fcn.00476df2
add esp, 4
mov edx, dword [esp + 0x3c]
push edx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
call fcn.00476df2
add esp, 4
mov byte [esp + 0x60], 0
cmp dword [esp + 0x30], 0
je 0x432c83
mov eax, dword [0x4c9484]
test eax, eax
jmp 0x432c75
mov eax, dword [ebx]
jmp 0x432993
mov eax, dword [ebx]
jmp 0x4329ce
mov eax, dword [esp + 0x48]
test eax, eax
je 0x432c0f
push eax
call fcn.00476df2
add esp, 4
mov eax, dword [esp + 0x3c]
xor esi, esi
push eax
jmp 0x432b6f
mov eax, dword [esp + 0x48]
cmp eax, esi
je 0x432b6a
push eax
call fcn.00476df2
add esp, 4
jmp 0x432b6a
mov eax, dword [esp + 0x48]
test eax, eax
je 0x432c46
push eax
call fcn.00476df2
add esp, 4
mov edx, dword [esp + 0x3c]
xor eax, eax
push edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
call fcn.00476df2
add esp, 4
xor esi, esi
mov byte [esp + 0x60], 0
cmp dword [esp + 0x30], esi
je 0x432c83
mov eax, dword [0x4c9484]
cmp eax, esi
je 0x432c83
call eax
push 0x4c9470
call fcn.00429ab0
cmp dword [0x4c8f74], 0
je 0x4330b9
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc0], 0
jne 0x432e56
mov dword [esp + 0x2c], 0x4c9470
mov dword [esp + 0x30], 0
mov byte [esp + 0x60], 4
call fcn.0040b920
mov dword [0x4c8f74], 1
test eax, eax
jne 0x432cd1
mov byte [esp + 0x60], al
jmp 0x432e56
call fcn.0040bb00
lea ecx, [esp + 0x3c]
push ecx
call fcn.00436940
mov eax, dword [ebp + 8]
lea edx, [esp + 0x3c]
push edx
push 0x417
add eax, 0x78
push eax
mov byte [esp + 0x6c], 5
call fcn.00409080
mov dword [esp + 0x20], 0x4c8e80
mov ecx, dword [esp + 0x20]
cmp dword [ecx], 0
je 0x432df4
cmp dword [esp + 0x30], 0
je 0x432d34
mov eax, dword [0x4c9484]
test eax, eax
je 0x432d2c
call eax
push 0x4c9470
call fcn.00429ab0
mov dword [esp + 0x30], 0
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
mov esi, 0x4c9470
call fcn.004298b0
mov edi, dword [esp + 0x48]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x4c]
cmp edi, eax
jbe 0x432d5d
call fcn.00477ad6
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov esi, eax
cmp dword [esp + 0x48], eax
jbe 0x432d6e
call fcn.00477ad6
test ebx, ebx
je 0x432d78
cmp ebx, dword [esp + 0x3c]
je 0x432d7d
call fcn.00477ad6
cmp edi, esi
je 0x432df4
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc0], 0
jne 0x432e9b
test ebx, ebx
jne 0x432dec
call fcn.00477ad6
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x432da6
call fcn.00477ad6
mov ecx, dword [edi]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x24]
push eax
push 0x168
push 0xce
push 0x417
call edx
test eax, eax
jne 0x432ede
test ebx, ebx
jne 0x432df0
call fcn.00477ad6
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x432de0
call fcn.00477ad6
mov eax, dword [esp + 0x4c]
add edi, 4
jmp 0x432d61
mov eax, dword [ebx]
jmp 0x432d9c
mov eax, dword [ebx]
jmp 0x432dd6
mov eax, dword [esp + 0x20]
add eax, 4
cmp eax, 0x4c8ebc
mov dword [esp + 0x20], eax
jl 0x432d03
mov eax, dword [esp + 0x48]
test eax, eax
je 0x432e1b
push eax
call fcn.00476df2
add esp, 4
mov edx, dword [esp + 0x3c]
xor esi, esi
push edx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
call fcn.00476df2
add esp, 4
mov byte [esp + 0x60], 0
cmp dword [esp + 0x30], esi
je 0x432e56
mov eax, dword [0x4c9484]
cmp eax, esi
je 0x432e56
call eax
push 0x4c9470
call fcn.00429ab0
mov esi, dword [ebp + 8]
cmp dword [esi + 0xc0], 0
jne 0x4330b9
mov dword [esp + 0x2c], 0x4c9470
mov dword [esp + 0x30], 0
mov byte [esp + 0x60], 7
call fcn.0040b920
mov dword [0x4c8f74], 1
test eax, eax
jne 0x432f30
mov byte [esp + 0x60], al
jmp 0x4330b9
mov eax, dword [esp + 0x48]
test eax, eax
je 0x432eac
push eax
call fcn.00476df2
add esp, 4
mov eax, dword [esp + 0x3c]
xor esi, esi
push eax
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
call fcn.00476df2
add esp, 4
mov byte [esp + 0x60], 0
cmp dword [esp + 0x30], esi
je 0x432e56
mov eax, dword [0x4c9484]
test eax, eax
jmp 0x432e48
mov eax, dword [esp + 0x48]
test eax, eax
je 0x432eef
push eax
call fcn.00476df2
add esp, 4
mov ecx, dword [esp + 0x3c]
push ecx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
call fcn.00476df2
add esp, 4
mov byte [esp + 0x60], 0
cmp dword [esp + 0x30], 0
je 0x432e56
mov eax, dword [0x4c9484]
test eax, eax
jmp 0x432e48
call fcn.0040bb00
lea eax, [esp + 0x3c]
push eax
call fcn.00436940
lea ecx, [esp + 0x3c]
push ecx
push 0x418
add esi, 0x78
push esi
mov byte [esp + 0x6c], 8
call fcn.00409080
mov dword [esp + 0x20], 0x4c8e80
nop
mov edx, dword [esp + 0x20]
cmp dword [edx], 0
je 0x433057
cmp dword [esp + 0x30], 0
je 0x432f91
mov eax, dword [0x4c9484]
test eax, eax
je 0x432f89
call eax
push 0x4c9470
call fcn.00429ab0
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov esi, 0x4c9470
call fcn.004298b0
mov edi, dword [esp + 0x48]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x4c]
cmp edi, eax
jbe 0x432fba
call fcn.00477ad6
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x3c]
mov edi, edi
mov esi, eax
cmp dword [esp + 0x48], eax
jbe 0x432fcd
call fcn.00477ad6
test ebx, ebx
je 0x432fd7
cmp ebx, dword [esp + 0x3c]
je 0x432fdc
call fcn.00477ad6
cmp edi, esi
je 0x433057
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xc0], 0
jne 0x43311e
test ebx, ebx
jne 0x43304f
call fcn.00477ad6
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x433009
call fcn.00477ad6
mov ecx, dword [edi]
mov edx, dword [ecx]
mov edx, dword [edx + 0x28]
lea eax, [esp + 0x24]
push eax
push 0x168
push 0xce
push 0x418
call edx
test eax, eax
jne 0x433139
test ebx, ebx
jne 0x433053
call fcn.00477ad6
xor eax, eax
cmp edi, dword [eax + 0x10]
jb 0x433043
call fcn.00477ad6
mov eax, dword [esp + 0x4c]
add edi, 4
jmp 0x432fc0
mov eax, dword [ebx]
jmp 0x432fff
mov eax, dword [ebx]
jmp 0x433039
mov eax, dword [esp + 0x20]
add eax, 4
cmp eax, 0x4c8ebc
mov dword [esp + 0x20], eax
jl 0x432f60
mov eax, dword [esp + 0x48]
test eax, eax
je 0x43307e
push eax
call fcn.00476df2
add esp, 4
mov edx, dword [esp + 0x3c]
push edx
xor esi, esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
call fcn.00476df2
add esp, 4
mov byte [esp + 0x60], 0
cmp dword [esp + 0x30], esi
je 0x4330b9
mov eax, dword [0x4c9484]
test eax, eax
je 0x4330b9
call eax
push 0x4c9470
call fcn.00429ab0
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
call fcn.004337b0
test byte [0x4cbfc0], 1
jne 0x4330e7
or dword [0x4cbfc0], 1
call fcn.00401210
push 0x49fdb0
call fcn.0047736c
add esp, 4
mov ecx, dword [esp + 0x34]
mov eax, dword [0x4c9400]
push ecx
mov dword [0x4c8f6c], 1
mov dword [esi + 0x40], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0x48]
test eax, eax
je 0x43312f
push eax
call fcn.00476df2
add esp, 4
mov eax, dword [esp + 0x3c]
push eax
jmp 0x433083
mov eax, dword [esp + 0x48]
test eax, eax
je 0x43314a
push eax
call fcn.00476df2
add esp, 4
mov ecx, dword [esp + 0x3c]
push ecx
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
call fcn.00476df2
add esp, 4
mov byte [esp + 0x60], 0
cmp dword [esp + 0x30], 0
jmp 0x4330a2