Function at 0x495cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5556b1
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x5bc9cc]
xor eax, esp
mov dword [esp + 0xb0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5bc9cc]
xor eax, esp
push eax
lea eax, [esp + 0xcc]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xdc]
xor edi, edi
cmp ebp, edi
mov ebx, ecx
mov esi, edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], esi
je 0x495e60
cmp esi, edi
je 0x495e60
push 0x5703b8
lea ecx, [esp + 0x18]
call fcn.0040c150
mov dword [esp + 0xd4], edi
call fcn.0050d22b
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x495d4f
push 0x80004005
call fcn.00402660
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
push 0x7e
lea ecx, [esp + 0x4a]
push edi
mov byte [esp + 0xdc], 2
push ecx
mov word [esp + 0x50], di
call fcn.0052d8f0
mov dword [esi], edi
lea edi, [ebp + 8]
push 0x5703b8
push edi
mov dword [esp + 0x38], 0x40
call fcn.0041ef70
add esp, 0x14
test al, al
je 0x495e82
mov edx, dword [0x56b800]
mov eax, dword [0x56b804]
mov ecx, dword [0x56b808]
mov dword [esp + 0x34], edx
mov edx, dword [0x56b80c]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
call fcn.0041b650
lea eax, [esp + 0x34]
push 0x56b800
push eax
call fcn.004030f0
add esp, 8
test eax, eax
jne 0x495e82
cmp dword [ebp + 0xc], eax
jne 0x495e82
push str.SYSTEMCurrentControlSetControlMediaCategories_
lea ecx, [esp + 0x1c]
call fcn.0040c050
push edi
lea ecx, [esp + 0x1c]
call fcn.0040b770
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x495e45
lea eax, [esp + 0x20]
push eax
lea esi, [esp + 0x20]
call fcn.004100e0
test eax, eax
je 0x495e67
lea ecx, [esp + 0x1c]
call fcn.00410100
lea ecx, [esp + 0x18]
call fcn.00401660
lea ecx, [esp + 0x14]
call fcn.00401660
xor eax, eax
jmp 0x4960c0
push 0x571a9c
lea ecx, [esp + 0x20]
push ecx
lea edi, [esp + 0x2c]
lea esi, [esp + 0x4c]
call fcn.00410060
test eax, eax
jne 0x495e45
mov edx, dword [ebx + 4]
mov eax, dword [edx + 0x1804]
jmp 0x495e94
mov eax, dword [esp + 0x20]
test eax, eax
je 0x496044
mov esi, dword [eax + 8]
test esi, esi
mov ecx, dword [eax]
mov dword [esp + 0x20], ecx
je 0x495e90
cmp dword [esi + 0x38], 2
jle 0x495e90
push 0
push 0x5703b8
lea ecx, [esp + 0x1c]
call fcn.00402fc0
push 2
lea ecx, [esi + 0x2c]
call fcn.0050f31c
test eax, eax
je 0x495fdc
mov eax, dword [eax + 8]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.0040bfc0
mov edx, dword [esp + 0x14]
push 0x5c
push edx
call fcn.0052a2fe
add esp, 8
test eax, eax
je 0x495e90
sub eax, dword [esp + 0x14]
sar eax, 1
js 0x495e90
lea edi, [esp + 0x14]
call fcn.0040b9e0
mov eax, dword [esp + 0x14]
push 0x5c
push eax
call fcn.0052a2fe
add esp, 8
test eax, eax
jne 0x495f1e
or eax, 0xffffffff
jmp 0x495f24
sub eax, dword [esp + 0x14]
sar eax, 1
add eax, 1
push eax
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040ba40
lea edx, [ebp + 4]
push edx
push eax
call fcn.004248d0
mov bl, al
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x495f65
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x495e90
cmp dword [esi + 0x78], 0
jne 0x495fe1
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x495f82
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0xd4], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x495faa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xd4], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x495fd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4960c0
call fcn.0050c9ad
cmp dword [ebp + 0xc], 0
je 0x495ff5
mov ecx, dword [esi + 0x70]
mov edx, dword [ecx + 8]
mov eax, dword [esp + 0x28]
mov dword [eax], edx
jmp 0x49604f
mov edi, dword [esi + 0x70]
test edi, edi
je 0x49604f
test edi, edi
mov eax, edi
je 0x495fdc
mov ebp, dword [eax + 8]
test ebp, ebp
mov edi, dword [edi]
je 0x496036
lea esi, [esp + 0x24]
mov eax, ebp
call fcn.00464a70
mov eax, dword [eax]
lea ecx, [esp + 0x44]
push ecx
push eax
call fcn.0052a774
add esp, 8
test eax, eax
mov ecx, esi
sete bl
call fcn.00401660
test bl, bl
jne 0x49603c
test edi, edi
jne 0x495ffc
jmp 0x49604f
mov edx, dword [esp + 0x28]
mov dword [edx], ebp
jmp 0x49604f
mov eax, dword [esp + 0x2c]
mov dword [eax + 0xc], 1
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp dword [edx], ecx
setne cl
test eax, eax
mov esi, ecx
je 0x49606b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0xd4], 0
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x496093
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xd4], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4960be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0xcc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.0052944d
add esp, 0xc4
ret 4