Function at 0x418f40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x364
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, ecx
mov ecx, dword [ebp + 0x10]
xor bh, bh
push edi
push eax
mov dword [esp + 0x70], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0xb0], ecx
mov byte [esp + 0x16], bh
call sym.SystemInformer.exe_Ordinal_1669
cmp dword [esi], 0
mov edi, eax
mov dword [esp + 0x70], edi
je 0x419651
push dword [0x633a2c]
push 0x28
call sym.SystemInformer.exe_Ordinal_1240
mov ebx, eax
push 0x80
push 4
push dword [0x633a54]
mov dword [esp + 0x74], ebx
mov dword [ebx], 8
mov dword [ebx + 4], 0x502fe0
mov dword [ebx + 8], 0x503000
mov dword [ebx + 0xc], 0x20
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, eax
mov eax, dword [ebx + 0xc]
shl eax, 2
push eax
push 0xff
push ecx
mov dword [ebx + 0x10], ecx
call fcn.005861d0
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [ebx + 0x14], eax
shl eax, 4
push eax
push 4
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0xffffffff
mov dword [ebx + 0x24], 0
mov ebx, dword [esi]
mov esi, dword [esi + 4]
mov dword [esp + 0x14], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], esi
test ebx, ebx
je 0x4190a3
cmp word [esi], 0x40
jne 0x4190a3
lea eax, ds:[esi + 2]
sub ebx, 2
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x54]
mov dword [esp + 0x34], ebx
push eax
push 0x7c
lea eax, [esp + 0x3c]
push eax
call sym.SystemInformer.exe_Ordinal_1446
cmp dword [esp + 0x50], 0
je 0x41960d
lea eax, ds:[esp + 0x18]
push eax
push 0xa
lea eax, [esp + 0x58]
push eax
call sym.SystemInformer.exe_Ordinal_1451
test al, al
je 0x41960d
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x14], esi
jmp 0x4190a7
mov dword [esp + 0x64], edi
test ebx, ebx
je 0x41945a
nop
push 0
push 0x7c
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_Ordinal_1363
nop
cmp eax, 0xffffffff
jne 0x4190d7
xor eax, eax
mov edi, esi
mov esi, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], eax
xor ebx, ebx
jmp 0x4190f2
mov ecx, dword [esp + 0x14]
lea esi, [eax + eax]
mov edi, ecx
sub ebx, esi
add ecx, 2
add ecx, esi
sub ebx, 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], edi
test esi, esi
je 0x41944e
push 0
push 0x2c
lea eax, [esp + 0x7c]
push eax
call sym.SystemInformer.exe_Ordinal_1363
mov dword ds:[esp + 0x60], edi
cmp eax, 0xffffffff
jne 0x41912d
mov ecx, esi
xor eax, eax
xor esi, esi
jmp 0x41913a
lea ecx, [eax + eax]
lea eax, [ecx + 2]
sub esi, ecx
add eax, edi
sub esi, 2
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x5c], ecx
test ecx, ecx
je 0x41960d
movzx eax, word ds:[edi]
mov edx, eax
cmp eax, 0x2b
jne 0x41920d
cmp dword [esp + 0x6c], 0
je 0x41944e
lea eax, [edi + 2]
sub ecx, 2
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], ecx
push eax
push edx
push eax
call sym.SystemInformer.exe_Ordinal_1446
mov edi, dword ds:[esp + 0x28]
test edi, edi
je 0x41944e
cmp dword [esp + 0xb0], 0
je 0x41944e
lea eax, [esp + 0x88]
push eax
push 0xa
lea eax, [esp + 0xb8]
push eax
call sym.SystemInformer.exe_Ordinal_1451
test al, al
je 0x41944e
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xb8]
push dword [esp + 0x88]
mov ecx, dword [esp + 0x70]
mov dword [esp + 0xbc], edi
mov dword [esp + 0xc0], eax
call fcn.00418b40
nop
test eax, eax
je 0x41944e
mov edi, dword [eax + 8]
jmp 0x41923f
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edi
cmp edx, 0x2d
je 0x41926f
lea eax, [esp + 0x48]
mov edx, 0xa
push eax
lea ecx, [esp + 0x44]
call fcn.00503850
mov cl, al
mov edi, dword [esp + 0x48]
mov dword [esp + 0x18], edi
test cl, cl
je 0x41960d
push 0
push 0x2c
lea eax, [esp + 0x7c]
push eax
call sym.SystemInformer.exe_Ordinal_1363
mov edx, dword [esp + 0x38]
mov dword [esp + 0x60], edx
cmp eax, 0xffffffff
jne 0x4192a4
mov ecx, esi
mov dword [esp + 0x38], edx
mov dword [esp + 0x84], 0
xor esi, esi
jmp 0x4192b8
lea eax, [edi + 2]
sub ecx, 2
mov dword [esp + 0x44], eax
cmp edx, 0x2d
lea eax, [esp + 0x48]
mov dword [esp + 0x40], ecx
push eax
mov edx, 0xa
lea ecx, [esp + 0x44]
sete bl
call fcn.00503850
mov cl, al
test bl, bl
je 0x41922f
mov edi, dword [esp + 0x48]
neg edi
jmp 0x419233
lea ecx, [eax + eax]
lea eax, [edx + 2]
sub esi, ecx
add eax, ecx
sub esi, 2
mov dword [esp + 0x84], eax
mov dword ds:[esp + 0x5c], ecx
test ecx, ecx
je 0x41960d
movzx eax, word [edx]
xor bl, bl
mov dword [esp + 0x94], edx
mov edx, eax
mov dword [esp + 0xa8], edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x90], ecx
cmp eax, 0x2d
je 0x4192f5
cmp ax, 0x2b
jne 0x41930b
jmp 0x4192f7
mov bl, 1
lea eax, [edx + 2]
sub ecx, 2
mov dword [esp + 0x94], eax
mov dword [esp + 0x90], ecx
lea eax, ds:[esp + 0x98]
mov edx, 0xa
push eax
lea ecx, [esp + 0x94]
call fcn.00503850
test bl, bl
mov cl, al
mov ebx, dword [esp + 0x98]
je 0x419334
neg ebx
mov dword ds:[esp + 0x18], ebx
test cl, cl
je 0x41960d
test esi, esi
je 0x41960d
mov ecx, dword [esp + 0x84]
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], ecx
mov byte [esp + 0x13], 0
movzx eax, word [ecx]
mov edx, eax
cmp eax, 0x2d
je 0x41937b
cmp edx, 0x2b
jne 0x419394
jmp 0x419380
mov byte [esp + 0x13], 1
lea eax, [ecx + 2]
sub esi, 2
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], esi
lea eax, [esp + 0x50]
mov edx, 0xa
push eax
lea ecx, [esp + 0xa4]
call fcn.00503850
cmp byte [esp + 0x13], 0
mov cl, al
mov esi, dword [esp + 0x50]
je 0x4193b9
neg esi
mov dword ds:[esp + 0x18], esi
test cl, cl
je 0x41960d
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x70]
cmp eax, edx
je 0x419418
test eax, eax
je 0x419418
mov ecx, eax
shr ecx, 1
push 0
test esi, esi
js 0x4193fd
mov eax, esi
mul edx
add eax, ecx
mov ecx, dword [esp + 0x68]
push ecx
adc edx, 0
push edx
push eax
call fcn.005a5320
mov esi, eax
jmp 0x419418
neg esi
mov eax, esi
mul edx
add eax, ecx
mov ecx, dword [esp + 0x68]
push ecx
adc edx, 0
push edx
push eax
call fcn.005a5320
mov esi, eax
neg esi
push 0x28
push 4
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esp + 0x80], eax
mov dword [esp + 0x7c], edi
mov dword [eax + 4], edi
mov dword [eax + 0x18], ebx
mov dword [eax + 0x10], esi
lea eax, [esp + 0x7c]
push eax
push dword [esp + 0x6c]
call sym.SystemInformer.exe_Ordinal_1269
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x14]
test ebx, ebx
jne 0x4190b0
mov esi, dword [esp + 0x24]
push 0
push 0
push 0x41f
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
xor edi, edi
push ebx
push ebx
push 0x41e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x421
push esi
mov dword [esp + 0x4c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x280
mov dword [esp + 0x74], eax
lea eax, [esp + 0xec]
push ebx
push eax
call fcn.005861d0
xor esi, esi
add esp, 0xc
mov dword [esp + 0x14], esi
cmp dword [esp + 0x3c], ebx
jbe 0x4195df
lfence
nop dword [eax]
lea eax, [esp + 0xc0]
push eax
push edi
push 0x407
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4195d4
lea eax, [esp + 0x88]
mov dword [esp + 0x88], edi
push eax
push dword [esp + 0x6c]
call sym.SystemInformer.exe_Ordinal_1365
test eax, eax
je 0x41959c
lea esi, [eax + 4]
test esi, esi
je 0x419598
or dword [esp + 0xc0], 1
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov dword [esp + 0xd0], eax
lea eax, [esp + 0xc0]
push eax
push 0x100004
push 0x408
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SendMessageW]
test byte [esp + 0xc0], 4
jne 0x4195cf
cmp dword ds:[esp + 0x70], 0
je 0x41956f
mov ecx, dword [esi]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x41956f
dec eax
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x18]
cmp eax, 0xa0
jae 0x4195cf
mov dword [esp + eax*4 + 0xe8], edi
mov eax, dword [esi]
mov esi, dword [esp + 0x14]
mov eax, dword [eax + 0x18]
inc eax
cmp esi, eax
jae 0x4195d3
mov esi, eax
mov dword [esp + 0x14], esi
jmp 0x4195d3
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0xc0]
test al, 4
jne 0x4195d3
and eax, 0xfffffffe
mov dword [esp + 0xc0], eax
lea eax, [esp + 0xc0]
push eax
push 0x100000
push 0x408
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4195d3
mov esi, dword [esp + 0x14]
inc ebx
inc edi
cmp ebx, dword [esp + 0x3c]
jb 0x4194d0
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0xe8]
push eax
push esi
push 0x40a
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x41f
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [esp + 0x12], 1
mov ecx, dword [esp + 0x68]
mov ebx, dword [ecx]
mov edi, dword [ecx + 0x24]
add ebx, 8
mov esi, dword [ecx + 0x18]
imul edi, ebx
add edi, esi
cmp esi, edi
je 0x419636
mov eax, esi
add esi, ebx
cmp dword [eax], 0xffffffff
jne 0x419725
cmp esi, edi
jne 0x419625
mov ecx, dword [esp + 0x68]
or eax, 0xffffffff
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x41964d
call fcn.004fe1e0
mov bh, byte [esp + 0x12]
mov eax, dword ds:[esp + 0xac]
test eax, eax
je 0x4197d9
cmp dword [eax], 0
je 0x4197d9
lea ecx, ds:[esp + 0x50]
push ecx
lea ecx, [esp + 0x60]
push ecx
push 0x2c
push eax
call sym.SystemInformer.exe_Ordinal_1446
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4197d9
cmp dword [esp + 0x50], 0
je 0x4197d9
mov edx, dword [esp + 0x60]
or esi, 0xffffffff
movzx eax, word [edx]
mov edi, eax
cmp eax, 0x2b
jne 0x419774
cmp dword [esp + 0x6c], 0
je 0x4197a4
lea eax, [edx + 2]
sub ecx, 2
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], ecx
push eax
push edi
push eax
call sym.SystemInformer.exe_Ordinal_1446
mov edi, dword ds:[esp + 0x28]
test edi, edi
je 0x4197a4
cmp dword [esp + 0x7c], 0
je 0x4197a4
lea eax, [esp + 0x88]
push eax
push 0xa
lea eax, [esp + 0x84]
push eax
call sym.SystemInformer.exe_Ordinal_1451
test al, al
jne 0x419745
lea eax, [esp + 0x18]
push eax
push 0xa
lea eax, [esp + 0x58]
push eax
call sym.SystemInformer.exe_Ordinal_1451
nop
jmp 0x4197d9
add eax, 8
je 0x419636
push dword [eax + 4]
push 0
push dword [0x633a54]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
nop
jmp 0x419621
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x7c]
push dword [esp + 0x88]
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x80], edi
mov dword [esp + 0x84], eax
call fcn.00418b40
test eax, eax
je 0x4197a4
mov esi, dword [eax + 8]
jmp 0x4197a4
mov dword ds:[esp + 0x48], ecx
mov dword [esp + 0x4c], edx
cmp edi, 0x2d
je 0x4197f2
lea eax, [esp + 0x40]
mov edx, 0xa
push eax
lea ecx, [esp + 0x4c]
call fcn.00503850
mov esi, dword [esp + 0x40]
mov dword [esp + 0x18], esi
lea eax, [esp + 0x18]
push eax
push 0xa
lea eax, [esp + 0x58]
push eax
call sym.SystemInformer.exe_Ordinal_1451
cmp esi, 0xffffffff
je 0x4197d9
mov eax, dword ds:[esp + 0x18]
cmp eax, 2
jg 0x4197d9
push eax
push esi
push 0x40d
push dword [esp + 0x30]
lfence
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x36c]
mov al, bh
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00583f9f
mov esp, ebp
pop ebp
ret 0xc
lea eax, [edx + 2]
sub ecx, 2
mov dword [esp + 0x4c], eax
cmp edi, 0x2d
lea eax, [esp + 0x40]
mov dword [esp + 0x48], ecx
push eax
mov edx, 0xa
lea ecx, [esp + 0x4c]
sete bl
call fcn.00503850
nop dword [eax]
test bl, bl
je 0x41979c
mov esi, dword [esp + 0x40]
neg esi
jmp 0x4197a0