Function at 0x4e3357
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2bc
mov eax, dword [0x5184d0]
xor eax, esp
mov dword [esp + 0x2b8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [0x519974]
mov dword [esp + 4], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x84], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x3c]
push ebx
xor ebx, ebx
mov dword [esp + 0x98], eax
push esi
lea eax, [esp + 0x4c]
mov dword [esp + 0x1c], edx
xor esi, esi
mov dword [esp + 0xa4], eax
inc esi
mov dword [esp + 0x48], ecx
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x54]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x90], 0x405fe4
mov dword [esp + 0x98], 0x42fb98
mov dword [esp + 0xa0], 0x42fb74
mov dword [esp + 0xa8], 0x42fb54
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], 0x405f98
push edi
test ecx, ecx
jne 0x4e3459
lea ecx, [esp + 0x78]
mov dword [esp + 0x4c], ecx
mov edi, ecx
mov dword [esp + 0x14], ebx
xor eax, eax
lea ecx, [esp + 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x90]
push eax
push 5
pop edx
call fcn.004e16dc
mov edi, eax
test edi, edi
je 0x4e3489
push edi
push 0x8300197
jmp 0x4e382d
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
jne 0x4e34a7
call fcn.004c73cc
mov edi, eax
push edi
push 0x8360197
jmp 0x4e382d
push 0x12
mov edx, esi
mov dword [esp + 0x60], esi
pop ecx
call fcn.004e6904
mov edi, eax
test edi, edi
je 0x4e34c6
push edi
push 0x83b0197
jmp 0x4e382d
push 0x11
mov edx, esi
pop ecx
call fcn.004e6904
mov edi, eax
test edi, edi
je 0x4e34e1
push edi
push 0x83d0197
jmp 0x4e382d
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4e3822
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
and eax, 0x200
mov dword [esp + 0x38], eax
je 0x4e3508
test edx, edx
je 0x4e3822
test edx, edx
je 0x4e37d7
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0xbc]
push eax
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x4e353f
call fcn.004c73cc
mov edi, eax
push edi
push 0x84a0197
jmp 0x4e382d
lea eax, [esp + 0x18]
mov edx, 0x42f9dc
push eax
push ecx
lea ecx, [esp + 0xc0]
call fcn.004cc4cd
mov edi, eax
test edi, edi
je 0x4e3567
push edi
push 0x84d0197
jmp 0x4e382d
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x68]
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x28]
call fcn.004e24ba
mov edi, eax
test edi, edi
je 0x4e359d
push edi
push 0x8570197
jmp 0x4e382d
test dword [esp + 0x20], esi
jne 0x4e361a
lea eax, [esp + 0x30]
mov edx, 0x42f9f0
push eax
push ecx
mov ecx, dword [esp + 0x20]
call fcn.004cc4cd
mov edi, eax
test edi, edi
je 0x4e35c8
push edi
push 0x8660197
jmp 0x4e382d
push 2
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x3c]
call dword [sym.imp.certcli.dll_Ordinal_223]
mov edi, eax
test edi, edi
je 0x4e35ef
push edi
push 0x86d0197
jmp 0x4e382d
mov eax, dword [esp + 0x64]
cmp eax, 4
jbe 0x4e3668
mov ecx, dword [esp + 0x24]
xor edx, edx
shr eax, 1
cmp dx, word [ecx + eax*2 - 2]
jne 0x4e3668
cmp dx, word [ecx + eax*2 - 4]
jne 0x4e3668
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x2c], esi
cmp dword [esp + 0x38], ebx
jne 0x4e37ee
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x28]
mov eax, ecx
neg eax
sbb eax, eax
and eax, edx
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x90]
push eax
push ecx
mov ecx, dword [esp + 0x24]
call fcn.004e2a79
mov edi, eax
test edi, edi
je 0x4e3678
push edi
push 0x8870197
jmp 0x4e382d
mov edi, 0x8007000d
push edi
push 0x8740197
jmp 0x4e382d
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4e3684
mov dword [esp + 0x70], eax
lea eax, [esp + 0x14]
push eax
push esi
push dword [esp + 0x18]
mov esi, dword [esp + 0x48]
mov ecx, esi
call dword [0x51cbac]
call esi
mov edi, eax
test edi, edi
je 0x4e36ad
push edi
push 0x8930197
jmp 0x4e382d
push dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x70]
push dword [esp + 0x48]
mov esi, dword [esp + 0x48]
mov eax, ecx
neg eax
mov dword [esp + 0x5c], 1
push ebx
push ecx
sbb eax, eax
mov ecx, esi
and eax, edx
push eax
push ebx
push ebx
push dword [esp + 0x30]
mov dword [esp + 0x58], eax
call dword [0x51cbac]
call esi
mov edi, eax
test edi, edi
je 0x4e3773
push edi
push 0x8a00197
call dword [sym.imp.certcli.dll_Ordinal_357]
cmp edi, 0x80070005
jne 0x4e373d
push dword [esp + 0x1c]
mov esi, dword [esp + 0x4c]
mov ecx, esi
push dword [esp + 0x48]
push ebx
push dword [esp + 0x38]
push dword [esp + 0x48]
push ebx
push ebx
push dword [esp + 0x30]
call dword [0x51cbac]
call esi
mov edi, eax
test edi, edi
je 0x4e376f
push edi
push 0x8b10197
call dword [sym.imp.certcli.dll_Ordinal_357]
cmp edi, 0x80004004
jne 0x4e375e
mov ecx, dword [esp + 0x10]
call fcn.004e32c9
test eax, eax
je 0x4e375e
push eax
push 0x8bd0197
call dword [sym.imp.certcli.dll_Ordinal_357]
push edi
push 0x8bf0197
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4e37f6
mov esi, ebx
jmp 0x4e3776
xor esi, esi
inc esi
push dword [esp + 0x4c]
mov edx, dword [esp + 0x1c]
push dword [esp + 0x6c]
mov ecx, dword [esp + 0x28]
push dword [esp + 0x68]
push dword [esp + 0x98]
push dword [esp + 0x98]
push dword [esp + 0x98]
call fcn.004e30bf
mov edi, eax
test edi, edi
je 0x4e37b2
push edi
push 0x8cb0197
jmp 0x4e3764
test esi, esi
je 0x4e37ee
mov esi, dword [esp + 0x50]
mov ecx, esi
push ebx
push dword [esp + 0x18]
call dword [0x51cbac]
call esi
mov edi, eax
test edi, edi
je 0x4e37ee
push edi
push 0x8d00197
jmp 0x4e3764
test eax, eax
jne 0x4e37ee
call fcn.004e32c9
mov edi, eax
test edi, edi
je 0x4e37ee
push edi
push 0x8d70197
jmp 0x4e382d
mov edi, ebx
cmp dword [esp + 0x54], ebx
je 0x4e3833
push dword [esp + 0x14]
mov esi, dword [esp + 0x5c]
mov ecx, esi
call dword [0x51cbac]
call esi
mov esi, eax
test esi, esi
je 0x4e381a
push esi
push 0x8df0197
call dword [sym.imp.certcli.dll_Ordinal_357]
test edi, edi
jne 0x4e3833
mov edi, esi
jmp 0x4e3833
mov edi, 0x80004003
push edi
push 0x8430197
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4e3842
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4e3851
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4e3860
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x28], ebx
je 0x4e3870
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x5c], ebx
je 0x4e3890
push 0x11
xor edx, edx
pop ecx
call fcn.004e6904
push 0x12
xor edx, edx
pop ecx
call fcn.004e6904
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [esp + 0x34], ebx
je 0x4e38a0
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + ebx*4 + 0x84]
test eax, eax
je 0x4e38b2
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc ebx
cmp ebx, 3
jb 0x4e38a0
mov ecx, dword [esp + 0x2c4]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005036b0
mov esp, ebp
pop ebp
ret 0x14