Function at 0x4ab330
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x28], 0x180016
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], str.dbghelp.dll
push eax
push 0
push 0
call dword [sym.imp.ntdll.dll_LdrGetDllHandle]
xor edi, edi
mov dword [esp + 0x30], 0x160014
test eax, eax
mov dword [esp + 0x34], str.symsrv.dll
lea eax, [esp + 0x1c]
cmovns edi, dword [esp + 0x18]
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x14], edi
push eax
push 0
push 0
call dword [sym.imp.ntdll.dll_LdrGetDllHandle]
xor ecx, ecx
test eax, eax
cmovns ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
test edi, edi
je 0x4ab3aa
test ecx, ecx
jne 0x4abcc6
xor esi, esi
or edi, 0xffffffff
nop
push dword [esi + 0x547be0]
push dword [esi + 0x547bdc]
call sym.ProcessHacker.exe_PhGetKnownLocation
mov ebx, eax
test ebx, ebx
je 0x4ab3ee
push dword [ebx + 4]
call dword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
jne 0x4ab3f6
mov eax, ebx
xor ebx, ebx
test eax, eax
je 0x4ab3ee
lea ecx, [eax - 8]
mov eax, edi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4ab3ee
call fcn.004a2a20
add esi, 8
cmp esi, 0x20
jb 0x4ab3b0
mov edi, dword [esp + 0x10]
test ebx, ebx
je 0x4ab495
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x4ab482
lea eax, [esp + 0x20]
push eax
push edi
call sym.ProcessHacker.exe_PhGetDllFileName
mov dword [esp + 0x10], eax
test eax, eax
je 0x4ab482
mov edx, dword [esp + 0x20]
test edx, edx
je 0x4ab46f
mov ecx, dword [eax + 4]
lea eax, [edx + edx]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push 0x547bd4
push eax
mov dword [esp + 0x2c], ecx
call sym.ProcessHacker.exe_PhConcatStringRef2
mov esi, eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x14], eax
lea ecx, [esi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x4ab46b
call fcn.004a2a20
mov eax, dword [esp + 0x10]
lea ecx, [eax - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4ab482
call fcn.004a2a20
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4ab495
call fcn.004a2a20
test edi, edi
jne 0x4ab4a6
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov ebx, dword [esp + 0x14]
test ebx, ebx
jne 0x4ab4bb
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov ecx, 0x5a4d
test edi, edi
je 0x4abb30
movzx eax, word [edi]
mov edx, eax
cmp ax, cx
jne 0x4ab514
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4ab514
cmp eax, 0x10000000
jae 0x4ab514
cmp dword [eax + edi], 0x4550
jne 0x4ab514
lea ecx, [eax + 0x78]
mov eax, dword [ecx + edi]
add ecx, edi
test eax, eax
je 0x4ab514
cmp dword [ecx + 4], 0
je 0x4ab514
push 0
push str.SymInitializeW
add eax, edi
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov ecx, eax
movzx eax, word [edi]
jmp 0x4ab518
mov eax, edx
xor ecx, ecx
mov dword [0x54b620], ecx
mov ecx, 0x5a4d
movzx eax, ax
cmp ax, cx
mov ecx, eax
jne 0x4ab545
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4ab545
cmp edx, 0x10000000
jae 0x4ab545
cmp dword [edx + edi], 0x4550
je 0x4ab5a6
movzx eax, cx
xor edx, edx
movzx eax, ax
mov dword [0x54b618], edx
mov ecx, eax
mov edx, 0x5a4d
cmp ax, dx
jne 0x4ab63e
mov ecx, dword [edi + 0x3c]
mov edx, eax
test ecx, ecx
je 0x4ab5df
cmp ecx, 0x10000000
jae 0x4ab5df
cmp dword [ecx + edi], 0x4550
jne 0x4ab5e2
add ecx, 0x78
add ecx, edi
mov esi, dword [ecx]
test esi, esi
je 0x4ab5df
cmp dword [ecx + 4], 0
je 0x4ab5df
push 0
push str.SymEnumSymbolsW
lea eax, [esi + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
movzx eax, word [edi]
jmp 0x4ab5e2
lea ecx, [edx + 0x78]
mov esi, eax
mov edx, dword [ecx + edi]
add ecx, edi
test edx, edx
je 0x4ab5d7
cmp dword [ecx + 4], 0
je 0x4ab5d7
push 0
push str.SymCleanup
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov edx, eax
movzx eax, word [edi]
jmp 0x4ab54a
movzx eax, si
jmp 0x4ab548
movzx eax, dx
movzx eax, ax
mov edx, 0x5a4d
mov ecx, eax
cmp ax, dx
jne 0x4ab63e
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4ab641
cmp edx, 0x10000000
jae 0x4ab641
cmp dword [edx + edi], 0x4550
je 0x4ab60b
jmp 0x4ab641
lea ecx, [edx + 0x78]
mov esi, eax
mov edx, dword [ecx + edi]
add ecx, edi
test edx, edx
je 0x4ab639
cmp dword [ecx + 4], 0
je 0x4ab639
push 0
push str.SymFromAddrW
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov edx, eax
movzx eax, word [edi]
jmp 0x4ab646
movzx eax, si
jmp 0x4ab644
movzx ecx, cx
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b5f8], edx
mov ecx, eax
jne 0x4ab677
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4ab677
cmp edx, 0x10000000
jae 0x4ab677
cmp dword [edx + edi], 0x4550
je 0x4ab7c7
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b610], edx
mov ecx, eax
jne 0x4ab6ad
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4ab6ad
cmp edx, 0x10000000
jae 0x4ab6ad
cmp dword [edx + edi], 0x4550
je 0x4ab800
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b614], edx
mov ecx, eax
jne 0x4ab6e3
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4ab6e3
cmp edx, 0x10000000
jae 0x4ab6e3
cmp dword [edx + edi], 0x4550
je 0x4ab839
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b60c], edx
mov ecx, eax
jne 0x4ab719
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4ab719
cmp edx, 0x10000000
jae 0x4ab719
cmp dword [edx + edi], 0x4550
je 0x4ab872
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b5f0], edx
mov ecx, eax
jne 0x4ab74f
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4ab74f
cmp edx, 0x10000000
jae 0x4ab74f
cmp dword [edx + edi], 0x4550
je 0x4ab8ab
movzx eax, cx
xor edx, edx
movzx eax, ax
mov dword [0x54b604], edx
mov ecx, eax
mov edx, 0x5a4d
cmp ax, dx
jne 0x4ab943
mov ecx, dword [edi + 0x3c]
mov edx, eax
test ecx, ecx
je 0x4ab8e4
cmp ecx, 0x10000000
jae 0x4ab8e4
cmp dword [ecx + edi], 0x4550
jne 0x4ab8e7
add ecx, 0x78
add ecx, edi
mov esi, dword [ecx]
test esi, esi
je 0x4ab8e4
cmp dword [ecx + 4], 0
je 0x4ab8e4
push 0
push str.SymGetSearchPathW
lea eax, [esi + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
movzx eax, word [edi]
jmp 0x4ab8e7
lea ecx, [edx + 0x78]
mov esi, eax
mov edx, dword [ecx + edi]
add ecx, edi
test edx, edx
je 0x4ab7f8
cmp dword [ecx + 4], 0
je 0x4ab7f8
push 0
push str.SymFromNameW
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov edx, eax
movzx eax, word [edi]
jmp 0x4ab67c
movzx eax, si
jmp 0x4ab67a
lea ecx, [edx + 0x78]
mov esi, eax
mov edx, dword [ecx + edi]
add ecx, edi
test edx, edx
je 0x4ab831
cmp dword [ecx + 4], 0
je 0x4ab831
push 0
push str.SymGetLineFromAddrW64
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov edx, eax
movzx eax, word [edi]
jmp 0x4ab6b2
movzx eax, si
jmp 0x4ab6b0
lea ecx, [edx + 0x78]
mov esi, eax
mov edx, dword [ecx + edi]
add ecx, edi
test edx, edx
je 0x4ab86a
cmp dword [ecx + 4], 0
je 0x4ab86a
push 0
push str.SymLoadModuleExW
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov edx, eax
movzx eax, word [edi]
jmp 0x4ab6e8
movzx eax, si
jmp 0x4ab6e6
lea ecx, [edx + 0x78]
mov esi, eax
mov edx, dword [ecx + edi]
add ecx, edi
test edx, edx
je 0x4ab8a3
cmp dword [ecx + 4], 0
je 0x4ab8a3
push 0
push str.SymGetOptions
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov edx, eax
movzx eax, word [edi]
jmp 0x4ab71e
movzx eax, si
jmp 0x4ab71c
lea ecx, [edx + 0x78]
mov esi, eax
mov edx, dword [ecx + edi]
add ecx, edi
test edx, edx
je 0x4ab8dc
cmp dword [ecx + 4], 0
je 0x4ab8dc
push 0
push str.SymSetOptions
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov edx, eax
movzx eax, word [edi]
jmp 0x4ab754
movzx eax, si
jmp 0x4ab752
movzx eax, dx
movzx eax, ax
mov edx, 0x5a4d
mov ecx, eax
cmp ax, dx
jne 0x4ab943
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4ab946
cmp edx, 0x10000000
jae 0x4ab946
cmp dword [edx + edi], 0x4550
je 0x4ab910
jmp 0x4ab946
lea ecx, [edx + 0x78]
mov esi, eax
mov edx, dword [ecx + edi]
add ecx, edi
test edx, edx
je 0x4ab93e
cmp dword [ecx + 4], 0
je 0x4ab93e
push 0
push str.SymSetSearchPathW
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov edx, eax
movzx eax, word [edi]
jmp 0x4ab94b
movzx eax, si
jmp 0x4ab949
movzx ecx, cx
movzx eax, cx
xor edx, edx
movzx eax, ax
mov dword [0x54b5ec], edx
mov ecx, eax
mov edx, 0x5a4d
cmp ax, dx
jne 0x4aba06
mov ecx, dword [edi + 0x3c]
mov edx, eax
test ecx, ecx
je 0x4ab9a7
cmp ecx, 0x10000000
jae 0x4ab9a7
cmp dword [ecx + edi], 0x4550
jne 0x4ab9aa
add ecx, 0x78
add ecx, edi
mov esi, dword [ecx]
test esi, esi
je 0x4ab9a7
cmp dword [ecx + 4], 0
je 0x4ab9a7
push 0
push str.SymUnloadModule64
lea eax, [esi + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
movzx eax, word [edi]
jmp 0x4ab9aa
movzx eax, dx
movzx eax, ax
mov edx, 0x5a4d
mov ecx, eax
cmp ax, dx
jne 0x4aba06
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4aba09
cmp edx, 0x10000000
jae 0x4aba09
cmp dword [edx + edi], 0x4550
je 0x4ab9d3
jmp 0x4aba09
lea ecx, [edx + 0x78]
mov esi, eax
mov edx, dword [ecx + edi]
add ecx, edi
test edx, edx
je 0x4aba01
cmp dword [ecx + 4], 0
je 0x4aba01
push 0
push str.SymFunctionTableAccess64
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov edx, eax
movzx eax, word [edi]
jmp 0x4aba0e
movzx eax, si
jmp 0x4aba0c
movzx ecx, cx
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b5f4], edx
mov ecx, eax
jne 0x4aba3f
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4aba3f
cmp edx, 0x10000000
jae 0x4aba3f
cmp dword [edx + edi], 0x4550
je 0x4abba3
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b61c], edx
mov ecx, eax
jne 0x4aba75
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4aba75
cmp edx, 0x10000000
jae 0x4aba75
cmp dword [edx + edi], 0x4550
je 0x4abbdc
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b608], edx
mov ecx, eax
jne 0x4abaab
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4abaab
cmp edx, 0x10000000
jae 0x4abaab
cmp dword [edx + edi], 0x4550
je 0x4abc15
movzx eax, cx
xor edx, edx
movzx eax, ax
mov ecx, 0x5a4d
cmp ax, cx
mov dword [0x54b600], edx
mov ecx, eax
jne 0x4abae1
mov edx, dword [edi + 0x3c]
test edx, edx
je 0x4abae1
cmp edx, 0x10000000
jae 0x4abae1
cmp dword [edx + edi], 0x4550
je 0x4abc4e
movzx ecx, cx
xor eax, eax
mov dword [0x54b5fc], eax
mov eax, 0x5a4d
cmp cx, ax
jne 0x4abb30
mov eax, dword [edi + 0x3c]
test eax, eax
je 0x4abb30
cmp eax, 0x10000000
jae 0x4abb30
cmp dword [eax + edi], 0x4550
jne 0x4abb30
lea ecx, [eax + 0x78]
mov eax, dword [ecx + edi]
add ecx, edi
test eax, eax
je 0x4abb30
cmp dword [ecx + 4], 0
je 0x4abb30
push 0
push str.UnDecorateSymbolNameW
add eax, edi
push eax
push ecx
mov ecx, edi
call fcn.004a2140
test ebx, ebx
je 0x4abcc6
movzx eax, word [ebx]
mov edi, 0x5a4d
mov ecx, eax
cmp ax, di
jne 0x4abcc6
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4abc84
cmp eax, 0x10000000
jae 0x4abc84
cmp dword [eax + ebx], 0x4550
lea edx, [eax + ebx]
jne 0x4abc84
mov eax, dword [edx + 0x78]
add edx, 0x78
test eax, eax
je 0x4abc84
cmp dword [edx + 4], 0
je 0x4abc84
push 0
push str.SymbolServerGetOptions
add eax, ebx
mov ecx, ebx
push eax
push edx
call fcn.004a2140
movzx eax, word [ebx]
jmp 0x4abc86
lea ecx, [edx + 0x78]
mov esi, eax
mov edx, dword [ecx + edi]
add ecx, edi
test edx, edx
je 0x4abbd4
cmp dword [ecx + 4], 0
je 0x4abbd4
push 0
push str.SymGetModuleBase64
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov edx, eax
movzx eax, word [edi]
jmp 0x4aba44
movzx eax, si
jmp 0x4aba42
lea ecx, [edx + 0x78]
mov esi, eax
mov edx, dword [ecx + edi]
add ecx, edi
test edx, edx
je 0x4abc0d
cmp dword [ecx + 4], 0
je 0x4abc0d
push 0
push str.SymRegisterCallbackW64
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov edx, eax
movzx eax, word [edi]
jmp 0x4aba7a
movzx eax, si
jmp 0x4aba78
lea ecx, [edx + 0x78]
mov esi, eax
mov edx, dword [ecx + edi]
add ecx, edi
test edx, edx
je 0x4abc46
cmp dword [ecx + 4], 0
je 0x4abc46
push 0
push str.StackWalk64
lea eax, [edx + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
mov edx, eax
movzx eax, word [edi]
jmp 0x4abab0
movzx eax, si
jmp 0x4abaae
lea ecx, [edx + 0x78]
mov edx, eax
add ecx, edi
mov esi, dword [ecx]
test esi, esi
je 0x4abc7c
cmp dword [ecx + 4], 0
je 0x4abc7c
push 0
push str.MiniDumpWriteDump
lea eax, [esi + edi]
push eax
push ecx
mov ecx, edi
call fcn.004a2140
movzx ecx, word [edi]
jmp 0x4abae6
movzx ecx, dx
jmp 0x4abae4
mov eax, ecx
cmp ax, di
jne 0x4abcc6
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4abcc6
cmp eax, 0x10000000
jae 0x4abcc6
cmp dword [eax + ebx], 0x4550
jne 0x4abcc6
lea ecx, [eax + 0x78]
mov eax, dword [ecx + ebx]
add ecx, ebx
test eax, eax
je 0x4abcc6
cmp dword [ecx + 4], 0
je 0x4abcc6
push 0
push str.SymbolServerSetOptions
add eax, ebx
push eax
push ecx
mov ecx, ebx
call fcn.004a2140
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret