Function at 0x4d56e7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x10c8
call fcn.0051dcc0
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x10c4], eax
push edi
xor edi, edi
mov dword [0x5d544c], 1
cmp byte [0x58fed9], 0
mov dword [esp + 8], edi
mov dword [0x5d536c], edi
mov dword [0x5d5368], edi
mov dword [0x5d5370], edi
mov dword [0x5d5350], 0xffffffff
jne 0x4d58b7
call fcn.004d7120
test eax, eax
je 0x4d5806
movzx eax, byte [0x58fc0f]
push eax
push 1
push 0x5d5464
call fcn.00483010
call fcn.004d7120
test eax, eax
je 0x4d5806
push 0x5d5464
push 0x59701a
mov ecx, 0x5b68fc
call fcn.0047ad60
push 0x5d5464
call fcn.00494fa0
test al, al
jne 0x4d59e3
push 0x59701a
push 0x74
call fcn.004165b0
push 0x800
push 0x5d5464
lea eax, [esp + 0xd0]
push eax
call fcn.004b0360
push 1
push 0x5d5464
call fcn.00495580
push 0x5d5464
call fcn.004837b0
test al, al
je 0x4d57cc
movzx ecx, word [0x5d53b8]
movzx eax, word [0x5d53b6]
shl ecx, 0x10
add ecx, eax
mov dword [esp + 0x9c], edi
push ecx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xa4], edi
call fcn.004b1b50
push edi
lea eax, [esp + 0xa0]
push eax
push dword [0x5c5324]
push dword [0x5c5320]
push 0x800
push 0x5d5464
push 0x588ac0
call fcn.004b3950
cmp eax, 1
je 0x4d59e3
cmp eax, 6
je 0x4d59e3
movzx eax, byte [0x58fc0f]
push eax
push 1
push 0x5d5464
call fcn.00483010
call fcn.004d7120
test eax, eax
jne 0x4d59e3
push 0x5d5464
lea eax, [esp + 0xcc]
push eax
push 0x59701a
push 0x23
call fcn.00463ab0
cmp byte [0x58fed9], 0
jne 0x4d58b7
cmp dword [0x5c5324], edi
jl 0x4d58b7
jg 0x4d582e
cmp dword [0x5c5320], 0xffffffff
jbe 0x4d58b7
push 0x58aad6
call fcn.00483b80
test al, al
je 0x4d58b7
xor eax, eax
mov dword [esp + 0x2c], 0x54266c
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], 0x54266c
mov dword [esp + 0x34], 0x54266c
mov dword [esp + 0x38], 0x54266c
mov dword [esp + 0x3c], 0x54266c
mov dword [esp + 0x40], 0x54266c
mov dword [esp + 0x44], 0x54266c
mov dword [esp + 0x48], 0x54266c
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], 0x7e
call fcn.004b2040
cmp byte [0x58fed9], 0
push esi
mov byte [esp + 0xb], 0
jne 0x4d599f
cmp dword [0x5c5324], edi
jl 0x4d599f
jg 0x4d58e8
cmp dword [0x5c5320], 0xf4240
jbe 0x4d599f
push 0
push 0x400
push dword [0x5c5324]
push dword [0x5c5320]
call fcn.0051dcf0
cmp edx, dword [0x5c531c]
jg 0x4d599f
jl 0x4d591a
cmp eax, dword [0x5c5318]
jae 0x4d599f
cmp dword [0x5c5324], edi
jl 0x4d594d
jg 0x4d5930
cmp dword [0x5c5320], 0x5f5e100
jbe 0x4d594d
mov ecx, dword [0x5d5378]
call fcn.00481c30
cmp edx, dword [0x5c531c]
jl 0x4d599f
jg 0x4d594d
cmp eax, dword [0x5c5318]
jbe 0x4d599f
mov edi, dword [0x5d5450]
push 0
push dword [0x5c5324]
mov esi, dword [edi]
push dword [0x5c5320]
mov esi, dword [esi + 0x10]
mov ecx, esi
call dword [0x541740]
mov ecx, edi
call esi
mov ecx, dword [0x5d5450]
call fcn.00482690
mov edi, dword [0x5d5450]
push 0
push 0
push 0
mov eax, dword [edi]
mov byte [esp + 0x17], 1
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x541740]
mov ecx, edi
call esi
mov eax, dword [0x5c5320]
mov ecx, dword [0x5c5324]
inc dword [0x5c5338]
push ebx
push ebp
mov dword [0x5c5330], eax
mov dword [0x5c5334], ecx
call fcn.004d6c20
mov cx, word [0x5d53b4]
movzx eax, cx
cmp eax, 0x62
ja case.0x4d59dc.2
movzx eax, byte [eax + 0x4d638c]
jmp dword [eax*4 + 0x4d6364]
mov eax, 0x34
pop edi
mov ecx, dword [esp + 0x10c4]
xor ecx, esp
call fcn.0051dca8
add esp, 0x10c8
ret
xor ecx, ecx
xor ebp, ebp
xor edi, edi
mov edx, 0x5c534c
mov dword [0x5d5460], ecx
mov dword [0x5d545c], edx
jmp 0x4d5a20
mov esi, dword [0x5d5360]
mov eax, dword [0x5d5364]
add esi, 0xffffffff
mov dword [0x5d5360], esi
adc eax, 0xffffffff
mov dword [0x5d5364], eax
js 0x4d5a54
jg 0x4d5a44
test esi, esi
jb 0x4d5a54
mov eax, dword [0x5d5358]
movzx ebx, byte [eax]
inc eax
mov dword [0x5d5358], eax
jmp 0x4d5a67
call fcn.004d7600
mov ecx, dword [0x5d5460]
mov ebx, eax
mov edx, dword [0x5d545c]
cmp ebx, 0xffffffff
je 0x4d5b1e
mov byte [edx], bl
mov ecx, dword [0x5d5460]
mov edx, dword [0x5d545c]
inc ecx
inc edx
mov dword [0x5d5460], ecx
mov dword [0x5d545c], edx
cmp ecx, 0x10000
jne 0x4d5a20
mov ebx, dword [0x5d538c]
add ebp, 0x10000
mov dword [esp + 0x18], ebp
mov ebp, dword [0x5d5388]
adc edi, 0
mov dword [esp + 0x1c], edi
mov edi, dword [0x5d5378]
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x541740]
mov ecx, edi
call esi
add eax, dword [0x5d5390]
mov edi, dword [esp + 0x1c]
adc edx, dword [0x5d5394]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push edx
push eax
push dword [0x5c5324]
push dword [0x5c5320]
push edi
push ebp
call fcn.004b3b10
call fcn.004b3b80
call fcn.004b3b90
test al, al
jne 0x4d5b18
push dword [0x5d5460]
push 0x5c534c
call fcn.004d6ed0
xor ecx, ecx
jmp 0x4d5a04
mov ecx, dword [0x5d5460]
test ecx, ecx
je 0x4d5b2d
push ecx
push 0x5c534c
call fcn.004d6ed0
xor ebx, ebx
mov byte [esp + 0x12], 0
call fcn.004b3b90
test al, al
je 0x4d5b4b
cmp byte [0x58fed9], 0
jne 0x4d5b4b
mov byte [esp + 0x12], 1
cmp ebx, 6
jne 0x4d5b5a
mov ecx, 0x5b68fc
call fcn.0047b0f0
cmp byte [0x5d65f5], 0
je 0x4d608d
push 0xa
lea eax, [esp + 0xb8]
push eax
push 0x5d6600
call fcn.004db720
cmp dword [0x5c531c], 0
jg 0x4d5ba3
jl 0x4d5b8f
cmp dword [0x5c5318], 0
jae 0x4d5ba3
mov dword [0x5c5318], 0
mov dword [0x5c531c], 0
call fcn.004d7930
add dword [0x5c5318], 0xa
adc dword [0x5c531c], 0
call fcn.004d6c20
mov eax, dword [0x5c5348]
and dword [eax + 0x40], 0xfffffffe
xor esi, esi
mov edx, dword [0x5d5364]
mov ecx, dword [0x5d5360]
mov eax, dword [0x5d5358]
jmp 0x4d5be0
add ecx, 0xffffffff
mov dword [0x5d5360], ecx
adc edx, 0xffffffff
mov dword [0x5d5364], edx
js 0x4d6017
jg 0x4d5c02
test ecx, ecx
jb 0x4d6017
mov bl, byte [eax]
inc eax
mov dword [0x5d5358], eax
jmp 0x4d602f
push dword [0x5c5324]
push dword [0x5c5320]
push dword [0x5c531c]
push dword [0x5c5318]
call fcn.004d33e0
jmp 0x4d5b2d
mov eax, dword [0x5c5318]
xor esi, esi
mov edi, dword [0x5c5320]
mov ebp, dword [0x5c5324]
mov edx, dword [0x5d5364]
mov ecx, dword [0x5d5360]
mov dword [esp + 0x18], eax
mov eax, dword [0x5c531c]
mov dword [esp + 0x1c], eax
mov eax, dword [0x5d5358]
add ecx, 0xffffffff
mov dword [0x5d5360], ecx
adc edx, 0xffffffff
mov dword [0x5d5364], edx
js 0x4d5c87
jg 0x4d5c7c
test ecx, ecx
jb 0x4d5c87
movzx ebx, byte [eax]
inc eax
mov dword [0x5d5358], eax
jmp 0x4d5c9f
call fcn.004d7600
mov edx, dword [0x5d5364]
mov ebx, eax
mov ecx, dword [0x5d5360]
mov eax, dword [0x5d5358]
mov byte [esp + esi + 0xa8], bl
inc esi
cmp esi, 9
jb 0x4d5c62
cmp byte [esp + 0xaa], 5
jne 0x4d5d1a
cmp byte [esp + 0xab], 0
jne 0x4d5d1a
push 5
lea eax, [esp + 0xb0]
mov dword [esp + 0x50], 0
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x50], 0
push eax
call fcn.0042bce0
test eax, eax
je 0x4d5cf7
mov ecx, 0x5b68fc
call fcn.0047b0f0
jmp 0x4d5b2d
push ebp
push edi
push dword [esp + 0x24]
lea eax, [esp + 0x44]
push dword [esp + 0x24]
push eax
call fcn.004d3190
lea eax, [esp + 0x38]
push eax
call fcn.0042c470
jmp 0x4d5b2d
push 0x5d5464
push 0x59701a
mov ecx, 0x5b68fc
call fcn.0047b9a0
jmp 0x4d5b2d
push dword [0x5c5324]
push dword [0x5c5320]
push dword [0x5c531c]
push dword [0x5c5318]
call fcn.004dcb60
jmp 0x4d5b2d
push dword [0x5c5324]
push dword [0x5c5320]
push dword [0x5c531c]
push dword [0x5c5318]
call fcn.004d35c0
jmp 0x4d5b2d
mov eax, dword [0x5c5318]
mov dword [esp + 0x34], eax
mov eax, dword [0x5c531c]
mov dword [esp + 0x30], eax
call fcn.00434540
push eax
mov dword [esp + 0x2c], eax
call fcn.0051de7f
add esp, 4
mov dword [esp + 0x24], eax
call fcn.00434550
push eax
mov dword [esp + 0xac], eax
call fcn.0051de7f
add esp, 4
mov esi, eax
mov dword [esp + 0x18], esi
call fcn.00434560
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4d5b2d
mov dword [esp + 0x2c], 0
mov dword [esp + 0x20], 0
call fcn.004b3b90
test al, al
jne 0x4d5f6c
call fcn.004b3b80
mov edi, dword [0x5d5378]
mov ebp, dword [0x5d5388]
mov ebx, dword [0x5d538c]
mov eax, dword [edi]
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x541740]
mov ecx, edi
call esi
add eax, dword [0x5d5390]
push ebx
adc edx, dword [0x5d5394]
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x28]
push edx
push eax
push dword [esp + 0x40]
push dword [esp + 0x48]
push ebp
push ebx
call fcn.004b3b10
mov edx, dword [esp + 0x28]
xor esi, esi
test edx, edx
je 0x4d5f68
mov ebp, dword [esp + 0x24]
lea esp, [esp]
mov ecx, dword [0x5d5360]
mov eax, dword [0x5d5364]
add ecx, 0xffffffff
mov dword [0x5d5360], ecx
adc eax, 0xffffffff
mov dword [0x5d5364], eax
js 0x4d5e84
jg 0x4d5e74
test ecx, ecx
jb 0x4d5e84
mov eax, dword [0x5d5358]
movzx ecx, byte [eax]
inc eax
mov dword [0x5d5358], eax
jmp 0x4d5e8f
call fcn.004d7600
mov edx, dword [esp + 0x28]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4d5e9c
mov byte [esi + ebp], cl
inc esi
cmp esi, edx
jb 0x4d5e50
mov ebp, dword [esp + 0x20]
test esi, esi
je 0x4d5f68
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x18]
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc8], 0
lea esp, [esp]
mov eax, dword [esp + 0xa8]
mov dword [esp + 0xb8], eax
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0xb8]
mov dword [esp + 0xb8], edi
push eax
push dword [esp + 0x24]
mov dword [esp + 0xc8], 0
call fcn.00434e70
mov esi, eax
push esi
call fcn.00435bd0
test eax, eax
jne 0x4d5f46
push dword [esp + 0xbc]
push edi
call fcn.004d6ed0
add ebx, dword [esp + 0xbc]
mov eax, dword [esp + 0xc8]
adc ebp, 0
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebp
cmp eax, dword [esp + 0xc4]
jb 0x4d5ed0
jmp 0x4d5f5b
push esi
call fcn.004358b0
cmp eax, 0x40
jne 0x4d5f5b
mov ecx, 0x5b68fc
call fcn.0047b0f0
call fcn.004b3b90
test al, al
je 0x4d5de8
mov esi, dword [esp + 0x18]
push dword [esp + 0x1c]
call fcn.004357c0
push dword [esp + 0x24]
call fcn.0051de88
push esi
call fcn.0051de88
add esp, 8
jmp 0x4d5b2d
call fcn.004dbdc0
xor ebx, ebx
test eax, eax
je 0x4d5b2f
cmp eax, 3
sete bl
lea ebx, [ebx*4 + 2]
mov dword [esp + 0x14], ebx
jmp 0x4d5b2f
call fcn.004d1ce0
test eax, eax
je 0x4d5b2d
cmp eax, 5
je 0x4d5fc7
xor ebx, ebx
jmp 0x4d5f9b
mov eax, dword [0x5c5328]
xor ecx, ecx
cmp ecx, dword [0x5d53c4]
jg 0x4d5fee
jl 0x4d5fe0
cmp eax, dword [0x5d53c0]
ja 0x4d5fee
mov ebx, 1
mov dword [esp + 0x14], ebx
jmp 0x4d5b2f
mov ebx, 2
mov dword [esp + 0x14], ebx
jmp 0x4d5b2f
xor eax, eax
cmp cx, 9
sete al
push eax
call fcn.004d81a0
test eax, eax
je 0x4d5b2d
xor ebx, ebx
jmp 0x4d5f9b
call fcn.004d7600
mov edx, dword [0x5d5364]
mov bl, al
mov ecx, dword [0x5d5360]
mov eax, dword [0x5d5358]
mov byte [esp + esi + 0xa8], bl
inc esi
cmp esi, 0xa
jb 0x4d5be0
mov eax, dword [0x5c5348]
lea ecx, [esp + 0xa8]
lea edx, [esp + 0xb4]
or dword [eax + 0x40], 1
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4d61cd
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jne 0x4d61cd
movzx eax, word [ecx + 8]
cmp ax, word [edx + 8]
jne 0x4d61cd
cmp byte [0x5d65f5], 0
je 0x4d608d
cmp byte [0x5d65f6], 0
je 0x4d60a0
mov eax, dword [0x5d5350]
not eax
cmp eax, dword [0x5d53bc]
jne 0x4d61cd
cmp byte [0x58fed9], 0
je 0x4d62c0
mov edi, dword [0x5d53a8]
test edi, edi
je 0x4d6295
movzx ebp, word [0x5d53d2]
cmp ebp, 4
jb 0x4d6123
push edi
call fcn.004d7000
mov si, ax
lea eax, [edi + 2]
push eax
call fcn.004d7000
movzx ebx, ax
lea eax, [ebp - 4]
movzx ecx, si
cmp ebx, eax
ja 0x4d6192
cmp ecx, 9
je 0x4d60ff
cmp ecx, 0x4453
je 0x4d6138
cmp ecx, 0x4c41
jne 0x4d6110
push 0
push 4
push ebx
push edi
call fcn.004d6780
mov esi, eax
test esi, esi
jne 0x4d617a
mov eax, 0xfffffffc
add edi, 4
sub eax, ebx
add edi, ebx
add ebp, eax
cmp ebp, 4
jae 0x4d60c7
xor esi, esi
mov edi, dword [esp + 0x14]
cmp esi, edi
jle 0x4d6299
mov edi, esi
jmp 0x4d6299
cmp ebx, 5
jb 0x4d615d
cmp byte [edi + 8], 0
ja 0x4d6156
push 0
push 5
push ebx
push edi
call fcn.004d6780
mov esi, eax
test esi, esi
jne 0x4d6162
jmp 0x4d6110
mov esi, 0x4001
jmp 0x4d6162
mov esi, 0x4f
push 0x5d5464
push str.NTFS_ACL
push 0x59701a
push 0x48
call fcn.00463ab0
jmp 0x4d6125
push 0x5d5464
push str.OS_2
push 0x59701a
push 0x48
call fcn.00463ab0
jmp 0x4d6125
push ecx
push 0x554354
lea eax, [esp + 0xc8]
push 0xa
push eax
call fcn.00402c90
add esp, 0x10
lea eax, [esp + 0xc0]
push 0x5d5464
push eax
push 0x59701a
push 0x48
call fcn.00463ab0
mov esi, 2
jmp 0x4d6125
mov edi, dword [esp + 0x14]
cmp edi, 1
jbe 0x4d61df
cmp edi, 2
jne 0x4d6277
mov eax, dword [0x5c5348]
lea ecx, [esp + 0x38]
mov dword [esp + 0x40], 0x54266c
mov dword [esp + 0x44], 0x54266c
mov dword [esp + 0x48], 0x54266c
test byte [eax + 0x40], 1
mov dword [esp + 0x4c], 0x54266c
mov dword [esp + 0x50], 0x54266c
mov dword [esp + 0x54], 0x54266c
mov dword [esp + 0x38], 0x59701a
mov dword [esp + 0x3c], 0x5d5464
mov dword [esp + 0x78], 2
mov dword [esp + 0x80], 4
jne 0x4d624c
mov dword [esp + 0x80], 3
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x7c], eax
call fcn.004b2040
cmp byte [0x58fc68], 0
jne 0x4d628e
cmp byte [0x58fed9], 0
jne 0x4d628e
mov byte [esp + 0x12], 1
mov edi, 2
jmp 0x4d6299
mov edi, dword [esp + 0x14]
cmp byte [0x58fed9], 0
je 0x4d62c4
mov bl, byte [esp + 0x12]
test bl, bl
je 0x4d62b4
push 0x5d5464
call fcn.004831b0
call fcn.004d7930
mov eax, edi
jmp 0x4d634a
mov edi, dword [esp + 0x14]
cmp byte [esp + 0x13], 0
je 0x4d62ea
test edi, edi
jne 0x4d62df
cmp dword [0x5c5334], edi
ja 0x4d62df
cmp dword [0x5c5330], edi
jbe 0x4d62ea
mov ecx, dword [0x5d5450]
call fcn.00482690
cmp byte [0x58fed9], 0
mov bl, byte [esp + 0x12]
jne 0x4d62a6
test bl, bl
jne 0x4d630d
push 0x5d5464
call fcn.00403000
cmp byte [0x58fed9], bl
jne 0x4d62b4
call fcn.004d6b40
jmp 0x4d62a6
push 0x5d5464
push 0x59701a
mov ecx, 0x5b68fc
call fcn.0047b9a0
call fcn.004d7930
cmp byte [0x58fed9], 0
jne 0x4d6345
call fcn.004d6b40
push 0x5d5464
call fcn.004831b0
mov eax, 1
mov ecx, dword [esp + 0x10d4]
pop ebp
pop ebx
pop esi
pop edi
xor ecx, esp
call fcn.0051dca8
add esp, 0x10c8
ret