Function at 0x4ecb00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x654feb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x20b4
call fcn.006218a0
mov eax, dword [0x758898]
xor eax, esp
mov dword [esp + 0x20b0], eax
push ebx
push esi
push edi
mov eax, dword [0x758898]
xor eax, esp
push eax
lea eax, [esp + 0x20c8]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x38], esi
mov dword [0x75e688], esi
mov dword [esp + 0x24], ebx
cmp dword [ebx + 0x40], esi
je 0x4f1b92
mov eax, dword [ebx + 0x18]
push 0x67de24
push eax
call fcn.00622e3d
add esp, 8
mov dword [esp + 0x20], eax
cmp eax, esi
je 0x4f1b92
push eax
lea eax, [esp + 0xc0]
push 0x2000
push eax
mov dword [ebx + 0x48], esi
mov dword [ebx + 0x60], esi
mov dword [ebx + 0x54], esi
mov dword [esp + 0x34], esi
call fcn.006239a5
add esp, 0xc
test eax, eax
je 0x4f1b92
cmp byte [esp + 0xbc], 0xef
mov edi, 0xfde9
jne 0x4ecbd5
cmp byte [esp + 0xbd], 0xbb
jne 0x4ecbd5
cmp byte [esp + 0xbe], 0xbf
jne 0x4ecbd5
mov esi, 1
mov dword [ebx + 0x38], edi
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, edi
jne 0x4ecc7f
xor eax, eax
cmp esi, eax
je 0x4ecbfb
mov dword [ebx + 0x34], edi
mov dword [0x75e688], 1
jmp 0x4eccf7
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
movzx eax, word [ebx + 0x3c]
mov ecx, 0x400
cmp ax, cx
movzx eax, ax
ja 0x4ecc46
add eax, ecx
push 0x1000
lea edx, [esp + 0x98]
push edx
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x4eccf7
mov eax, dword [esp + 0x98]
mov dword [ebx + 0x34], eax
mov eax, 1
mov dword [0x75e688], eax
mov dword [esp + 0x28], eax
mov dword [ebx + 0x38], edi
jmp 0x4eccf7
xor eax, eax
cmp esi, eax
je 0x4ecc8a
mov dword [ebx + 0x34], edi
jmp 0x4eccf7
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
movzx eax, word [ebx + 0x3c]
mov ecx, 0x400
cmp ax, cx
movzx eax, ax
ja 0x4eccd5
add eax, ecx
push 0x1000
lea edx, [esp + 0x98]
push edx
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x4eccf7
mov eax, dword [esp + 0x98]
mov dword [ebx + 0x38], eax
mov ecx, dword [esp + 0x20]
push ecx
lea edx, [esp + 0xc0]
push 0x2000
push edx
call fcn.006239a5
add esp, 0xc
test eax, eax
je 0x4f1b60
or esi, 0xffffffff
lea ebx, [esi + 3]
nop
xor edi, edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], edi
call fcn.00402500
mov dword [esp + 0x20d0], 1
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc0]
push 0x67942c
push ecx
call fcn.00621b5e
add esp, 0xc
cmp eax, 1
je 0x4ecde0
cmp byte [esp + 0xbc], 0x6d
jne 0x4ecda0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xc1]
push 0x67942c
push eax
call fcn.00621b5e
add esp, 0xc
cmp eax, 1
je 0x4ecd9b
mov dword [esp + 0x20d0], esi
lea ecx, [esp + 0x18]
call fcn.004e6f40
jmp 0x4f1b3e
mov edi, 1
cmp byte [esp + 0xbc], 0x74
jne 0x4ece0b
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xc1]
push 0x67942c
push edx
call fcn.00621b5e
add esp, 0xc
cmp eax, 1
je 0x4ecdde
mov dword [esp + 0x20d0], esi
lea ecx, [esp + 0x18]
call fcn.004e6f40
jmp 0x4f1b3e
mov edi, ebx
lea eax, [esp + 0xbc]
push 0x3d
push eax
call fcn.00621750
add esp, 8
test eax, eax
jne 0x4ece24
mov dword [esp + 0x20d0], esi
lea ecx, [esp + 0x18]
call fcn.004e6f40
jmp 0x4f1b3e
test edi, edi
jne 0x4ecde0
mov dword [esp + 0x20d0], esi
lea ecx, [esp + 0x18]
call fcn.004e6f40
jmp 0x4f1b3e
inc eax
mov ecx, eax
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4ece30
sub ecx, esi
cmp ecx, ebx
jle 0x4ece52
dec ecx
cmp byte [ecx + eax], 0xa
jne 0x4ece47
mov byte [ecx + eax], dl
dec ecx
cmp byte [ecx + eax], 0xd
jne 0x4ece52
mov byte [ecx + eax], 0
push eax
lea ecx, [esp + 0x14]
call fcn.004030b0
mov byte [esp + 0x20d0], bl
push 0x67f2c4
push 0x6a0060
lea ecx, [esp + 0x18]
call fcn.00402c10
push 0x67f2c0
push 0x6a005c
lea ecx, [esp + 0x18]
call fcn.00402c10
push 0x6a0058
push 0x6a0054
lea ecx, [esp + 0x18]
call fcn.00402c10
push 0x6a0050
push 0x6a004c
lea ecx, [esp + 0x18]
call fcn.00402c10
push 0x67d038
push 0x6a0048
lea ecx, [esp + 0x18]
call fcn.00402c10
cmp dword [esp + 0x28], 0
mov esi, dword [esp + 0x24]
je 0x4ecede
mov edx, dword [esi + 0x34]
lea ecx, [esp + 0x10]
push ecx
push edx
call fcn.004e7d00
add esp, 8
mov eax, dword [esp + 0x14]
cmp eax, 0x4e20
jg 0x4ecfe7
je 0x4ecfd3
cmp eax, 0x4cc
jg 0x4ecf77
cmp eax, 0x4cb
jge case.0x4ecf70.1076
cmp eax, 0x424
jg 0x4ecf5a
je case.0x4ecf70.1076
lea ecx, [eax - 0x86]
cmp ecx, 0xc9
ja case.0x4ecf70.1077
movzx ecx, byte [ecx + 0x4f1bcc]
jmp dword [ecx*4 + 0x4f1bb8]
mov edx, dword [esp + 0x10]
push edx
mov ecx, 0x75f1e8
call fcn.0054f250
jmp case.0x4ecf2b.334
mov eax, dword [esp + 0x10]
push eax
mov ecx, 0x75f608
call fcn.0054f250
jmp case.0x4ecf2b.334
lea ecx, [eax - 0x434]
cmp ecx, 0x31
ja case.0x4ecf70.1077
movzx ecx, byte [ecx + 0x4f1ca0]
jmp dword [ecx*4 + 0x4f1c98]
cmp eax, 0x54f
jg 0x4ecfae
cmp eax, 0x54d
jge case.0x4ecf70.1076
mov ecx, eax
sub ecx, 0x4d3
je case.0x4ecf70.1076
sub ecx, 0x24
je case.0x4ecf70.1076
sub ecx, 0x2e
je case.0x4ecf70.1076
jmp case.0x4ecf70.1077
mov ecx, eax
sub ecx, 0x698
je case.0x4ecf70.1076
sub ecx, 0x62
je case.0x4ecf70.1076
sub ecx, 0x46
je case.0x4ecf70.1076
jmp case.0x4ecf70.1077
mov edx, dword [esp + 0x10]
push edx
mov ecx, 0x75e984
call fcn.0054f250
jmp case.0x4ecf2b.334
cmp eax, 0x82e6
jg 0x4f156b
je case.0x4ecf2b.334
lea ecx, [eax - 0x4e21]
cmp ecx, 0x4c8
ja case.0x4ecf70.1077
jmp dword [ecx*4 + 0x4f1cd4]
cmp eax, 0x84f1
jl case.0x4ecf70.1077
cmp eax, 0x84f3
jg case.0x4ecf70.1077
cmp eax, 0x437
jne 0x4f1597
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, 0x75f2f8
jmp 0x4f1ac7
cmp eax, 0x434
jne 0x4f15b5
cmp edi, ebx
jne case.0x4ecf70.1077
mov edx, dword [esp + 0x10]
push edx
mov ecx, 0x75f7b8
jmp 0x4f1ac7
cmp eax, 0x14f
jne 0x4f15cb
mov eax, dword [esp + 0x10]
push eax
mov ecx, 0x75f448
jmp 0x4f1ac7
cmp eax, 0x462
jne 0x4f15e1
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, 0x75f724
jmp 0x4f1ac7
cmp eax, 0x6fa
jne 0x4f15f7
mov edx, dword [esp + 0x10]
push edx
mov ecx, 0x75f720
jmp 0x4f1ac7
cmp eax, 0x84f2
jne 0x4f160d
mov eax, dword [esp + 0x10]
push eax
mov ecx, 0x75f46c
jmp 0x4f1ac7
cmp eax, 0x84f3
jne 0x4f1623
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, 0x75f470
jmp 0x4f1ac7
cmp eax, 0x54d
jne 0x4f1678
lea ecx, [esp + 0x7c]
call fcn.0040e040
mov byte [esp + 0x20d0], 3
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x80]
mov dword [esp + 0x84], 0x73a
call fcn.0054f250
lea eax, [esp + 0x7c]
push eax
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x7c]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x740
jne 0x4f16c7
lea ecx, [esp + 0x3c]
call fcn.0040e040
mov byte [esp + 0x20d0], 4
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x40]
mov dword [esp + 0x44], 0x744
call fcn.0054f250
lea edx, [esp + 0x3c]
push edx
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x3c]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x54e
jne 0x4f1725
lea ecx, [esp + 0x8c]
call fcn.0040e040
mov byte [esp + 0x20d0], 5
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x94], 0x73b
call fcn.0054f250
lea ecx, [esp + 0x8c]
push ecx
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x8c]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x54f
jne 0x4f1774
lea ecx, [esp + 0x4c]
call fcn.0040e040
mov byte [esp + 0x20d0], 6
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x50]
mov dword [esp + 0x54], 0x73c
call fcn.0054f250
lea eax, [esp + 0x4c]
push eax
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x4c]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x4d3
jne 0x4f17c3
lea ecx, [esp + 0x2c]
call fcn.0040e040
mov byte [esp + 0x20d0], 7
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], 0x735
call fcn.0054f250
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x2c]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x4cb
jne 0x4f1812
lea ecx, [esp + 0x5c]
call fcn.0040e040
mov byte [esp + 0x20d0], 8
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x60]
mov dword [esp + 0x64], 0x736
call fcn.0054f250
lea ecx, [esp + 0x5c]
push ecx
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x5c]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x4f7
jne 0x4f1870
lea ecx, [esp + 0xb4]
call fcn.0040e040
mov byte [esp + 0x20d0], 9
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0xb8]
mov dword [esp + 0xbc], 0x737
call fcn.0054f250
lea eax, [esp + 0xb4]
push eax
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0xb4]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x4cc
jne 0x4f18bf
lea ecx, [esp + 0x6c]
call fcn.0040e040
mov byte [esp + 0x20d0], 0xa
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x70]
mov dword [esp + 0x74], 0x738
call fcn.0054f250
lea edx, [esp + 0x6c]
push edx
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x6c]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x424
jne 0x4f190e
lea ecx, [esp + 0x34]
call fcn.0040e040
mov byte [esp + 0x20d0], 0xb
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x3c], 0x739
call fcn.0054f250
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x34]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x463
jne 0x4f195d
lea ecx, [esp + 0x44]
call fcn.0040e040
mov byte [esp + 0x20d0], 0xc
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x4c], 0x725
call fcn.0054f250
lea eax, [esp + 0x44]
push eax
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x44]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x464
jne 0x4f19ac
lea ecx, [esp + 0x54]
call fcn.0040e040
mov byte [esp + 0x20d0], 0xd
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x58]
mov dword [esp + 0x5c], 0x726
call fcn.0054f250
lea edx, [esp + 0x54]
push edx
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x54]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x525
jne 0x4f19fb
lea ecx, [esp + 0x64]
call fcn.0040e040
mov byte [esp + 0x20d0], 0xe
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x6c], 0x1ee
call fcn.0054f250
lea ecx, [esp + 0x64]
push ecx
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x64]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x698
jne 0x4f1a4a
lea ecx, [esp + 0x74]
call fcn.0040e040
mov byte [esp + 0x20d0], 0xf
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x78]
mov dword [esp + 0x7c], 0x731
call fcn.0054f250
lea eax, [esp + 0x74]
push eax
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x74]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x465
jne 0x4f1aa5
lea ecx, [esp + 0x84]
call fcn.0040e040
mov byte [esp + 0x20d0], 0x10
mov ecx, dword [esp + 0x10]
push ecx
lea ecx, [esp + 0x88]
mov dword [esp + 0x8c], 0x727
call fcn.0054f250
lea edx, [esp + 0x84]
push edx
mov ecx, esi
call fcn.004e8d90
mov byte [esp + 0x20d0], bl
lea ecx, [esp + 0x84]
call fcn.004e6f40
jmp 0x4f1acc
cmp eax, 0x84f1
jne case.0x4ecf70.1077
cmp edi, 1
jne 0x4f1abd
mov eax, dword [esp + 0x10]
push eax
mov ecx, 0x75f464
jmp 0x4f1ac7
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, 0x75f468
call fcn.0054f250
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
call fcn.0054f250
mov eax, edi
sub eax, 1
je 0x4f1b0a
sub eax, 1
je 0x4f1afc
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004e8d90
jmp case.0x4ecf2b.334
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.004e8e90
jmp case.0x4ecf2b.334
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.004e8c90
mov byte [esp + 0x20d0], 1
lea ecx, [esp + 0x10]
call fcn.00402570
mov dword [esp + 0x20d0], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.004e6f40
or esi, 0xffffffff
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0xc0]
push 0x2000
push ecx
call fcn.006239a5
add esp, 0xc
test eax, eax
jne 0x4ecd20
mov edx, dword [esp + 0x20]
push edx
call fcn.00622b17
mov eax, dword [0x75efb4]
mov ecx, dword [0x75efb0]
push eax
push ecx
push str.mailto:_subject_sbody_s__20https:__www.internetdownloadmanager.com
push 0x75efac
call fcn.00402f70
mov ecx, dword [esp + 0x38]
add esp, 0x14
call fcn.004e6320
mov ecx, dword [esp + 0x20c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20b0]
xor ecx, esp
call fcn.0062016f
mov esp, ebp
pop ebp
ret