Function at 0x49d000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push ecx
push edx
push ebx
push ebp
push esi
push edi
call 0x49d00c
pop ecx
sub ecx, 0x8c40c
mov edx, 0
push ecx
add dword [ecx + 0x78], reloc.ADVAPI32.dll_TraceMessage
xor dword [ecx + 0x20], 0x25603448
add dword [ecx + 0xc4], 0x33a900b3
not dword [ecx + 0x74]
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x20097d8b
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + 0xd8]
sub dword [ecx + 0x54], 0x478f4c93
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x59b41e4d
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x2f5a28a9
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x215a6774
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x55912893
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x2d332cc4
xor dword [ecx + 0xcc], 0x46eb46f1
sub dword [ecx + 0xe8], 0x18462293
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x57930109
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x27b70e3c
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x2e25238b
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x78453632
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x438c29ac
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x79a40894
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x48976eef
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x70d6710f
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x1ca022ef
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x2eb1262
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x21e2167e
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x60452b1d
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x77a44e03
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x698e611b
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x7de30575
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x5a8b1ace
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x7e0b0e77
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x570f4570
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [ecx + 0xdc], 0x6cf20e60
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x560240fb
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x3d3c77b5
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x1a1e7583
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x42481acb
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x1dc245be
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x13d36ed9
xor dword [ecx + 0xe4], 0x7df66fd5
not dword [ecx + 0x1c]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + 0x80], 0x4a991fad
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x1cae16f7
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x2e765fb
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x34a717c7
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + 0x5c], 0x1e5b79ab
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x2d0a2b20
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x3f7a22c4
add dword [ecx + 0x2c], 0x4c0536d8
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x76c75742
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + 0xfc], 0x5a94a13
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x20a56bf8
xor dword [ecx + 0xec], 0x1655c4
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x3e1b54f6
sub dword [ecx + 0x30], 0x57057ffd
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [ecx + 0x58], 0x23457073
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x781b47ee
not dword [ecx + 0x64]
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x6c1651e2
sub dword [ecx + 0x34], 0x1dda07f6
xor dword [ecx + 0x9c], 0x35b2780a
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x1ae1626
add dword [ecx + 0xd4], 0x35a27888
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0xb4d1240
not dword [ecx + 0x14]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x4a2e29af
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x321c190e
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + 0x84]
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0xaa67599
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + 0x3c]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x4c922c67
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x7d7166cc
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x5568253e
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x28fb136f
xor dword [ecx + 0xc8], 0x6d6930b4
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x16620285
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x18780f57
add dword [ecx + 0x38], 0x4b177ee0
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x165073d5
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x25657878
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x732b5dfe
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x202118c7
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x7e1356fe
sub dword [ecx + 0xbc], 0x71241eb1
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + 0x6c], 0x6f206fa2
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x10fa71b9
sub dword [ecx + 0x70], 0x72a80b45
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x4ea33c09
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x57563c7f
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x319328f6
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x3ea70975
xor dword [ecx + 0x4c], 0x2c931934
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x12a960d6
not dword [ecx + 0x24]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx], reloc.ADVAPI32.dll_TraceMessage
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x58ee3b47
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x31fb446f
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x5c491be2
xor dword [ecx + 0xc0], 0x402b6121
sub dword [ecx + 4], 0x16a0696e
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x61f18f5
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x8563ce1
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + 0xf8], 0x2985fa3
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x658b500f
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x4c140b8c
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x643013ba
not dword [ecx + 0xb8]
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x7fa60e6a
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x16f5784c
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x7bb05fc4
add dword [ecx + 0x28], 0x8e3381f
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x22f35434
add dword [ecx + 0x90], 0x20be7ce9
sub dword [ecx + 0x44], 0x796d6699
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x3a5747d8
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x24d6519f
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x234c6ace
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x75df5d95
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x574b31b4
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x4a8d084a
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x243512ba
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x1a953df5
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x1fca1fb5
not dword [ecx + 0xa4]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0xe9265f
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x54b429ed
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0xd224373
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x11156bd3
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0xac9089b
sub dword [ecx + 0xe0], 0x6b116d48
not dword [ecx + 8]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x602622c1
add dword [ecx + 0xc], 0x253956cd
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x19234b4e
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + 0xf0], 0x7c0a5a85
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x33b107f0
add dword [ecx + 0xd0], 0x53ea2be1
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x3191145d
add dword [ecx + 0x48], 0x15340e6
not dword [ecx + 0x94]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x46f44253
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x4a1f2061
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x3fef7f1b
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x7ff73513
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x1e1c71e2
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x373534a8
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x248600c7
not dword [ecx + 0x40]
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x1a803065
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x64bb3f8f
sub dword [ecx + 0xac], 0x5996103d
add dword [ecx + 0x50], 0x36f604d6
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x49e16629
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x7b90c8c
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x2dfe70f0
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x5c592ae1
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x44f31fc6
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x34593510
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x563d1fb0
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x4428296d
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x18ce68a6
add dword [ecx + 0x8c], 0x3d4a4617
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x3c384102
sub dword [ecx + 0x10], 0x46a63fa0
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + 0xb4]
add dword [ecx + 0x88], 0x7446013
add dword [ecx + 0x18], 0x5b174009
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x479d32e1
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x706e0fb3
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x6793e36
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x6aa5104d
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + 0x7c], 0x7b14ee4
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x1a2763b8
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x241f730c
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x47b606a8
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x5bd90608
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x36233867
add dword [ecx + 0x68], 0x5ed3360a
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x7b7c3f46
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x2dae0e87
sub dword [ecx + 0x98], 0x301f59d4
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x9c0229a
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x4d2d45b1
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x2e454f93
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + 0x60], 0x56782b32
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x7c953a52
add dword [ecx + 0xa0], 0x7bf53655
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x268a4594
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x20b27d7f
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x1bf94b77
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x69363c8a
add dword [ecx + 0xb0], 0x67d14365
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x69303f97
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x9bb6743
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x2324545e
sub dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x4a874262
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0xd8848af
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
add dword [ecx + 0xf4], 0x1e8d5b33
xor dword [ecx + 0xa8], 0x2f9d1d31
not dword [ecx + reloc.ADVAPI32.dll_TraceMessage]
xor dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x941039
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x6d304144
add dword [ecx + reloc.ADVAPI32.dll_TraceMessage], 0x542a6f17
add edx, 0x400
add ecx, 0x400
cmp edx, 0x8c000
je 0x49d8c5
jmp 0x49d019
call fcn.0045a5b8
pop edi
pop esi
pop ebp
pop ebx
pop edx
pop ecx
pop eax