Function at 0xa9b349
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
mov eax, dword [0xc940a0]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push esi
push edi
push 0x40000044
mov dword [esp + 0x48], ecx
call dword [sym.imp.SHELL32.dll_SHRestricted]
xor ebx, ebx
mov dword [esp + 0x3c], eax
push 0xfffffffffffffffc
lea edx, [esp + 0x34]
mov dword [esp + 0x34], ebx
pop ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call fcn.00a9c1e7
test eax, eax
jns 0xa9b5fa
lea ecx, [esp + 0x30]
call fcn.00b67649
push 0x5b
lea eax, [esp + 0xa4]
mov edx, 0x9f48c8
push eax
push 2
push 0x9f9fd0
mov ecx, reloc.SHCORE.dll_Ordinal_1
call fcn.00aac1c5
test eax, eax
jns 0xa9b3d4
xor eax, eax
mov word [esp + 0xa0], ax
xor eax, eax
mov esi, 0x9f0528
inc eax
push eax
push 0x9f9d64
push esi
call dword [sym.imp.SHCORE.dll_Ordinal_123]
push ebx
push 0x9fa01c
mov edi, eax
push esi
mov dword [esp + 0x1c], edi
call dword [sym.imp.SHCORE.dll_Ordinal_123]
mov esi, ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], esi
call fcn.00a9cbb3
test al, al
je 0xa9b481
mov dword [esp + 0xc], ebx
mov bl, 1
call fcn.00ab4ea1
test al, al
je 0xa9b43e
lea eax, [esp + 0xc]
push eax
push 0x9f9ff0
push 0x9f6508
call dword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_0.dll_PolicyManager_GetPolicyInt]
test eax, eax
js 0xa9b43e
cmp dword [esp + 0xc], esi
setne bl
and dword [esp + 0xc], esi
mov bh, 1
call fcn.00ab4ea1
test al, al
je 0xa9b46d
lea eax, [esp + 0xc]
push eax
push 0x9fa04c
push 0x9eefec
call dword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_0.dll_PolicyManager_GetPolicyInt]
test eax, eax
js 0xa9b46d
cmp dword [esp + 0xc], esi
setne bh
movzx esi, bl
mov dword [esp + 0x24], esi
test bl, bl
jne 0xa9b47c
test bh, bh
je 0xa9b481
call fcn.00a9cb1c
mov ebx, 0x1f4
test byte [ebx*8 + 0xa02c6c], 8
je 0xa9b49b
cmp dword [esp + 0x3c], 0
jne 0xa9b6f9
movzx eax, word [ebx*8 + 0xa02c68]
push eax
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrChrIW]
test eax, eax
jne 0xa9b6f9
cmp ebx, 0x1fc
jne 0xa9b4ca
test edi, edi
je 0xa9b6f9
cmp ebx, 0x23c
jne 0xa9b4dd
cmp dword [esp + 0x40], 0
je 0xa9b6f9
cmp ebx, 0x242
jne 0xa9b4ed
test esi, esi
je 0xa9b6f9
mov ecx, dword [0xc97280]
test cl, 2
jne 0xa9b510
lea eax, [esp + 0x50]
mov ecx, 0xc97280
push eax
call fcn.00a9b71f
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x4c], eax
xor eax, eax
xor edx, edx
mov word [esp + 0x2a], ax
inc edx
mov byte [esp + 0x2c], al
mov eax, ecx
shr ecx, 8
and ecx, edx
shr eax, 9
push 3
pop esi
and eax, edx
mov word [esp + 0x28], dx
mov dword [esp + 0xc], ecx
xor edx, edx
mov ecx, esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x20], eax
call fcn.00a5ef47
push ecx
push 0
lea ecx, [esp + 0x60]
mov dword [esp + 0x24], eax
push ecx
mov edx, eax
mov ecx, 0xc97288
call fcn.00a604e0
push 6
pop ecx
mov esi, eax
lea edi, [esp + 0x88]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [0xc96f84]
test edi, edi
je 0xa9b648
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x88]
push eax
push 0xc97288
xor eax, eax
mov ecx, edi
inc eax
push eax
push esi
push 0xa3b12d
call dword [0xc99200]
call edi
cmp dword [esp + 0xc], 0
je 0xa9b685
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov dword [esp + 0x84], eax
lea eax, [esp + 0x70]
push eax
push ecx
xor eax, eax
mov dword [esp + 0x78], ecx
inc eax
mov dword [esp + 0x7c], ecx
push eax
push esi
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x88], esi
mov esi, dword [0xc96f84]
mov ecx, esi
push 0xa3b12d
call dword [0xc99200]
call esi
jmp 0xa9b685
mov ecx, dword [esp + 0x30]
call fcn.00a9b892
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.00ab02ed
test esi, esi
je 0xa9b3a6
push 0x9f9bbc
push 0x5b
pop edx
lea ecx, [esp + 0xa4]
call fcn.00a535e0
test eax, eax
jns 0xa9b3d4
mov ecx, dword [ebp + 4]
push eax
push 0x9f9b8c
push 0x27
pop edx
call fcn.00ab606d
jmp 0xa9b3d4
cmp dword [esp + 0xc], 0
je 0xa9b685
mov esi, dword [esp + 0x1c]
cmp esi, 0xfe
je 0xa9b685
and dword [esp + 0x18], 0
cmp dword [esp + 0x20], 0
mov dword [esp + 0x14], 0xa3b12d
mov word [esp + 0x18], si
je 0xa9b67c
xor eax, eax
inc eax
or word [esp + 0x1a], ax
lea ecx, [esp + 0x14]
call fcn.00ab5f99
cmp dword [esp + 0x98], 0
jne 0xa9b6bc
mov esi, dword [0xc9581c]
test esi, esi
je 0xa9b6bc
xor eax, eax
xor ecx, ecx
inc eax
push eax
push ecx
push ecx
lea eax, [esp + 0x54]
push eax
push ecx
push ecx
lea eax, [esp + 0x40]
mov ecx, esi
push eax
push 0xa3b12d
call dword [0xc99200]
call esi
cmp ebx, 0x1f5
je 0xa9b6f5
movzx eax, word [ebx*8 + 0xa02c68]
push eax
mov eax, dword [ebx*8 + 0xa02c6c]
or eax, 0x4000
push eax
mov eax, dword [esp + 0x4c]
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_RegisterHotKey]
cmp ebx, 0x242
jne 0xa9b6f5
call fcn.00a9caf1
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
inc ebx
cmp ebx, 0x24e
jl 0xa9b486
mov ecx, dword [esp + 0x15c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00ab3c50
mov esp, ebp
pop ebp
ret