Function at 0x4b2200
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x750
mov eax, dword [edx + 4]
movaps xmm0, xmmword [0x560240]
mov ebx, ecx
mov cl, 1
xor esi, esi
mov byte [esp + 0x8a], 0
mov dword [esp + 0x68], 4
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 2
mov word [esp + 0x88], 0
mov dword [esp + 0x10], edx
test cl, cl
movups xmmword [esp + 0x78], xmm0
mov dword [esp + 0x64], 0x2020200
mov dword [esp + 0x3c], eax
mov byte [esp + 0x8c], 0
jne 0x4b22bd
mov byte [esp + 0x8c], 1
mov byte [esp + 0x8a], 0
mov edi, dword [esp + 0x68]
mov dword [esp + 0x70], 0
add edi, 4
jmp 0x4b22a6
add edi, 0xc
dec esi
je 0x4b22da
cmp dword [edi], 0
je 0x4b22a0
push dword [edi - 4]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
jmp 0x4b22a0
mov eax, dword [edx + 4]
mov edi, edx
test eax, eax
je 0x4b22f9
mov edx, dword [edi]
lea ecx, [esp + 0x68]
push eax
call sym.aho_corasick::packed::pattern::Patterns::add::h464c4b7cb4317b00
add esp, 4
jmp 0x4b236c
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0xffffffff
mov word [esp + 0x88], 0
jmp 0x4b236c
mov byte [esp + 0x8c], 1
mov byte [esp + 0x8a], 0
mov edi, ebx
mov al, 1
mov ebx, dword [esp + 0x68]
test al, al
mov dword [esp + 0x70], 0
jne 0x4b234d
add ebx, 4
jmp 0x4b2336
add ebx, 0xc
dec esi
je 0x4b234d
cmp dword [ebx], 0
je 0x4b2330
push dword [ebx - 4]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
jmp 0x4b2330
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0xffffffff
mov word [esp + 0x88], 0
mov ebx, edi
lea ecx, [esp + 0x1c8]
lea edx, [esp + 0x64]
call sym.aho_corasick::packed::api::Builder::build::h13e750a78c2cdc2c
movzx eax, byte [esp + 0x208]
cmp al, 2
jne 0x4b23d1
mov esi, dword [esp + 0x70]
mov byte [ebx + 0x1a0], 2
test esi, esi
je 0x4b24bd
mov edi, dword [esp + 0x68]
add edi, 4
jmp 0x4b23ba
add edi, 0xc
dec esi
je 0x4b24bd
cmp dword [edi], 0
je 0x4b23b0
push dword [edi - 4]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
jmp 0x4b23b0
mov byte [esp + 3], al
mov eax, dword [esp + 0x1c8]
movsd xmm0, qword [esp + 0x1d4]
mov ecx, dword [esp + 0x1e8]
mov edi, dword [esp + 0x70]
mov dword [esp + 0x2c], ebx
mov edx, dword [esp + 0x1f0]
mov ebx, dword [esp + 0x1ec]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1cc]
movsd qword [esp + 0x50], xmm0
movsd xmm0, qword [esp + 0x1dc]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x1f4]
test edi, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1d0]
movsd qword [esp + 0x58], xmm0
movsd xmm0, qword [esp + 0x1f8]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1e4]
movsd qword [esp + 0x40], xmm0
movsd xmm0, qword [esp + 0x200]
mov dword [esp + 0xc], eax
movzx eax, word [esp + 0x209]
movsd qword [esp + 0x48], xmm0
mov word [esp + 4], ax
movzx eax, byte [esp + 0x20b]
mov byte [esp + 6], al
je 0x4b24e9
mov esi, dword [esp + 0x68]
add esi, 4
jmp 0x4b24a6
add esi, 0xc
dec edi
je 0x4b24e9
cmp dword [esi], 0
je 0x4b24a0
push dword [esi - 4]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
jmp 0x4b24a0
cmp dword [esp + 0x6c], 0
je 0x4b24d5
push dword [esp + 0x68]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
cmp dword [esp + 0x78], 0
je 0x4b26b2
push dword [esp + 0x74]
jmp 0x4b26a5
cmp dword [esp + 0x6c], 0
mov esi, dword [esp + 0x10]
je 0x4b2505
push dword [esp + 0x68]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
cmp dword [esp + 0x78], 0
je 0x4b251d
push dword [esp + 0x74]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
mov dword [esp + 0x30], 3
mov byte [esp + 0x34], 1
mov word [esp + 0x38], 0x102
mov word [esp + 0x35], 0
lea ecx, [esp + 0x1c8]
lea edx, [esp + 0x30]
push esi
call sym.aho_corasick::nfa::noncontiguous::Builder::build::h392b1b17a1c8913a
add esp, 4
cmp dword [esp + 0x1c8], 0
je 0x4b2599
movsd xmm0, qword [esp + 0x1e0]
movsd xmm1, qword [esp + 0x1d0]
movsd xmm2, qword [esp + 0x1d8]
movsd qword [esp + 0x338], xmm1
movsd qword [esp + 0x340], xmm2
movsd qword [esp + 0x348], xmm0
mov dword [esp + 0x330], 1
jmp 0x4b25f8
lea eax, [esp + 0x1cc]
push 0x164
push eax
lea esi, [esp + 0x6c]
push esi
call sym._memcpy
add esp, 0xc
lea edi, [esp + 0x5e8]
push 0x164
push esi
push edi
call sym._memcpy
add esp, 0xc
mov edx, dword [esp + 0x38]
movzx eax, byte [esp + 0x39]
lea ecx, [esp + 0x330]
push edi
push eax
call sym.aho_corasick::dfa::Builder::build_from_noncontiguous::h16d588b86000c829
add esp, 8
mov ecx, edi
call sym.core::ptr::drop_in_place_LT_aho_corasick..nfa..noncontiguous..NFA_GT_::h76602a0109d346ff
cmp dword [esp + 0x330], 0
je 0x4b26ba
lea ecx, [esp + 0x330]
call sym.__ZN4core3ptr111drop_in_place_LT_core..result..Result_LT_aho_corasick..dfa..DFA_C_aho_corasick..util..error..BuildError_GT__GT
mov eax, dword [esp + 0x2c]
test ebx, ebx
mov byte [eax + 0x1a0], 2
je 0x4b263d
mov eax, dword [esp + 0xc]
lea esi, [eax + 4]
jmp 0x4b2626
add esi, 0xc
dec ebx
je 0x4b263d
cmp dword [esi], 0
je 0x4b2620
push dword [esi - 4]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
jmp 0x4b2620
cmp dword [esp + 0x18], 0
je 0x4b2655
push dword [esp + 0xc]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
cmp dword [esp + 0x1c], 0
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
je 0x4b2675
push dword [esp + 0x14]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
test ebx, ebx
je 0x4b269d
lea esi, [edi + 4]
jmp 0x4b2686
add esi, 0xc
dec ebx
je 0x4b269d
cmp dword [esi], 0
je 0x4b2680
push dword [esi - 4]
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
jmp 0x4b2680
cmp dword [esp + 0x24], 0
je 0x4b26b2
push edi
push 0
push dword [0x5da100]
call sub.kernel32.dll_HeapFree
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea esi, [esp + 0x490]
lea eax, [esp + 0x334]
push 0x158
push eax
push esi
call sym._memcpy
add esp, 0xc
movzx ecx, byte [esp + 0x48c]
movzx eax, word [esp + 0x48d]
movzx edx, byte [esp + 0x48f]
cmp cl, 3
mov word [esp + 8], ax
mov byte [esp + 0xa], dl
je 0x4b2604
mov edi, dword [esp + 0x2c]
lea eax, [edi + 4]
push 0x158
push esi
push eax
mov byte [esp + 0x1c], cl
call sym._memcpy
add esp, 0xc
movzx eax, word [esp + 8]
movsd xmm0, qword [esp + 0x50]
movsd xmm1, qword [esp + 0x58]
mov edx, dword [esp + 0x14]
movzx ecx, byte [esp + 3]
movzx esi, word [esp + 4]
mov ch, byte [esp + 6]
mov word [edi + 0x15d], ax
movzx eax, byte [esp + 0xa]
mov byte [edi + 0x15f], al
mov eax, dword [esp + 0x28]
mov dword [edi + 0x160], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 0x164], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x168], eax
mov eax, dword [esp + 0xc]
movsd qword [edi + 0x16c], xmm0
movsd qword [edi + 0x174], xmm1
movsd xmm0, qword [esp + 0x40]
movsd xmm1, qword [esp + 0x48]
mov dword [edi + 0x17c], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x180], eax
mov dword [edi + 0x184], ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 0x188], edx
mov edx, dword [esp + 0x3c]
mov dword [edi + 0x18c], ebx
movsd qword [edi + 0x190], xmm0
movsd qword [edi + 0x198], xmm1
mov byte [edi + 0x1a0], cl
mov cl, byte [esp + 0x10]
mov word [edi + 0x1a1], si
mov byte [edi + 0x1a3], ch
mov dword [edi], edx
mov byte [edi + 0x15c], cl
jmp 0x4b26b2