Function at 0x1004d700
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1014412e
mov eax, dword fs:[0]
push eax
sub esp, 0x730
mov eax, dword [0x10170024]
xor eax, esp
mov dword [esp + 0x728], eax
push ebx
push esi
push edi
mov eax, dword [0x10170024]
xor eax, esp
push eax
lea eax, [esp + 0x740]
mov dword fs:[0], eax
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov eax, ecx
mov edi, dword [eax]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x38], eax
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [eax + 0xc], ebx
mov eax, dword [edi + 0xcc]
call eax
cmp eax, 0xffffffff
mov dword [esp + 0x30], eax
jne 0x1004d7ac
call sub.Comn.dll_GetObjectLog
mov ebx, eax
mov esi, dword [ebx]
push 0x24d7
mov edi, str..UiRecord.cpp
add esi, 0xc
call fcn.1002f7d0
mov ecx, dword [esi]
add esp, 4
push eax
push str._s:_invalid_GUID
push ebx
call ecx
add esp, 0xc
xor eax, eax
jmp 0x1004e1c8
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov edx, dword [edx + 0x15c]
push eax
call edx
mov edi, eax
mov dword [esp + 0x34], edi
lea eax, [esp + 0x9c]
push eax
mov ebx, edi
mov dword [esp + 0x74c], 0
call fcn.10031850
mov byte [esp + 0x748], 1
call fcn.10060390
mov dword [esp + 0x14], eax
mov byte [eax + 0xf], 1
mov eax, dword [esp + 0x14]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x14]
mov dword [eax], eax
mov eax, dword [esp + 0x14]
mov dword [eax + 8], eax
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0xa0]
mov byte [esp + 0x74c], 2
call fcn.10031910
lea ecx, [esp + 0x10]
call fcn.1004d5a0
cmp dword [esp + 0x18], 0
jne 0x1004d86b
lea eax, [esp + 0x10]
mov byte [esp + 0x748], 1
call fcn.1004e280
lea edx, [esp + 0x9c]
push edx
mov byte [esp + 0x74c], 0
call fcn.1004e1f0
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, 1
jmp 0x1004e1c5
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov byte [esp + 0x748], 3
mov eax, dword [esp + 0x14]
mov ebx, dword [eax]
lea esi, [esp + 0x10]
mov dword [esp + 0x118], ebx
mov dword [esp + 0x114], esi
lea esp, [esp]
test esi, esi
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x40], ecx
je 0x1004d8b4
lea edx, [esp + 0x10]
cmp esi, edx
je 0x1004d8ba
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp ebx, dword [esp + 0x40]
je 0x1004d931
test esi, esi
jne 0x1004d8ca
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp ebx, dword [esi + 4]
jne 0x1004d8d5
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp ebx, dword [esi + 4]
lea edi, [ebx + 0xc]
jne 0x1004d8e3
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
movzx eax, byte [edi]
movzx ecx, byte [ebx + 0xd]
push eax
push ecx
call fcn.1004d1a0
add esp, 8
test al, al
jne 0x1004d90e
cmp ebx, dword [esi + 4]
jne 0x1004d903
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ebx, edi
lea esi, [esp + 0x20]
call fcn.10003530
lea esi, [esp + 0x114]
call fcn.1005d1a0
mov ebx, dword [esp + 0x118]
mov esi, dword [esp + 0x114]
mov edi, dword [esp + 0x34]
jmp 0x1004d8a0
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1004d945
mov edx, dword [esp + 0x28]
sub edx, eax
jne 0x1004d9ec
call sub.Comn.dll_GetObjectLog
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push str.All_drive_letters_restored
push eax
call edx
mov byte [esp + 0x750], 2
mov eax, dword [esp + 0x2c]
add esp, 8
test eax, eax
je 0x1004d97c
mov ecx, dword [esp + 0x2c]
sub ecx, eax
push ecx
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::allocator_char_::deallocate_char___unsigned_int_]
mov byte [esp + 0x748], 1
mov eax, dword [esp + 0x14]
push eax
xor ebx, ebx
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov edx, dword [eax]
push edx
mov esi, ecx
push esi
lea edx, [esp + 0x8c]
push edx
mov edi, ecx
call fcn.1005ea30
mov eax, dword [esp + 0x14]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x9c]
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x74c], bl
call fcn.1004e1f0
mov edx, dword [esp + 0x34]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
lea eax, [ebx + 1]
jmp 0x1004e1c5
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xa4]
push edx
call fcn.1004d430
xor ebx, ebx
add esp, 0xc
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov ecx, dword [esp + 0x38]
lea edx, [esp + 0x54]
push edx
lea edx, [esp + 0x48]
mov byte [esp + 0x74c], 5
mov eax, dword [ecx]
mov eax, dword [eax + 0x54]
push edx
mov edx, dword [esp + 0x38]
push edx
call eax
mov esi, dword [esp + 0x48]
mov dword [esp + 0x114], ebx
mov dword [esp + 0x3c], ebx
test esi, esi
je 0x1004db31
mov ecx, dword [esp + 0x4c]
sub ecx, esi
mov eax, 0x10e1cc09
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x1004db31
mov ecx, dword [esp + 0x3c]
mov edi, dword [esp + 0x28]
cmp dword [esp + 0x24], edi
mov dl, byte [ecx + esi + 0x12]
mov byte [esp + 0x1f], dl
jbe 0x1004da98
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov esi, dword [esp + 0x48]
mov ebx, dword [esp + 0x24]
cmp ebx, dword [esp + 0x28]
jbe 0x1004daac
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov esi, dword [esp + 0x48]
xor ecx, ecx
cmp ebx, edi
mov eax, ebx
je 0x1004db11
mov dl, byte [esp + 0x1f]
cmp byte [eax], dl
jne 0x1004dabf
add ecx, 1
add eax, 1
cmp eax, edi
jne 0x1004dab4
test ecx, ecx
je 0x1004db11
test esi, esi
je 0x1004daee
mov ecx, dword [esp + 0x4c]
sub ecx, esi
mov eax, 0x10e1cc09
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x114], eax
jb 0x1004daf8
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x9c]
lea edx, [eax + esi + 0x12]
push ecx
call fcn.10031c30
mov esi, dword [esp + 0x48]
add dword [esp + 0x114], 1
add dword [esp + 0x3c], 0xf2a
mov ebx, dword [esp + 0x114]
mov edi, dword [esp + 0x34]
jmp 0x1004da51
call fcn.1005fff0
mov dword [esp + 0x68], eax
mov byte [eax + 0x2d], 1
mov eax, dword [esp + 0x68]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x68]
mov dword [eax], eax
mov eax, dword [esp + 0x68]
xor esi, esi
mov dword [eax + 8], eax
mov dword [esp + 0x6c], esi
mov byte [esp + 0x748], 6
call fcn.1005fff0
mov dword [esp + 0x74], eax
mov byte [eax + 0x2d], 1
mov eax, dword [esp + 0x74]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x74]
mov dword [eax], eax
mov eax, dword [esp + 0x74]
mov dword [eax + 8], eax
mov dword [esp + 0x78], esi
mov byte [esp + 0x748], 7
mov edx, dword [edi]
mov eax, dword [edx + 0xac]
mov ecx, edi
call eax
lea ecx, [esp + 0x64]
call fcn.1000b560
mov ecx, dword [esp + 0x68]
mov esi, dword [ecx]
lea ebx, [esp + 0x64]
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
jmp 0x1004dbc0
test ebx, ebx
mov edx, dword [esp + 0x68]
mov dword [esp + 0x80], edx
je 0x1004dbd7
lea eax, [esp + 0x64]
cmp ebx, eax
je 0x1004dbdd
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, dword [esp + 0x80]
je 0x1004dcf4
test ebx, ebx
mov ecx, dword [0x101510d0]
mov edx, dword [0x101510d4]
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], edx
jne 0x1004dc0e
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, dword [ebx + 4]
jne 0x1004dc19
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
movsx ax, byte [esi + 0xc]
lea ecx, [esp + 0x9c]
push ecx
lea edx, [esp + 0x118]
mov word [esp + 0x118], ax
call fcn.10031c30
cmp esi, dword [ebx + 4]
jne 0x1004dc45
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov dl, byte [esp + 0x114]
add esi, 0x10
push esi
lea ecx, [esp + 0xcc]
mov byte [esp + 0xc8], dl
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov byte [esp + 0x748], 8
mov al, byte [esp + 0xc4]
lea ecx, [esp + 0xc8]
push ecx
lea ecx, [esp + 0xfc]
mov byte [esp + 0xf8], al
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
lea edx, [esp + 0xf4]
push edx
lea eax, [esp + 0xe8]
push eax
lea ebx, [esp + 0x78]
mov byte [esp + 0x750], 9
call fcn.1000b5a0
lea ecx, [esp + 0xf8]
mov byte [esp + 0x748], 8
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0xc8]
mov byte [esp + 0x748], 7
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea esi, [esp + 0x3c]
call fcn.1005e9c0
mov esi, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x34]
jmp 0x1004dbc0
mov edx, dword [edi]
mov eax, dword [edx + 0xac]
mov ecx, edi
call eax
mov esi, eax
push esi
lea ecx, [esp + 0x88]
push ecx
call fcn.1005b350
add esi, 0xc
push esi
lea edx, [esp + 0x94]
push edx
mov byte [esp + 0x750], 0xa
call fcn.1005b430
lea eax, [esp + 0x70]
lea ecx, [esp + 0x84]
mov byte [esp + 0x748], 0xb
call fcn.1000b560
mov eax, dword [edi]
mov edx, dword [eax + 0x5c]
lea ecx, [esp + 0x84]
push ecx
mov ecx, edi
call edx
mov ebx, dword [esp + 0x38]
mov eax, dword [edi]
mov esi, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, edi
add esi, 0x194
call edx
mov edx, dword [esi]
push eax
mov eax, dword [esp + 0x34]
push eax
mov ecx, ebx
call edx
mov eax, dword [edi]
mov edx, dword [eax + 0x74]
lea ecx, [esp + 0xe4]
push ecx
mov ecx, edi
mov dword [esp + 0x118], 0
call edx
mov edx, dword [eax]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
push ebx
lea edx, [esp + 0x128]
mov dword [ecx + 0xc], eax
call fcn.1004cd90
test eax, eax
jne 0x1004defc
lea eax, [esp + 0x90]
mov byte [esp + 0x748], 0xc
call fcn.1000c260
lea eax, [esp + 0x84]
mov byte [esp + 0x748], 7
call fcn.1000be70
lea eax, [esp + 0x70]
mov byte [esp + 0x748], 6
call fcn.1000be70
lea eax, [esp + 0x64]
mov byte [esp + 0x748], 5
call fcn.1000be70
mov byte [esp + 0x748], 4
mov esi, dword [esp + 0x58]
xor ebx, ebx
cmp esi, ebx
je 0x1004de3f
mov edi, dword [esp + 0x5c]
cmp esi, edi
je 0x1004de36
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add esi, 0x1c
cmp esi, edi
jne 0x1004de23
mov esi, dword [esp + 0x58]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x48]
cmp eax, ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
je 0x1004de5c
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x748], 2
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
je 0x1004de8a
mov ecx, dword [esp + 0x2c]
sub ecx, eax
push ecx
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::allocator_char_::deallocate_char___unsigned_int_]
mov byte [esp + 0x748], 1
mov eax, dword [esp + 0x14]
push eax
xor ebx, ebx
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov edx, dword [eax]
push edx
mov esi, ecx
push esi
lea edx, [esp + 0x8c]
push edx
mov edi, ecx
call fcn.1005ea30
mov eax, dword [esp + 0x14]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x9c]
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x74c], bl
call fcn.1004e1f0
mov edx, dword [esp + 0x34]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
jmp 0x1004e1c8
mov ebx, dword [esp + 0x114]
mov esi, str.Image
mov eax, ebx
call fcn.1007d6d0
mov esi, eax
test esi, esi
je 0x1004df4d
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
test eax, eax
jne 0x1004df99
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1004df4d
lea esp, [esp]
mov esi, dword [eax + 0x20]
add esi, 8
mov edi, str.Image
mov ecx, 6
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x1004df92
mov eax, dword [eax + 0x28]
test eax, eax
jne 0x1004df30
xor eax, eax
test eax, eax
jne 0x1004dfaf
mov esi, str.Dest
mov eax, ebx
call fcn.1007d6d0
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x1004df86
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
mov ecx, edi
call edx
test eax, eax
jne 0x1004dfa4
mov esi, str.Dest
mov eax, edi
call fcn.1007d720
mov edi, eax
cmp edi, ebx
jne 0x1004df67
xor eax, eax
cmp eax, ebx
je 0x1004e073
jmp 0x1004dfb1
mov esi, eax
jmp 0x1004df15
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
mov ecx, esi
call edx
jmp 0x1004df4f
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
mov ecx, edi
call edx
jmp 0x1004df88
xor ebx, ebx
lea edi, [eax + 0x2c]
mov esi, str.path
call fcn.1007ed30
cmp eax, ebx
je 0x1004e073
mov esi, dword [eax + 0x18]
add esi, 8
cmp esi, ebx
je 0x1004e073
push 0x206
lea eax, [esp + 0x122]
push ebx
push eax
mov word [esp + 0x128], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x103
lea ecx, [esp + 0x120]
push esi
push ecx
call dword [sym.imp.MSVCR80.dll_mbstowcs]
add esp, 0xc
lea edx, [esp + 0x9c]
push edx
lea edx, [esp + 0x120]
call fcn.10031c30
push 0x40f
lea eax, [esp + 0x120]
push eax
lea ecx, [esp + 0x32c]
push ecx
call dword [sym.imp.MSVCR80.dll_wcstombs]
add esp, 0xc
push str.path
mov eax, edi
call fcn.1007ed80
cmp eax, ebx
je 0x1004e073
lea ecx, [esp + 0x324]
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x1004e055
sub ecx, esi
lea edi, [eax + 0x18]
mov esi, ecx
lea ebx, [esp + 0x324]
call fcn.10080f80
xor ebx, ebx
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov edx, dword [edx + 0x50]
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x48]
push eax
mov eax, dword [esp + 0x38]
push eax
call edx
mov dword [esp + 0x30], eax
lea eax, [esp + 0x90]
mov byte [esp + 0x748], 0xd
call fcn.1000c260
lea eax, [esp + 0x84]
mov byte [esp + 0x748], 7
call fcn.1000be70
lea eax, [esp + 0x70]
mov byte [esp + 0x748], 6
call fcn.1000be70
lea eax, [esp + 0x64]
mov byte [esp + 0x748], 5
call fcn.1000be70
mov byte [esp + 0x748], 4
mov esi, dword [esp + 0x58]
cmp esi, ebx
je 0x1004e10f
mov edi, dword [esp + 0x5c]
cmp esi, edi
je 0x1004e106
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add esi, 0x1c
cmp esi, edi
jne 0x1004e0f3
mov esi, dword [esp + 0x58]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x48]
cmp eax, ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
je 0x1004e12c
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [esp + 0x748], 2
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
je 0x1004e15a
mov ecx, dword [esp + 0x2c]
sub ecx, eax
push ecx
push eax
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::allocator_char_::deallocate_char___unsigned_int_]
mov byte [esp + 0x748], 1
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov edx, dword [eax]
push edx
mov esi, ecx
push esi
lea edx, [esp + 0x8c]
push edx
mov edi, ecx
call fcn.1005ea30
mov eax, dword [esp + 0x14]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x9c]
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x74c], 0
call fcn.1004e1f0
mov edx, dword [esp + 0x34]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x34]
add esp, 4
mov ecx, dword [esp + 0x740]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x728]
xor ecx, esp
call fcn.1012d370
mov esp, ebp
pop ebp
ret 0x10