Function at 0x481db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x580
mov esi, esp
mov dword [esi + 0x568], ebp
mov dword [esi + 0x56c], esp
mov dword [esi + 0x578], 0xffffffff
mov dword [esi + 0x574], 0x4aa0b0
lea eax, [esi + 0x570]
mov ebx, dword [ebp + 8]
mov ecx, dword fs:[0]
mov dword [esi + 0x570], ecx
mov dword fs:[0], eax
mov eax, dword [0x53cb20]
cmp eax, 1
je 0x481fd4
test eax, eax
jne 0x481f1b
lea ecx, [esi + 0x290]
mov edx, 0x4e9f88
push 0x12
call fcn.004827a0
add esp, 4
movzx ecx, byte [esi + 0x29c]
cmp cl, 2
mov byte [esi + 0x14], cl
jne 0x481e70
mov al, 2
mov byte [esi + 0x16c], al
mov dword [esi + 0x578], 0
lea ecx, [esi + 0x290]
mov edx, 0x4e9f9a
push 0xe
call fcn.004827a0
add esp, 4
movzx eax, byte [esi + 0x29c]
cmp al, 2
jne 0x481ea8
mov edi, dword [esi + 4]
xor ebx, ebx
jmp 0x481eee
mov eax, dword [esi + 0x290]
test cl, cl
mov dword [esi + 4], eax
mov eax, dword [esi + 0x294]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x298]
je 0x482310
mov ecx, dword [esi + 4]
mov bl, 1
cmp eax, 1
jne 0x481ea0
cmp byte [ecx], 0x30
setne bl
cmp dword [esi + 0xc], 0
jne 0x481efd
jmp 0x481f07
mov ecx, dword [esi + 0x290]
test al, al
mov dword [esi + 8], ecx
mov ecx, dword [esi + 0x294]
mov dword [esi + 0x10], ecx
mov ecx, dword [esi + 0x298]
je 0x482393
mov edi, dword [esi + 4]
mov bl, 1
cmp ecx, 1
jne 0x481edb
mov eax, dword [esi + 8]
cmp byte [eax], 0x30
setne bl
cmp dword [esi + 0x10], 0
je 0x481eee
mov ecx, dword [esi + 8]
mov edx, 1
call fcn.00425c30
mov eax, dword [esi + 0xc]
cmp byte [esi + 0x14], 2
je 0x481f07
test eax, eax
je 0x481f07
mov ecx, edi
mov edx, 1
call fcn.00425c30
movzx eax, bl
inc eax
test bl, bl
mov ebx, dword [ebp + 8]
mov dword [0x53cb20], eax
je 0x481fd4
push 0x53cb54
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [0x53cbe4]
test eax, 0x7fffffff
jne 0x482413
mov dword [esi + 0x28], 0
movzx eax, byte [0x53cb58]
mov dword [esi + 0x18], 8
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [esi + 0x30], eax
lea edi, [esi + 0x290]
push 0x2d0
push 0
push edi
call fcn.004bae60
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov dword [esi + 0x578], 1
call fcn.004816c0
mov ebx, dword [ebp + 8]
test eax, eax
je 0x481fdf
movzx eax, byte [esi + 0x162]
movzx edx, word [esi + 0x160]
movsd xmm0, qword [esi + 0x290]
mov ecx, dword [esi + 0x298]
mov byte [ebx + 0x1b], al
mov word [ebx + 0x19], dx
mov dword [ebx], 0
movsd qword [ebx + 8], xmm0
mov dword [ebx + 0x10], ecx
jmp 0x4822d9
mov dword [ebx], 1
jmp 0x4822fa
mov ebx, dword [0x53cbc4]
mov edi, edx
mov dword [esi + 0x34], edx
test ebx, ebx
jne 0x48200e
push str.SymFunctionTableAccess64
push dword [0x53cbb0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48269f
mov ebx, eax
mov dword [0x53cbc4], eax
mov eax, dword [0x53cbc8]
test eax, eax
jne 0x482035
push str.SymGetModuleBase64
push dword [0x53cbb0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4826c2
mov dword [0x53cbc8], eax
mov dword [esi + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esi + 0x38], eax
mov eax, dword [0x53cbd4]
test eax, eax
jne 0x482068
push str.StackWalkEx
push dword [0x53cbb0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48242c
mov dword [0x53cbd4], eax
mov edi, eax
lea eax, [esi + 0x50]
push 0x100
push 0
push eax
call fcn.004bae60
add esp, 0xc
mov eax, dword [esi + 0x344]
mov ecx, dword [esi + 0x348]
mov edx, dword [esi + 0x354]
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x150], pe_nt_image_headers32
mov dword [esi + 0x154], 0
mov dword [esi + 0x158], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], ecx
mov dword [esi + 0x54], 3
mov dword [esi + 0x78], edx
mov dword [esi + 0x7c], 0
mov dword [esi + 0x84], 3
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], 0
mov dword [esi + 0x74], 3
push 0
push 0
push dword [esi + 0x24]
push ebx
push 0
lea eax, [esi + 0x290]
push eax
lea eax, [esi + 0x48]
push eax
push dword [esi + 0x30]
push dword [esi + 0x10]
push 0x14c
mov dword [esi + 0x3c], edi
call edi
cmp eax, 1
jne 0x482237
mov edi, dword [esi + 0x24]
mov dword [esi + 0x2c], ebx
lea ebx, [esi + 0x160]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 8
mov dword [esi + 4], 0
jmp 0x4821c6
mov ecx, dword [esi + 8]
imul eax, edi, 0x130
mov dword [esi + 8], ecx
add eax, ecx
push 0x130
push ebx
push eax
call fcn.004ba8e0
add esp, 0xc
mov eax, dword [esi + 0x48]
mov edx, dword [esi + 4]
mov ecx, fcn.00481db0
inc edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x20], edi
xor eax, ecx
or eax, edx
mov eax, dword [esi + 0xc]
cmove eax, edi
mov dword [esi + 0xc], eax
mov eax, 1
cmove edx, eax
mov dword [esi + 4], edx
push 0
push 0
mov edi, dword [esi + 0x24]
push edi
push dword [esi + 0x2c]
push 0
lea eax, [esi + 0x290]
push eax
lea eax, [esi + 0x48]
push eax
push dword [esi + 0x30]
push dword [esi + 0x10]
push 0x14c
call dword [esi + 0x3c]
cmp eax, 1
jne 0x48224c
push 0
push dword [esi + 0x48]
push dword [esi + 0x38]
call edi
mov dword [esi + 0x158], eax
push 0x120
lea eax, [esi + 0x40]
push eax
push ebx
call fcn.004ba8e0
add esp, 0xc
mov edi, dword [esi + 0x14]
mov dword [esi + 0x280], 4
mov dword [esi + 0x284], 0
mov dword [esi + 0x288], 0
cmp edi, dword [esi + 0x1c]
jne 0x482150
lea ecx, [esi + 0x18]
mov edx, edi
mov dword [esi + 0x578], 3
call fcn.00482ad0
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea ebx, [esi + 0x160]
jmp 0x482153
mov dword [esi + 0x14], 0
mov dword [esi + 8], 8
mov dword [esi + 4], 0
mov ebx, dword [esi + 0x14]
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp + 8]
test ebx, ebx
lea eax, [edx + 8]
je 0x482294
mov ecx, dword [esi + 4]
mov edi, dword [esi + 0xc]
mov ebx, dword [esi + 0x20]
movsd xmm0, qword [esi + 0x18]
mov dword [edx], 2
mov dword [edx + 4], 0
test ecx, ecx
mov dword [eax + 8], ebx
mov ebx, edx
movsd qword [eax], xmm0
cmove edi, ecx
mov dword [edx + 0x14], edi
mov byte [edx + 0x18], 0
jmp 0x4822d9
movzx ebx, word [esi + 0x160]
movzx ecx, byte [esi + 0x162]
cmp dword [esi + 0x1c], 0
mov edi, dword [esi + 0x298]
movsd xmm0, qword [esi + 0x290]
mov word [edx + 0x19], bx
mov ebx, edx
mov byte [edx + 0x1b], cl
mov dword [edx], 0
mov dword [eax + 8], edi
movsd qword [eax], xmm0
je 0x4822d9
mov ecx, dword [esi + 8]
mov edx, 8
call fcn.00425c30
cmp byte [esi + 0x28], 0
jne 0x4822ef
mov eax, dword [0x53cbe4]
test eax, 0x7fffffff
jne 0x4825fa
push 0x53cb54
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi + 0x570]
mov dword fs:[0], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
test eax, eax
je 0x4825d2
mov edi, dword [esi + 4]
lea edx, [edi + eax]
jmp 0x48233a
add edi, 2
cmp ebx, edx
cmovne ebx, edi
nop dword [eax + eax]
cmp ebx, edx
mov edi, ebx
je 0x481e90
movzx ecx, byte [edi]
lea ebx, [edi + 1]
test cl, cl
jns 0x482330
cmp cl, 0xe0
jb 0x482320
cmp cl, 0xed
jne 0x482372
cmp ebx, edx
je 0x481e90
lea ecx, [edi + 2]
cmp ecx, edx
je 0x481e90
cmp byte [edi + 1], 0x9f
ja 0x48261d
add edi, 3
mov ebx, edi
jmp 0x482330
add edi, 2
cmp ebx, edx
cmove edi, ebx
xor ebx, ebx
cmp edi, edx
setne bl
add ebx, edi
cmp cl, 0xf0
jb 0x482330
xor ecx, ecx
cmp ebx, edx
setne cl
add ebx, ecx
jmp 0x482330
test ecx, ecx
je 0x4825e6
mov ebx, dword [esi + 8]
lea edi, [ebx + ecx]
jmp 0x4823ba
add ebx, 2
cmp eax, edi
cmovne eax, ebx
nop dword [eax + eax]
cmp eax, edi
mov ebx, eax
je 0x481ec8
movzx edx, byte [ebx]
lea eax, [ebx + 1]
test dl, dl
jns 0x4823b0
cmp dl, 0xe0
jb 0x4823a3
cmp dl, 0xed
jne 0x4823f2
cmp eax, edi
je 0x481ec8
lea eax, [ebx + 2]
cmp eax, edi
je 0x481ec8
cmp byte [ebx + 1], 0x9f
ja 0x482660
add ebx, 3
mov eax, ebx
jmp 0x4823b0
add ebx, 2
cmp eax, edi
cmove ebx, eax
xor eax, eax
cmp ebx, edi
setne al
add eax, ebx
cmp dl, 0xf0
jb 0x4823b0
xor edx, edx
cmp eax, edi
setne dl
add eax, edx
jmp 0x4823b0
mov dword [esi + 0x578], 0xffffffff
call fcn.004cb260
xor al, 1
mov dword [esi + 0x28], eax
jmp 0x481f3d
mov dword [esi + 0x2c], ebx
lea eax, [esi + 0x50]
push 0x100
push 0
push eax
call fcn.004bae60
add esp, 0xc
mov eax, dword [esi + 0x344]
mov ecx, dword [esi + 0x348]
mov edx, dword [esi + 0x354]
xor edi, edi
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 1
mov dword [esi + 0x158], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 8], 8
mov dword [esi + 4], 0
mov dword [esi + 0x48], ecx
mov dword [esi + 0x54], 3
mov dword [esi + 0x78], edx
mov dword [esi + 0x7c], 0
mov dword [esi + 0x84], 3
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], 0
mov dword [esi + 0x74], 3
jmp 0x48250a
mov ecx, dword [esi + 8]
imul eax, edi, 0x130
mov dword [esi + 8], ecx
add eax, ecx
push 0x130
lea ecx, [esi + 0x160]
push ecx
push eax
call fcn.004ba8e0
add esp, 0xc
mov eax, dword [esi + 0x48]
mov ebx, dword [esi + 4]
mov ecx, fcn.00481db0
inc edi
mov edx, 1
mov dword [esi + 0x20], edi
xor eax, ecx
or eax, ebx
mov eax, dword [esi + 0xc]
cmove ebx, edx
mov dword [esi + 4], ebx
cmove eax, edi
mov dword [esi + 0xc], eax
mov ecx, dword [0x53cbc0]
test ecx, ecx
jne 0x482534
push str.StackWalk64
push dword [0x53cbb0]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48267c
mov ecx, eax
mov dword [0x53cbc0], eax
mov ebx, edi
push 0
mov edi, dword [esi + 0x24]
push edi
push dword [esi + 0x2c]
push 0
lea eax, [esi + 0x290]
push eax
lea eax, [esi + 0x48]
push eax
push dword [esi + 0x30]
push dword [esi + 0x10]
push 0x14c
call ecx
cmp eax, 1
jne 0x48224f
push 0
push dword [esi + 0x48]
push dword [esi + 0x38]
call edi
mov dword [esi + 0x158], eax
push 0x120
lea eax, [esi + 0x40]
push eax
lea eax, [esi + 0x160]
push eax
call fcn.004ba8e0
add esp, 0xc
cmp ebx, dword [esi + 0x1c]
mov edi, ebx
mov dword [esi + 0x280], 4
mov dword [esi + 0x284], 0
mov dword [esi + 0x288], 0
jne 0x4824c0
lea ecx, [esi + 0x18]
mov edx, edi
mov dword [esi + 0x578], 4
call fcn.00482ad0
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
jmp 0x4824c3
mov ecx, dword [esi + 4]
mov bl, 1
cmp dword [esi + 0xc], 0
jne 0x481efd
jmp 0x481f07
mov edi, dword [esi + 4]
mov bl, 1
cmp dword [esi + 0x10], 0
jne 0x481ee1
jmp 0x481eee
mov dword [esi + 0x578], 0xffffffff
call fcn.004cb260
test al, al
jne 0x4822ef
mov byte [0x53cb58], 1
jmp 0x4822ef
lea edx, [esi + 0x29d]
mov edi, dword [esi + 4]
mov dword [esi + 0x578], 0
movzx ecx, word [edx]
movzx ebx, byte [edx + 2]
mov edx, dword [esi + 0xc]
mov word [esi + 0x16d], cx
mov byte [esi + 0x16f], bl
mov dword [esi + 0x160], edi
mov dword [esi + 0x164], edx
mov dword [esi + 0x168], eax
xor eax, eax
jmp 0x481e39
cmp dword [esi + 0x10], 0
je 0x481e69
mov ecx, dword [esi + 8]
mov edx, 1
call fcn.00425c30
jmp 0x481e69
mov dword [esi + 0x578], 2
mov ecx, 0x4f022c
mov edx, 0x2b
push 0x4ec15c
call fcn.004c88c0
add esp, 4
jmp 0x4826e3
mov dword [esi + 0x578], 2
mov ecx, 0x4f022c
mov edx, 0x2b
push 0x4ec15c
call fcn.004c88c0
add esp, 4
jmp 0x4826e3
mov dword [esi + 0x578], 2
mov ecx, 0x4f022c
mov edx, 0x2b
push 0x4ec15c
call fcn.004c88c0
add esp, 4
ud2