Function at 0x4a6b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
sub rsp, 0x168
mov rax, qword [0x0072f1d0]
mov qword [rsp + 0x110], rax
cmp byte [rcx + 0x11], 0
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov rdi, qword [rcx + 8]
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
mov r14, qword [rsp + 0x190]
mov ebp, r9d
mov r13d, r8d
mov rbx, rdx
mov qword [rsp + 0x90], r14
mov rsi, rcx
je 0x4a6bc5
inc dword [rcx + 0x14]
cmp byte [rcx + 0x12], 0
jne 0x4a6bc5
call fcn.0042d140
mov rax, qword [rdi]
mov qword [rsp + 0x128], r15
mov rcx, qword [rax + 0x110]
mov r15d, dword [rcx + 0x18]
mov qword [rsp + 0x30], rdi
mov rax, qword [rdi]
mov qword [rsp + 0x38], rax
mov ecx, dword [rdi + 0x3c]
xor eax, eax
test ecx, ecx
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], ecx
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov dword [r14], eax
jne 0x4a6c2a
cmp byte [rsi + 0x11], al
je 0x4a6c23
dec dword [rsi + 0x14]
jne 0x4a6c23
mov rcx, rsi
call fcn.0042d110
xor eax, eax
jmp 0x4a742f
mov qword [rsp + 0x140], r12
mov r12d, ecx
shr r12d, 3
inc r12d
je 0x4a6c95
cmp r12, 0x7fffff00
jae 0x4a6c95
cmp dword [reloc.WS2_32.dll_accept], eax
je 0x4a6c87
mov rcx, qword [0x00772b88]
test rcx, rcx
je 0x4a6c61
call qword [0x0072d0f8]
lea rdx, [rsp + 0x20]
mov ecx, r12d
call fcn.0043a720
mov rcx, qword [0x00772b88]
test rcx, rcx
je 0x4a6c9d
call qword [0x0072d108]
mov rbp, qword [rsp + 0x20]
jmp 0x4a6ca2
mov ecx, r12d
call qword [0x0072d098]
mov rbp, rax
jmp 0x4a6ca2
xor r12d, r12d
mov rbp, r12
jmp 0x4a6cc4
mov rbp, qword [rsp + 0x20]
test rbp, rbp
je 0x4a6cbd
mov r8, r12
xor edx, edx
mov rcx, rbp
call sub.msvcrt.dll_memset
mov ecx, dword [rsp + 0x48]
xor r12d, r12d
jmp 0x4a6cc4
mov ecx, dword [rsp + 0x48]
xor r12d, r12d
test rbp, rbp
mov qword [rsp + 0x40], rbp
jne 0x4a6cef
mov dword [r14], 1
cmp byte [rsi + 0x11], bpl
je 0x4a6ce8
dec dword [rsi + 0x14]
jne 0x4a6ce8
mov rcx, rsi
call fcn.0042d110
xor eax, eax
jmp 0x4a7427
mov eax, dword [0x0072d218]
xor edx, edx
div dword [rdi + 0x30]
inc eax
cmp eax, ecx
ja 0x4a6d18
mov r8d, eax
and eax, 7
mov edx, 1
movzx ecx, al
shr r8, 3
shl dl, cl
or byte [r8 + rbp], dl
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x80], r12d
mov dword [rsp + 0x84], 0x64
mov dword [rsp + 0x88], 0x3b9aca00
mov byte [rsp + 0x8d], 0
mov byte [rsp + 0x8c], 2
lea rax, [rsp + 0xa0]
mov edx, 1
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x78], rax
lea rax, str.Main_freelist:
mov qword [rsp + 0x58], rax
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax + 0x50]
movzx eax, byte [rcx + 0x26]
movzx r9d, byte [rcx + 0x25]
movzx r8d, byte [rcx + 0x21]
shl r9d, 8
shl r8d, 8
or r9d, eax
movzx eax, byte [rcx + 0x27]
shl r9d, 8
or r9d, eax
movzx eax, byte [rcx + 0x24]
shl eax, 0x18
or r9d, eax
movzx eax, byte [rcx + 0x22]
or r8d, eax
movzx eax, byte [rcx + 0x20]
shl eax, 0x18
shl r8d, 8
or r8d, eax
movzx eax, byte [rcx + 0x23]
lea rcx, [rsp + 0x30]
or r8d, eax
call fcn.0048d4f0
test r13d, r13d
mov qword [rsp + 0x58], r12
mov ebp, r12d
jle 0x4a6e3d
lea r14, str.List_of_tree_roots:
cmp dword [rsp + 0x4c], 0
je 0x4a6e35
mov edx, dword [rbx]
test edx, edx
je 0x4a6e2a
cmp byte [rdi + 0x21], 0
je 0x4a6e0e
cmp edx, 1
jle 0x4a6e0e
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov r8b, 1
call fcn.0048d340
mov edx, dword [rbx]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x58], r14
call fcn.004a62f0
mov qword [rsp + 0x58], r12
inc ebp
add rbx, 4
cmp ebp, r13d
jl 0x4a6de6
mov r14, qword [rsp + 0x90]
mov ebx, 1
cmp dword [rsp + 0x48], ebx
jb 0x4a6f51
nop
cmp dword [rsp + 0x4c], 0
je 0x4a6f4e
mov rax, qword [rsp + 0x40]
mov ecx, ebx
mov r12d, ebx
and ecx, 7
mov ebp, 1
shr r12, 3
shl ebp, cl
test byte [r12 + rax], bpl
jne 0x4a6ed8
cmp ebx, 2
jae 0x4a6e83
xor r8d, r8d
jmp 0x4a6eb9
mov eax, 0xcccccccd
mul dword [rdi + 0x34]
lea eax, [rbx - 2]
mov ecx, edx
xor edx, edx
shr ecx, 2
inc ecx
div ecx
xor edx, edx
mov r8d, eax
mov eax, dword [0x0072d218]
div dword [rdi + 0x30]
imul r8d, ecx
inc eax
add r8d, 2
cmp r8d, eax
jne 0x4a6eb9
inc r8d
cmp r8d, ebx
jne 0x4a6ec4
cmp byte [rdi + 0x21], 0
jne 0x4a6ed8
lea rdx, str.Page__d_is_never_used
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.00464580
mov rax, qword [rsp + 0x40]
test byte [r12 + rax], bpl
je 0x4a6f42
cmp ebx, 2
jae 0x4a6eed
xor r8d, r8d
jmp 0x4a6f23
mov eax, 0xcccccccd
mul dword [rdi + 0x34]
lea eax, [rbx - 2]
mov ecx, edx
xor edx, edx
shr ecx, 2
inc ecx
div ecx
xor edx, edx
mov r8d, eax
mov eax, dword [0x0072d218]
div dword [rdi + 0x30]
imul r8d, ecx
inc eax
add r8d, 2
cmp r8d, eax
jne 0x4a6f23
inc r8d
cmp r8d, ebx
jne 0x4a6f42
cmp byte [rdi + 0x21], 0
je 0x4a6f42
lea rdx, str.Pointer_map_page__d_is_referenced
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.00464580
inc ebx
cmp ebx, dword [rsp + 0x48]
jbe 0x4a6e50
xor r12d, r12d
mov rax, qword [rdi]
mov rcx, qword [rax + 0x110]
mov r9d, dword [rcx + 0x18]
cmp r15d, r9d
je 0x4a6f78
lea rdx, str.Outstanding_page_count_goes_from__d_to__d_during_this_analysis
lea rcx, [rsp + 0x30]
mov r8d, r15d
call fcn.00464580
cmp byte [rsi + 0x11], 0
je 0x4a6f8b
dec dword [rsi + 0x14]
jne 0x4a6f8b
mov rcx, rsi
call fcn.0042d110
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x4a703c
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x4a7028
mov rcx, qword [0x00772b88]
test rcx, rcx
je 0x4a6fb8
call qword [0x0072d0f8]
mov rcx, rbx
call qword [0x0072d0b0]
mov edx, dword [0x00772960]
mov rcx, rbx
neg eax
add edx, eax
mov eax, dword [0x00772988]
cmp edx, eax
mov dword [0x00772960], edx
cmovg eax, edx
mov edx, dword [0x00772984]
dec edx
mov dword [0x00772988], eax
mov eax, dword [0x007729ac]
cmp edx, eax
mov dword [0x00772984], edx
cmovg eax, edx
mov dword [0x007729ac], eax
call qword [0x0072d0a0]
mov r11, qword [0x00772b88]
test r11, r11
je 0x4a7043
mov rcx, r11
call qword [0x0072d108]
mov r11, qword [0x00772b88]
jmp 0x4a7043
mov rcx, qword [rsp + 0x40]
call qword [0x0072d0a0]
mov r11, qword [0x00772b88]
jmp 0x4a7043
mov r11, qword [0x00772b88]
cmp dword [rsp + 0x54], 0
je 0x4a7237
mov rbx, qword [rsp + 0x78]
cmp rbx, qword [rsp + 0x70]
je 0x4a7227
cmp byte [rsp + 0x8c], 1
jne 0x4a7186
test rbx, rbx
mov rcx, qword [rsp + 0x68]
je 0x4a7227
test rcx, rcx
je 0x4a70da
cmp qword [rcx + 0x320], 0
je 0x4a70a1
mov rdx, rbx
call fcn.00425e50
mov eax, dword [rsp + 0x50]
inc eax
mov dword [r14], eax
xor eax, eax
jmp 0x4a7427
cmp rbx, qword [rcx + 0x168]
jb 0x4a70da
cmp rbx, qword [rcx + 0x170]
jae 0x4a70da
mov rax, qword [rcx + 0x160]
mov qword [rbx], rax
dec dword [rcx + 0x14c]
mov qword [rcx + 0x160], rbx
mov eax, dword [rsp + 0x50]
inc eax
mov dword [r14], eax
xor eax, eax
jmp 0x4a7427
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x4a716d
test r11, r11
je 0x4a70f5
mov rcx, r11
call qword [0x0072d0f8]
mov rcx, rbx
call qword [0x0072d0b0]
mov ecx, dword [0x00772960]
neg eax
add ecx, eax
mov eax, dword [0x00772988]
cmp ecx, eax
mov dword [0x00772960], ecx
cmovg eax, ecx
mov ecx, dword [0x00772984]
dec ecx
mov dword [0x00772988], eax
mov eax, dword [0x007729ac]
cmp ecx, eax
mov dword [0x00772984], ecx
cmovg eax, ecx
mov rcx, rbx
mov dword [0x007729ac], eax
call qword [0x0072d0a0]
mov rcx, qword [0x00772b88]
test rcx, rcx
je 0x4a7227
call qword [0x0072d108]
mov eax, dword [rsp + 0x50]
inc eax
mov dword [r14], eax
xor eax, eax
jmp 0x4a7427
mov rcx, rbx
call qword [0x0072d0a0]
mov eax, dword [rsp + 0x50]
inc eax
mov dword [r14], eax
xor eax, eax
jmp 0x4a7427
test rbx, rbx
je 0x4a7227
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x4a721e
test r11, r11
je 0x4a71aa
mov rcx, r11
call qword [0x0072d0f8]
mov rcx, rbx
call qword [0x0072d0b0]
mov edx, dword [0x00772960]
mov rcx, rbx
neg eax
add edx, eax
mov eax, dword [0x00772988]
cmp edx, eax
mov dword [0x00772960], edx
cmovg eax, edx
mov edx, dword [0x00772984]
dec edx
mov dword [0x00772988], eax
mov eax, dword [0x007729ac]
cmp edx, eax
mov dword [0x00772984], edx
cmovg eax, edx
mov dword [0x007729ac], eax
call qword [0x0072d0a0]
mov rcx, qword [0x00772b88]
test rcx, rcx
je 0x4a7227
call qword [0x0072d108]
mov eax, dword [rsp + 0x50]
inc eax
mov dword [r14], eax
xor eax, eax
jmp 0x4a7427
mov rcx, rbx
call qword [0x0072d0a0]
mov eax, dword [rsp + 0x50]
inc eax
mov dword [r14], eax
xor eax, eax
jmp 0x4a7427
mov eax, dword [rsp + 0x50]
test eax, eax
mov dword [r14], eax
jne 0x4a7316
mov rbx, qword [rsp + 0x78]
cmp rbx, qword [rsp + 0x70]
je 0x4a730e
cmp byte [rsp + 0x8c], 1
jne 0x4a7275
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
call fcn.00425ea0
mov rcx, r12
jmp 0x4a7424
test rbx, rbx
je 0x4a730e
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x4a7305
mov rcx, qword [0x00772b88]
test rcx, rcx
je 0x4a7299
call qword [0x0072d0f8]
mov rcx, rbx
call qword [0x0072d0b0]
mov edx, dword [0x00772960]
mov rcx, rbx
neg eax
add edx, eax
mov eax, dword [0x00772988]
cmp edx, eax
mov dword [0x00772960], edx
cmovg eax, edx
mov edx, dword [0x00772984]
dec edx
mov dword [0x00772988], eax
mov eax, dword [0x007729ac]
cmp edx, eax
mov dword [0x00772984], edx
cmovg eax, edx
mov dword [0x007729ac], eax
call qword [0x0072d0a0]
mov rcx, qword [0x00772b88]
test rcx, rcx
je 0x4a730e
call qword [0x0072d108]
mov rcx, r12
jmp 0x4a7424
mov rcx, rbx
call qword [0x0072d0a0]
mov rcx, r12
jmp 0x4a7424
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x4a7424
movsxd rax, dword [rsp + 0x80]
mov byte [rax + rcx], 0
movzx eax, byte [rsp + 0x8c]
test al, al
je 0x4a741f
mov rcx, qword [rsp + 0x78]
cmp rcx, qword [rsp + 0x70]
jne 0x4a7424
cmp al, 1
jne 0x4a7377
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
inc eax
movsxd rdx, eax
call fcn.0043b030
mov rcx, rax
mov qword [rsp + 0x78], rax
jmp 0x4a7404
mov ebx, dword [rsp + 0x80]
inc ebx
call fcn.0049a550
test eax, eax
je 0x4a738e
mov rcx, r12
jmp 0x4a73ff
test ebx, ebx
jg 0x4a7397
mov rcx, r12
jmp 0x4a73ff
movsxd rbx, ebx
test rbx, rbx
je 0x4a73f5
cmp rbx, 0x7fffff00
jae 0x4a73f5
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x4a73e8
mov rcx, qword [0x00772b88]
test rcx, rcx
je 0x4a73c3
call qword [0x0072d0f8]
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.0043a720
mov rcx, qword [0x00772b88]
test rcx, rcx
je 0x4a73fa
call qword [0x0072d108]
mov rcx, qword [rsp + 0x20]
jmp 0x4a73ff
mov ecx, ebx
call qword [0x0072d098]
mov rcx, rax
jmp 0x4a73ff
mov rcx, r12
jmp 0x4a73ff
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x78], rcx
test rcx, rcx
je 0x4a7424
mov eax, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x70]
inc eax
movsxd r8, eax
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x78]
mov rax, rcx
mov r12, qword [rsp + 0x140]
mov r15, qword [rsp + 0x128]
mov r14, qword [rsp + 0x130]
mov r13, qword [rsp + 0x138]
mov rdi, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x150]
mov rbp, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x110]
call fcn.00693b90
add rsp, 0x168
ret