Function at 0x40a5ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edx
xor ecx, ecx
mov dword [esp + 0x44], 0x5285a4
xor ebx, ebx
mov dword [esp + 0x40], ecx
inc ebx
mov dword [esp + 0x38], ecx
mov eax, dword [edi]
mov esi, 0xc0000135
mov dword [esp + 0x3c], edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x24], edi
sub eax, ecx
je 0x40a8d5
sub eax, ebx
je 0x40a7b3
sub eax, ebx
je 0x40a70b
sub eax, ebx
je 0x40a64d
mov esi, 0xc0000002
jmp 0x40a932
push ecx
push 0xb
lea edx, [esp + 0x14]
pop ecx
call fcn.0040a4c5
mov esi, eax
pop ecx
test esi, esi
js 0x40a932
mov edi, dword [esp + 0xc]
lea eax, [esp + 0x18]
and dword [esp + 0x10], 0
mov dword [esp + 0x30], eax
cmp dword [edi], 0
jbe 0x40a932
push 0xfffffffffffffff0
pop edx
lea ecx, [edi + 0x10]
sub edx, edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x34], edx
test ebx, ebx
je 0x40a932
mov eax, dword [ecx - 4]
mov dword [esp + 0x20], eax
mov eax, dword [ecx]
mov dword [esp + 0x28], eax
movzx eax, word [ecx + 0xe]
add eax, edx
add eax, ecx
lea ecx, [edi + 0x20]
add ecx, eax
call fcn.0040f5e0
mov dword [esp + 0x48], eax
test eax, eax
je 0x40a6e7
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push dword [ebp + 8]
and dword [esp + 0x30], 0
lea eax, [esp + 0x24]
push eax
call dword [esp + 0x1c]
push dword [esp + 0x48]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
inc eax
mov edx, dword [esp + 0x34]
add ecx, 0x11c
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
cmp eax, dword [edi]
jb 0x40a68f
jmp 0x40a932
push ecx
mov ecx, dword [edi + 4]
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], eax
push 4
pop edx
mov ecx, dword [ecx]
call fcn.00409808
pop ecx
test eax, eax
je 0x40a932
xor edx, edx
mov dword [esp + 0x10], edx
cmp dword [eax], edx
jbe 0x40a930
lea ecx, [eax + 0xc]
mov esi, eax
mov dword [esp + 0xc], ecx
test ebx, ebx
je 0x40a930
mov eax, dword [ecx - 8]
mov dword [esp + 0x20], eax
mov eax, dword [ecx]
mov dword [esp + 0x28], eax
mov eax, dword [edi + 4]
mov eax, dword [eax]
mov eax, dword [eax + 4]
add eax, dword [ecx + 0xc]
je 0x40a79e
add eax, 4
push 0x5c
push eax
call fcn.0049e627
pop ecx
pop ecx
add eax, 2
push eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea ecx, [esp + 0x20]
call fcn.0040a93b
push dword [ebp + 8]
lea eax, [esp + 0x24]
push eax
call dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov ebx, eax
mov edx, dword [esp + 0x10]
inc edx
add ecx, 0x6c
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
cmp edx, dword [esi]
jb 0x40a741
jmp 0x40a930
lea eax, [esp + 0x18]
push ecx
lea edx, [esp + 0x50]
mov dword [esp + 0x34], eax
mov ecx, edi
call fcn.0040ab75
pop ecx
test eax, eax
je 0x40a932
lea eax, [esp + 0x94]
mov dword [esp + 0x40], eax
lea edx, [esp + 0x38]
mov eax, dword [esp + 0x58]
lea ecx, [esp + 0x40]
push 0x24
mov dword [esp + 0x3c], eax
call fcn.004092a6
pop ecx
test eax, eax
je 0x40a932
mov ecx, dword [esp + 0xa8]
mov esi, dword [esp + 0x58]
add ecx, 0xfffffff8
add esi, 0xc
jmp 0x40a8cb
test ebx, ebx
je 0x40a930
lea eax, [esp + 0x60]
mov dword [esp + 0x38], ecx
push 0x34
lea edx, [esp + 0x3c]
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x44]
call fcn.004092a6
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40a8c4
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x78]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x80]
shr ecx, 0x10
push ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x94]
push 0x40
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x40a8c4
mov dword [esp + 0x40], eax
lea edx, [esp + 0x38]
mov eax, dword [esp + 0x90]
lea ecx, [esp + 0x40]
mov dword [esp + 0x38], eax
movzx eax, word [esp + 0x1a]
push eax
call fcn.004092a6
pop ecx
test eax, eax
je 0x40a8ba
lea ecx, [esp + 0x20]
call fcn.0040a93b
push dword [ebp + 8]
lea eax, [esp + 0x24]
push eax
call dword [esp + 0x1c]
mov ebx, eax
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x68]
add ecx, 0xfffffff8
cmp ecx, esi
jne 0x40a811
jmp 0x40a930
push ecx
lea edx, [esp + 0x50]
mov ecx, edi
call fcn.0040ab75
pop ecx
test eax, eax
je 0x40a932
mov eax, dword [esp + 0x58]
mov esi, dword [eax + 0x14]
jmp 0x40a926
test ebx, ebx
je 0x40a930
mov eax, dword [esi + 0x18]
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 0x28], eax
lea eax, [esi + 0x2c]
mov dword [esp + 0x30], eax
call fcn.0040a93b
push dword [ebp + 8]
lea eax, [esp + 0x24]
push eax
call dword [esp + 0x1c]
mov esi, dword [esi + 8]
mov ebx, eax
mov eax, dword [esp + 0x58]
sub esi, 8
add eax, 0xc
cmp esi, eax
jne 0x40a8ef
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret