Function at 0x418d20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x364
mov eax, dword [0x62e040]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov eax, ecx
mov ecx, dword [ebp + 0x10]
xor bh, bh
push edi
push eax
mov dword [esp + 0x70], edx
mov dword [esp + 0x28], eax
mov dword [esp + 0xb0], ecx
mov byte [esp + 0x16], bh
call sym.SystemInformer.exe_PhGetWindowDpi
cmp dword [esi], 0
mov edi, eax
mov dword [esp + 0x70], edi
je 0x419431
push dword [0x634f00]
push 0x28
call sym.SystemInformer.exe_PhCreateObject
mov ebx, eax
push 0x80
push 4
push dword [0x635044]
mov dword [esp + 0x74], ebx
mov dword [ebx], 8
mov dword [ebx + 4], 0x500e10
mov dword [ebx + 8], 0x500e30
mov dword [ebx + 0xc], 0x20
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, eax
mov eax, dword [ebx + 0xc]
shl eax, 2
push eax
push 0xff
push ecx
mov dword [ebx + 0x10], ecx
call fcn.00582250
mov eax, dword [ebx + 0xc]
add esp, 0xc
mov dword [ebx + 0x14], eax
shl eax, 4
push eax
push 4
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0xffffffff
mov dword [ebx + 0x24], 0
mov ebx, dword [esi]
mov esi, dword [esi + 4]
mov dword [esp + 0x14], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], esi
test ebx, ebx
je 0x418e83
cmp word [esi], 0x40
jne 0x418e83
lea eax, ds:[esi + 2]
sub ebx, 2
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x54]
mov dword [esp + 0x34], ebx
push eax
push 0x7c
lea eax, [esp + 0x3c]
push eax
call sym.SystemInformer.exe_PhSplitStringRefAtChar
cmp dword [esp + 0x50], 0
je 0x4193ed
lea eax, ds:[esp + 0x18]
push eax
push 0xa
lea eax, [esp + 0x58]
push eax
call sym.SystemInformer.exe_PhStringToInteger64
test al, al
je 0x4193ed
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x64], ecx
mov dword [esp + 0x14], esi
jmp 0x418e87
mov dword [esp + 0x64], edi
test ebx, ebx
je 0x41923a
nop
push 0
push 0x7c
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_PhFindCharInStringRef
mov edi, edi
cmp eax, 0xffffffff
jne 0x418eb7
xor eax, eax
mov edi, esi
mov esi, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], eax
xor ebx, ebx
jmp 0x418ed2
mov ecx, dword [esp + 0x14]
lea esi, [eax + eax]
mov edi, ecx
sub ebx, esi
add ecx, 2
add ecx, esi
sub ebx, 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], edi
test esi, esi
je 0x41922e
push 0
push 0x2c
lea eax, [esp + 0x7c]
push eax
call sym.SystemInformer.exe_PhFindCharInStringRef
mov dword ds:[esp + 0x60], edi
cmp eax, 0xffffffff
jne 0x418f0d
mov ecx, esi
xor eax, eax
xor esi, esi
jmp 0x418f1a
lea ecx, [eax + eax]
lea eax, [ecx + 2]
sub esi, ecx
add eax, edi
sub esi, 2
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x5c], ecx
test ecx, ecx
je 0x4193ed
movzx eax, word ds:[edi]
mov edx, eax
cmp eax, 0x2b
jne 0x418fed
cmp dword [esp + 0x6c], 0
je 0x41922e
lea eax, [edi + 2]
sub ecx, 2
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xb0]
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], ecx
push eax
push edx
push eax
call sym.SystemInformer.exe_PhSplitStringRefAtChar
mov edi, dword ds:[esp + 0x28]
test edi, edi
je 0x41922e
cmp dword [esp + 0xb0], 0
je 0x41922e
lea eax, [esp + 0x88]
push eax
push 0xa
lea eax, [esp + 0xb8]
push eax
call sym.SystemInformer.exe_PhStringToInteger64
test al, al
je 0x41922e
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0xb8]
push dword [esp + 0x88]
mov ecx, dword [esp + 0x70]
mov dword [esp + 0xbc], edi
mov dword [esp + 0xc0], eax
call fcn.00418940
mov edi, edi
test eax, eax
je 0x41922e
mov edi, dword [eax + 8]
jmp 0x41901f
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edi
cmp edx, 0x2d
je 0x41904f
lea eax, [esp + 0x48]
mov edx, 0xa
push eax
lea ecx, [esp + 0x44]
call fcn.00501640
mov cl, al
mov edi, dword [esp + 0x48]
mov dword [esp + 0x18], edi
test cl, cl
je 0x4193ed
push 0
push 0x2c
lea eax, [esp + 0x7c]
push eax
call sym.SystemInformer.exe_PhFindCharInStringRef
mov edx, dword [esp + 0x38]
mov dword [esp + 0x60], edx
cmp eax, 0xffffffff
jne 0x419084
mov ecx, esi
mov dword [esp + 0x38], edx
mov dword [esp + 0x84], 0
xor esi, esi
jmp 0x419098
lea eax, [edi + 2]
sub ecx, 2
mov dword [esp + 0x44], eax
cmp edx, 0x2d
lea eax, [esp + 0x48]
mov dword [esp + 0x40], ecx
push eax
mov edx, 0xa
lea ecx, [esp + 0x44]
sete bl
call fcn.00501640
mov cl, al
test bl, bl
je 0x41900f
mov edi, dword [esp + 0x48]
neg edi
jmp 0x419013
lea ecx, [eax + eax]
lea eax, [edx + 2]
sub esi, ecx
add eax, ecx
sub esi, 2
mov dword [esp + 0x84], eax
mov dword ds:[esp + 0x5c], ecx
test ecx, ecx
je 0x4193ed
movzx eax, word [edx]
xor bl, bl
mov dword [esp + 0x94], edx
mov edx, eax
mov dword [esp + 0xa8], edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0x90], ecx
cmp eax, 0x2d
je 0x4190d5
cmp ax, 0x2b
jne 0x4190eb
jmp 0x4190d7
mov bl, 1
lea eax, [edx + 2]
sub ecx, 2
mov dword [esp + 0x94], eax
mov dword [esp + 0x90], ecx
lea eax, ds:[esp + 0x98]
mov edx, 0xa
push eax
lea ecx, [esp + 0x94]
call fcn.00501640
test bl, bl
mov cl, al
mov ebx, dword [esp + 0x98]
je 0x419114
neg ebx
mov dword ds:[esp + 0x18], ebx
test cl, cl
je 0x4193ed
test esi, esi
je 0x4193ed
mov ecx, dword [esp + 0x84]
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], ecx
mov byte [esp + 0x13], 0
movzx eax, word [ecx]
mov edx, eax
cmp eax, 0x2d
je 0x41915b
cmp edx, 0x2b
jne 0x419174
jmp 0x419160
mov byte [esp + 0x13], 1
lea eax, [ecx + 2]
sub esi, 2
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa0], esi
lea eax, [esp + 0x50]
mov edx, 0xa
push eax
lea ecx, [esp + 0xa4]
call fcn.00501640
cmp byte [esp + 0x13], 0
mov cl, al
mov esi, dword [esp + 0x50]
je 0x419199
neg esi
mov dword ds:[esp + 0x18], esi
test cl, cl
je 0x4193ed
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x70]
cmp eax, edx
je 0x4191f8
test eax, eax
je 0x4191f8
mov ecx, eax
shr ecx, 1
push 0
test esi, esi
js 0x4191dd
mov eax, esi
mul edx
add eax, ecx
mov ecx, dword [esp + 0x68]
push ecx
adc edx, 0
push edx
push eax
call fcn.005a0630
mov esi, eax
jmp 0x4191f8
neg esi
mov eax, esi
mul edx
add eax, ecx
mov ecx, dword [esp + 0x68]
push ecx
adc edx, 0
push edx
push eax
call fcn.005a0630
mov esi, eax
neg esi
push 0x28
push 4
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esp + 0x80], eax
mov dword [esp + 0x7c], edi
mov dword [eax + 4], edi
mov dword [eax + 0x18], ebx
mov dword [eax + 0x10], esi
lea eax, [esp + 0x7c]
push eax
push dword [esp + 0x6c]
call sym.SystemInformer.exe_PhAddEntryHashtable
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x14]
test ebx, ebx
jne 0x418e90
mov esi, dword [esp + 0x24]
push 0
push 0
push 0x41f
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
xor edi, edi
push ebx
push ebx
push 0x41e
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x421
push esi
mov dword [esp + 0x4c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x280
mov dword [esp + 0x74], eax
lea eax, [esp + 0xec]
push ebx
push eax
call fcn.00582250
xor esi, esi
add esp, 0xc
mov dword [esp + 0x14], esi
cmp dword [esp + 0x3c], ebx
jbe 0x4193bf
lfence
lea ecx, [ecx]
lea eax, [esp + 0xc0]
push eax
push edi
push 0x407
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4193b4
lea eax, [esp + 0x88]
mov dword [esp + 0x88], edi
push eax
push dword [esp + 0x6c]
call sym.SystemInformer.exe_PhFindEntryHashtable
test eax, eax
je 0x41937c
lea esi, [eax + 4]
test esi, esi
je 0x419378
or dword [esp + 0xc0], 1
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov dword [esp + 0xd0], eax
lea eax, [esp + 0xc0]
push eax
push 0x100004
push 0x408
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SendMessageW]
test byte [esp + 0xc0], 4
jne 0x4193af
cmp dword ds:[esp + 0x70], 0
je 0x41934f
mov ecx, dword [esi]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x41934f
dec eax
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x18]
cmp eax, 0xa0
jae 0x4193af
mov dword [esp + eax*4 + 0xe8], edi
mov eax, dword [esi]
mov esi, dword [esp + 0x14]
mov eax, dword [eax + 0x18]
inc eax
cmp esi, eax
jae 0x4193b3
mov esi, eax
mov dword [esp + 0x14], esi
jmp 0x4193b3
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0xc0]
test al, 4
jne 0x4193b3
and eax, 0xfffffffe
mov dword [esp + 0xc0], eax
lea eax, [esp + 0xc0]
push eax
push 0x100000
push 0x408
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4193b3
mov esi, dword [esp + 0x14]
inc ebx
inc edi
cmp ebx, dword [esp + 0x3c]
jb 0x4192b0
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0xe8]
push eax
push esi
push 0x40a
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x41f
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [esp + 0x12], 1
mov ecx, dword [esp + 0x68]
mov ebx, dword [ecx]
mov edi, dword [ecx + 0x24]
add ebx, 8
mov esi, dword [ecx + 0x18]
imul edi, ebx
add edi, esi
cmp esi, edi
je 0x419416
mov eax, esi
add esi, ebx
cmp dword [eax], 0xffffffff
jne 0x419505
cmp esi, edi
jne 0x419405
mov ecx, dword [esp + 0x68]
or eax, 0xffffffff
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x41942d
call fcn.004fc020
mov bh, byte [esp + 0x12]
mov eax, dword ds:[esp + 0xac]
test eax, eax
je 0x4195b9
cmp dword [eax], 0
je 0x4195b9
lea ecx, ds:[esp + 0x50]
push ecx
lea ecx, [esp + 0x60]
push ecx
push 0x2c
push eax
call sym.SystemInformer.exe_PhSplitStringRefAtChar
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4195b9
cmp dword [esp + 0x50], 0
je 0x4195b9
mov edx, dword [esp + 0x60]
or esi, 0xffffffff
movzx eax, word [edx]
mov edi, eax
cmp eax, 0x2b
jne 0x419554
cmp dword [esp + 0x6c], 0
je 0x419584
lea eax, [edx + 2]
sub ecx, 2
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], ecx
push eax
push edi
push eax
call sym.SystemInformer.exe_PhSplitStringRefAtChar
mov edi, dword ds:[esp + 0x28]
test edi, edi
je 0x419584
cmp dword [esp + 0x7c], 0
je 0x419584
lea eax, [esp + 0x88]
push eax
push 0xa
lea eax, [esp + 0x84]
push eax
call sym.SystemInformer.exe_PhStringToInteger64
test al, al
jne 0x419525
lea eax, [esp + 0x18]
push eax
push 0xa
lea eax, [esp + 0x58]
push eax
call sym.SystemInformer.exe_PhStringToInteger64
nop
jmp 0x4195b9
add eax, 8
je 0x419416
push dword [eax + 4]
push 0
push dword [0x635044]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
nop
jmp 0x419401
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x7c]
push dword [esp + 0x88]
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x80], edi
mov dword [esp + 0x84], eax
call fcn.00418940
test eax, eax
je 0x419584
mov esi, dword [eax + 8]
jmp 0x419584
mov dword ds:[esp + 0x48], ecx
mov dword [esp + 0x4c], edx
cmp edi, 0x2d
je 0x4195d2
lea eax, [esp + 0x40]
mov edx, 0xa
push eax
lea ecx, [esp + 0x4c]
call fcn.00501640
mov esi, dword [esp + 0x40]
mov dword [esp + 0x18], esi
lea eax, [esp + 0x18]
push eax
push 0xa
lea eax, [esp + 0x58]
push eax
call sym.SystemInformer.exe_PhStringToInteger64
cmp esi, 0xffffffff
je 0x4195b9
mov eax, dword ds:[esp + 0x18]
cmp eax, 2
jg 0x4195b9
push eax
push esi
push 0x40d
push dword [esp + 0x30]
lfence
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x36c]
mov al, bh
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005802ef
mov esp, ebp
pop ebp
ret 0xc
lea eax, [edx + 2]
sub ecx, 2
mov dword [esp + 0x4c], eax
cmp edi, 0x2d
lea eax, [esp + 0x40]
mov dword [esp + 0x48], ecx
push eax
mov edx, 0xa
lea ecx, [esp + 0x4c]
sete bl
call fcn.00501640
lea esp, [esp]
test bl, bl
je 0x41957c
mov esi, dword [esp + 0x40]
neg esi
jmp 0x419580