Function at 0x4033d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4b82b5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov eax, dword [0x4f5b3c]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x74], 0
mov dword [esp + 0x14], eax
mov eax, dword [edi + 4]
mov ebx, 1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x78], bl
call fcn.004a9d5c
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x40342f
push eax
lea ecx, [esp + 0x14]
call fcn.004a9d5c
mov eax, dword [0x4fef30]
lea ecx, [esp + 0x10]
push eax
call fcn.004a7309
test eax, eax
jle 0x40380f
lea esi, [edi + 0x34]
push ebx
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x88], esp
push 0x4fef30
call fcn.004a9994
lea ecx, [esp + 0x1c]
call fcn.00436ed0
test eax, eax
je 0x4037f7
push str.RE_
lea ecx, [esp + 0x18]
call fcn.004a9d5c
push 0x4ee4fc
lea ecx, [esp + 0x2c]
push 0x4fef30
push ecx
call fcn.004a9e68
push esi
lea edx, [esp + 0x28]
push eax
push edx
mov byte [esp + 0x80], 2
call fcn.004a9e02
push 0x4ee4f8
push eax
lea eax, [esp + 0x28]
mov byte [esp + 0x7c], 3
push eax
call fcn.004a9e68
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x78], 4
call fcn.004a9feb
lea ecx, [esp + 0x20]
mov byte [esp + 0x74], 3
call fcn.004a9c1f
lea ecx, [esp + 0x24]
mov byte [esp + 0x74], 2
call fcn.004a9c1f
lea ecx, [esp + 0x28]
mov byte [esp + 0x74], bl
call fcn.004a9c1f
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x80], esp
push edx
call fcn.004a9994
mov ecx, 0x4fee30
call fcn.00421b40
mov eax, dword [0x4ff144]
test eax, eax
je 0x403573
push esi
lea ecx, [esp + 0x1c]
call fcn.004a9994
push ecx
mov byte [esp + 0x78], 5
mov ecx, esp
mov dword [esp + 0x80], esp
push 0x4fc5e4
call fcn.004a9c8d
push ecx
lea eax, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
mov byte [esp + 0x80], 6
call fcn.00403850
mov ecx, dword [0x4ff144]
mov byte [esp + 0x7c], 5
call fcn.0040ea70
lea ecx, [esp + 0x18]
mov byte [esp + 0x74], bl
call fcn.004a9c1f
xor ebp, ebp
push 0x4ee514
mov ecx, esi
mov dword [esp + 0x80], ebp
call fcn.004a7309
test eax, eax
jl 0x40358e
mov ebp, ebx
push 0x4ee510
mov ecx, esi
call fcn.004a7309
test eax, eax
jl 0x4035a2
mov dword [esp + 0x7c], ebx
test ebp, ebp
je 0x4035d0
lea ecx, [esp + 0x2c]
push 3
push ecx
mov ecx, esi
call fcn.004a70e4
mov eax, dword [eax]
mov ecx, esi
push eax
mov byte [esp + 0x78], 7
call fcn.004a9d5c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x74], bl
call fcn.004a9c1f
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x403602
lea edx, [esp + 0x30]
push 3
push edx
mov ecx, esi
call fcn.004a70e4
mov eax, dword [eax]
mov ecx, esi
push eax
mov byte [esp + 0x78], 8
call fcn.004a9d5c
lea ecx, [esp + 0x30]
mov byte [esp + 0x74], bl
call fcn.004a9c1f
test ebp, ebp
je 0x403672
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push esi
call fcn.004a9994
mov ecx, edi
call fcn.00407140
xor ecx, ecx
test eax, eax
sete cl
mov ebp, ecx
test ebp, ebp
je 0x403672
mov ecx, 0x4fef30
call fcn.004033c0
push eax
lea ecx, [esp + 0x14]
call fcn.004a7309
mov ecx, 0x4fef30
mov edi, eax
call fcn.004033c0
mov edx, edi
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
add edx, ecx
mov eax, esp
mov dword [esp + 0x38], esp
push edx
push eax
lea ecx, [esp + 0x1c]
call fcn.004a70e4
lea ecx, [esp + 0x14]
call fcn.0040cea0
push ecx
mov dword [esp + 0x38], esp
mov ecx, esp
push esi
call fcn.004a9994
mov ecx, 0x4ff028
call fcn.00453dc0
test eax, eax
je 0x403694
mov ebp, ebx
jmp 0x40378c
test ebp, ebp
jne 0x40378c
mov eax, dword [esp + 0x7c]
test eax, eax
je 0x403723
mov eax, dword [0x4f5b3c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
push 0xa
lea ecx, [esp + 0x54]
mov byte [esp + 0x78], 0xb
call fcn.004a7f83
mov dword [esp + 0x40], 0x4ca7b0
mov eax, dword [esi]
lea ecx, [esp + 0x40]
push eax
mov byte [esp + 0x78], 0xc
call fcn.0042e1a0
lea ecx, [esp + 0x50]
mov byte [esp + 0x74], 0xf
call fcn.004a7ff7
lea ecx, [esp + 0x4c]
mov byte [esp + 0x74], 0xe
call fcn.004a9c1f
lea ecx, [esp + 0x48]
mov byte [esp + 0x74], 0xd
call fcn.004a9c1f
lea ecx, [esp + 0x40]
lea edx, [esp + 0x44]
neg ecx
sbb ecx, ecx
mov byte [esp + 0x74], bl
and ecx, edx
mov dword [esp + 0x38], ecx
call fcn.004a9c1f
push 0
mov ecx, esi
call fcn.00434b80
test eax, eax
je 0x40378c
mov ecx, esi
call fcn.00436630
test eax, eax
je 0x40375b
push str..lnk
mov ecx, esi
call fcn.00434380
test eax, eax
jle 0x40378c
mov eax, dword [esi]
push 0
push eax
push ebx
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x40378c
push ecx
mov dword [esp + 0x38], esp
mov ecx, esp
push esi
call fcn.004a9994
push ecx
mov byte [esp + 0x7c], 0x10
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x4fc5e4
call fcn.00441d00
mov ecx, 0x4fee30
mov byte [esp + 0x7c], bl
call fcn.00423580
mov ecx, 0x4fef30
call fcn.004033c0
push eax
lea ecx, [esp + 0x14]
call fcn.004a7309
mov ecx, 0x4fef30
mov edi, eax
call fcn.004033c0
mov dword [esp + 0x34], edi
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x34]
not ecx
dec ecx
push ecx
add eax, ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.004a70e4
lea ecx, [esp + 0x14]
call fcn.0040cea0
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
push ebp
push edx
push 0
push eax
call fcn.004038e0
mov edi, dword [esp + 0x1c]
mov ecx, dword [0x4fef30]
push ecx
lea ecx, [esp + 0x14]
call fcn.004a7309
test eax, eax
jg 0x403449
lea ecx, [esp + 0x14]
mov byte [esp + 0x74], 0
call fcn.004a9c1f
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], 0xffffffff
call fcn.004a9c1f
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x68
ret 4