Function at 0x41d6ba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x1d4
mov eax, 0x429ba4
call fcn.00423ccf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1d4], ecx
mov dword [ebp - 0x1d8], ecx
test eax, eax
je 0x41e130
test ecx, ecx
je 0x41e130
push 9
pop ecx
cmp word [eax], cx
jne 0x41e129
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x41e129
xor ebx, ebx
mov dword [ebp - 0x1a8], ebx
lea edx, [ebp - 0x1a8]
push edx
push 0x40d574
mov dword [ebp - 4], ebx
mov eax, dword [ecx]
push ecx
call dword [eax]
mov esi, eax
test esi, esi
jns 0x41d745
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1a8]
test ecx, ecx
je 0x41d73e
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
jmp 0x41e135
push 0x18c
lea eax, [ebp - 0x1a0]
push ebx
push eax
mov dword [ebp - 0x1a4], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x1a8]
add esp, 0xc
lea edx, [ebp - 0x1a4]
or ebx, 0xffffffff
push edx
mov dword [ebp - 0x188], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov esi, eax
test esi, esi
jns 0x41d787
mov dword [ebp - 4], ebx
jmp 0x41d72e
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x1a0]
push edx
push eax
call dword [ecx + 0x34]
mov esi, eax
test esi, esi
js 0x41d782
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x19c]
push edx
push eax
call dword [ecx + 0x3c]
mov esi, eax
test esi, esi
js 0x41d782
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x198]
push edx
push eax
call dword [ecx + 0x44]
mov esi, eax
test esi, esi
js 0x41d782
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x194]
push edx
push eax
call dword [ecx + 0x4c]
mov esi, eax
test esi, esi
js 0x41d782
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x190]
push edx
push eax
call dword [ecx + 0x54]
mov esi, eax
test esi, esi
js 0x41d782
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x18c]
push edx
push eax
call dword [ecx + 0x5c]
mov esi, eax
test esi, esi
js 0x41d782
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x15c]
push edx
push eax
call dword [ecx + 0x64]
mov esi, eax
test esi, esi
js 0x41d782
xor esi, esi
cmp dword [ebp - 0x15c], esi
jbe 0x41d875
mov eax, dword [ebp - 0x1a8]
mov edx, dword [eax]
lea ecx, [ebp - 0x154]
add ecx, esi
push ecx
push esi
push eax
call dword [edx + 0x6c]
mov edi, eax
test edi, edi
js 0x41d958
inc esi
cmp esi, dword [ebp - 0x15c]
jb 0x41d84c
mov eax, dword [ebp - 0x1a8]
and dword [ebp - 0x1d0], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x1d0]
push edx
push eax
call dword [ecx + 0x84]
mov esi, eax
test esi, esi
js 0x41d782
mov eax, dword [ebp - 0x1a8]
and dword [ebp - 0x1c8], 0
mov ecx, dword [eax]
lea edx, [ebp - 0x1c8]
push edx
push eax
call dword [ecx + 0x8c]
mov esi, eax
test esi, esi
js 0x41d782
and dword [ebp - 0x1c4], 0
mov byte [ebp - 4], 1
mov eax, dword [section..data]
mov ebx, section..data
mov ecx, ebx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1b4], esi
mov byte [ebp - 4], 3
mov eax, dword [section..data]
mov ecx, ebx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x1b8], edi
and dword [ebp - 0x1ac], 0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x1ac]
push edx
push eax
call dword [ecx + 0x78]
mov ebx, eax
test ebx, ebx
jns 0x41d972
push dword [ebp - 0x1ac]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea edx, [edi - 0x10]
call fcn.00410ac9
lea edx, [esi - 0x10]
call fcn.00410ac9
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1a8]
test ecx, ecx
je 0x41d951
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, ebx
jmp 0x41e135
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x1a8]
test eax, eax
je 0x41d96b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, edi
jmp 0x41e135
mov ecx, dword [ebp - 0x1ac]
lea eax, [ebp - 0x1b8]
push eax
call fcn.00412df1
push dword [ebp - 0x1ac]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call ebx
and dword [ebp - 0x1ac], 0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x1ac]
push edx
push eax
call dword [ecx + 0x1c]
mov edi, eax
test edi, edi
jns 0x41d9ea
push dword [ebp - 0x1ac]
call ebx
mov edx, dword [ebp - 0x1b8]
lea edx, [edx - 0x10]
call fcn.00410ac9
lea edx, [esi - 0x10]
call fcn.00410ac9
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1a8]
test ecx, ecx
je 0x41d96b
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
jmp 0x41d96b
mov ecx, dword [ebp - 0x1ac]
lea eax, [ebp - 0x1b4]
push eax
call fcn.00412df1
mov byte [ebp - 4], 4
push dword [ebp - 0x1ac]
call ebx
mov eax, dword [section..data]
mov edi, section..data
mov ecx, edi
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x1b0], ebx
cmp dword [ebp + 0xc], 2
je 0x41dafc
and dword [ebp - 0x1ac], 0
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x1ac]
push edx
push eax
call dword [ecx + 0x24]
mov esi, eax
test esi, esi
jns 0x41da83
push dword [ebp - 0x1ac]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea edx, [ebx - 0x10]
call fcn.00410ac9
mov edx, dword [ebp - 0x1b8]
lea edx, [edx - 0x10]
call fcn.00410ac9
mov edx, dword [ebp - 0x1b4]
lea edx, [edx - 0x10]
call fcn.00410ac9
jmp 0x41d72a
mov ecx, dword [ebp - 0x1ac]
lea eax, [ebp - 0x1b0]
push eax
call fcn.00412df1
mov byte [ebp - 4], 7
push dword [ebp - 0x1ac]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x190]
mov ebx, dword [ebp - 0x1bc]
mov esi, 0x400
test esi, eax
jne 0x41dc39
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x41dc2b
mov esi, dword [ebp - 0x1b0]
cmp dword [esi - 0xc], 0
jne 0x41db80
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
lea ecx, [ebp - 0x1b0]
push ecx
mov ecx, eax
call fcn.00412df1
mov ebx, dword [ebp - 0x1b0]
mov dword [ebp - 4], 7
mov byte [ebp - 4], 0xf
mov esi, dword [ebp - 0x1b4]
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x405f4c
push esi
mov byte [ebp - 0x1bd], 0
call edi
pop ecx
pop ecx
test eax, eax
je 0x41dd8b
push 0x4090e0
push esi
call edi
pop ecx
pop ecx
test eax, eax
je 0x41dd8b
push 0x5c0
call fcn.004227f4
mov edi, eax
pop ecx
mov dword [ebp - 0x1cc], edi
mov byte [ebp - 4], 0x13
test edi, edi
je 0x41dd7e
or eax, 0xffffffff
push eax
push eax
push 0
lea eax, [ebp - 0x1a4]
push eax
push ebx
push esi
mov ecx, edi
call dword [sym.imp.perfctrl.dll_public:_void___thiscall_LoggingSession::constructor_unsigned_short_int_const___unsigned_short_int_const___struct_SESSION_PROPERTIES_const___bool__unsigned_long_long_unsigned___int64__]
mov dword [edi], 0x40c970
jmp 0x41dd80
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x41dbd0
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x41dbd0
lea ecx, [eax + 1]
lea eax, [ebp - 0x1bc]
lea esi, [ebp - 0x1b0]
call fcn.00420886
mov ecx, esi
push ecx
mov byte [ebp - 4], 9
call fcn.004204ea
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x1bc]
lea edx, [edx - 0x10]
call fcn.00410ac9
mov esi, dword [ebp - 0x1b0]
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1ac], eax
mov byte [ebp - 4], 0xa
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
push esi
push eax
lea eax, [ebp - 0x1ac]
push 0x40d070
push eax
call fcn.00422364
add esp, 0x10
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1ac]
call fcn.004204ea
mov edx, dword [ebp - 0x1ac]
lea edx, [edx - 0x10]
call fcn.00410ac9
jmp 0x41daf6
mov eax, dword [ebp - 0x190]
test esi, eax
je 0x41daf6
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
je 0x41daf6
mov esi, dword [ebp - 0x1b0]
cmp dword [esi - 0xc], 0
jne 0x41dc72
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
lea ecx, [ebp - 0x1b0]
push ecx
mov ecx, eax
call fcn.00412df1
jmp 0x41dd18
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x41dcc2
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x41dcc2
lea ecx, [eax + 1]
lea eax, [ebp - 0x1bc]
lea esi, [ebp - 0x1b0]
call fcn.00420886
mov ecx, esi
push ecx
mov byte [ebp - 4], 0xb
call fcn.004204ea
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x1bc]
lea edx, [edx - 0x10]
call fcn.00410ac9
mov esi, dword [ebp - 0x1b0]
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1ac], eax
mov byte [ebp - 4], 0xc
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
push esi
push eax
lea eax, [ebp - 0x1ac]
push 0x40d070
push eax
call fcn.00422364
add esp, 0x10
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1ac]
call fcn.004204ea
mov edx, dword [ebp - 0x1ac]
lea edx, [edx - 0x10]
call fcn.00410ac9
lea eax, [ebp - 0x1b0]
push eax
add ebx, 0xc
mov byte [ebp - 4], 0xd
call fcn.00420c4f
jmp 0x41daf6
xor edi, edi
mov dword [ebp - 0x1c4], edi
jmp 0x41df37
push 0x5e0
call fcn.004227f4
mov edi, eax
pop ecx
mov dword [ebp - 0x1cc], edi
mov byte [ebp - 4], 0x10
test edi, edi
je 0x41ddc6
or eax, 0xffffffff
push eax
push eax
push 0
lea eax, [ebp - 0x1a4]
push eax
push ebx
push esi
mov ecx, edi
call dword [sym.imp.perfctrl.dll_public:_void___thiscall_KernelLoggingSession::constructor_unsigned_short_int_const___unsigned_short_int_const___struct_SESSION_PROPERTIES_const___bool__unsigned_long_long_unsigned___int64__]
mov dword [edi], 0x40c900
jmp 0x41ddc8
xor edi, edi
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x1d0], 0
je 0x41ddf2
cmp dword [ebp - 0x1c8], 0
je 0x41ddf2
push dword [ebp - 0x1c8]
mov ecx, edi
push dword [ebp - 0x1d0]
call dword [sym.imp.perfctrl.dll_public:_void___thiscall_KernelLoggingSession::SetStackCaching_unsigned_long_int__unsigned_long_int_]
and dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1c4], edi
mov byte [ebp - 0x1bd], 1
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x1ac]
push edx
push eax
call dword [ecx + 0x7c]
push dword [ebp - 0x1ac]
mov dword [ebp - 0x1bc], eax
test eax, eax
jns 0x41de81
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea edx, [ebx - 0x10]
call fcn.00410ac9
mov edx, dword [ebp - 0x1b8]
lea edx, [edx - 0x10]
call fcn.00410ac9
lea edx, [esi - 0x10]
call fcn.00410ac9
mov byte [ebp - 4], 0
test edi, edi
je 0x41de62
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0x34]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1a8]
test ecx, ecx
je 0x41de76
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, dword [ebp - 0x1bc]
jmp 0x41e135
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x41df2b
mov esi, dword [ebp - 0x1ac]
lea eax, [ebp - 0x1bc]
push eax
call fcn.00419b3d
mov byte [ebp - 4], 0x12
push dword [ebp - 0x1bc]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x54]
mov edx, dword [ebp - 0x1bc]
mov dword [ebp - 0x1cc], eax
lea edx, [edx - 0x10]
test eax, eax
jns 0x41df26
call fcn.00410ac9
push dword [ebp - 0x1ac]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea edx, [ebx - 0x10]
call fcn.00410ac9
mov edx, dword [ebp - 0x1b8]
lea edx, [edx - 0x10]
call fcn.00410ac9
mov edx, dword [ebp - 0x1b4]
lea edx, [edx - 0x10]
call fcn.00410ac9
mov byte [ebp - 4], 0
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0x34]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1a8]
test ecx, ecx
je 0x41df1b
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, dword [ebp - 0x1cc]
jmp 0x41e135
call fcn.00410ac9
push dword [ebp - 0x1ac]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp + 0xc], 1
mov dword [ebp - 4], 7
je 0x41dfc8
cmp byte [ebp - 0x1bd], 0
je 0x41df7f
mov eax, dword [ebp - 0x1b8]
cmp dword [eax - 0xc], 0
je 0x41df6e
lea eax, [ebp - 0x1b8]
push eax
mov edx, 0x4091cc
call fcn.00412e2d
lea eax, [ebp - 0x1b8]
push eax
mov edx, 0x4091d0
call fcn.00412e2d
mov esi, dword [ebp - 0x1b8]
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x30]
test eax, eax
jne 0x41dfce
mov ecx, dword [ebp - 0x1d4]
lea edx, [ebx - 0x10]
mov dword [ecx], 0x80070057
call fcn.00410ac9
lea edx, [esi - 0x10]
call fcn.00410ac9
mov edx, dword [ebp - 0x1b4]
lea edx, [edx - 0x10]
call fcn.00410ac9
mov byte [ebp - 4], 0
mov eax, dword [edi]
mov ecx, edi
jmp 0x41e0ef
mov esi, dword [ebp - 0x1b8]
lea edx, [ebx - 0x10]
call fcn.00410ac9
lea edx, [esi - 0x10]
call fcn.00410ac9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 2
sub eax, 0
je 0x41e082
dec eax
je 0x41e03a
dec eax
je 0x41e031
mov esi, dword [ebp - 0x1b4]
push 0x57
pop eax
call fcn.004109d1
mov ecx, dword [ebp - 0x1d4]
lea edx, [esi - 0x10]
mov dword [ecx], eax
call fcn.00410ac9
mov byte [ebp - 4], 0
test edi, edi
je 0x41e026
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 0x34]
or eax, 0xffffffff
mov dword [ebp - 4], eax
jmp 0x41e0f8
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x24]
jmp 0x41e089
mov esi, dword [ebp - 0x1b4]
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x405f4c
push esi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x41e06b
push 0x4090e0
push esi
call ebx
pop ecx
pop ecx
test eax, eax
je 0x41e06b
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x28]
jmp 0x41e08f
mov edx, dword [edi]
or eax, 0xffffffff
cmp word [ebp + 0x14], ax
mov ecx, edi
sete al
movzx eax, al
push eax
call dword [edx + 0x50]
jmp 0x41e08f
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x20]
mov esi, dword [ebp - 0x1b4]
test eax, eax
jne 0x41e000
jmp 0x41e005
push 1
call dword [eax + 0x34]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1a8]
test eax, eax
je 0x41e108
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x41e135
mov eax, 0x80070057
jmp 0x41e135
mov eax, 0x80004003
call fcn.00423d3a
ret 0x10