Function at 0x4aeaaa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
cmp byte [esp + 0x88], 0
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x2c], edx
push edi
mov dword [esp + 0x40], esi
je 0x4aeaf0
mov eax, dword [esi + 8]
mov ebx, dword [esi + 4]
lea edx, [eax + 4]
cmp edx, ebx
ja 0x4af3fa
mov ebp, dword [esi]
mov eax, dword [eax + ebp]
mov dword [esi + 8], edx
cmp eax, 0x1cf51ba
jne 0x4af3fa
lea edi, [edx + 4]
cmp edi, ebx
ja 0x4af3fa
mov eax, dword [edx + ebp]
mov dword [esi + 8], edi
mov dword [esi + 4], eax
mov edx, dword [esi + 8]
mov edi, dword [esi + 4]
lea eax, [edx + 0x10]
cmp eax, edi
ja 0x4af3fa
mov ebx, dword [esi]
mov ebp, dword [ebx + edx]
mov dword [esp + 0x24], ebp
mov ebp, dword [ebx + edx + 4]
mov dword [esp + 0x20], ebp
mov ebp, dword [ebx + edx + 8]
mov edx, dword [ebx + edx + 0xc]
mov dword [esp + 0x18], edx
lea edx, [eax + 1]
mov dword [esp + 0x1c], ebp
mov dword [esi + 8], eax
cmp edx, edi
ja 0x4af3fa
mov al, byte [ebx + eax]
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
mov dword [esi + 8], edx
mov eax, dword [0x519ca0]
mov dword [esp + 0x58], eax
mov eax, dword [0x519ca4]
mov dword [esp + 0x5c], eax
mov eax, dword [0x519ca8]
mov dword [esp + 0x60], eax
mov eax, dword [0x519cac]
mov dword [esp + 0x64], eax
je 0x4aeb92
lea ebp, [edx + 0x10]
cmp ebp, edi
ja 0x4af3fa
mov eax, dword [ebx + edx]
mov dword [esp + 0x58], eax
mov eax, dword [ebx + edx + 4]
mov dword [esp + 0x5c], eax
mov eax, dword [ebx + edx + 8]
mov dword [esp + 0x60], eax
mov eax, dword [ebx + edx + 0xc]
mov dword [esp + 0x64], eax
mov dword [esi + 8], ebp
mov ebp, dword [esp + 0x90]
test ebp, ebp
je 0x4aebac
mov eax, dword [ebp]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4aebac
add ecx, 0x10
jmp 0x4aebb1
mov ecx, 0x519ca0
mov eax, dword [ecx]
mov edx, 0x519ca0
mov dword [esp + 0x48], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x4c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x50], eax
mov eax, dword [ecx + 0xc]
lea ecx, [esp + 0x48]
mov dword [esp + 0x54], eax
call fcn.004c3c44
mov edi, dword [esp + 0x24]
test al, al
je 0x4aebfe
mov eax, dword [esp + 0x20]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x48], edi
mov dword [esp + 0x54], eax
push 0x40
push 8
push dword [0x4cefc8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4aec26
push ebp
lea ecx, [esp + 0x4c]
push ecx
push 0
push esi
mov ecx, eax
call fcn.004aafeb
mov ebx, eax
jmp 0x4aec28
xor ebx, ebx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x24]
push eax
push ebx
sub esp, 0x10
mov dword [esp + 0x3c], 0
mov eax, esp
mov dword [eax], edi
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x34]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x30]
mov dword [eax + 0xc], ecx
call fcn.004c0080
test eax, eax
js 0x4af3fa
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
mov dword [eax], edi
test ebx, ebx
je 0x4aec97
push ebx
push 0
mov dword [ebx], 0x51cda0
mov dword [ebx + 4], 0x51cd8c
mov dword [ebx + 8], 0x51cd7c
mov dword [ebx + 0x20], 0x51cd78
push dword [0x4cefc8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esi + 8]
lea edx, [ecx + 2]
cmp edx, dword [esi + 4]
ja 0x4af3fa
mov eax, dword [esi]
movzx eax, word [ecx + eax]
mov dword [esp + 0x30], eax
mov dword [esi + 8], edx
test ebp, ebp
je 0x4af105
cmp byte [esp + 0x98], 0
je 0x4aedbd
test edi, edi
je 0x4aedbd
mov eax, dword [edi]
lea ecx, [esp + 0x1c]
push ecx
push 0x51cd68
push edi
mov dword [esp + 0x28], 0
call dword [eax]
mov ebx, dword [esp + 0x1c]
push 0x12
push 8
push dword [0x4cefc8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4aed15
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov byte [ecx + 0x10], 0
jmp 0x4aed17
xor ecx, ecx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov byte [ecx + 0x11], 0
mov eax, dword [ebp + 0x30]
test eax, eax
je 0x4aed2b
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0x30]
mov dword [ecx], eax
inc dword [ebp + 0x38]
cmp dword [ebp + 0x34], 0
mov dword [ebp + 0x30], ecx
jne 0x4aed3f
mov dword [ebp + 0x34], ecx
mov ecx, dword [0x4cef48]
test ecx, ecx
je 0x4aed5e
cmp dword [0x4cef44], 0
jne 0x4aed5e
mov eax, dword [0x4cef3c]
test eax, eax
je 0x4aed5e
push ecx
call eax
mov ecx, dword [edi + 0x48]
test ecx, ecx
je 0x4aed6a
call fcn.004aaf62
push 0x150
push 8
push dword [0x4cefc8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4aed9c
push 0x150
push 0
push ebx
call fcn.004c4adc
add esp, 0xc
mov ecx, ebx
call fcn.004aad2a
jmp 0x4aed9e
xor eax, eax
mov dword [edi + 0x48], eax
mov dword [eax + 0x18], edi
mov ecx, dword [edi + 0x48]
mov eax, dword [esp + 0x1c]
mov dword [ecx + 0x1c], eax
mov ecx, edi
call fcn.004aab8e
test eax, eax
js 0x4af3fa
mov eax, dword [esp + 0x94]
mov ecx, dword [eax]
add ecx, 0x60
add ecx, ebp
cmp byte [esp + 0x17], 0
mov dword [esp + 0x2c], ecx
jne 0x4aeddd
mov dword [ecx], edi
jmp 0x4aeebc
mov ebx, ecx
mov ecx, dword [ecx]
sub ebx, ebp
mov dword [esp + 0x24], ecx
sub ebx, 0x60
mov eax, ebx
and ebx, 0x7fffffff
shr eax, 0x1f
mov dword [esp + 0x18], eax
cmp ecx, edi
jne 0x4aee18
test edi, edi
je 0x4aeec2
test al, al
je 0x4aeec2
mov eax, dword [edi]
push edi
call dword [eax + 8]
jmp 0x4aeec2
test edi, edi
je 0x4aee22
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov eax, dword [ebp]
mov ecx, dword [eax - 8]
xor eax, eax
mov dword [esp + 0x28], ecx
cmp dword [ecx + 0xc], eax
jbe 0x4aee9f
add ecx, 0x20
lea esp, [esp]
mov edx, dword [ecx]
lea ecx, [ecx + 4]
inc eax
cmp dword [edx + 4], ebx
je 0x4aee53
mov edx, dword [esp + 0x28]
cmp eax, dword [edx + 0xc]
jb 0x4aee3d
jmp 0x4aee9f
mov ebx, dword [edx]
add ebx, ebp
push ebx
mov eax, dword [ebx]
call dword [eax + 4]
cmp dword [esp + 0x24], 0
je 0x4af01d
mov edx, 0x51cd90
lea ecx, [esp + 0x58]
call fcn.004c3c44
test al, al
jne 0x4af01d
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x58]
call fcn.004acbc1
mov ecx, eax
mov dword [esp + 0x20], ecx
test ecx, ecx
jne 0x4aef74
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
test edi, edi
je 0x4aeeb6
mov eax, dword [edi]
push edi
call dword [eax + 8]
cmp byte [esp + 0x18], 0
je 0x4aeeb6
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [esp + 0x2c]
mov dword [eax], edi
mov eax, dword [edi]
push edi
call dword [eax + 4]
mov ecx, dword [esp + 0x94]
xor ebx, ebx
mov eax, dword [esp + 0x30]
movzx eax, ax
add dword [ecx], 4
test eax, eax
je 0x4af105
push 0
push 0
push ecx
push ebp
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], 0
mov ecx, esi
call fcn.004aea9d
add esp, 0x10
test al, al
je 0x4af3fa
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4af0ee
lea edx, [esp + 0x2c]
mov dword [esp + 0x2c], 0
mov eax, dword [ecx]
push edx
push 0x51cd68
push ecx
call dword [eax]
test eax, eax
js 0x4af0e4
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
test eax, eax
je 0x4af0e4
mov eax, dword [esp + 0x1c]
push 0x12
push 8
push dword [0x4cefc8]
mov dword [esp + 0x34], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4af0b0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov byte [ecx + 0x10], 0
jmp 0x4af0b2
mov dword [esp + 0x1c], 0
lea edx, [esp + 0x1c]
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0x1c]
test eax, eax
jns 0x4aef9d
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov ecx, dword [esp + 0x20]
push ecx
mov eax, dword [ecx]
jmp 0x4aee9c
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
lea edx, [esp + 0x4c]
mov dword [esp + 0x4c], 0
push edx
mov dword [esp + 0x54], 0
mov dword [esp + 0x30], 0
mov eax, dword [ecx]
push 1
push ecx
call dword [eax + 0xc]
test eax, eax
jne 0x4af009
mov eax, dword [esp + 0x48]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [esp + 0x48], ebx
je 0x4aeffb
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
lea edx, [esp + 0x4c]
push edx
mov eax, dword [ecx]
push 1
push ecx
call dword [eax + 0xc]
test eax, eax
je 0x4aefcf
jmp 0x4af009
mov ecx, dword [esp + 0x20]
push dword [esp + 0x4c]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [esp + 0x20]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
test edi, edi
je 0x4af07e
lea edx, [esp + 0x58]
mov ecx, edi
call fcn.004acbc1
mov ecx, eax
mov dword [esp + 0x20], ecx
test ecx, ecx
jne 0x4af041
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
jmp 0x4aeea3
lea edx, [esp + 0x34]
mov dword [esp + 0x34], 0
mov eax, dword [ecx]
push edx
push ebx
push ecx
call dword [eax + 0x14]
test eax, eax
jns 0x4af06e
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov ecx, dword [esp + 0x20]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
jmp 0x4aeea3
mov ecx, dword [esp + 0x20]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4af092
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esp + 0x2c]
mov dword [eax], edi
test edi, edi
je 0x4aeec2
cmp byte [esp + 0x18], 0
jne 0x4aeec2
jmp 0x4aeebc
xor ecx, ecx
mov eax, dword [esp + 0x34]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x28]
mov dword [ecx + 0xc], eax
mov byte [ecx + 0x11], 0
mov eax, dword [edi + 0x30]
test eax, eax
je 0x4af0ce
mov dword [eax + 4], ecx
mov eax, dword [edi + 0x30]
mov dword [ecx], eax
inc dword [edi + 0x38]
cmp dword [edi + 0x34], 0
mov dword [edi + 0x30], ecx
jne 0x4af0ee
mov dword [edi + 0x34], ecx
jmp 0x4af0ee
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [esp + 0x30]
inc ebx
movzx eax, cx
mov ecx, dword [esp + 0x94]
cmp ebx, eax
jl 0x4aeedd
cmp byte [esp + 0x98], 0
je 0x4af3f0
mov ecx, dword [esi + 8]
lea edx, [ecx + 4]
cmp edx, dword [esi + 4]
ja 0x4af3f0
mov eax, dword [esi]
mov dword [esp + 0x2c], 0
mov eax, dword [ecx + eax]
mov dword [esp + 0x48], eax
mov dword [esi + 8], edx
test eax, eax
jle 0x4af3f0
mov eax, dword [0x519cac]
mov edi, dword [0x519ca0]
mov edx, dword [0x519ca4]
mov ecx, dword [0x519ca8]
mov dword [esp + 0x74], eax
mov dword [esp + 0x84], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x68], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x6c], edx
mov dword [esp + 0x7c], edx
lea edi, [eax + 4]
mov edx, dword [esi + 4]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x80], ecx
cmp edi, edx
ja 0x4af3fa
mov ecx, dword [esi]
mov eax, dword [ecx + eax]
mov dword [esp + 0x24], eax
lea eax, [edi + 4]
mov dword [esi + 8], edi
cmp eax, edx
ja 0x4af3fa
mov ebx, dword [ecx + edi]
lea edi, [eax + 4]
mov dword [esp + 0x34], ebx
mov dword [esi + 8], eax
cmp edi, edx
ja 0x4af3fa
mov eax, dword [ecx + eax]
lea ebx, [edi + 4]
mov dword [esp + 0x30], eax
mov dword [esi + 8], edi
cmp ebx, edx
ja 0x4af3fa
mov edi, dword [ecx + edi]
lea eax, [ebx + 0x10]
mov dword [esp + 0x20], edi
mov dword [esi + 8], ebx
cmp eax, edx
ja 0x4af3fa
lea eax, [ecx + ebx]
push 0x10
push eax
lea eax, [esp + 0x70]
push eax
call fcn.004c4b46
mov ecx, dword [esi + 8]
add esp, 0xc
add ecx, 0x10
mov dword [esi + 8], ecx
lea eax, [ecx + 0x10]
cmp eax, dword [esi + 4]
ja 0x4af3fa
mov eax, dword [esi]
add eax, ecx
push 0x10
push eax
lea eax, [esp + 0x80]
push eax
call fcn.004c4b46
add dword [esi + 8], 0x10
lea eax, [esp + 0x24]
add esp, 0xc
mov dword [esp + 0x18], 0
push eax
push 1
push 9
call dword [sym.imp.OLEAUT32.dll_SafeArrayCreateEx]
test eax, eax
js 0x4af3fa
mov eax, dword [esp + 0x18]
mov ecx, 0x400
push 0x3c
push 8
or word [eax + 2], cx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
inc ecx
mov dword [eax + 4], 4
mov eax, dword [esp + 0x20]
mov dword [eax + 0x10], ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
add ecx, 0x60
add ecx, ebp
mov dword [eax + 0x14], 0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x4c], ecx
mov dword [ecx], eax
push dword [0x4cefc8]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4af343
mov eax, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov ecx, dword [esp + 0x68]
mov edi, dword [esp + 0x70]
mov edx, dword [esp + 0x6c]
mov ebx, dword [esp + 0x74]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 8], eax
mov eax, esi
mov dword [esi], 0x51cd30
mov dword [esi + 4], 1
mov esi, dword [esp + 0x20]
mov dword [eax + 0xc], esi
mov esi, dword [esp + 0x34]
mov dword [eax + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0x10], esi
mov esi, dword [esp + 0x30]
mov dword [eax + 0x14], esi
mov esi, dword [esp + 0x24]
mov dword [eax + 0x20], edx
mov dword [eax + 0x2c], ebp
mov ebp, dword [esp + 0x90]
mov dword [eax + 0x24], edi
mov edi, dword [esp + 0x20]
mov dword [eax + 0x18], esi
mov esi, dword [esp + 0x40]
mov dword [eax + 0x28], ebx
mov eax, dword [esp + 0x28]
mov dword [ecx + 0x30], eax
mov eax, dword [esp + 0x38]
mov dword [ecx + 0x34], eax
mov eax, dword [esp + 0x3c]
mov dword [ecx + 0x38], eax
jmp 0x4af349
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x44]
mov dword [eax + 4], ecx
push dword [esp + 0x18]
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroyDescriptor]
test eax, eax
js 0x4af3fa
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], 0
mov eax, dword [eax + 0xc]
mov dword [esp + 0x44], eax
test edi, edi
jle 0x4af3dd
lea esp, [esp]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
lea edi, [eax + 4]
cmp edi, ecx
ja 0x4af3fa
mov edx, dword [esi]
mov ebx, dword [edx + eax]
lea eax, [edi + 4]
mov dword [esi + 8], edi
cmp eax, ecx
ja 0x4af3fa
mov edi, dword [edx + edi]
mov dword [esi + 8], eax
mov ebx, dword [ebx + ebp + 0x60]
push ebx
mov eax, dword [ebx]
call dword [eax + 4]
mov eax, dword [esp + 0x24]
or eax, 0x80000000
push eax
mov eax, dword [esp + 0x48]
push ebx
lea eax, [eax + edi*4]
push eax
push ebp
lea eax, [esp + 0x78]
push eax
call fcn.004ab2a7
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
inc edx
mov dword [ebx + 0x5c], eax
mov dword [esp + 0x30], edx
cmp edx, dword [esp + 0x20]
jl 0x4af37d
mov ebx, dword [esp + 0x2c]
inc ebx
mov dword [esp + 0x2c], ebx
cmp ebx, dword [esp + 0x48]
jl 0x4af13e
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x7c
ret