Function at 0x4ca61e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x51bd70
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x5675a0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
call fcn.004d8c7a
test al, al
je 0x4ca731
or dword [esp + 0x58], 0xffffffff
or dword [esp + 0x5c], 0xffffffff
xor edi, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], 0x539d88
mov dword [esp + 0x60], edi
push 0x20019
push str.SystemCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [esp + 0x60]
mov dword [esp + 0x7c], edi
call fcn.00411a77
cmp eax, edi
jne 0x4ca723
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
lea eax, [esp + 0x40]
push eax
push str.PendingfileRenameOperations
lea ebx, [esp + 0x58]
mov byte [esp + 0x78], 1
call fcn.004d4c21
xor esi, esi
cmp dword [esp + 0x44], edi
je 0x4ca71a
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x44]
sar eax, 2
cmp esi, eax
jae 0x4ca71a
mov eax, dword [esp + 0x44]
push 0x5352f8
push 0x53d59c
lea eax, [eax + esi*4]
push eax
call fcn.004118cc
cmp dword [esp + 0x44], edi
je 0x4ca6fe
mov eax, dword [esp + 0x48]
sub eax, dword [esp + 0x44]
sar eax, 2
cmp esi, eax
jb 0x4ca703
call fcn.00447be0
mov eax, dword [esp + 0x44]
lea eax, [eax + esi*4]
push eax
push dword [ebp + 8]
lea ebx, [esp + 0x3c]
call fcn.0041fee1
inc esi
jmp 0x4ca6bd
lea esi, [esp + 0x40]
call fcn.00411edc
lea ecx, [esp + 0x50]
call fcn.004d4502
jmp 0x4ca866
lea eax, [esp + 0x18]
push eax
call fcn.004ca571
mov dword [esp + 0x74], 2
lea ecx, [esp + 0x18]
mov dword [esp], str.WinInit.ini
push ecx
mov ecx, eax
call fcn.00411aaa
pop ecx
pop ecx
mov byte [esp + 0x70], 4
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.00410d34
push dword [esp + 0x14]
call fcn.004ca560
test al, al
pop ecx
je 0x4ca85a
push 0x1c
call fcn.004484be
pop ecx
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x70], 5
je 0x4ca79a
push eax
call fcn.004c6752
mov esi, eax
jmp 0x4ca79c
xor esi, esi
mov byte [esp + 0x70], 4
push esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], esi
call fcn.0042fb91
push esi
lea eax, [esp + 0x28]
push esi
push eax
call fcn.00427699
add esp, 0xc
mov byte [esp + 0x70], 6
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4ca848
push dword [esp + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x18]
lea esi, [esp + 0x34]
call fcn.0042c1f6
mov byte [esp + 0x70], 7
mov ecx, dword [esp + 0x24]
mov eax, dword [ecx]
mov edx, esi
push edx
push str.rename
call dword [eax + 0x28]
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
mov dword [esp + 0x20], ecx
mov edx, esi
mov ecx, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
lea edi, [esp + 0x2c]
lea esi, [esp + 0x1c]
call fcn.00411e4b
test al, al
jne 0x4ca83a
call fcn.00408586
add eax, 4
push eax
push dword [ebp + 8]
lea ebx, [esp + 0x48]
call fcn.0041fee1
call fcn.0041a666
jmp 0x4ca80d
lea eax, [esp + 0x34]
mov byte [esp + 0x70], 6
call fcn.0040f9ac
mov byte [esp + 0x70], 4
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x4ca85a
call fcn.00411e0e
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.00410d34
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret