Function at 0x430013
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e208d
mov eax, dword fs:[0]
push eax
sub esp, 0x360
mov eax, dword [0x5181f4]
xor eax, esp
mov dword [esp + 0x358], eax
push ebx
push esi
push edi
mov eax, dword [0x5181f4]
xor eax, esp
push eax
lea eax, [esp + 0x370]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x74], eax
mov eax, dword [ebp + 0x14]
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0xa8], eax
mov dword [esp + 0x14], ebx
call fcn.004319c7
mov dword [esp + 0x64], eax
mov byte [eax + 0x39], 1
mov eax, dword [esp + 0x64]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x64]
mov dword [eax], eax
mov eax, dword [esp + 0x64]
mov dword [eax + 8], eax
mov dword [esp + 0x68], ebx
mov dword [esp + 0x378], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x378], 1
call fcn.0043167f
mov dword [esp + 0x84], eax
mov byte [eax + 0xf9], 1
mov eax, dword [esp + 0x84]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x84]
mov dword [eax], eax
mov eax, dword [esp + 0x84]
mov dword [eax + 8], eax
mov dword [esp + 0x88], ebx
push ebx
lea ecx, [esp + 0xfc]
mov dword [esp + 0x114], 7
call fcn.00404d28
push ebx
push ebx
push 0x51f95c
mov byte [esp + 0x384], 3
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
lea ecx, [esp + 0x114]
push ecx
mov dword [esp + 0x9c], eax
mov eax, dword [esi]
push str.Audit_audit____________.dat
mov ecx, esi
mov dword [esp + 0x64], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call dword [eax + 0x1c]
cmp eax, ebx
mov dword [esp + 0x50], eax
jne 0x43018c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
mov dword [esp + 0x14], eax
je 0x430183
cmp eax, 2
je 0x430183
cmp eax, 3
je 0x430183
push eax
push str.EnumerateAuditFiles:_error__d_occured_while_recieving_files_list
call fcn.0048bf00
pop ecx
pop ecx
jmp 0x430711
mov dword [esp + 0x14], ebx
jmp 0x430711
test byte [esp + 0x114], 0x10
jne 0x430226
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x144]
push str.audit__02d__02d__04d__I64X
push eax
call fcn.0044579f
add esp, 0xc
cmp eax, 1
jne 0x430226
mov eax, dword [esp + 0x8c]
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0xd0], eax
lea eax, [esp + 0x140]
push eax
lea ecx, [esp + 0xd8]
call fcn.0040431c
lea eax, [esp + 0xcc]
push eax
lea edi, [esp + 0xb8]
lea ebx, [esp + 0x64]
mov byte [esp + 0x37c], 4
call fcn.00430bcb
push 0
push 1
lea ecx, [esp + 0xdc]
mov byte [esp + 0x380], 3
call fcn.00404df2
xor ebx, ebx
mov eax, dword [esi]
lea ecx, [esp + 0x114]
push ecx
push dword [esp + 0x54]
mov ecx, esi
call dword [eax + 0x20]
test eax, eax
jne 0x43018c
lea eax, [esp + 0x34]
push eax
lea eax, [ebp + 8]
push eax
push str.CALL_DLLastAuditRecordTime__i___oI_
push 1
push 1
push ebx
push ebx
push dword [esp + 0x5c]
call fcn.004223b7
add esp, 0x20
cmp eax, ebx
jge 0x43026d
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov eax, dword [esp + 0x64]
mov eax, dword [eax]
lea ecx, [esp + 0x60]
mov edi, eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edi
cmp dword [esp + 0x54], ebx
mov eax, dword [esp + 0x64]
mov dword [esp + 0xb0], eax
je 0x43029c
lea eax, [esp + 0x60]
cmp dword [esp + 0x54], eax
je 0x4302a1
call fcn.00441e1b
cmp edi, dword [esp + 0xb0]
je 0x430711
push ebx
push dword [0x5223c8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4306f9
push str.Audit
lea ecx, [esp + 0xfc]
mov dword [esp + 0x7c], 1
call fcn.004043e7
push 0x4fa6bc
lea ecx, [esp + 0xfc]
call fcn.0040959a
cmp dword [esp + 0x54], ebx
jne 0x4302f8
call fcn.00441e1b
mov eax, dword [esp + 0x54]
cmp edi, dword [eax + 4]
jne 0x430306
call fcn.00441e1b
lea eax, [edi + 0x18]
or edi, 0xffffffff
push edi
push ebx
push eax
lea ecx, [esp + 0x104]
call fcn.004099bf
cmp dword [esp + 0x110], 8
mov eax, dword [esp + 0xfc]
mov dword [esp + 0x4c], ebx
jae 0x430337
lea eax, [esp + 0xfc]
push eax
push esi
lea ecx, [esp + 0x54]
lea esi, [esp + 0x20]
call fcn.0042f533
test eax, eax
pop ecx
pop ecx
jne 0x43037a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x2cb
push 8
push edi
push eax
mov ecx, str.GetAuditXMLData
mov dword [esp + 0x24], eax
call fcn.0042cdde
add esp, 0x10
cmp dword [esp + 0x4c], ebx
je 0x43070d
mov dword [esp + 0x14], ebx
lea eax, [esp + 0x18]
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x10], ebx
call fcn.00430989
test eax, eax
jbe 0x430417
push dword [esp + 0x10]
lea esi, [esp + 0x1c]
call fcn.004309a1
mov eax, dword [eax + 0xc]
xor edx, edx
mov cl, 0x20
call fcn.004d7550
push dword [esp + 0x10]
mov edi, eax
mov dword [esp + 0xcc], edx
call fcn.004309a1
mov eax, dword [eax + 8]
xor ecx, ecx
or ecx, dword [esp + 0xc8]
or eax, edi
cmp ecx, dword [esp + 0x48]
ja 0x4303ee
jb 0x4303e6
cmp eax, dword [esp + 0x44]
jae 0x4303ee
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
cmp ecx, dword [esp + 0x30]
jb 0x430404
ja 0x4303fc
cmp eax, dword [esp + 0x2c]
jbe 0x430404
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
inc dword [esp + 0x10]
lea eax, [esp + 0x18]
call fcn.00430989
cmp dword [esp + 0x10], eax
jb 0x43039f
lea eax, [esp + 0x18]
mov dword [esp + 0x10], ebx
call fcn.00430989
test eax, eax
jbe 0x43067d
push dword [esp + 0x10]
lea esi, [esp + 0x1c]
mov dword [esp + 0x74], ebx
mov dword [esp + 0x80], ebx
call fcn.004309a1
mov eax, dword [eax + 0xc]
xor edx, edx
mov cl, 0x20
call fcn.004d7550
push dword [esp + 0x10]
mov edi, eax
mov dword [esp + 0xbc], edx
call fcn.004309a1
mov eax, dword [eax + 8]
push dword [esp + 0x10]
xor ecx, ecx
or ecx, dword [esp + 0xbc]
or eax, edi
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], ecx
call fcn.004309a1
add eax, 0x54
mov ecx, 0x5dc
cmp dword [eax + 0x14], ecx
jbe 0x4304aa
push 0xffffffffffffffff
push ecx
push dword [esp + 0x18]
call fcn.004309a1
mov ecx, eax
add ecx, 0x54
call fcn.00404404
push dword [esp + 0x10]
lea esi, [esp + 0x1c]
call fcn.004309a1
add eax, 0x10
mov edi, 0x1f4
cmp dword [eax + 0x14], edi
jbe 0x4304da
push 0xffffffffffffffff
push edi
push dword [esp + 0x18]
call fcn.004309a1
mov ecx, eax
add ecx, 0x10
call fcn.00404404
push dword [esp + 0x10]
lea esi, [esp + 0x1c]
call fcn.004309a1
add eax, 0x70
cmp dword [eax + 0x14], edi
jbe 0x430505
push 0xffffffffffffffff
push edi
push dword [esp + 0x18]
call fcn.004309a1
mov ecx, eax
add ecx, 0x70
call fcn.00404404
push dword [esp + 0x10]
lea esi, [esp + 0x1c]
call fcn.004309a1
add eax, 0x8c
cmp dword [eax + 0x14], edi
jbe 0x430535
push 0xffffffffffffffff
push edi
push dword [esp + 0x18]
call fcn.004309a1
mov ecx, eax
add ecx, 0x8c
call fcn.00404404
push dword [esp + 0x10]
lea esi, [esp + 0x1c]
call fcn.004309a1
add eax, 0xa8
cmp dword [eax + 0x14], edi
jbe 0x430565
push 0xffffffffffffffff
push edi
push dword [esp + 0x18]
call fcn.004309a1
mov ecx, eax
add ecx, 0xa8
call fcn.00404404
mov eax, dword [esp + 0xa0]
cmp eax, dword [esp + 0x38]
ja 0x4305e0
jb 0x430581
mov eax, dword [esp + 0x9c]
cmp eax, dword [esp + 0x34]
ja 0x4305e0
cmp dword [esp + 0x6c], ebx
jne 0x4305bf
mov ecx, dword [esp + 0x74]
lea eax, [esp + 0x80]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x54]
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.0042f725
add esp, 0x18
test eax, eax
je 0x43066d
mov dword [esp + 0x6c], 1
push dword [esp + 0x10]
lea esi, [esp + 0x1c]
call fcn.004309a1
lea ecx, [esp + 0x80]
push ecx
mov edi, eax
call fcn.0042fe0e
test eax, eax
pop ecx
jne 0x430654
lea eax, [esp + 0x7c]
push eax
push dword [esp + 0x14]
lea esi, [esp + 0x20]
call fcn.004309a1
mov ecx, dword [esp + 0x44]
add eax, 8
push eax
lea edx, [esp + 0x78]
call fcn.0042f14c
test eax, eax
pop ecx
pop ecx
je 0x430703
cmp dword [esp + 0x70], ebx
jne 0x430627
inc dword [esp + 0x5c]
cmp dword [esp + 0x7c], ebx
mov dword [esp + 0x78], ebx
je 0x43070d
jmp 0x430654
push dword [esp + 0x10]
lea esi, [esp + 0x1c]
call fcn.004309a1
push dword [esp + 0x40]
mov ecx, eax
push dword [ebp + 8]
push dword [esp + 0xa0]
call fcn.0042f304
add esp, 0xc
test eax, eax
je 0x430703
inc dword [esp + 0x10]
lea eax, [esp + 0x18]
call fcn.00430989
cmp dword [esp + 0x10], eax
jb 0x43042c
jmp 0x430677
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x78], ebx
je 0x4306bf
cmp dword [esp + 0x110], 8
mov eax, dword [esp + 0xfc]
jae 0x430695
lea eax, [esp + 0xfc]
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
cmp dword [esp + 0x4c], ebx
je 0x4306bf
mov eax, dword [esp + 0x74]
cmp eax, ebx
jne 0x4306b2
mov eax, str.unknown
push eax
push 0xa0000022
call fcn.0042c80d
pop ecx
pop ecx
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
cmp ecx, eax
ja 0x4306e3
jb 0x4306d7
mov ecx, dword [esp + 0x34]
cmp ecx, dword [esp + 0x2c]
jae 0x4306e3
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], eax
lea esi, [esp + 0x54]
call fcn.004057dd
mov edi, dword [esp + 0x58]
mov esi, dword [esp + 0x28]
jmp 0x430281
mov dword [esp + 0x14], 0x45b
jmp 0x430711
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0xa8]
cmp eax, ebx
je 0x430722
mov ecx, dword [esp + 0x5c]
mov dword [eax], ecx
cmp dword [esp + 0x50], ebx
je 0x430733
push dword [esp + 0x50]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp dword [esp + 0x14], ebx
push ebx
sete al
push 1
lea ecx, [esp + 0x100]
mov edi, eax
call fcn.00404df2
lea esi, [esp + 0x80]
mov byte [esp + 0x378], 1
call fcn.00430b40
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x430786
push dword [esp + 0x20]
call fcn.00430ed0
push dword [esp + 0x1c]
call fcn.00441cca
pop ecx
or dword [esp + 0x378], 0xffffffff
lea eax, [esp + 0x60]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.00430b96
mov eax, edi
mov ecx, dword [esp + 0x370]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, esp
call fcn.00441cbb
mov esp, ebp
pop ebp
ret