Function at 0x4c0fe0
Capabilities:
Access peb ldr_data
Get process heap flags
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0x18]
sub esp, 0x1c
mov eax, dword [eax + 0x30]
push ebx
push esi
push edi
mov edi, dword [eax + 0xc]
add edi, 0xc
mov esi, dword [edi]
cmp esi, edi
je 0x4c1099
jmp 0x4c1010
movzx eax, word [esi + 0x2c]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x30]
push 1
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
push 0x5afe84
push eax
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x4c103c
mov esi, dword [esi]
cmp esi, edi
jne 0x4c1010
jmp 0x4c1099
lea esp, [esp]
test esi, esi
je 0x4c1099
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov esi, dword [edi]
cmp esi, edi
je 0x4c1099
lea esp, [esp]
movzx eax, word ds:[esi + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x30]
push 1
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push 0x5afe8c
push eax
call sym.ProcessHacker.exe_PhEqualStringRef
test al, al
jne 0x4c1091
mov esi, dword [esi]
cmp esi, edi
jne 0x4c1060
jmp 0x4c1099
test esi, esi
jne 0x4c1a9c
xor ebx, ebx
lea eax, [esp + 0x10]
push ebx
push 0x5afe6c
push 0xfffffffffffffffd
push 0x20019
push eax
mov dword [esp + 0x34], ebx
call sym.ProcessHacker.exe_PhOpenKey
test eax, eax
js 0x4c1249
push str.KitsRoot10
push dword [esp + 0x14]
call sym.ProcessHacker.exe_PhQueryRegistryString
mov edi, eax
mov dword [esp + 0x18], eax
or esi, 0xffffffff
mov dword [esp + 0x14], edi
test eax, eax
je 0x4c10e4
lea ecx, [ecx]
cmp dword [eax], ebx
jne 0x4c111a
push str.KitsRoot81
push dword [esp + 0x14]
call sym.ProcessHacker.exe_PhQueryRegistryString
mov edi, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], edi
test eax, eax
je 0x4c1116
lea ecx, [eax - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4c1116
call fcn.004b3960
test edi, edi
je 0x4c111e
cmp dword [edi], ebx
jne 0x4c114a
push str.KitsRoot
push dword [esp + 0x14]
call sym.ProcessHacker.exe_PhQueryRegistryString
mov ecx, edi
mov edi, eax
mov dword [esp + 0x14], edi
test ecx, ecx
je 0x4c114a
add ecx, 0xfffffff8
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4c114a
call fcn.004b3960
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
test edi, edi
je 0x4c1249
mov esi, dword [edi]
push dword [0x5b1d70]
add esi, 0x1e
lea eax, [esi + 0xa]
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, eax
xor edx, edx
lea eax, [ecx + 8]
mov dword [esp + 0x18], ecx
mov dword [ecx + 4], eax
mov dword [ecx], esi
mov word [eax + esi], dx
push dword [edi]
push dword [edi + 4]
push dword [ecx + 4]
call fcn.00521a30
mov eax, dword [esp + 0x24]
mov ecx, 7
mov edi, dword [edi]
mov esi, str.Debuggersx86_
add esp, 0xc
add edi, dword [eax + 4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff8
movsw word es:[edi], word [esi]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4c11c5
nop
call fcn.004b3960
mov edi, dword [esp + 0x18]
push 0x5afe84
push edi
call sym.ProcessHacker.exe_PhConcatStringRef2
mov dword [esp + 0x18], eax
test eax, eax
je 0x4c11fe
push dword ds:[eax + 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [esp + 0x18]
mov ebx, eax
add ecx, 0xfffffff8
mov edx, esi
lock xadd dword [ecx + 4], edx
dec edx
jne 0x4c11fe
call fcn.004b3960
push 0x5afe8c
push edi
call sym.ProcessHacker.exe_PhConcatStringRef2
mov dword [esp + 0x18], eax
test eax, eax
je 0x4c1234
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [esp + 0x18]
mov edx, esi
mov dword [esp + 0x20], eax
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], edx
dec edx
jne 0x4c1234
call fcn.004b3960
lea ecx, [edi - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x4c1245
nop
call fcn.004b3960
test ebx, ebx
jne 0x4c1256
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp dword [esp + 0x20], 0
jne 0x4c1268
push str.symsrv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test ebx, ebx
je 0x4c1a9c
movzx eax, word [ebx]
mov esi, 0x5a4d
mov edx, eax
cmp ax, si
jne 0x4c12d1
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4c12d1
cmp eax, 0x7fffffff
jae 0x4c12d1
cmp dword [eax + ebx], 0x4550
jne 0x4c12d1
lea ecx, ds:[eax + 0x78]
mov eax, dword [ecx + ebx]
add ecx, ebx
test eax, eax
je 0x4c12c3
cmp dword [ecx + 4], 0
je 0x4c12c3
push 0
push str.SymInitializeW
add eax, ebx
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov ecx, eax
movzx eax, word [ebx]
jmp 0x4c12d5
mov dword [0x5b1f04], 0
mov eax, edx
jmp 0x4c12e5
xor ecx, ecx
mov eax, edx
movzx eax, ax
mov dword [0x5b1f04], ecx
cmp ax, si
jne 0x4c132c
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4c132c
cmp ecx, 0x7fffffff
jae 0x4c132c
cmp dword [ecx + ebx], 0x4550
jne 0x4c132c
add ecx, 0x78
add ecx, ebx
mov edx, dword [ecx]
test edx, edx
je 0x4c132c
cmp dword [ecx + 4], 0
je 0x4c132c
push 0
push str.SymCleanup
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov ecx, eax
movzx eax, word [ebx]
jmp 0x4c1331
movzx eax, ax
xor ecx, ecx
movzx eax, ax
mov dword [0x5b1f0c], ecx
mov ecx, eax
cmp ax, si
jne 0x4c13f3
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4c1390
cmp ecx, 0x7fffffff
jae 0x4c1390
cmp dword ds:[ecx + ebx], 0x4550
jne 0x4c1390
add ecx, 0x78
add ecx, ebx
mov edx, dword [ecx]
test edx, edx
je 0x4c1390
cmp dword [ecx + 4], 0
je 0x4c1390
push 0
push str.SymEnumSymbolsW
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
movzx eax, word [ebx]
mov ecx, eax
cmp ax, si
jne 0x4c13f3
mov edx, dword [ebx + 0x3c]
movzx ecx, ax
test edx, edx
je 0x4c13f6
movzx ecx, ax
cmp edx, 0x7fffffff
jae 0x4c13f6
cmp dword [edx + ebx], 0x4550
je 0x4c13b6
movzx ecx, ax
jmp 0x4c13f6
lea ecx, ds:[edx + 0x78]
mov edx, dword [ecx + ebx]
add ecx, ebx
test edx, edx
je 0x4c13e4
cmp dword [ecx + 4], 0
je 0x4c13e4
push 0
push str.SymFromAddrW
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov edx, eax
movzx eax, word [ebx]
jmp 0x4c13fb
mov dword [0x5b1f2c], 0
movzx eax, ax
jmp 0x4c1409
movzx ecx, cx
xor edx, edx
movzx eax, cx
movzx eax, ax
mov dword [0x5b1f2c], edx
cmp ax, si
jne 0x4c145c
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4c145c
cmp ecx, 0x7fffffff
jae 0x4c145c
cmp dword ds:[ecx + ebx], 0x4550
jne 0x4c145c
add ecx, 0x78
add ecx, ebx
mov edx, dword [ecx]
test edx, edx
je 0x4c144d
cmp dword [ecx + 4], 0
je 0x4c144d
push 0
push str.SymFromNameW
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov ecx, eax
movzx eax, word [ebx]
jmp 0x4c1461
mov dword [0x5b1f14], 0
movzx eax, ax
jmp 0x4c146f
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5b1f14], ecx
cmp ax, si
jne 0x4c14c2
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4c14c2
cmp ecx, 0x7fffffff
jae 0x4c14c2
cmp dword [ecx + ebx], 0x4550
jne 0x4c14c2
add ecx, 0x78
add ecx, ebx
mov edx, dword [ecx]
test edx, edx
je 0x4c14b2
cmp dword [ecx + 4], 0
je 0x4c14b2
push 0
push str.SymGetLineFromAddrW64
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov ecx, eax
movzx eax, word [ebx]
jmp 0x4c14c7
mov dword [0x5b1f10], 0
movzx eax, ax
jmp 0x4c14d5
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5b1f10], ecx
cmp ax, si
jne 0x4c152b
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4c152b
lea esp, [esp]
cmp ecx, 0x7fffffff
jae 0x4c152b
cmp dword [ecx + ebx], 0x4550
jne 0x4c152b
add ecx, 0x78
add ecx, ebx
mov edx, dword [ecx]
test edx, edx
je 0x4c151c
cmp dword [ecx + 4], 0
je 0x4c151c
push 0
push str.SymLoadModuleExW
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov ecx, eax
movzx eax, word [ebx]
jmp 0x4c1530
mov dword [0x5b1f18], 0
movzx eax, ax
jmp 0x4c153e
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5b1f18], ecx
cmp ax, si
jne 0x4c1593
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4c1593
cmp ecx, 0x7fffffff
jae 0x4c1593
cmp dword [ecx + ebx], 0x4550
jne 0x4c1593
add ecx, 0x78
add ecx, ebx
mov edx, dword [ecx]
test edx, edx
je 0x4c1584
cmp dword [ecx + 4], 0
je 0x4c1584
push 0
push str.SymGetOptions
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov ecx, eax
movzx eax, word [ebx]
jmp 0x4c1598
mov dword [0x5b1f34], 0
movzx eax, ax
jmp 0x4c15a6
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5b1f34], ecx
cmp ax, si
jne 0x4c15fb
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4c15fb
cmp ecx, 0x7fffffff
jae 0x4c15fb
cmp dword [ecx + ebx], 0x4550
jne 0x4c15fb
add ecx, 0x78
add ecx, ebx
mov edx, dword [ecx]
test edx, edx
je 0x4c15ec
cmp dword [ecx + 4], 0
je 0x4c15ec
push 0
push str.SymSetOptions
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov ecx, eax
movzx eax, word [ebx]
jmp 0x4c1600
mov dword [0x5b1f20], 0
movzx eax, ax
jmp 0x4c1614
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5b1f20], ecx
mov ecx, eax
cmp ax, si
jne 0x4c1673
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4c176f
nop
cmp ecx, 0x7fffffff
jae 0x4c176f
cmp dword [ecx + ebx], 0x4550
jne 0x4c176f
add ecx, 0x78
add ecx, ebx
mov edx, dword [ecx]
test edx, edx
je 0x4c176f
cmp dword [ecx + 4], 0
je 0x4c176f
push 0
push str.SymGetSearchPathW
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
movzx eax, word [ebx]
mov ecx, eax
cmp ax, si
je 0x4c1772
movzx ecx, cx
xor edx, edx
movzx eax, cx
movzx eax, ax
mov dword [0x5b1f38], edx
mov ecx, eax
cmp ax, si
jne 0x4c16f3
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4c17eb
lea ebx, [ebx]
cmp ecx, 0x7fffffff
jae 0x4c17eb
cmp dword [ecx + ebx], 0x4550
jne 0x4c17eb
add ecx, 0x78
add ecx, ebx
mov edx, dword [ecx]
test edx, edx
je 0x4c17eb
cmp dword [ecx + 4], 0
je 0x4c17eb
push 0
push str.SymUnloadModule64
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
movzx eax, word [ebx]
mov ecx, eax
cmp ax, si
je 0x4c17ee
movzx ecx, cx
xor edx, edx
movzx eax, cx
movzx eax, ax
mov dword [0x5b1f30], edx
cmp ax, si
jne 0x4c1874
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4c1874
jmp 0x4c1720
cmp ecx, 0x7fffffff
jae 0x4c1874
cmp dword [ecx + ebx], 0x4550
jne 0x4c1874
add ecx, 0x78
add ecx, ebx
mov edx, dword [ecx]
test edx, edx
je 0x4c1865
cmp dword [ecx + 4], 0
je 0x4c1865
push 0
push str.SymGetModuleBase64
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov ecx, eax
movzx eax, word [ebx]
jmp 0x4c1879
movzx eax, ax
mov edx, dword ds:[ebx + 0x3c]
movzx ecx, ax
test edx, edx
je 0x4c1676
movzx ecx, ax
cmp edx, 0x7fffffff
jae 0x4c1676
cmp dword ds:[edx + ebx], 0x4550
je 0x4c17aa
movzx ecx, ax
jmp 0x4c1676
lea ecx, [edx + 0x78]
mov edx, dword [ecx + ebx]
add ecx, ebx
test edx, edx
je 0x4c17d9
cmp dword [ecx + 4], 0
je 0x4c17d9
push 0
push str.SymSetSearchPathW
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov edx, eax
movzx eax, word [ebx]
jmp 0x4c167b
mov dword [0x5b1f38], 0
movzx eax, ax
jmp 0x4c168f
movzx eax, ax
mov edx, dword [ebx + 0x3c]
movzx ecx, ax
test edx, edx
je 0x4c16f6
movzx ecx, ax
cmp edx, 0x7fffffff
jae 0x4c16f6
cmp dword [edx + ebx], 0x4550
je 0x4c181d
movzx ecx, ax
jmp 0x4c16f6
lea ecx, [edx + 0x78]
mov edx, dword [ecx + ebx]
add ecx, ebx
test edx, edx
je 0x4c184f
cmp dword [ecx + 4], 0
je 0x4c184f
push 0
push str.SymFunctionTableAccess64
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov edx, eax
movzx eax, word [ebx]
jmp 0x4c16fb
mov dword [0x5b1f30], 0
movzx eax, ax
jmp 0x4c170d
mov dword [0x5b1f08], 0
movzx eax, ax
jmp 0x4c188b
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5b1f08], ecx
cmp ax, si
jne 0x4c18e2
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4c18e2
cmp ecx, 0x7fffffff
jae 0x4c18e2
cmp dword [ecx + ebx], 0x4550
jne 0x4c18e2
add ecx, 0x78
add ecx, ebx
mov edx, dword [ecx]
test edx, edx
je 0x4c18d2
cmp dword [ecx + 4], 0
je 0x4c18d2
push 0
push str.SymRegisterCallbackW64
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov ecx, eax
movzx eax, word [ebx]
jmp 0x4c18e7
mov dword [0x5b1f1c], 0
movzx eax, ax
jmp 0x4c18f9
xor ecx, ecx
movzx eax, ax
movzx eax, ax
mov dword [0x5b1f1c], ecx
cmp ax, si
jne 0x4c1953
mov ecx, dword ds:[ebx + 0x3c]
test ecx, ecx
je 0x4c1953
cmp ecx, 0x7fffffff
jae 0x4c1953
cmp dword [ecx + ebx], 0x4550
jne 0x4c1953
add ecx, 0x78
add ecx, ebx
mov edx, dword [ecx]
test edx, edx
je 0x4c1944
cmp dword [ecx + 4], 0
je 0x4c1944
push 0
push str.StackWalk64
lea eax, [edx + ebx]
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
mov edx, eax
movzx eax, word [ebx]
jmp 0x4c1958
mov dword [0x5b1f24], 0
movzx ecx, ax
jmp 0x4c196a
xor edx, edx
movzx eax, ax
movzx ecx, ax
mov dword [0x5b1f24], edx
cmp cx, si
jne 0x4c19ba
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4c19ba
cmp eax, 0x7fffffff
jae 0x4c19ba
cmp dword [eax + ebx], 0x4550
jne 0x4c19ba
lea ecx, [eax + 0x78]
mov eax, dword [ecx + ebx]
add ecx, ebx
test eax, eax
je 0x4c19ae
cmp dword [ecx + 4], 0
je 0x4c19ae
push 0
push str.MiniDumpWriteDump
add eax, ebx
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
movzx ecx, word [ebx]
jmp 0x4c19bf
mov dword [0x5b1f28], 0
jmp 0x4c19cd
xor eax, eax
movzx ecx, cx
mov dword [0x5b1f28], eax
cmp cx, si
jne 0x4c1a9c
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4c1a11
cmp eax, 0x7fffffff
jae 0x4c1a11
cmp dword [eax + ebx], 0x4550
jne 0x4c1a11
lea ecx, [eax + 0x78]
mov eax, dword [ecx + ebx]
add ecx, ebx
test eax, eax
je 0x4c1a11
cmp dword [ecx + 4], 0
je 0x4c1a11
push 0
push str.UnDecorateSymbolNameW
add eax, ebx
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
cmp word [ebx], si
jne 0x4c1a9c
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4c1a5d
lea esp, [esp]
cmp eax, 0x7fffffff
jae 0x4c1a5d
cmp dword [eax + ebx], 0x4550
jne 0x4c1a5d
lea ecx, [eax + 0x78]
mov eax, dword [ecx + ebx]
add ecx, ebx
test eax, eax
je 0x4c1a5d
cmp dword [ecx + 4], 0
je 0x4c1a5d
push 0
push str.SymGetDiaSession
add eax, ebx
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
cmp word [ebx], si
jne 0x4c1a9c
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4c1a9c
cmp eax, 0x7fffffff
jae 0x4c1a9c
cmp dword [eax + ebx], 0x4550
jne 0x4c1a9c
lea ecx, [eax + 0x78]
mov eax, dword [ecx + ebx]
add ecx, ebx
test eax, eax
je 0x4c1a9c
cmp dword [ecx + 4], 0
je 0x4c1a9c
push 0
push str.SymFreeDiaString
add eax, ebx
push eax
push ecx
mov ecx, ebx
call fcn.004b2920
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret