Function at 0xdee040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0xe1aed8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 4], edi
mov byte [ecx + 0xe1af18], 0x20
test ebx, ebx
je 0xdee0ab
mov esi, dword [ebp + 8]
test esi, esi
je 0xdee073
add esi, 0x10
jmp 0xdee075
xor esi, esi
push 0
lea edx, [ebp - 0x1c]
push ebx
push edx
call fcn.00df2f48
add esp, 0xc
test esi, esi
jne 0xdee08c
xor ecx, ecx
jmp 0xdee093
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push esi
call fcn.00dd61e0
add esp, 0x14
mov eax, dword [ebp + 8]
test eax, eax
je 0xdee0b7
add eax, 0x10
jmp 0xdee0b9
xor eax, eax
push str._suspicious__:___n
push eax
call fcn.00dd5f20
mov eax, dword [edi + 0x38]
add esp, 8
inc ebx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
cmp eax, dword [edi + 0x3c]
je 0xdee9bb
mov esi, dword [ebp + 8]
add esi, 0x10
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov eax, dword [0xe1aed8]
mov ecx, dword [eax + 4]
mov dword [ebp + 0xc], edx
mov byte [ecx + 0xe1af18], 0x20
test ebx, ebx
je 0xdee13c
mov edi, dword [ebp + 8]
push 0
lea edx, [ebp - 0x1c]
push ebx
neg edi
push edx
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee11d
xor ecx, ecx
jmp 0xdee124
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
add esp, 0x14
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push 0xe0f954
push eax
call fcn.00dd5f20
mov ecx, dword [0xe1aed8]
mov edx, dword [ecx + 4]
add esp, 8
inc ebx
mov byte [edx + 0xe1af18], 0x20
je 0xdee1a3
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 0x6c]
push ebx
neg edi
push eax
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee184
xor ecx, ecx
jmp 0xdee18b
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
add esp, 0x14
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push str._pid__:
push eax
call fcn.00dd5f20
add esp, 8
test esi, esi
jne 0xdee1c2
xor eax, eax
jmp 0xdee1c9
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add eax, esi
mov edx, dword [eax + 0x14]
and edx, 0xfffff3ff
or edx, 0x200
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 0xc]
push 0xe0f944
push eax
mov ecx, esi
call fcn.00deaa00
push eax
call fcn.00dd5f20
mov ecx, dword [0xe1aed8]
mov edx, dword [ecx + 4]
add esp, 8
mov byte [edx + 0xe1af18], 0x20
test ebx, ebx
je 0xdee248
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 0xdc]
push ebx
neg edi
push eax
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee229
xor ecx, ecx
jmp 0xdee230
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
add esp, 0x14
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push str._is_managed__:
push eax
call fcn.00dd5f20
add esp, 8
test esi, esi
jne 0xdee267
xor eax, eax
jmp 0xdee26e
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add eax, esi
mov edx, dword [eax + 0x14]
mov ecx, dword [ebp - 4]
and edx, 0xfffff3ff
or edx, 0x200
mov dword [eax + 0x14], edx
push 0xe0f944
lea eax, [ebp + 0xc]
push eax
add ecx, 0x18
call fcn.00ded6f0
movzx ecx, byte [eax + 4]
push ecx
mov ecx, esi
call fcn.00ded410
push eax
call fcn.00dd5f20
mov edx, dword [0xe1aed8]
mov eax, dword [edx + 4]
add esp, 8
mov byte [eax + 0xe1af18], 0x20
test ebx, ebx
je 0xdee2fd
mov edi, dword [ebp + 8]
push 0
lea ecx, [ebp - 0xcc]
push ebx
neg edi
push ecx
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee2de
xor ecx, ecx
jmp 0xdee2e5
mov edx, dword [edi]
mov ecx, dword [edx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
add esp, 0x14
mov edi, dword [ebp + 8]
mov eax, edi
neg eax
sbb eax, eax
and eax, esi
push str._name__:
push eax
call fcn.00dd5f20
add esp, 8
push 0xe0f924
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 4]
neg edi
sbb edi, edi
add ecx, 0x28
and edi, esi
call fcn.00dedd20
push eax
push 0xe0e704
push edi
call fcn.00dd5f20
add esp, 8
push eax
call fcn.00dd5c80
add esp, 8
push eax
call fcn.00dd5f20
mov edx, dword [0xe1aed8]
mov eax, dword [edx + 4]
add esp, 8
mov byte [eax + 0xe1af18], 0x20
test ebx, ebx
je 0xdee3a2
mov edi, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x3c]
push ebx
neg edi
push ecx
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee383
xor ecx, ecx
jmp 0xdee38a
mov edx, dword [edi]
mov ecx, dword [edx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
add esp, 0x14
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push str._replaced__:
push eax
call fcn.00dd5f20
add esp, 8
test esi, esi
jne 0xdee3c1
xor eax, eax
jmp 0xdee3c8
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add eax, esi
mov edx, dword [eax + 0x14]
mov edi, dword [ebp - 4]
and edx, 0xfffff3ff
or edx, 0x200
mov dword [eax + 0x14], edx
push 0xe0f944
lea eax, [ebp + 0xc]
push eax
lea ecx, [edi + 0x18]
call fcn.00ded6f0
mov ecx, dword [eax + 0x10]
push ecx
mov ecx, esi
call fcn.00deaa00
push eax
call fcn.00dd5f20
mov edx, dword [0xe1aed8]
mov eax, dword [edx + 4]
add esp, 8
mov byte [eax + 0xe1af18], 0x20
test ebx, ebx
je 0xdee459
mov edi, dword [ebp + 8]
push 0
lea ecx, [ebp - 0xac]
push ebx
neg edi
push ecx
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee437
xor ecx, ecx
jmp 0xdee43e
mov edx, dword [edi]
mov ecx, dword [edx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
mov edi, dword [ebp - 4]
add esp, 0x14
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push str._hdr_modified__:
push eax
call fcn.00dd5f20
add esp, 8
test esi, esi
jne 0xdee478
xor eax, eax
jmp 0xdee47f
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add eax, esi
mov edx, dword [eax + 0x14]
and edx, 0xfffff3ff
or edx, 0x200
mov dword [eax + 0x14], edx
push 0xe0f944
lea eax, [ebp + 0xc]
push eax
lea ecx, [edi + 0x18]
call fcn.00ded6f0
mov ecx, dword [eax + 0x14]
push ecx
mov ecx, esi
call fcn.00deaa00
push eax
call fcn.00dd5f20
mov edx, dword [ebp + 0x10]
add esp, 8
cmp byte [edx + 0x74], 0
jne 0xdee576
mov eax, dword [0xe1aed8]
mov ecx, dword [eax + 4]
mov byte [ecx + 0xe1af18], 0x20
test ebx, ebx
je 0xdee519
mov edi, dword [ebp + 8]
push 0
lea edx, [ebp - 0x8c]
push ebx
neg edi
push edx
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee4f7
xor ecx, ecx
jmp 0xdee4fe
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
mov edi, dword [ebp - 4]
add esp, 0x14
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push str._patched__:
push eax
call fcn.00dd5f20
add esp, 8
test esi, esi
jne 0xdee538
xor eax, eax
jmp 0xdee53f
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add eax, esi
mov edx, dword [eax + 0x14]
and edx, 0xfffff3ff
or edx, 0x200
mov dword [eax + 0x14], edx
push 0xe0f944
lea eax, [ebp + 0xc]
push eax
lea ecx, [edi + 0x18]
call fcn.00ded6f0
mov ecx, dword [eax + 0x1c]
push ecx
mov ecx, esi
call fcn.00deaa00
push eax
call fcn.00dd5f20
add esp, 8
mov edx, dword [ebp + 0x10]
cmp dword [edx + 0x78], 0
je 0xdee633
mov eax, dword [0xe1aed8]
mov ecx, dword [eax + 4]
mov byte [ecx + 0xe1af18], 0x20
test ebx, ebx
je 0xdee5d6
mov edi, dword [ebp + 8]
push 0
lea edx, [ebp - 0x4c]
push ebx
neg edi
push edx
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee5b4
xor ecx, ecx
jmp 0xdee5bb
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
mov edi, dword [ebp - 4]
add esp, 0x14
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push str._iat_hooked__:
push eax
call fcn.00dd5f20
add esp, 8
test esi, esi
jne 0xdee5f5
xor eax, eax
jmp 0xdee5fc
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add eax, esi
mov edx, dword [eax + 0x14]
and edx, 0xfffff3ff
or edx, 0x200
mov dword [eax + 0x14], edx
push 0xe0f944
lea eax, [ebp + 0xc]
push eax
lea ecx, [edi + 0x18]
call fcn.00ded6f0
mov ecx, dword [eax + 0x20]
push ecx
mov ecx, esi
call fcn.00deaa00
push eax
call fcn.00dd5f20
add esp, 8
mov edx, dword [0xe1aed8]
mov eax, dword [edx + 4]
mov byte [eax + 0xe1af18], 0x20
test ebx, ebx
je 0xdee687
mov edi, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x5c]
push ebx
neg edi
push ecx
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee665
xor ecx, ecx
jmp 0xdee66c
mov edx, dword [edi]
mov ecx, dword [edx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
mov edi, dword [ebp - 4]
add esp, 0x14
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push str._implanted_pe__:
push eax
call fcn.00dd5f20
add esp, 8
test esi, esi
jne 0xdee6a6
xor eax, eax
jmp 0xdee6ad
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add eax, esi
mov edx, dword [eax + 0x14]
and edx, 0xfffff3ff
or edx, 0x200
mov dword [eax + 0x14], edx
push 0xe0f944
lea eax, [ebp + 0xc]
push eax
lea ecx, [edi + 0x18]
call fcn.00ded6f0
mov ecx, dword [eax + 0x28]
push ecx
mov ecx, esi
call fcn.00deaa00
push eax
call fcn.00dd5f20
mov edx, dword [0xe1aed8]
mov eax, dword [edx + 4]
add esp, 8
mov byte [eax + 0xe1af18], 0x20
test ebx, ebx
je 0xdee738
mov edi, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x7c]
push ebx
neg edi
push ecx
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee716
xor ecx, ecx
jmp 0xdee71d
mov edx, dword [edi]
mov ecx, dword [edx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
mov edi, dword [ebp - 4]
add esp, 0x14
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push str._implanted_shc__:
push eax
call fcn.00dd5f20
add esp, 8
test esi, esi
jne 0xdee757
xor eax, eax
jmp 0xdee75e
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add eax, esi
mov edx, dword [eax + 0x14]
and edx, 0xfffff3ff
or edx, 0x200
mov dword [eax + 0x14], edx
push 0xe0f944
lea eax, [ebp + 0xc]
push eax
lea ecx, [edi + 0x18]
call fcn.00ded6f0
mov ecx, dword [eax + 0x2c]
push ecx
mov ecx, esi
call fcn.00deaa00
push eax
call fcn.00dd5f20
mov edx, dword [0xe1aed8]
mov eax, dword [edx + 4]
add esp, 8
mov byte [eax + 0xe1af18], 0x20
test ebx, ebx
je 0xdee7ec
mov edi, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x9c]
push ebx
neg edi
push ecx
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee7ca
xor ecx, ecx
jmp 0xdee7d1
mov edx, dword [edi]
mov ecx, dword [edx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
mov edi, dword [ebp - 4]
add esp, 0x14
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push str._unreachable_file__:
push eax
call fcn.00dd5f20
add esp, 8
test esi, esi
jne 0xdee80b
xor eax, eax
jmp 0xdee812
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add eax, esi
mov edx, dword [eax + 0x14]
and edx, 0xfffff3ff
or edx, 0x200
mov dword [eax + 0x14], edx
push 0xe0f944
lea eax, [ebp + 0xc]
push eax
lea ecx, [edi + 0x18]
call fcn.00ded6f0
mov ecx, dword [eax + 0x18]
push ecx
mov ecx, esi
call fcn.00deaa00
push eax
call fcn.00dd5f20
mov edx, dword [0xe1aed8]
mov eax, dword [edx + 4]
add esp, 8
mov byte [eax + 0xe1af18], 0x20
test ebx, ebx
je 0xdee8a0
mov edi, dword [ebp + 8]
push 0
lea ecx, [ebp - 0xbc]
push ebx
neg edi
push ecx
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee87e
xor ecx, ecx
jmp 0xdee885
mov edx, dword [edi]
mov ecx, dword [edx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
mov edi, dword [ebp - 4]
add esp, 0x14
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push str._other__:
push eax
call fcn.00dd5f20
add esp, 8
test esi, esi
jne 0xdee8bf
xor eax, eax
jmp 0xdee8c6
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add eax, esi
mov edx, dword [eax + 0x14]
and edx, 0xfffff3ff
or edx, 0x200
mov dword [eax + 0x14], edx
push 0xe0e448
lea eax, [ebp + 0xc]
push eax
lea ecx, [edi + 0x18]
call fcn.00ded6f0
mov ecx, dword [eax + 0x30]
push ecx
mov ecx, esi
call fcn.00deaa00
push eax
call fcn.00dd5f20
mov edx, dword [0xe1aed8]
mov eax, dword [edx + 4]
add esp, 8
dec ebx
mov byte [eax + 0xe1af18], 0x20
je 0xdee950
mov edi, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x2c]
push ebx
neg edi
push ecx
sbb edi, edi
call fcn.00df2f48
add esp, 0xc
and edi, esi
jne 0xdee92e
xor ecx, ecx
jmp 0xdee935
mov edx, dword [edi]
mov ecx, dword [edx + 4]
add ecx, edi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push edi
call fcn.00dd61e0
mov edi, dword [ebp - 4]
add esp, 0x14
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push 0xe0f890
push eax
call fcn.00dd5f20
mov ecx, dword [edi + 0x3c]
sub ecx, dword [edi + 0x38]
mov eax, dword [ebp - 8]
inc eax
sar ecx, 2
add esp, 8
mov dword [ebp - 8], eax
cmp eax, ecx
jae 0xdee992
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push 0xe0f88c
push eax
call fcn.00dd5f20
add esp, 8
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, esi
push 0xe0e448
push eax
call fcn.00dd5f20
mov eax, dword [ebp - 0xc]
add eax, 4
add esp, 8
mov dword [ebp - 0xc], eax
cmp eax, dword [edi + 0x3c]
jne 0xdee0e4
dec ebx
mov edx, dword [0xe1aed8]
mov eax, dword [edx + 4]
mov edi, dword [ebp + 8]
mov byte [eax + 0xe1af18], 0x20
je 0xdeea12
test edi, edi
je 0xdee9da
lea esi, [edi + 0x10]
jmp 0xdee9dc
xor esi, esi
push 0
lea ecx, [ebp - 0x2c]
push ebx
push ecx
call fcn.00df2f48
add esp, 0xc
test esi, esi
jne 0xdee9f3
xor ecx, ecx
jmp 0xdee9fa
mov edx, dword [esi]
mov ecx, dword [edx + 4]
add ecx, esi
mov edx, dword [eax + 0xc]
push edx
mov edx, dword [eax + 8]
mov eax, dword [eax]
push edx
push ecx
call eax
push 0x20
push esi
call fcn.00dd61e0
add esp, 0x14
test edi, edi
je 0xdeea1b
lea eax, [edi + 0x10]
jmp 0xdeea1d
xor eax, eax
push 0xe0f888
push eax
call fcn.00dd5f20
mov eax, dword [ebp - 8]
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc