Function at 0x5de37d
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0x18
mov ecx, dword fs:[0x30]
mov eax, dword [ecx + 0xc]
add eax, 0xc
mov edx, dword [eax]
cmp edx, eax
je 0x5de624
mov eax, dword [edx + 0x30]
mov edx, dword [edx + 0x18]
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
mov eax, dword [0x61e716]
mov dword [esp + 8], eax
mov eax, dword [ecx + 0xc]
add eax, 0xc
mov dword [esp + 0x10], eax
mov edi, dword [eax]
cmp edi, eax
je 0x5de48c
cmp dword [esp + 8], 0
je 0x5de3fc
mov esi, dword [edi + 0x30]
xor ebp, ebp
movzx eax, word [esi]
test eax, eax
je 0x5de3f2
xor ebx, ebx
movzx eax, word [esi + ebx*2]
call fcn.005de63a
inc ebx
movzx edx, ax
add ebp, edx
movzx ecx, word [esi + ebx*2]
test ecx, ecx
jne 0x5de3db
cmp ebp, dword [esp + 8]
jne 0x5de480
mov ebx, dword [edi + 0x18]
mov ebp, dword [0x61e73a]
test ebx, ebx
je 0x5de493
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx + ebx + 0x78]
mov dword [esp + 0x14], eax
mov edx, dword [eax + ebx + 0x18]
mov ecx, dword [eax + ebx + 0x20]
add ecx, ebx
mov dword [esp + 0x10], edx
test edx, edx
jbe 0x5de493
mov al, byte [ebp]
xor edx, edx
mov byte [esp + 8], al
mov esi, ebx
add esi, dword [ecx + edx*4]
mov al, byte [esi]
cmp al, byte [esp + 8]
jne 0x5de477
xor edi, edi
cmp byte [edi + esi], 0
je 0x5de44e
cmp byte [edi + ebp], 0
jne 0x5de46e
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + ebx + 0x24]
add ecx, ebx
mov ebp, dword [eax + ebx + 0x1c]
add ebp, ebx
movzx edx, word [ecx + edx*2]
mov esi, dword [ebp + edx*4]
add esi, ebx
mov dword [esp + 8], esi
jmp 0x5de49b
inc edi
mov al, byte [edi + esi]
cmp al, byte [edi + ebp]
je 0x5de442
inc edx
cmp edx, dword [esp + 0x10]
jb 0x5de433
jmp 0x5de493
mov edi, dword [edi]
cmp edi, dword [esp + 0x10]
jne 0x5de3c6
mov eax, dword [0x61e73a]
xor ebx, ebx
mov dword [esp + 8], 0
mov ebp, dword [0x61e71a]
cmp dword [ebp], 0
je 0x5de4be
mov eax, dword [esp + 0xc]
call fcn.005de651
cmp eax, dword [ebp + 4]
je 0x5de4be
cmp eax, dword [ebp + 8]
jne 0x5de616
push 4
push 0x1000
mov eax, dword [0x61e712]
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov ebp, eax
mov eax, dword [0x61e746]
test eax, eax
jbe 0x5de4fd
xor edi, edi
mov eax, dword [0x61e70a]
mov edx, dword [eax + edi]
mov dword [ebp + edi], edx
lea edx, [0x61e71e]
mov ecx, dword [edx]
add edi, ecx
mov esi, dword [edx + 0x28]
cmp edi, esi
jb 0x5de4e0
test ebx, ebx
je 0x5de616
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx + ebx + 0x78]
mov dword [esp + 0x14], eax
mov edx, dword [eax + ebx + 0x18]
mov ecx, dword [eax + ebx + 0x20]
add ecx, ebx
mov dword [esp + 0x10], edx
test edx, edx
jbe 0x5de616
mov al, byte [ebp]
xor edx, edx
mov byte [esp + 0xc], al
mov esi, ebx
add esi, dword [ecx + edx*4]
mov al, byte [esi]
cmp al, byte [esp + 0xc]
jne 0x5de60b
xor edi, edi
cmp byte [edi + esi], 0
je 0x5de552
cmp byte [edi + ebp], 0
jne 0x5de5fe
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + ebx + 0x24]
add ecx, ebx
mov ebp, dword [eax + ebx + 0x1c]
add ebp, ebx
movzx edx, word [ecx + edx*2]
add ebx, dword [ebp + edx*4]
je 0x5de616
lea ebp, [esp + 0xc]
push ebp
lea eax, [0x61e70e]
mov ebp, dword [eax]
mov edx, dword [eax + 0x1c]
mov eax, dword [eax + 0x38]
push eax
push edx
push ebp
call ebx
lea ecx, [0x61e742]
mov eax, dword [ecx]
mov edx, dword [esp + 4]
add edx, eax
mov eax, dword [ecx - 0xc]
mov ecx, dword [ecx - 0x18]
mov dword [esp + 4], edx
mov edx, dword [edx + 4]
jmp 0x5de5bf
mov ecx, dword [esp + 4]
mov esi, dword [ecx + eax]
add esi, edx
mov dword [ebp + eax], esi
lea esi, [0x61e71e]
mov edi, dword [esi]
add eax, edi
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jb 0x5de5a5
lea ecx, [0x61e74e]
mov edx, dword [ecx]
lea eax, [esp + 0xc]
mov ecx, dword [ecx - 0x1c]
push eax
mov dword [ebp + ecx*4], edx
push dword [esp + 0x10]
mov esi, dword [0x61e72a]
push esi
push ebp
call ebx
mov ecx, dword [ebp + 0xc]
add ecx, ebp
lea edx, [0x61e73e]
mov eax, dword [edx]
add ecx, eax
mov edx, dword [edx]
add ebp, edx
push ebp
call ecx
pop eax
jmp 0x5de616
inc edi
mov al, byte [edi + esi]
cmp al, byte [edi + ebp]
je 0x5de542
inc edx
cmp edx, dword [esp + 0x10]
jb 0x5de52f
push 0
call dword [esp + 0xc]
add esp, 0x18
pop ebp
pop ebx
pop edi
pop esi
ret
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
jmp 0x5de3a9