Function at 0x4fe350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x78bd58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4fe844
sub esp, 0x74
mov eax, dword [esp + 0x7c]
cmp eax, 0x63
je 0x4fe391
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call fcn.004fcf60
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call fcn.004fd480
nop
mov eax, dword [esp + 0x7c]
xor ecx, ecx
jmp 0x4fe3c2
mov eax, dword [esp + 0x78]
mov dword [esp], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 4], eax
call fcn.004fd9e0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], ecx
add esp, 0x74
ret
cmp ecx, 7
jge 0x4fe759
lea edx, [0x5daa9a]
movzx ebx, byte [edx + ecx]
cmp ebx, 0x80
jge 0x4fe3e0
inc ecx
jmp 0x4fe406
mov dword [esp], edx
mov dword [esp + 4], 7
mov dword [esp + 8], ecx
call fcn.00467810
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x7c]
lea edx, [0x5daa9a]
cmp eax, ebx
jne 0x4fe3c2
cmp eax, 0x58
jg 0x4fe41b
cmp eax, 0x55
je 0x4fe44e
cmp eax, 0x58
je 0x4fe44e
jmp 0x4fe460
cmp eax, 0x62
jne 0x4fe432
mov ecx, 2
mov edx, 2
lea ebx, [0x5da0b8]
jmp 0x4fe470
cmp eax, 0x6f
jne 0x4fe449
mov ecx, 8
mov edx, 8
lea ebx, [0x5dae7d]
jmp 0x4fe470
cmp eax, 0x78
jne 0x4fe460
mov ecx, 0x10
mov edx, 0x16
lea ebx, [0x5e04f8]
jmp 0x4fe470
mov ecx, 0xa
mov edx, 0xa
lea ebx, [0x5db7a1]
cmp eax, 0x55
je 0x4fe4a0
cmp eax, 0x76
je 0x4fe481
xor eax, eax
jmp 0x4fe51a
mov eax, dword [esp + 0x78]
mov dword [esp], eax
call fcn.004fdbb0
mov ecx, dword [esp + 4]
mov ebx, dword [esp + 8]
movzx eax, byte [esp + 0x10]
mov edx, dword [esp + 0xc]
jmp 0x4fe51a
mov dword [esp + 0x48], ecx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x44], edx
mov eax, dword [esp + 0x78]
mov dword [esp], eax
lea ecx, [0x6204bc]
mov dword [esp + 4], ecx
mov dword [esp + 8], 1
mov byte [esp + 0xc], 0
call fcn.004fd220
movzx eax, byte [esp + 0x10]
test al, al
je 0x4fe6fd
mov eax, dword [esp + 0x78]
mov dword [esp], eax
lea ecx, str.___SM____CZyi_____tvrRuUeEaAlLsS01bBoOxX_nNiIfFpP:_01__.2500xd__M___________n__s____Pn___n__n___n__t__LlLtLuMnCcCfCoCsLmLoMcMeNdNlNoPcPdPePfPiPoPsScSkSmSoZlZpZsYiip53_:____nid___q_vjsoreqgegtleltne_sif__dD_sSwWE:__inil01_______.__125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET0001CATWATEATGMTHSTHDT_03_04_05ESTCSTCDTMSTMDT_02EDTASTADTPSTPDTNSTNDT06030407IST0908IDT12PKT11KST05JST10_01_11_12_08_0913CETBSTMSK_0614_mStdDltzeddiegdbkdbHxDdbghxdSAEmdbdbxtcpgetregNUL:_EOFintmapptr...finobjgc__:_gp___in__n___n_____P__MPC___end___and_:_npc__GHanLaoMroNkoVaicgodnsudpftpssh::1setadxaesshaavxfmanet_:_TTLlennot:_____.exe.lnkFPStrueeEpPopenreadfileseeksyncpipeStat3125Atoi_InfInfJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT_as_hour_in_dumppeekhttpkgdbmdbgwmicpathname.com.bat.cmdboolint8uintchanfunccallkindArgs_on_Callallgallprootitabsbrkidledead_is_LEAFbase_of______GOGC____pc:_pcas1cas2cas3cas4cas5cas6_at__n_tm_sp_sp:_lr:_fp_gp_mp__mquitbindAhomChamKawiLisuMiaoModiNewaThaiTotoicmpigmpftpspop3smtpmdnsdial__r_t_nunix.ps1ermssse3avx2bmi1bmi2bitsNameTypehtmlelsewith__s___t_r_n_s_scap_____failErrorfalse_nil_svqxXchdirwritechmodchowncloseLstat1562578125MarchApril053004300545063003300845103012451345_0930monthLocaldnspyilspydebugILSpypizzacrackida__brutejamesproxymodelqueryvirusBrunoint16int32int64uint8arrayslice_and_kinddefersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleepgcing_MB___got_..._n_maxscav__ptr_____usageinit__ms__fault_tab_top_...___fp:ntohsGreekAdlamBamumBatakBuhidDograKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilfileshttpsimap2imap3imapspop3shoststoastshort_FileInts:Ptrs:sse41sse42ssse3__at_no_IPClassbreak.eEpPindexprintblockrangeinputmatchrune_Hello_StringFormat__byte_for_stringreadatremove390625SundayMondayFridayAugustUTC_11UTC_02UTC_08UTC_09UTC12UTC13minutesecondx32dbgpc_retCentoswindbgdbgclrde4dotpepperghidrahackerx96dbgfolderprl_sfprl_tgMillergeorgevmwareERROR:exec:_uint16uint32uint64structchan____chan_Valuesysmontimersefenceselect__not_object_next_jobs_goid_sweep__B______util_alloc_free__span_prev_list__i___code_addr_m__p_p__mSCHED__curg_ctxt:_min__max__...__n_mnil_base_GetACPhangupkilledlistensocketCommonArabicBrahmiCarianChakmaCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidinetdnsdomaingophertelnet.localreturn.onionsendtoBypass__val_rdtscppopcntcmd_goheaderAnswerLengthprintf___
mov dword [esp + 4], ecx
mov dword [esp + 8], 1
mov byte [esp + 0xc], 0
call fcn.004fd220
movzx eax, byte [esp + 0x10]
test al, al
je 0x4fe6fd
mov edx, dword [esp + 0x44]
xor eax, eax
mov ebx, dword [esp + 0x68]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x4c], ecx
mov ebp, dword [esp + 0x78]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov byte [esp + 0xc], al
call fcn.004fd8b0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x5c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0x40
call fcn.00490630
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4fe6c4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov edx, dword [esp + 0x14]
mov dword [esp + 0x38], edx
mov ebx, dword [esp + 0x80]
lea ecx, [ebx - 0x40]
neg ecx
mov dword [esp + 0x58], ecx
shl edx, cl
mov ebp, eax
shl eax, cl
lea esi, [ecx - 0x20]
mov dword [esp + 0x54], esi
mov edi, ecx
mov ecx, esi
shl ebp, cl
neg ecx
mov ebx, dword [esp + 0x34]
shr ebx, cl
cmp esi, 0x20
sbb esi, esi
mov dword [esp + 0x50], esi
and ebp, esi
cmp ecx, 0x20
sbb esi, esi
and ebx, esi
cmp edi, 0x20
sbb edi, edi
and edx, edi
or ebx, edx
or ebx, ebp
and eax, edi
mov edx, ebx
shl ebx, cl
and ebx, esi
mov ecx, dword [esp + 0x58]
shr eax, cl
mov ebp, edx
shr edx, cl
and edx, edi
and eax, edi
or eax, ebx
mov ecx, dword [esp + 0x54]
shr ebp, cl
mov ebx, dword [esp + 0x50]
and ebp, ebx
or eax, ebp
mov ebx, dword [esp + 0x38]
cmp ebx, edx
setne dl
mov ebp, dword [esp + 0x34]
cmp ebp, eax
setne al
or edx, eax
test dl, dl
jne 0x4fe616
mov dword [esp + 0x84], ebp
mov dword [esp + 0x88], ebx
add esp, 0x74
ret
mov dword [esp], 0
lea eax, [0x5e5d1d]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x23
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
call fcn.00457ee0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x60], ecx
lea edx, [0x5b95e0]
mov dword [esp], edx
call fcn.00410f90
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x3c]
mov dword [eax + 4], ecx
mov ecx, dword [0x78be40]
test ecx, ecx
jne 0x4fe6b7
mov ecx, dword [esp + 0x60]
mov dword [eax], ecx
lea ecx, [0x621e98]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], eax
lea eax, [0x5b9520]
mov dword [esp], eax
lea ecx, [esp + 0x6c]
mov dword [esp + 4], ecx
call fcn.0040e660
mov eax, dword [esp + 8]
lea ecx, [0x5b9520]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043d570
call fcn.0046fee0
mov ecx, dword [esp + 0x60]
mov dword [edi], ecx
jmp 0x4fe677
mov ecx, dword [esp + 0x1c]
nop
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
lea eax, [0x5b9520]
mov dword [esp], eax
lea ecx, [esp + 0x6c]
mov dword [esp + 4], ecx
call fcn.0040e660
mov eax, dword [esp + 8]
lea ecx, [0x5b9520]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043d570
nop
lea eax, [0x5b95e0]
mov dword [esp], eax
call fcn.00410f90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x5ded4f]
mov dword [eax], ecx
lea ecx, [0x621e98]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], eax
lea eax, [0x5b9520]
mov dword [esp], eax
lea ecx, [esp + 0x6c]
mov dword [esp + 4], ecx
call fcn.0040e660
mov eax, dword [esp + 8]
lea ecx, [0x5b9520]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043d570
mov ecx, eax
sar eax, 0x1f
lea edx, [esp + 0x2c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004586a0
mov dword [esp], 0
lea eax, [0x5dbd08]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
lea eax, [0x5da7aa]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 6
lea eax, [0x5daaa1]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 7
call fcn.00458010
mov eax, dword [esp + 0x28]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x64], ecx
lea edx, [0x5b95e0]
mov dword [esp], edx
call fcn.00410f90
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x40]
mov dword [eax + 4], ecx
mov ecx, dword [0x78be40]
test ecx, ecx
jne 0x4fe837
mov ecx, dword [esp + 0x64]
mov dword [eax], ecx
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
lea ecx, [0x621e98]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], eax
lea eax, [0x5b9520]
mov dword [esp], eax
lea ecx, [esp + 0x6c]
mov dword [esp + 4], ecx
call fcn.0040e660
mov eax, dword [esp + 8]
lea ecx, [0x5b9520]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043d570
call fcn.0046fee0
mov ecx, dword [esp + 0x64]
mov dword [edi], ecx
jmp 0x4fe7e7
call fcn.0046eae0
jmp fcn.004fe350