Function at 0x4fddc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x78bd58]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4fe33e
sub esp, 0x7c
mov eax, dword [esp + 0x84]
cmp eax, 0x63
je 0x4fde0d
mov eax, dword [esp + 0x80]
mov dword [esp], eax
call fcn.004fcf60
mov eax, dword [esp + 0x80]
mov dword [esp], eax
call fcn.004fd480
nop
mov eax, dword [esp + 0x84]
xor ecx, ecx
jmp 0x4fde41
mov eax, dword [esp + 0x80]
mov dword [esp], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 4], eax
call fcn.004fd9e0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
add esp, 0x7c
ret
cmp ecx, 7
jge 0x4fe253
lea edx, [0x5daa9a]
movzx ebx, byte [edx + ecx]
cmp ebx, 0x80
jge 0x4fde5f
inc ecx
jmp 0x4fde88
mov dword [esp], edx
mov dword [esp + 4], 7
mov dword [esp + 8], ecx
call fcn.00467810
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x84]
lea edx, [0x5daa9a]
cmp eax, ebx
jne 0x4fde41
cmp eax, 0x58
jg 0x4fde9d
cmp eax, 0x55
je 0x4fded0
cmp eax, 0x58
je 0x4fded0
jmp 0x4fdee2
cmp eax, 0x62
jne 0x4fdeb4
mov ecx, 2
mov edx, 2
lea ebx, [0x5da0b8]
jmp 0x4fdef2
cmp eax, 0x6f
jne 0x4fdecb
mov ecx, 8
mov edx, 8
lea ebx, [0x5dae7d]
jmp 0x4fdef2
cmp eax, 0x78
jne 0x4fdee2
mov ecx, 0x10
mov edx, 0x16
lea ebx, [0x5e04f8]
jmp 0x4fdef2
mov ecx, 0xa
mov edx, 0xa
lea ebx, [0x5db7a1]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x44], edx
cmp eax, 0x55
jne 0x4fdf79
mov eax, dword [esp + 0x80]
mov dword [esp], eax
lea ecx, [0x6204bc]
mov dword [esp + 4], ecx
mov dword [esp + 8], 1
mov byte [esp + 0xc], 0
call fcn.004fd220
movzx eax, byte [esp + 0x10]
test al, al
je 0x4fe1f7
mov eax, dword [esp + 0x80]
mov dword [esp], eax
lea ecx, str.___SM____CZyi_____tvrRuUeEaAlLsS01bBoOxX_nNiIfFpP:_01__.2500xd__M___________n__s____Pn___n__n___n__t__LlLtLuMnCcCfCoCsLmLoMcMeNdNlNoPcPdPePfPiPoPsScSkSmSoZlZpZsYiip53_:____nid___q_vjsoreqgegtleltne_sif__dD_sSwWE:__inil01_______.__125625nanNaNSunMonTueWedThuFriSatJanFebMarAprMayJunJulAugSepOctNovDecUTCEET0001CATWATEATGMTHSTHDT_03_04_05ESTCSTCDTMSTMDT_02EDTASTADTPSTPDTNSTNDT06030407IST0908IDT12PKT11KST05JST10_01_11_12_08_0913CETBSTMSK_0614_mStdDltzeddiegdbkdbHxDdbghxdSAEmdbdbxtcpgetregNUL:_EOFintmapptr...finobjgc__:_gp___in__n___n_____P__MPC___end___and_:_npc__GHanLaoMroNkoVaicgodnsudpftpssh::1setadxaesshaavxfmanet_:_TTLlennot:_____.exe.lnkFPStrueeEpPopenreadfileseeksyncpipeStat3125Atoi_InfInfJuneJulyEESTSASTAKSTAKDTACSTACDTAESTAEDTAWSTCESTNZSTNZDT_as_hour_in_dumppeekhttpkgdbmdbgwmicpathname.com.bat.cmdboolint8uintchanfunccallkindArgs_on_Callallgallprootitabsbrkidledead_is_LEAFbase_of______GOGC____pc:_pcas1cas2cas3cas4cas5cas6_at__n_tm_sp_sp:_lr:_fp_gp_mp__mquitbindAhomChamKawiLisuMiaoModiNewaThaiTotoicmpigmpftpspop3smtpmdnsdial__r_t_nunix.ps1ermssse3avx2bmi1bmi2bitsNameTypehtmlelsewith__s___t_r_n_s_scap_____failErrorfalse_nil_svqxXchdirwritechmodchowncloseLstat1562578125MarchApril053004300545063003300845103012451345_0930monthLocaldnspyilspydebugILSpypizzacrackida__brutejamesproxymodelqueryvirusBrunoint16int32int64uint8arrayslice_and_kinddefersweeptestRtestWexecWexecRschedhchansudoggscanmheaptracepanicsleepgcing_MB___got_..._n_maxscav__ptr_____usageinit__ms__fault_tab_top_...___fp:ntohsGreekAdlamBamumBatakBuhidDograKhmerLatinLimbuNushuOghamOriyaOsageRunicTakriTamilfileshttpsimap2imap3imapspop3shoststoastshort_FileInts:Ptrs:sse41sse42ssse3__at_no_IPClassbreak.eEpPindexprintblockrangeinputmatchrune_Hello_StringFormat__byte_for_stringreadatremove390625SundayMondayFridayAugustUTC_11UTC_02UTC_08UTC_09UTC12UTC13minutesecondx32dbgpc_retCentoswindbgdbgclrde4dotpepperghidrahackerx96dbgfolderprl_sfprl_tgMillergeorgevmwareERROR:exec:_uint16uint32uint64structchan____chan_Valuesysmontimersefenceselect__not_object_next_jobs_goid_sweep__B______util_alloc_free__span_prev_list__i___code_addr_m__p_p__mSCHED__curg_ctxt:_min__max__...__n_mnil_base_GetACPhangupkilledlistensocketCommonArabicBrahmiCarianChakmaCopticGothicHangulHatranHebrewKaithiKhojkiLepchaLycianLydianRejangSyriacTai_LeTangsaTangutTeluguThaanaWanchoYezidinetdnsdomaingophertelnet.localreturn.onionsendtoBypass__val_rdtscppopcntcmd_goheaderAnswerLengthprintf___
mov dword [esp + 4], ecx
mov dword [esp + 8], 1
mov byte [esp + 0xc], 0
call fcn.004fd220
movzx eax, byte [esp + 0x10]
test al, al
je 0x4fe1f7
mov edx, dword [esp + 0x44]
xor eax, eax
mov ebx, dword [esp + 0x70]
mov ecx, dword [esp + 0x48]
jmp 0x4fdfdc
nop
mov eax, dword [esp + 0x80]
mov dword [esp], eax
lea ecx, [0x5da0c0]
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
mov byte [esp + 0xc], 1
call fcn.004fd220
mov eax, dword [esp + 0x84]
cmp eax, 0x76
je 0x4fdfbc
mov edx, dword [esp + 0x44]
xor eax, eax
mov ebx, dword [esp + 0x70]
mov ecx, dword [esp + 0x48]
jmp 0x4fdfdc
mov eax, dword [esp + 0x80]
mov dword [esp], eax
call fcn.004fdbb0
mov ecx, dword [esp + 4]
mov ebx, dword [esp + 8]
movzx eax, byte [esp + 0x10]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x4c], ecx
mov ebp, dword [esp + 0x80]
mov dword [esp], ebp
mov dword [esp + 4], ebx
mov dword [esp + 8], edx
mov byte [esp + 0xc], al
call fcn.004fd8b0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x64], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], ecx
mov dword [esp], eax
mov dword [esp + 4], ecx
mov edx, dword [esp + 0x4c]
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0x40
call fcn.00490fb0
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x4fe1be
mov eax, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov edx, dword [esp + 0x14]
mov dword [esp + 0x38], edx
mov ebx, dword [esp + 0x88]
lea ecx, [ebx - 0x40]
neg ecx
mov dword [esp + 0x60], ecx
shl edx, cl
mov ebp, eax
shl eax, cl
lea esi, [ecx - 0x20]
mov edi, ecx
mov ecx, esi
shl ebp, cl
neg ecx
mov dword [esp + 0x5c], ecx
mov ebx, dword [esp + 0x34]
shr ebx, cl
shr edi, 5
mov dword [esp + 0x58], edi
cmp esi, 0x20
sbb edi, edi
and ebp, edi
xchg edi, ebx
not ebx
xchg edi, ebx
or edi, esi
mov dword [esp + 0x54], edi
cmp ecx, 0x20
sbb esi, esi
mov dword [esp + 0x50], esi
and ebx, esi
mov esi, dword [esp + 0x60]
cmp esi, 0x20
sbb ecx, ecx
sbb edi, edi
and edx, ecx
or edx, ebx
or edx, ebp
and eax, ecx
mov ebx, ecx
mov ecx, esi
shr eax, cl
and eax, ebx
mov ecx, dword [esp + 0x54]
mov ebx, edx
sar edx, cl
mov ecx, dword [esp + 0x5c]
mov ebp, ebx
shl ebx, cl
mov ecx, edx
mov edx, dword [esp + 0x50]
and ebx, edx
or eax, ebx
xchg edi, ebx
not ebx
xchg edi, ebx
or esi, edi
mov edx, ecx
mov ecx, esi
sar ebp, cl
mov ebx, dword [esp + 0x58]
cmp ebx, 1
sbb ebx, ebx
xor ebx, 0xffffffff
and ebx, edx
or ebx, eax
mov eax, dword [esp + 0x38]
cmp eax, ebp
setne dl
mov ebp, dword [esp + 0x34]
cmp ebp, ebx
setne bl
or edx, ebx
test dl, dl
jne 0x4fe110
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x90], eax
add esp, 0x7c
ret
mov dword [esp], 0
lea eax, [0x5e24bd]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
mov eax, dword [esp + 0x64]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
call fcn.00457ee0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x68], ecx
lea edx, [0x5b95e0]
mov dword [esp], edx
call fcn.00410f90
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x3c]
mov dword [eax + 4], ecx
mov ecx, dword [0x78be40]
test ecx, ecx
jne 0x4fe1b1
mov ecx, dword [esp + 0x68]
mov dword [eax], ecx
lea ecx, [0x621e98]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
lea eax, [0x5b9520]
mov dword [esp], eax
lea ecx, [esp + 0x74]
mov dword [esp + 4], ecx
call fcn.0040e660
mov eax, dword [esp + 8]
lea ecx, [0x5b9520]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043d570
call fcn.0046fee0
mov ecx, dword [esp + 0x68]
mov dword [edi], ecx
jmp 0x4fe171
mov ecx, dword [esp + 0x1c]
nop
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
lea eax, [0x5b9520]
mov dword [esp], eax
lea ecx, [esp + 0x74]
mov dword [esp + 4], ecx
call fcn.0040e660
mov eax, dword [esp + 8]
lea ecx, [0x5b9520]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043d570
nop
lea eax, [0x5b95e0]
mov dword [esp], eax
call fcn.00410f90
mov eax, dword [esp + 4]
mov dword [eax + 4], 0x13
lea ecx, [0x5ded4f]
mov dword [eax], ecx
lea ecx, [0x621e98]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
lea eax, [0x5b9520]
mov dword [esp], eax
lea ecx, [esp + 0x74]
mov dword [esp + 4], ecx
call fcn.0040e660
mov eax, dword [esp + 8]
lea ecx, [0x5b9520]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043d570
mov ecx, eax
sar eax, 0x1f
lea edx, [esp + 0x2c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004586a0
mov dword [esp], 0
lea eax, [0x5dbd08]
mov dword [esp + 4], eax
mov dword [esp + 8], 0xb
lea eax, [0x5da7aa]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 6
lea eax, [0x5daaa1]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 7
call fcn.00458010
mov eax, dword [esp + 0x28]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x6c], ecx
lea edx, [0x5b95e0]
mov dword [esp], edx
call fcn.00410f90
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x40]
mov dword [eax + 4], ecx
mov ecx, dword [0x78be40]
test ecx, ecx
jne 0x4fe331
mov ecx, dword [esp + 0x6c]
mov dword [eax], ecx
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
lea ecx, [0x621e98]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], eax
lea eax, [0x5b9520]
mov dword [esp], eax
lea ecx, [esp + 0x74]
mov dword [esp + 4], ecx
call fcn.0040e660
mov eax, dword [esp + 8]
lea ecx, [0x5b9520]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0043d570
call fcn.0046fee0
mov ecx, dword [esp + 0x6c]
mov dword [edi], ecx
jmp 0x4fe2e1
call fcn.0046eae0
jmp fcn.004fddc0