Function at 0x4ddf44
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4de251
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4de268
call fcn.0040463c
push 0
mov ecx, 0x4de278
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3e90
mov edx, dword [ebx + 0x114]
mov dword [edx + 4], eax
push 0
mov ecx, 0x4de28c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3e90
mov edx, dword [ebx + 0x114]
mov dword [edx + 0xc], eax
push 0
mov ecx, 0x4de2a0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3e90
mov edx, dword [ebx + 0x114]
mov dword [edx + 8], eax
push 0
mov ecx, 0x4de2b4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3e90
mov edx, dword [ebx + 0x114]
mov dword [edx + 0x10], eax
push 0
mov ecx, 0x4de2cc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3e90
mov esi, dword [ebx + 0x114]
mov dword [esi + 0x18], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4de2dc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3d50
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 0x14]
mov eax, ebx
call fcn.004dc9f8
push 0
mov ecx, 0x4de2ec
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3e90
mov esi, dword [ebx + 0x114]
mov dword [esi + 0x1c], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4de2fc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3d50
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi + 0x44]
mov eax, ebx
call fcn.004dc9f8
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4de310
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3d50
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x114]
mov edx, dword [eax + 0x48]
mov eax, ebx
call fcn.004dc9f8
push 0xffffffffffffffff
mov ecx, 0x4de324
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3e90
mov edx, dword [ebx + 0x114]
mov dword [edx + 0x2c], eax
push 0xffffffffffffffff
mov ecx, 0x4de33c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3e90
mov edx, dword [ebx + 0x114]
mov dword [edx + 0x30], eax
push 0xffffffffffffffff
mov ecx, 0x4de354
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3e90
mov edx, dword [ebx + 0x114]
mov dword [edx + 0x34], eax
push 0
mov ecx, 0x4de36c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3e90
mov edx, dword [ebx + 0x114]
mov dword [edx + 0x4c], eax
push 0
mov ecx, 0x4de388
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3e90
mov esi, dword [ebx + 0x114]
mov dword [esi + 0x50], eax
cmp dword [esi + 0x1c], 1
jle 0x4de113
xor eax, eax
mov dword [esi + 0x1c], eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4de3a4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3d50
cmp dword [ebp - 8], 0
je 0x4de13b
mov eax, dword [ebx + 0x114]
mov byte [eax + 0x54], 1
jmp 0x4de145
mov eax, dword [ebx + 0x114]
mov byte [eax + 0x54], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4de3bc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3d50
cmp dword [ebp - 8], 0
je 0x4de16d
mov eax, dword [ebx + 0x114]
mov byte [eax + 0x55], 1
jmp 0x4de177
mov eax, dword [ebx + 0x114]
mov byte [eax + 0x55], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4de3d8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3d50
cmp dword [ebp - 8], 0
je 0x4de19f
mov eax, dword [ebx + 0x114]
mov byte [eax + 0x56], 1
jmp 0x4de1a9
mov eax, dword [ebx + 0x114]
mov byte [eax + 0x56], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4de3a4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3d50
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebx + 0xb0]
mov eax, ebx
call fcn.004df450
mov edx, dword [ebx + 0x114]
mov dword [edx + 0x38], eax
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4de3bc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3d50
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0xb0]
mov eax, ebx
call fcn.004df450
mov edx, dword [ebx + 0x114]
mov dword [edx + 0x3c], eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x4de3d8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004b3d50
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebx + 0xb0]
mov eax, ebx
call fcn.004df450
mov edx, dword [ebx + 0x114]
mov dword [edx + 0x40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4de258
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004045c8
ret