Function at 0x4ded20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x580
movzx eax, byte [0x537040]
mov esi, dword [ebp + 8]
cmp al, 1
je 0x4deef6
movzx eax, al
test eax, eax
jne 0x4dee52
lea ecx, [esp + 0x2a0]
mov edx, 0x514945
push 0x12
call fcn.004df690
add esp, 4
mov edi, dword [esp + 0x2a0]
cmp edi, 0x80000000
jne 0x4deda8
mov dword [esp + 0x170], 0x80000000
mov edx, 0x514957
lea ecx, [esp + 0x2a0]
push 0xe
call fcn.004df690
add esp, 4
mov esi, dword [esp + 0x2a0]
cmp esi, 0x80000000
jne 0x4deddf
xor ebx, ebx
jmp 0x4dee28
mov eax, dword [esp + 0x2a4]
cmp byte [esp + 0x2ac], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2a8]
je 0x4df272
mov bl, 1
cmp eax, 1
jne 0x4dedd9
mov eax, dword [esp + 0xc]
cmp byte [eax], 0x30
setne bl
test edi, edi
je 0x4dee3e
jmp 0x4dee30
mov eax, dword [esp + 0x2a4]
mov ecx, dword [esp + 0x2a8]
cmp byte [esp + 0x2ac], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
je 0x4df313
cmp dword [esp + 0x14], 1
mov bl, 1
jne 0x4dee16
mov eax, dword [esp + 0x10]
cmp byte [eax], 0x30
setne bl
test esi, esi
je 0x4dee28
mov ecx, dword [esp + 0x10]
mov edx, 1
call fcn.0044dba0
test edi, 0x7fffffff
je 0x4dee3e
mov ecx, dword [esp + 0xc]
mov edx, 1
call fcn.0044dba0
mov esi, dword [ebp + 8]
mov eax, ebx
inc al
test bl, bl
mov byte [0x537040], al
je 0x4deef6
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x537099], cl
jne 0x4df393
mov eax, dword [0x5370f4]
test eax, 0x7fffffff
jne 0x4df3a2
mov dword [esp + 0x30], 0
movzx eax, byte [0x53709a]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 8
mov dword [esp + 0x28], 0
call sub.kernel32.dll_GetCurrentProcess
mov dword [esp + 0x38], eax
call sub.kernel32.dll_GetCurrentThread
mov dword [esp + 0x34], eax
lea edi, [esp + 0x2a0]
push 0x2d0
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push edi
call sub.kernel32.dll_RtlCaptureContext
call fcn.004df9d0
test eax, eax
je 0x4def01
movsd xmm0, qword [esp + 0x2a0]
mov eax, dword [esp + 0x2a8]
mov dword [esi], 0
movsd qword [esi + 4], xmm0
mov dword [esi + 0xc], eax
jmp 0x4df1f8
mov dword [esi], 1
jmp 0x4df22d
mov eax, dword [0x5370e8]
mov dword [esp + 0x40], edx
test eax, eax
mov dword [esp + 0x18], eax
jne 0x4def37
push str.SymFunctionTableAccess64
push dword [0x5370c8]
call sub.kernel32.dll_GetProcAddress
test eax, eax
mov dword [esp + 0x18], eax
je 0x4df624
mov eax, dword [esp + 0x18]
mov dword [0x5370e8], eax
mov ebx, dword [0x5370ec]
test ebx, ebx
jne 0x4def60
push str.SymGetModuleBase64
push dword [0x5370c8]
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4df624
mov ebx, eax
mov dword [0x5370ec], eax
call sub.kernel32.dll_GetCurrentProcess
mov esi, dword [0x5370f0]
mov dword [esp + 0x44], eax
mov dword [esp + 0x14], ebx
test esi, esi
jne 0x4def96
push str.StackWalkEx
push dword [0x5370c8]
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4df3b2
mov esi, eax
mov dword [0x5370f0], eax
mov edi, ebx
lea ebx, [esp + 0x58]
lea eax, [esp + 0x60]
push 0x100
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x354]
mov ecx, dword [esp + 0x358]
mov edx, dword [esp + 0x364]
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x160], 0x110
mov dword [esp + 0x164], 0
mov dword [esp + 0x168], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], ecx
mov dword [esp + 0x64], 3
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], 0
mov dword [esp + 0x94], 3
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], 0
mov dword [esp + 0x84], 3
push 0
push 0
push edi
push dword [esp + 0x24]
push 0
lea eax, [esp + 0x2b4]
push eax
push ebx
push dword [esp + 0x50]
push dword [esp + 0x58]
push 0x14c
call esi
cmp eax, 1
jne 0x4df1b3
mov eax, dword [esp + 0x14]
mov dword [esp + 0x4c], esi
xor esi, esi
mov edi, 1
mov dword [esp + 0x48], 8
mov dword [esp + 0xc], 0
jmp 0x4df11c
mov eax, dword [esp + 0x48]
add eax, esi
push 0x130
lea ecx, [esp + 0x174]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0xc]
mov ecx, fcn.004ded20
mov edi, dword [esp + 0x2c]
xor eax, ecx
mov dword [esp + 0x28], edi
or eax, edx
mov eax, dword [esp + 0x10]
cmove eax, edi
mov dword [esp + 0x10], eax
mov eax, 1
cmove edx, eax
mov dword [esp + 0xc], edx
push 0
push 0
push dword [esp + 0x1c]
push dword [esp + 0x24]
push 0
lea eax, [esp + 0x2b4]
push eax
lea ebx, [esp + 0x70]
push ebx
push dword [esp + 0x50]
push dword [esp + 0x58]
push 0x14c
call dword [esp + 0x74]
inc edi
add esi, 0x130
cmp eax, 1
mov eax, dword [esp + 0x14]
jne 0x4df1bb
lea ecx, [edi - 1]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x1c], ecx
push 0
push dword [esp + 0x5c]
push dword [esp + 0x4c]
call eax
mov dword [esp + 0x168], eax
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov dword [esp + 0x3c], eax
push 0x118
push ebx
lea eax, [esp + 0x180]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x174], edi
cmp ecx, dword [esp + 0x20]
mov dword [esp + 0x170], eax
mov dword [esp + 0x290], 0
mov dword [esp + 0x294], 4
mov dword [esp + 0x298], 0
jne 0x4df090
lea ecx, [esp + 0x20]
call fcn.004dfdd0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x48], eax
jmp 0x4df090
mov dword [esp + 0xc], 0
push dword [esp + 0x40]
call sub.kernel32.dll_ReleaseMutex
mov esi, dword [ebp + 8]
cmp dword [esp + 0x28], 0
lea eax, [esi + 4]
je 0x4df237
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov edi, dword [esp + 0x28]
movsd xmm0, qword [esp + 0x20]
mov dword [esi], 2
test ecx, ecx
mov dword [eax + 8], edi
movsd qword [eax], xmm0
cmove edx, ecx
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 0
cmp byte [esp + 0x30], 0
jne 0x4df216
mov eax, dword [0x5370f4]
test eax, 0x7fffffff
jne 0x4df5b1
xor eax, eax
xchg byte [0x537099], al
cmp al, 2
jne 0x4df22d
push 0x537099
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [esp + 0x20], 0
mov ecx, dword [esp + 0x2a8]
movsd xmm0, qword [esp + 0x2a0]
mov dword [esi], 0
mov dword [eax + 8], ecx
movsd qword [eax], xmm0
mov dword [esi + 0x14], 0
je 0x4df1ff
mov ecx, dword [esp + 0x24]
mov edx, 8
call fcn.0044dba0
jmp 0x4df1ff
test eax, eax
je 0x4df5a2
movzx ecx, byte [esp + 0x2af]
movzx edx, word [esp + 0x2ad]
mov esi, dword [esp + 0xc]
shl ecx, 0x10
or edx, ecx
mov dword [esp + 0x10], edx
lea edx, [esi + eax]
jmp 0x4df2ba
add esi, 2
cmp ebx, edx
cmovne ebx, esi
nop word cs:[eax + eax]
nop
cmp ebx, edx
mov esi, ebx
je 0x4dedc8
movzx ecx, byte [esi]
lea ebx, [esi + 1]
test cl, cl
jns 0x4df2b0
cmp cl, 0xe0
jb 0x4df29c
cmp cl, 0xed
jne 0x4df2f2
cmp ebx, edx
je 0x4dedc8
lea ecx, [esi + 2]
cmp ecx, edx
je 0x4dedc8
cmp byte [esi + 1], 0x9f
ja 0x4df5d9
add esi, 3
mov ebx, esi
jmp 0x4df2b0
add esi, 2
cmp ebx, edx
cmove esi, ebx
xor ebx, ebx
cmp esi, edx
setne bl
add ebx, esi
cmp cl, 0xf0
jb 0x4df2b0
xor ecx, ecx
cmp ebx, edx
setne cl
add ebx, ecx
jmp 0x4df2b0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4df5ca
mov edx, dword [esp + 0x10]
lea ebx, [edx + eax]
jmp 0x4df33a
add edx, 2
cmp eax, ebx
cmovne eax, edx
cmp eax, ebx
mov edx, eax
je 0x4dee03
movzx ecx, byte [edx]
lea eax, [edx + 1]
test cl, cl
jns 0x4df330
cmp cl, 0xe0
jb 0x4df328
cmp cl, 0xed
jne 0x4df372
cmp eax, ebx
je 0x4dee03
lea eax, [edx + 2]
cmp eax, ebx
je 0x4dee03
cmp byte [edx + 1], 0x9f
ja 0x4df605
add edx, 3
mov eax, edx
jmp 0x4df330
add edx, 2
cmp eax, ebx
cmove edx, eax
xor eax, eax
cmp edx, ebx
setne al
add eax, edx
cmp cl, 0xf0
jb 0x4df330
xor ecx, ecx
cmp eax, ebx
setne cl
add eax, ecx
jmp 0x4df330
mov ecx, 0x537099
call fcn.004bf100
jmp 0x4dee64
call fcn.004bf1a0
xor al, 1
mov dword [esp + 0x30], eax
jmp 0x4dee7c
lea esi, [esp + 0x58]
lea eax, [esp + 0x60]
push 0x100
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x354]
mov ecx, dword [esp + 0x358]
mov edx, dword [esp + 0x364]
xor edi, edi
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x168], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x2c], 8
mov dword [esp + 0x1c], 1
mov dword [esp + 0xc], 0
mov dword [esp + 0x58], ecx
mov dword [esp + 0x64], 3
mov dword [esp + 0x88], edx
mov dword [esp + 0x8c], 0
mov dword [esp + 0x94], 3
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], 0
mov dword [esp + 0x84], 3
jmp 0x4df4c7
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add eax, edi
push 0x130
lea ecx, [esp + 0x174]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x58]
mov ebx, dword [esp + 0xc]
mov ecx, fcn.004ded20
mov edx, dword [esp + 0x1c]
mov esi, 1
xor eax, ecx
mov dword [esp + 0x28], edx
or eax, ebx
mov eax, dword [esp + 0x10]
cmove ebx, esi
lea esi, [esp + 0x58]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x14]
cmove eax, edx
inc edx
add edi, 0x130
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov eax, dword [0x5370e4]
test eax, eax
jne 0x4df4ed
push str.StackWalk64
push dword [0x5370c8]
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4df624
mov dword [0x5370e4], eax
push 0
push ebx
push dword [esp + 0x20]
push 0
lea ecx, [esp + 0x2b0]
push ecx
push esi
push dword [esp + 0x4c]
push dword [esp + 0x54]
push 0x14c
call eax
cmp eax, 1
jne 0x4df1bb
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x3c], eax
push 0
push dword [esp + 0x5c]
push dword [esp + 0x4c]
call ebx
mov dword [esp + 0x168], eax
mov eax, esi
mov esi, edi
mov edi, dword [esp + 0x54]
mov ebx, dword [esp + 0x50]
push 0x118
push eax
lea eax, [esp + 0x180]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x174], edi
mov edi, esi
mov dword [esp + 0x170], ebx
mov dword [esp + 0x290], 0
mov dword [esp + 0x294], 4
mov dword [esp + 0x298], 0
cmp eax, dword [esp + 0x20]
jne 0x4df468
lea ecx, [esp + 0x20]
call fcn.004dfdd0
jmp 0x4df460
mov bl, 1
test edi, edi
jne 0x4deddd
jmp 0x4dee3e
call fcn.004bf1a0
test al, al
jne 0x4df216
mov byte [0x53709a], 1
jmp 0x4df216
mov bl, 1
test esi, esi
jne 0x4dee1a
jmp 0x4dee28
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x170], edi
shl edx, 8
mov dword [esp + 0x174], ecx
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], edx
jmp 0x4ded7c
test esi, 0x7fffffff
je 0x4deda1
mov ecx, dword [esp + 0x10]
mov edx, 1
call fcn.0044dba0
jmp 0x4deda1
mov ecx, 0x5162d8
call fcn.00444f90
ud2