Function at 0x4ddb90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59d460
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x634384]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
call fcn.004a0f60
cmp byte [eax], 0
je 0x4de4be
call fcn.004c9e00
mov ecx, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x40], 0x5ade7c
mov dword [ebp - 0x3c], eax
mov edx, dword [eax]
call dword [edx]
mov dword [ebp - 4], 0
call fcn.004c9e00
push 0x5eaccc
push eax
call fcn.004e35c0
call fcn.004c9e00
push str.SpIDer_Guard_configuration:
push eax
call fcn.004e35c0
call fcn.004c9e00
push 0x5eaccc
push eax
call fcn.004e35c0
add esp, 0x18
call fcn.004a0f60
mov ecx, dword [eax + 0x28]
or ecx, dword [eax + 0x2c]
je 0x4ddc9d
call fcn.004c9e00
mov dword [ebp - 0x1c], eax
call fcn.004c9e00
cmp dword [eax + 0x38], 8
lea ebx, [eax + 0x24]
jb 0x4ddc42
mov ebx, dword [ebx]
call fcn.004a0f60
mov ecx, 0x5eaccc
mov edi, str._buffered
cmp byte [eax + 0x11], 0
cmove edi, ecx
call fcn.004a0f60
mov esi, str._verbose
cmp byte [eax], 0
mov eax, 0x5eaccc
cmove esi, eax
call fcn.004a0f60
push 0
push 0x400
push dword [eax + 0x2c]
push dword [eax + 0x28]
call fcn.00539960
push ebx
push edi
push esi
push eax
push str.__Maximum__luKB_s_s_log_file:___s_
push dword [ebp - 0x1c]
call fcn.004e35c0
mov edi, dword [ebp - 0x14]
add esp, 0x18
jmp 0x4ddcf3
call fcn.004c9e00
mov dword [ebp - 0x1c], eax
call fcn.004c9e00
cmp dword [eax + 0x38], 8
lea ebx, [eax + 0x24]
jb 0x4ddcb5
mov ebx, dword [ebx]
call fcn.004a0f60
mov ecx, 0x5eaccc
mov esi, str._buffered
cmp byte [eax + 0x11], 0
cmove esi, ecx
call fcn.004a0f60
push ebx
mov ecx, str._verbose
push esi
cmp byte [eax], 0
mov eax, 0x5eaccc
cmove ecx, eax
push ecx
push str.__Unlimited_s_s_log_file:___s_
push dword [ebp - 0x1c]
call fcn.004e35c0
add esp, 0x14
call fcn.004a0f60
cmp byte [eax + 1], 0
je 0x4ddd11
call fcn.004c9e00
push str.__Log_file_contains_extended_SpIDer_Guard_event_information
push eax
call fcn.004e35c0
add esp, 8
call fcn.004a0f60
cmp byte [eax + 2], 0
je 0x4ddd2f
call fcn.004c9e00
push str.__Log_file_contains_debugging_information
push eax
call fcn.004e35c0
add esp, 8
call fcn.004c9e00
mov dword [ebp - 0x1c], eax
call fcn.004a0f60
mov ecx, 0x5b5ebc
mov edx, 0x5b5ec4
mov ebx, ecx
mov dword [ebp - 0x20], edx
mov esi, ecx
cmp byte [eax + 0xc], 0
mov eax, dword [edi + 0x28]
mov edi, ecx
cmove ebx, edx
test al, 0x80
cmove edi, edx
test al, 0x40
cmove esi, edx
call fcn.004a0f60
push ebx
push edi
mov ecx, 0x5b5ebc
cmp byte [eax + 3], 0
mov eax, 0x5b5ec4
push esi
cmove ecx, eax
push ecx
push str.__Show:_clean_files:__s__archiver:__s__packer:__s__skipped:__s
push dword [ebp - 0x1c]
call fcn.004e35c0
call fcn.004c9e00
mov dword [ebp - 0x1c], eax
call fcn.004a0f60
mov ebx, 0x64
mov edi, ebx
sub edi, dword [eax + 0x20]
call fcn.004a0f60
mov esi, ebx
sub esi, dword [eax + 0x1c]
call fcn.004a0f60
push edi
push esi
sub ebx, dword [eax + 0x18]
push ebx
push str.__Resource_usage:_execute:__d____files:__d____rescan:__d__
push dword [ebp - 0x1c]
call fcn.004e35c0
call fcn.004c9e00
mov esi, eax
call fcn.004a0f60
mov ecx, dword [eax + 0x14]
push ecx
push str.__No_driver_warning_every__d_sec
push esi
call fcn.004e35c0
call fcn.004c9e00
mov edi, dword [ebp - 0x14]
mov ebx, 0x5b5ebc
mov edx, 0x5b5ec4
mov ecx, ebx
test byte [edi + 0x28], 1
cmove ecx, edx
push ecx
push str.__Using_heuristic:__s
push eax
call fcn.004e35c0
add esp, 0x44
call fcn.004c9e00
mov esi, eax
call fcn.004a0f60
mov ecx, ebx
cmp byte [eax + 6], 0
mov eax, 0x5b5ec4
cmove ecx, eax
push ecx
push str.__Block_autorun.inf_files:__s
push esi
call fcn.004e35c0
call fcn.004c9e00
mov esi, eax
call fcn.004a0f60
mov ecx, ebx
cmp byte [eax + 7], 0
mov eax, 0x5b5ec4
cmove ecx, eax
push ecx
push str.__Scan_all_files_before_access:__s
push esi
call fcn.004e35c0
call fcn.004c9e00
mov esi, eax
call fcn.004a0f60
mov ecx, ebx
cmp byte [eax + 8], 0
mov eax, 0x5b5ec4
cmove ecx, eax
push ecx
push str.__Scan_files_on_removable_medias:__s
push esi
call fcn.004e35c0
call fcn.004c9e00
mov esi, eax
call fcn.004a0f60
mov ecx, ebx
cmp byte [eax + 9], 0
mov eax, 0x5b5ec4
cmove ecx, eax
push ecx
push str.__Scan_network_files:__s
push esi
call fcn.004e35c0
add esp, 0x30
call fcn.004c9e00
mov esi, eax
call fcn.004a0f60
cmp byte [eax + 4], 0
jne 0x4ddebc
mov ecx, 0x5b5ec4
jmp 0x4dded2
call fcn.004a0f60
mov ecx, str.on_create
mov edx, str.in_background
cmp byte [eax + 5], 0
cmove ecx, edx
push ecx
push str.__Scan_processes:__s
push esi
call fcn.004e35c0
call fcn.004c9e00
mov edx, dword [edi + 0x28]
mov esi, ebx
test dl, 4
mov ecx, 0x5b5ec4
cmove esi, ecx
test edx, 0x800
mov ecx, ebx
cmove ecx, dword [ebp - 0x20]
test dl, 2
push esi
mov edx, 0x5b5ec4
push ecx
cmove ebx, edx
push ebx
push str.__Scan:_archive:__s__containers:__s__mail:__s
push eax
call fcn.004e35c0
add esp, 0x20
call fcn.004a0f60
mov dword [ebp - 0x30], 0x5ade7c
lea esi, [eax + 0x30]
mov eax, dword [esi]
mov ecx, esi
mov dword [ebp - 0x2c], esi
call dword [eax]
mov byte [ebp - 4], 1
call fcn.004a0f60
lea ecx, [eax + 0x54]
call fcn.004e2be0
call fcn.004a0f60
lea ecx, [eax + 0x78]
call fcn.004e2be0
call fcn.004a0f60
lea ecx, [eax + 0x9c]
call fcn.004e2be0
mov byte [ebp - 4], 0
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 4]
call fcn.004c9e00
movzx ecx, byte [edi + 0x3a]
mov ebx, eax
push ecx
call fcn.004d4670
mov edi, eax
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x39]
push ecx
call fcn.004d4670
mov esi, eax
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x38]
push ecx
call fcn.004d4670
push edi
push esi
push eax
push str.__Actions:_infected:__s__incurable:__s__suspicious:__s
push ebx
call fcn.004e35c0
call fcn.004c9e00
mov esi, dword [ebp - 0x14]
mov ebx, eax
movzx ecx, byte [esi + 0x3c]
push ecx
call fcn.004d4670
movzx ecx, byte [esi + 0x3d]
mov edi, eax
push ecx
call fcn.004d4670
mov esi, eax
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x3b]
push ecx
call fcn.004d4670
push edi
push esi
push eax
push str.___________archive:__s__container:__s__email_file:__s
push ebx
call fcn.004e35c0
add esp, 0x40
call fcn.004c9e00
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
movzx ecx, byte [esi + 0x43]
push ecx
call fcn.004d4670
movzx ecx, byte [esi + 0x42]
push ecx
mov dword [ebp - 0x20], eax
call fcn.004d4670
movzx ecx, byte [esi + 0x41]
push ecx
mov dword [ebp - 0x1c], eax
call fcn.004d4670
movzx ecx, byte [esi + 0x40]
mov ebx, eax
push ecx
call fcn.004d4670
movzx ecx, byte [esi + 0x3f]
mov edi, eax
push ecx
call fcn.004d4670
mov esi, eax
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x3e]
push ecx
call fcn.004d4670
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push ebx
push edi
push esi
push eax
push str.___________adware:__s__dialer:__s__joke:__s__riskware:__s__hacktool:__s__exploitable_software:__s
push dword [ebp - 0x24]
call fcn.004e35c0
call fcn.004c9e00
mov ebx, dword [ebp - 0x14]
push dword [ebx + 0x30]
push str.__Cure_limit:__lu
push eax
call fcn.004e35c0
add esp, 0x44
call fcn.004c9e00
push dword [ebx + 0x10]
push dword [ebx + 0xc]
push str.__Maximum:_scan_time:__lu_ms__packing_level:__lu
push eax
call fcn.004e35c0
call fcn.004c9e00
push dword [ebx + 0x20]
push dword [ebx + 0x18]
push dword [ebx + 0x14]
push str.___________archive:_level:__lu__size:__lu_KB__extract:__lu
push eax
call fcn.004e35c0
call fcn.004c9e00
push dword [ebx + 0x24]
push dword [ebx + 0x1c]
push str.___________compression_ratio:__lu__ratio_check_threshold:__d
push eax
call fcn.004e35c0
call fcn.004c9e00
mov ecx, dword [0x633480]
mov ebx, dword [0x63346c]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x633484]
shrd ecx, eax, 0xa
shr eax, 0xa
mov dword [ebp - 0x24], eax
mov eax, dword [0x633468]
shrd eax, ebx, 0xa
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x24]
mov eax, dword [0x633460]
push dword [ebp - 0x20]
mov esi, dword [0x633464]
mov edi, dword [0x633458]
mov ecx, dword [0x63345c]
mov edx, dword [0x633450]
shrd eax, esi, 0xa
shr ebx, 0xa
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [0x633454]
shr esi, 0xa
push esi
push dword [ebp - 0x28]
shrd edi, ecx, 0xa
shrd edx, eax, 0xa
shr ecx, 0xa
push ecx
push edi
shr eax, 0xa
push eax
push edx
push str.___________OLEEXPL:__I64uKB__PPT:__I64uKB__VISIO:__I64uKB__RTF:__I64uKB__EMBEDOBJ:__I64uKB
push dword [ebp - 0x2c]
call fcn.004e35c0
add esp, 0x64
call fcn.004c9e00
mov ecx, dword [0x6334a8]
mov ebx, dword [0x633494]
mov esi, dword [0x63348c]
mov edi, dword [0x633470]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x6334ac]
shrd ecx, eax, 0xa
mov edx, dword [0x633478]
shr eax, 0xa
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
mov eax, dword [0x633490]
shrd eax, ebx, 0xa
mov dword [ebp - 0x28], ecx
push dword [ebp - 0x28]
mov ecx, dword [0x633474]
mov dword [ebp - 0x24], eax
mov eax, dword [0x633488]
shrd eax, esi, 0xa
shr ebx, 0xa
push ebx
push dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [0x63347c]
shr esi, 0xa
push esi
push dword [ebp - 0x20]
shrd edi, ecx, 0xa
shrd edx, eax, 0xa
shr ecx, 0xa
push ecx
push edi
shr eax, 0xa
push eax
push edx
push str.___________CHM:__I64uKB__HTML:__I64uKB__HTMLVBA:__I64uKB__MSGVBA:__I64uKB__PDF:__I64uKB
push dword [ebp - 0x1c]
call fcn.004e35c0
call fcn.004c9e00
mov ebx, dword [0x6334bc]
mov esi, dword [0x6334a4]
mov edi, dword [0x633498]
mov ecx, dword [0x63349c]
mov dword [ebp - 0x24], eax
mov eax, dword [0x6334b8]
shrd eax, ebx, 0xa
mov dword [ebp - 0x2c], eax
mov eax, dword [0x6334a0]
shrd eax, esi, 0xa
shr ebx, 0xa
mov dword [ebp - 0x28], eax
shr esi, 0xa
mov edx, dword [0x6334b0]
mov eax, dword [0x6334b4]
push ebx
push dword [ebp - 0x2c]
shrd edi, ecx, 0xa
push esi
push dword [ebp - 0x28]
shr ecx, 0xa
push ecx
shrd edx, eax, 0xa
push edi
shr eax, 0xa
push eax
push edx
push str.___________AUTOIT:__I64uKB__BINARYRES:__I64uKB__DOC1C:__I64uKB__JSHTML:__I64uKB
push dword [ebp - 0x24]
call fcn.004e35c0
add esp, 0x58
call fcn.004c9e00
mov ebx, dword [ebp - 0x14]
mov ecx, str.__backup_is_DISABLED_
mov edi, 0x5eaccc
test dword [ebx + 0x28], 0x400
cmove ecx, edi
push ecx
push dword [ebx + 0x48]
push dword [ebx + 0x44]
push str.__Quarantine:_max_size:__lu____storage_period:__lu_day_s
push eax
call fcn.004e35c0
lea eax, [ebp - 0xd]
push 0
push eax
call fcn.004a4280
mov ecx, dword [ebx + 0x270]
add esp, 0x1c
test ecx, ecx
je 0x4de291
cmp eax, ecx
cmova eax, ecx
mov esi, dword [ebx + 0x26c]
cmp eax, esi
cmovbe esi, eax
mov eax, 0x3e
cmp esi, eax
cmova esi, eax
test ecx, ecx
jne 0x4de2c0
call fcn.004c9e00
push esi
push str.__Engine_usage_limit_is_not_set__using_computer_specific_value__u
push eax
call fcn.004e35c0
add esp, 0xc
jmp 0x4de2f9
cmp esi, ecx
jne 0x4de2df
call fcn.004c9e00
push dword [ebx + 0x270]
push str.__Engine_usage_limit_is_set_to__u
push eax
call fcn.004e35c0
add esp, 0xc
jmp 0x4de2f9
call fcn.004c9e00
push esi
push dword [ebx + 0x270]
push str.__Engine_usage_limit_is_set_to__u_which_is_greater_than__lu_possible
push eax
call fcn.004e35c0
add esp, 0x10
push 0
push 0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004a42e0
mov eax, dword [ebx + 0x278]
add esp, 0x10
test eax, eax
jne 0x4de32c
call fcn.004c9e00
push str.__CPU_cores_usage_limit_is_not_set__using_all_online_cores
push eax
call fcn.004e35c0
add esp, 8
jmp 0x4de368
cmp eax, dword [ebp - 0x18]
ja 0x4de34c
call fcn.004c9e00
push dword [ebx + 0x278]
push str.__CPU_cores_usage_limit_is_set_to__u
push eax
call fcn.004e35c0
add esp, 0xc
jmp 0x4de368
call fcn.004c9e00
push dword [ebp - 0x18]
push dword [ebx + 0x278]
push str.__CPU_cores_usage_limit_is_set_to__u_which_is_greater_than__lu_possible
push eax
call fcn.004e35c0
add esp, 0x10
call fcn.004c9e00
mov cl, byte [ebp - 0xd]
mov esi, str.__single_CPU_system_
test cl, cl
mov dword [ebp - 0x2c], eax
cmove esi, edi
cmp byte [ebx + 0x280], 0
je 0x4de38f
mov edi, str.bound
test cl, cl
je 0x4de394
mov edi, str.not_bound
push dword [ebx + 0x278]
push 0
call fcn.004a4280
mov ecx, eax
add esp, 8
mov eax, dword [ebx + 0x270]
test eax, eax
je 0x4de3b5
cmp ecx, eax
cmova ecx, eax
mov eax, dword [ebx + 0x26c]
cmp ecx, eax
push esi
cmovbe eax, ecx
mov ecx, 0x3e
cmp eax, 0x3e
push edi
cmova eax, ecx
push eax
push str.__Using__u_engines_which_are__s_to_CPU_cores_s
push dword [ebp - 0x2c]
call fcn.004e35c0
add esp, 0x14
cmp dword [ebx + 0x27c], 0
jne 0x4de3fe
call fcn.004c9e00
mov ecx, ebx
mov esi, eax
call fcn.004df600
push eax
push str.__Background_scan_CPU_cores_usage_limit_is_not_set__using__u
push esi
jmp 0x4de443
mov ecx, ebx
call fcn.004df600
cmp dword [ebx + 0x27c], eax
jbe 0x4de432
call fcn.004c9e00
mov ecx, ebx
mov esi, eax
call fcn.004df600
push eax
push dword [ebx + 0x27c]
push str.__Background_scan_CPU_cores_usage_limit_is_set_to__u_which_is_greater_than__lu_possible
push esi
call fcn.004e35c0
add esp, 0x10
jmp 0x4de44b
call fcn.004c9e00
push dword [ebx + 0x27c]
push str.__Background_scan_CPU_cores_usage_limit_is_set_to__u
push eax
call fcn.004e35c0
add esp, 0xc
call fcn.004c9e00
mov esi, eax
call fcn.004a0f60
mov edx, str.enabled
mov ecx, str.DISABLED
cmp byte [eax + 0x12], 0
cmove ecx, edx
push ecx
push str.__Watcher_is__s
push esi
call fcn.004e35c0
call fcn.004c9e00
mov esi, eax
mov eax, 0x10624dd3
imul dword [ebx + 0x274]
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
push str.__Notification_read_timeout_is__d_seconds
push esi
call fcn.004e35c0
call fcn.004c9e00
push 0x5eaccc
push eax
call fcn.004e35c0
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x34]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret