Function at 0x4ed2c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x120
mov eax, dword [0x520014]
xor eax, ebp
mov dword [esp + 0x118], eax
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x100], eax
xorpd xmm0, xmm0
movapd xmmword [esp + 0xf0], xmm0
mov dword [esp + 0x10], ecx
mov eax, dword [ecx + 0x54]
test eax, eax
je 0x4ed52e
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
lea esi, [eax + 0x18]
xor edi, edi
test byte [0x522044], 0x19
mov dword [esp + 8], esi
jne 0x4ed3f2
mov eax, dword [esi]
sub eax, dword [esi - 8]
mov ecx, dword [esi + 4]
sbb ecx, dword [esi - 4]
mov edx, eax
add edx, ebx
mov ebx, ecx
mov esi, 0x80000000
adc ebx, esi
cmp edx, 2
sbb ebx, 0
jae 0x4ed396
mov edx, dword [esp + edi*8 + 0xf0]
mov ebx, dword [esp + edi*8 + 0xf4]
mov dword [esp + 0x14], edx
xor esi, esi
inc esi
add edx, esi
mov dword [esp + 0xc], ebx
mov esi, 0x80000000
adc ebx, esi
xor esi, esi
inc esi
cmp esi, edx
mov edx, 0
sbb edx, ebx
jb 0x4ed3c3
mov esi, dword [esp + 0x14]
xor esi, eax
mov edx, dword [esp + 0xc]
xor edx, ecx
or edx, esi
mov esi, dword [esp + 8]
je 0x4ed3c7
jmp 0x4edc24
add eax, dword [esp + edi*8 + 0xf0]
adc ecx, dword [esp + edi*8 + 0xf4]
seto bl
xor edx, edx
test ecx, ecx
setns dl
add edx, 0x7fffffff
test bl, bl
cmove edx, ecx
sar ecx, 0x1f
test bl, bl
cmovne eax, ecx
mov ecx, edx
mov esi, dword [esp + 8]
mov dword [esp + edi*8 + 0xf0], eax
mov dword [esp + edi*8 + 0xf4], ecx
inc edi
add esi, 0x10
cmp edi, 3
mov ebx, 1
jne 0x4ed31c
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
jmp 0x4ed304
mov eax, dword [esi - 8]
mov dword [esp + 0xc], eax
mov eax, dword [esi - 4]
mov dword [esp + 0x14], eax
mov eax, dword [0x523f20]
mov ecx, eax
mov esi, dword [esp + 0x18]
xor ecx, esi
mov dword [esp + 0x40], ecx
mov ecx, dword [0x523f24]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], esi
test edi, edi
je 0x4edb9a
cmp edi, 2
je 0x4edba4
jmp 0x4edbae
mov esi, dword [esp + 8]
mov edx, dword [esp + 0xc]
sub esp, 0x1c
mov cl, byte [esp + 0x50]
mov byte [esp + 0x18], cl
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
lea ecx, [esp + 0x5c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x522044
mov dword [esp], 0x42
call fcn.004d9e50
add esp, 0x1c
test byte [0x522044], 0x19
je 0x4ed32d
mov eax, dword [esi]
mov dword [esp + 0xc], eax
mov ebx, dword [esi + 4]
mov eax, dword [0x523f20]
mov ecx, eax
mov esi, dword [esp + 0x18]
xor ecx, esi
mov dword [esp + 0x40], ecx
mov ecx, dword [0x523f24]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x58], esi
mov esi, dword [esp + 8]
sub esp, 0x1c
mov al, byte [esp + 0x50]
mov byte [esp + 0x18], al
mov dword [esp + 0x14], ebx
xor ebx, ebx
inc ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x5139d8
mov dword [esp + 4], 0x522044
mov dword [esp], 0x45
call fcn.004d9e50
add esp, 0x1c
jmp 0x4ed32d
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x80], 0
je 0x4ed62a
xor esi, esi
mov ecx, dword [esp + esi*8 + 0xf0]
mov edi, dword [esp + esi*8 + 0xf4]
mov eax, ecx
or eax, edi
jne 0x4ed560
inc esi
cmp esi, 3
jne 0x4ed541
jmp 0x4ed62a
mov dword [esp + 8], ecx
xor eax, eax
dec eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x80]
lea ecx, [esp + 0x40]
call fcn.004ee0e0
lea ecx, [esp + 0x34]
lea edx, [esp + 0x40]
cmp esi, 2
je 0x4ed5aa
cmp esi, 1
jne 0x4ed5bc
call fcn.004ee160
lea ecx, [esp + 0x34]
mov edx, str..Mutator.Scan
push 0xd
jmp 0x4ed5cc
call fcn.004ee160
lea ecx, [esp + 0x34]
mov edx, str..Mutator
push 8
jmp 0x4ed5cc
call fcn.004ee160
lea ecx, [esp + 0x34]
mov edx, str..Mutator.Clear
push 0xe
call fcn.004ee530
add esp, 4
movsd xmm0, qword [esp + 0x34]
movsd qword [esp + 0x28], xmm0
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
cmp byte [esp + 0x4b], 0
mov ecx, dword [esp + 8]
js 0x4edbde
cmp byte [esp + 0x33], 0
lea eax, [esp + 0x28]
jns 0x4ed606
mov eax, dword [esp + 0x28]
push edi
push ecx
push eax
call fcn.00450a20
add esp, 0xc
cmp byte [esp + 0x33], 0
jns 0x4ed555
mov ecx, dword [esp + 0x28]
call fcn.004ee660
jmp 0x4ed555
xorpd xmm0, xmm0
movapd xmmword [esp + 0x50], xmm0
movapd xmmword [esp + 0x40], xmm0
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x6c]
test eax, eax
je 0x4ed885
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
lea edx, [eax + 0x18]
xor esi, esi
test byte [0x522044], 0x19
mov dword [esp + 8], edx
jne 0x4ed71d
mov eax, dword [edx]
sub eax, dword [edx - 8]
mov ecx, dword [edx + 4]
sbb ecx, dword [edx - 4]
mov edx, eax
add edx, ebx
mov ebx, ecx
mov edi, 0x80000000
adc ebx, edi
cmp edx, 2
sbb ebx, 0
jae 0x4ed6cd
mov edx, dword [esp + esi*8 + 0x40]
mov ebx, dword [esp + esi*8 + 0x44]
mov dword [esp + 0xc], edx
xor edi, edi
inc edi
add edx, edi
mov dword [esp + 0x14], ebx
mov edi, 0x80000000
adc ebx, edi
xor edi, edi
inc edi
cmp edi, edx
mov edx, 0
sbb edx, ebx
jb 0x4ed6f4
mov edx, dword [esp + 0xc]
xor edx, eax
mov edi, dword [esp + 0x14]
xor edi, ecx
or edi, edx
mov edx, dword [esp + 8]
je 0x4ed6f8
jmp 0x4edc27
add eax, dword [esp + esi*8 + 0x40]
adc ecx, dword [esp + esi*8 + 0x44]
seto bl
xor edx, edx
test ecx, ecx
setns dl
add edx, 0x7fffffff
test bl, bl
cmove edx, ecx
sar ecx, 0x1f
test bl, bl
cmovne eax, ecx
mov ecx, edx
mov edx, dword [esp + 8]
mov dword [esp + esi*8 + 0x40], eax
mov dword [esp + esi*8 + 0x44], ecx
inc esi
add edx, 0x10
cmp esi, 4
mov ebx, 1
jne 0x4ed659
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
jmp 0x4ed641
mov eax, dword [edx - 8]
mov dword [esp + 0xc], eax
mov eax, dword [edx - 4]
mov dword [esp + 0x14], eax
mov eax, dword [0x523f20]
mov ecx, eax
mov edi, dword [esp + 0x18]
xor ecx, edi
mov dword [esp + 0xf0], ecx
mov ecx, dword [0x523f24]
mov dword [esp + 0xf4], ecx
mov dword [esp + 0xfc], ecx
mov dword [esp + 0xf8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
mov dword [esp + 0x104], ecx
mov dword [esp + 0x100], eax
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x108], edi
mov eax, str.PCScan.Scanner.Clear
jmp dword [esi*4 + 0x51400c]
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x80], 0
je 0x4ed9b4
xor esi, esi
lea ecx, [esp + 0xf0]
mov ebx, dword [esp + esi*8 + 0x40]
mov edi, dword [esp + esi*8 + 0x44]
mov eax, ebx
or eax, edi
jne 0x4ed8b8
inc esi
cmp esi, 4
jne 0x4ed89f
jmp 0x4ed9b4
xor eax, eax
dec eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x10]
mov edx, dword [eax + 0x80]
call fcn.004ee0e0
jmp dword [esi*4 + 0x51401c]
mov eax, dword [esp + 0x10]
mov ebx, dword [eax + 0x78]
mov edi, dword [eax + 0x7c]
mov eax, dword [eax + 0x90]
mov esi, dword [eax + 0xc]
push 0x3c
push str..._.._base_allocator_partition_allocator_starscan_pcscan.cc
call fcn.0046e450
add esp, 8
cmp eax, 2
jl 0x4eda94
lea ecx, [esp + 0x40]
push 0xfffffffffffffffe
push 0xd0
push str..._.._base_allocator_partition_allocator_starscan_pcscan.cc
call fcn.00441e40
lea eax, [esp + 0x48]
mov ecx, 0x11
push ecx
push str.quarantine_size:
push eax
call fcn.00466fc0
add esp, 0xc
mov ecx, eax
push esi
call fcn.00410ba0
push 4
push 0x513fe4
push eax
call fcn.00466fc0
add esp, 0xc
mov ecx, eax
push ebx
call fcn.00410ba0
push 0xf
push str.__swept_bytes:
push eax
call fcn.00466fc0
add esp, 0xc
mov ecx, eax
push edi
call fcn.00410ba0
mov ecx, 0x11
push ecx
push str.__survival_rate:
push eax
call fcn.00466fc0
add esp, 0xc
movq xmm0, qword [0x501c70]
movd xmm1, ebx
por xmm1, xmm0
subsd xmm1, xmm0
movd xmm2, esi
por xmm2, xmm0
subsd xmm2, xmm0
divsd xmm1, xmm2
sub esp, 8
movsd qword [esp], xmm1
mov ecx, eax
call fcn.00410fa0
lea ecx, [esp + 0x40]
call fcn.00442220
call fcn.0045a5b0
mov edx, dword [0x527060]
xor eax, eax
mov ecx, 0
test edx, 0x3fffffff
je 0x4edaca
shl edx, 2
xor esi, esi
xor ecx, ecx
mov edi, dword [esi + 0x527040]
mov edi, dword [edi + 0x1134]
add ecx, edi
add esi, 4
cmp edx, esi
jne 0x4edab5
mov edx, dword [0x527084]
test edx, 0x3fffffff
je 0x4edaf4
shl edx, 2
xor esi, esi
xor eax, eax
mov edi, dword [esi + 0x527064]
mov edi, dword [edi + 0x1134]
add eax, edi
add esi, 4
cmp edx, esi
jne 0x4edadf
mov edi, dword [esp + 0x10]
mov edx, dword [edi + 0x90]
mov esi, dword [edi + 0x78]
lock add dword [edx], esi
add eax, ecx
mov ecx, dword [edx + 4]
mov ecx, dword [edi + 0x90]
movd xmm0, eax
por xmm0, xmmword [0x505660]
subsd xmm0, qword [0x501c70]
mulsd xmm0, qword [0x5139d0]
movsd qword [esp + 0x20], xmm0
fld qword [esp + 0x20]
fisttp qword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov edx, 0x100000
cmp eax, edx
cmova edx, eax
mov dword [ecx + 4], edx
call fcn.0045a5b0
mov edi, dword [0x52703c]
mov dword [0x52703c], 0
test edi, edi
je 0x4edb6c
lock dec dword [edi]
je 0x4edc0f
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x90]
xor ecx, ecx
xchg byte [eax + 0x10], cl
cmp cl, 3
jne 0x4edc2a
mov ecx, dword [esp + 0x118]
xor ecx, ebp
call fcn.0048a678
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, str.PCScan.Mutator.Clear
jmp 0x4ed451
mov eax, str.PCScan.Mutator
jmp 0x4ed451
mov esi, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov eax, str.PCScan.Mutator.Scan
jmp 0x4ed459
mov ecx, dword [esp + 0x40]
call fcn.004ee660
mov ecx, dword [esp + 8]
jmp 0x4ed5f7
mov ecx, edi
call fcn.004f0040
push edi
call fcn.004f00c0
add esp, 4
jmp 0x4edb6c
int3
int3
int3