Function at 0x4a9830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5af19e
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x5fa040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 4], 1
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
mov edx, dword [edi + 0x1c]
add edx, dword [eax + ecx*8]
mov al, byte [edi + 0x30]
mov byte [ebp + 0xb], al
test al, al
je 0x4a98a6
mov al, byte [edx]
movzx ecx, al
mov dword [ebp - 0x14], eax
movzx eax, byte [edx + 1]
shl cx, 8
or cx, ax
movzx ecx, cx
jmp 0x4a98af
movzx eax, word [edx]
mov dword [ebp - 0x14], eax
movzx ecx, ax
mov eax, dword [ebp + 0x10]
and ecx, 0xf000
add eax, 0xfffffffd
cmp eax, 0x32
ja case.0x4a98cb.4
movzx eax, byte [eax + 0x4a9a88]
jmp dword [eax*4 + 0x4a9a70]
push dword [ebp + 0xc]
lea eax, [ebp - 0x34]
mov ecx, edi
push eax
call fcn.004a9210
mov esi, eax
mov byte [ebp - 4], 3
push 8
mov dword [ebp - 0x28], 0
call fcn.0058813f
add esp, 4
mov dword [ebp - 0x28], eax
xor ecx, ecx
mov dword [ebp - 0x24], 0
mov edx, esi
mov dword [ebp - 0x20], 3
mov word [eax], cx
lea ecx, [ebp - 0x28]
push 1
mov dword [ebp - 0x18], 1
call fcn.0046e660
add esp, 4
cmp word [ebp - 0x44], 0
je 0x4a993d
lea ecx, [ebp - 0x44]
call fcn.00471a40
mov ecx, dword [ebp - 0x3c]
test eax, eax
cmovs ecx, eax
mov dword [ebp - 0x3c], ecx
push dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
push esi
mov dword [ebp - 0x44], 8
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x4a9a59
push esi
call fcn.00588148
push dword [ebp - 0x34]
call fcn.00588148
add esp, 8
jmp case.0x4a98cb.4
xor eax, eax
mov dword [ebp - 0x44], 0xb
mov edx, 0x4000
cmp cx, dx
setne al
dec eax
mov word [ebp - 0x3c], ax
jmp case.0x4a98cb.4
mov eax, 0x4000
cmp cx, ax
je case.0x4a98cb.4
cmp byte [ebp + 0xb], 0
mov eax, dword [edx + 4]
je 0x4a99c9
bswap eax
shr eax, 8
mov dword [ebp - 0x3c], eax
jmp 0x4a9a14
and eax, 0xffffff
mov dword [ebp - 0x3c], eax
jmp 0x4a9a14
mov eax, 0x4000
cmp cx, ax
je case.0x4a98cb.4
lea eax, [ebp + 8]
mov ecx, edi
push eax
push dword [ebp + 0xc]
call fcn.004a93b0
test al, al
je case.0x4a98cb.4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
jmp 0x4a9a14
cmp byte [ebp + 0xb], 0
je 0x4a9a0e
mov eax, dword [ebp - 0x14]
movzx ecx, al
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
jmp 0x4a9a11
movzx ecx, word [edx]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x44], 0x13
mov esi, dword [ebp + 0x14]
cmp word [esi], 0
je 0x4a9a2f
mov ecx, esi
call fcn.00471a40
test eax, eax
js 0x4a9a3b
movups xmm0, xmmword [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x44], eax
movups xmmword [esi], xmm0
lea ecx, [ebp - 0x44]
call fcn.004719d0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x5f7a14
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], str.out_of_memory
push eax
call fcn.0058acc1
nop
rcr byte [eax - 0x666effb6], cl
dec edx
add byte [ecx + ebx*4 - 0x662cffb6], ch
dec edx
add bh, dh
cdq
dec edx
add byte [ebx], bl
lcall 0x105, 0x500004a
add al, byte [ebx]
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 84215045
add eax, 67437829
int3