Function at 0x4bb650
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4bb95d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4bb974
call fcn.004043ec
push 0
mov ecx, 0x4bb984
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494b3c
mov edx, dword [ebx + 0x11c]
mov dword [edx + 4], eax
push 0
mov ecx, 0x4bb998
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494b3c
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0xc], eax
push 0
mov ecx, 0x4bb9ac
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494b3c
mov edx, dword [ebx + 0x11c]
mov dword [edx + 8], eax
push 0
mov ecx, 0x4bb9c0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494b3c
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x10], eax
push 0
mov ecx, 0x4bb9d8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494b3c
mov esi, dword [ebx + 0x11c]
mov dword [esi + 0x18], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4bb9e8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494a0c
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 0x14]
mov eax, ebx
call fcn.004ba190
push 0
mov ecx, 0x4bb9f8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494b3c
mov esi, dword [ebx + 0x11c]
mov dword [esi + 0x1c], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4bba08
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494a0c
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi + 0x44]
mov eax, ebx
call fcn.004ba190
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4bba1c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494a0c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x11c]
mov edx, dword [eax + 0x48]
mov eax, ebx
call fcn.004ba190
push 0xffffffffffffffff
mov ecx, 0x4bba30
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494b3c
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x2c], eax
push 0xffffffffffffffff
mov ecx, 0x4bba48
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494b3c
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x30], eax
push 0xffffffffffffffff
mov ecx, 0x4bba60
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494b3c
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x34], eax
push 0
mov ecx, 0x4bba78
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494b3c
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x4c], eax
push 0
mov ecx, 0x4bba94
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494b3c
mov esi, dword [ebx + 0x11c]
mov dword [esi + 0x50], eax
cmp dword [esi + 0x1c], 1
jle 0x4bb81f
xor eax, eax
mov dword [esi + 0x1c], eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4bbab0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494a0c
cmp dword [ebp - 8], 0
je 0x4bb847
mov eax, dword [ebx + 0x11c]
mov byte [eax + 0x54], 1
jmp 0x4bb851
mov eax, dword [ebx + 0x11c]
mov byte [eax + 0x54], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4bbac8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494a0c
cmp dword [ebp - 8], 0
je 0x4bb879
mov eax, dword [ebx + 0x11c]
mov byte [eax + 0x55], 1
jmp 0x4bb883
mov eax, dword [ebx + 0x11c]
mov byte [eax + 0x55], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4bbae4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494a0c
cmp dword [ebp - 8], 0
je 0x4bb8ab
mov eax, dword [ebx + 0x11c]
mov byte [eax + 0x56], 1
jmp 0x4bb8b5
mov eax, dword [ebx + 0x11c]
mov byte [eax + 0x56], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4bbab0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494a0c
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebx + 0xb8]
mov eax, ebx
call fcn.004bca80
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x38], eax
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4bbac8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494a0c
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0xb8]
mov eax, ebx
call fcn.004bca80
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x3c], eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x4bbae4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.00494a0c
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebx + 0xb8]
mov eax, ebx
call fcn.004bca80
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bb964
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00404378
ret