Function at 0x484d44
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x484f7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x548]
mov eax, dword [eax + 0x38]
mov dword [ebp - 8], eax
call fcn.00483de8
and eax, 0x7f
cmp eax, 8
ja case.default.0x484d80
jmp dword [eax*4 + 0x484d87]
mov edx, 0x484f90
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00440510
jmp case.default.0x484d80
mov edx, 0x484fb0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00440510
jmp case.default.0x484d80
mov edx, 0x484fc4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00440510
jmp case.default.0x484d80
mov edx, 0x484fe0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00440510
jmp case.default.0x484d80
mov edx, 0x484ff4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00440510
jmp case.default.0x484d80
mov edx, 0x485018
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00440510
jmp case.default.0x484d80
mov edx, 0x48502c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00440510
jmp case.default.0x484d80
mov edx, 0x485044
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00440510
jmp case.default.0x484d80
mov edx, 0x48505c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x308]
call fcn.00440510
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x2c]
mov ecx, 3
mov eax, 0x485074
call fcn.0040999c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x374]
call fcn.00440510
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x378]
call fcn.00440510
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
call fcn.00440510
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38c]
call fcn.00440510
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x398]
call fcn.00440510
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x39c]
call fcn.00440510
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b0]
call fcn.00440510
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x38]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b4]
call fcn.00440510
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3b8]
call fcn.00440510
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484f84
lea eax, [ebp - 0xc]
call fcn.004044d4
ret