Function at 0x5004cc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x500985
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
jne 0x50050b
mov eax, dword [ebp - 4]
test byte [eax + 0x381], 1
je 0x5007da
mov byte [ebp - 5], 0
test bl, bl
je 0x500521
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00511fe0
test al, al
jne 0x500525
xor eax, eax
jmp 0x500527
mov al, 1
mov ebx, eax
mov byte [ebp - 6], 0
mov eax, dword [ebp - 4]
call fcn.004fbb9c
xor eax, eax
push ebp
push 0x5007d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2d0]
mov edx, dword [eax]
call dword [edx + 0x38]
mov ecx, eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp ecx, eax
setle al
or al, byte [ebp + 0xc]
je 0x500592
test esi, esi
jle 0x50057c
mov eax, dword [ebp - 4]
call fcn.004ffcf0
mov eax, dword [eax + 0x30]
cmp byte [eax + 0xa1], 0
je 0x500592
test esi, esi
jge 0x500592
mov eax, dword [ebp - 4]
call fcn.004ffcf0
mov eax, dword [eax + 0x30]
cmp byte [eax + 0xa0], 0
xor eax, eax
push ebp
push 0x500793
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x50076f
mov eax, dword [ebp - 4]
test byte [eax + 0x381], 0x10
je 0x5006e1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2d0]
cmp byte [eax + 0x15], 0
je 0x5006e1
test bl, bl
je 0x5006d9
mov eax, dword [ebp - 4]
cmp byte [eax + 0x38d], 0
jne 0x500663
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2bc]
call fcn.004b98a8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, 0x394
call fcn.00404314
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2bc]
call fcn.004b97a0
mov edx, dword [ebp - 4]
mov byte [edx + 0x4ae], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0x40a], 0
je 0x500643
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x4ae]
xor dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2bc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
jmp 0x500653
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2bc]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov byte [eax + 0x38d], 1
mov byte [ebp - 5], 1
jmp 0x5006e1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2bc]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.004b98a8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x394]
mov eax, dword [ebp - 0xc]
call fcn.004b9910
mov ecx, eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
push eax
mov eax, esi
pop edx
mov edi, edx
cdq
idiv edi
neg eax
cmp ecx, eax
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
jne 0x5006e1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x40a], 0
je 0x5006cd
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x4ae]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
jmp 0x5006e1
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
jmp 0x5006e1
mov eax, dword [ebp - 4]
call fcn.00500470
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2d0]
call fcn.0048dd9c
push eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
push eax
mov eax, esi
pop edx
mov ecx, edx
cdq
idiv ecx
mov edx, eax
pop eax
call fcn.004929ac
test eax, eax
jne 0x50071b
call fcn.00403d8c
call fcn.00403d8c
jmp 0x50096a
cmp byte [ebp - 5], 0
je 0x500759
mov eax, dword [ebp - 4]
cmp byte [eax + 0x40a], 0
je 0x500749
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x4ae]
xor dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2bc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
jmp 0x500759
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2bc]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp byte [ebp + 0xc], 0
jne 0x500767
test esi, esi
jle 0x500766
dec esi
jmp 0x500767
inc esi
test esi, esi
jne 0x5005a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50079a
cmp byte [ebp - 6], 0
je 0x500792
mov eax, dword [ebp - 4]
call fcn.004ffcf0
mov eax, dword [eax + 0x30]
call fcn.00491da8
ret
test bl, bl
je 0x5007ec
mov dl, 2
mov eax, dword [ebp - 4]
call fcn.00511fe0
test al, al
jne 0x5007f0
xor eax, eax
jmp 0x5007f2
mov al, 1
mov ebx, eax
test bl, bl
jne 0x500812
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2d0]
call fcn.0048dd9c
mov edx, esi
call fcn.004929ac
jmp 0x500953
mov eax, dword [ebp - 4]
call fcn.004fbb9c
xor edx, edx
push ebp
push 0x50094c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x390]
cmp byte [eax + 0x10], 2
je 0x500885
mov eax, dword [eax + 0xc]
call fcn.00514188
push 1
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2d0]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x11c]
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.0051168c
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004fbb34
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x390]
mov eax, dword [eax + 0xc]
pop ecx
call fcn.005146c4
cmp byte [ebp + 0xc], 0
je 0x5008b8
dec esi
jne 0x5008a3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2d0]
call fcn.0048dd9c
call fcn.00492910
jmp 0x5008cd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2d0]
call fcn.0048dd9c
call fcn.00492838
jmp 0x5008cd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2d0]
call fcn.0048dd9c
mov edx, esi
call fcn.004929ac
push 1
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2d0]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x11c]
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.0051168c
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004fbb34
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x390]
mov eax, dword [eax + 0xc]
pop ecx
call fcn.005146c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x500953
mov eax, dword [ebp - 4]
call fcn.004ffce0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3c8], 0
jne 0x50094b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3fd], 0
je 0x50094b
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x150]
ret
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3c8], 0
jne 0x50096a
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x88]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50098c
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004042e4
ret