Function at 0x4b9fe0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x54e198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [0x5ab980]
push ebx
push ebp
push esi
mov esi, dword [0x5b8cb4]
mov ebp, ecx
mov dword [esp + 0x3c], eax
xor ebx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x68], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x1c], eax
lea eax, [esi + 0xec]
lea ecx, [esp + 0x34]
push eax
mov byte [esp + 0x6c], 3
call fcn.00512659
add esi, 0xf4
lea ecx, [esp + 0x30]
push esi
mov byte [esp + 0x6c], 4
call fcn.00512659
mov eax, dword [0x5ab980]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push 0xa
lea ecx, [esp + 0x48]
mov byte [esp + 0x6c], 8
call fcn.00510deb
push str.CommonStartMenuEx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x6c], 9
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.00512952
mov eax, dword [0x5b8cb0]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
lea ecx, [eax + 0x10]
mov byte [esp + 0x70], 0xa
call fcn.00495ca0
lea ecx, [esp + 0x18]
mov byte [esp + 0x68], 9
call fcn.005128e4
mov ecx, dword [ebp + 0x34]
cmp dword [ecx - 8], ebx
je 0x4ba0c8
mov edx, dword [ebp + 0x690]
cmp dword [edx - 8], ebx
je 0x4ba0c8
mov eax, 1
jmp 0x4ba0ca
xor eax, eax
cmp word [ebp + 0xcc4], bx
jne 0x4ba1c3
cmp eax, ebx
je 0x4ba11c
mov eax, dword [0x5ab980]
mov dword [esp + 0x74], eax
add ebp, 0x690
lea ecx, [esp + 0x74]
push ebp
mov byte [esp + 0x6c], 0xb
call fcn.00512a1d
mov ecx, dword [esp + 0x74]
push ebx
push 0x5a2ef8
push ecx
mov ecx, 0x5b8c78
call fcn.00498ca0
lea ecx, [esp + 0x74]
mov byte [esp + 0x68], 9
call fcn.005128e4
lea ecx, [esp + 0x44]
mov byte [esp + 0x68], 8
call fcn.00510e5f
lea ecx, [esp + 0x10]
mov byte [esp + 0x68], 7
call fcn.005128e4
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 6
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x68], 5
call fcn.005128e4
lea ecx, [esp + 0x30]
mov byte [esp + 0x68], 4
call fcn.005128e4
lea ecx, [esp + 0x34]
mov byte [esp + 0x68], 3
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x68], 2
call fcn.005128e4
lea ecx, [esp + 0x38]
mov byte [esp + 0x68], 1
call fcn.005128e4
lea ecx, [esp + 0x20]
mov byte [esp + 0x68], bl
call fcn.005128e4
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.005128e4
pop esi
pop ebp
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 8
mov eax, dword [0x5b8cb4]
mov edx, dword [0x5b8cb0]
add eax, 0x10
add edx, 0x10
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x44]
neg eax
sbb eax, eax
mov dword [esp + 0x24], edx
cmp eax, ebx
mov dword [esp + 0x2c], eax
je 0x4ba719
push edi
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x34]
push edx
push eax
lea ecx, [ebp + 0x38]
call fcn.00511df1
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 8], ebx
je 0x4ba70e
mov edx, dword [esp + 0x18]
cmp dword [edx - 8], ebx
je 0x4ba70e
push str._dos
lea ecx, [esp + 0x18]
call fcn.0050e341
test eax, eax
jg 0x4ba70e
push 0x25
lea ecx, [esp + 0x1c]
call fcn.00512dab
test eax, eax
jge 0x4ba70e
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push ecx
lea ecx, [ebp + 0x694]
call fcn.00511d05
test eax, eax
je 0x4ba70e
mov edx, dword [esp + 0x10]
cmp dword [edx - 8], ebx
je 0x4ba70e
lea eax, [esp + 0x18]
xor edi, edi
push eax
call fcn.0041f9c0
lea ecx, [esp + 0x14]
push ecx
call fcn.0041f9c0
add esp, 8
lea edx, [esp + 0x28]
lea eax, [esp + 0x18]
mov ecx, ebp
push edx
push eax
call fcn.004b9e00
test eax, eax
je 0x4ba70e
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebp
call fcn.004b9e00
test eax, eax
je 0x4ba70e
cmp dword [esp + 0x78], ebx
je 0x4ba3ae
mov eax, dword [esp + 0x14]
mov esi, str.personal
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4ba2f6
cmp cl, bl
je 0x4ba2f2
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4ba2f6
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4ba2d2
xor eax, eax
jmp 0x4ba2fb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4ba70e
push str.Files.MyDocs.CU
mov ecx, 0x5bc868
call fcn.00469c40
test eax, eax
je 0x4ba70e
mov eax, dword [0x5ab980]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x10]
push ebx
push 0x5a5980
push ecx
mov ecx, 0x5b8c78
mov byte [esp + 0x78], 0xc
call fcn.00498ca0
lea edx, [ebp + 0x690]
push str.My_Documents_
lea eax, [esp + 0x48]
push edx
push eax
call fcn.00512b79
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x70], 0xd
call fcn.00512a1d
lea ecx, [esp + 0x44]
mov byte [esp + 0x6c], 0xc
call fcn.005128e4
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call fcn.004f9670
add esp, 8
cmp eax, ebx
je 0x4ba39b
mov eax, dword [esp + 0x1c]
push ebx
push 0x5a5980
push eax
mov ecx, 0x5b8c78
call fcn.00498ca0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x6c], 9
call fcn.005128e4
jmp 0x4ba70e
test byte [0x5bc5c0], 0x80
jne 0x4ba3f6
mov ecx, dword [esp + 0x14]
push str.sendto
push ecx
call fcn.00422ad0
add esp, 8
test eax, eax
jne 0x4ba3e3
mov edx, dword [esp + 0x14]
push str.startup
push edx
call fcn.00422ad0
add esp, 8
test eax, eax
je 0x4ba3f6
lea eax, [esp + 0x10]
lea ecx, [esp + 0x48]
push eax
call fcn.00510fd7
jmp 0x4ba70e
mov ecx, dword [esp + 0x14]
push str.cache
push ecx
call fcn.00422ad0
add esp, 8
test eax, eax
je 0x4ba432
push str.Settings.Browser.IE.Cache
mov ecx, 0x5bc868
call fcn.00469c40
test eax, eax
jne 0x4ba432
lea edx, [esp + 0x10]
lea ecx, [esp + 0x48]
push edx
call fcn.00510fd7
jmp 0x4ba70e
mov eax, dword [esp + 0x14]
push str.history
push eax
call fcn.00422ad0
add esp, 8
test eax, eax
je 0x4ba46e
push str.Settings.Browser.IE.History
mov ecx, 0x5bc868
call fcn.00469c40
test eax, eax
jne 0x4ba46e
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x4c]
call fcn.00510fd7
jmp 0x4ba70e
mov edx, dword [esp + 0x14]
push str.cookies
push edx
call fcn.00422ad0
add esp, 8
test eax, eax
je 0x4ba4aa
push str.Settings.Browser.IE.Cookies
mov ecx, 0x5bc868
call fcn.00469c40
test eax, eax
jne 0x4ba4aa
lea eax, [esp + 0x10]
lea ecx, [esp + 0x48]
push eax
call fcn.00510fd7
jmp 0x4ba70e
mov ecx, dword [esp + 0x14]
push str.desktop
push ecx
call fcn.004f9670
add esp, 8
cmp eax, ebx
jne 0x4ba500
push str.Settings.Desktop.Files
mov ecx, 0x5bc868
call fcn.00469c40
test eax, eax
jne 0x4ba4e6
lea edx, [esp + 0x10]
lea ecx, [esp + 0x48]
push edx
call fcn.00510fd7
jmp 0x4ba70e
mov eax, dword [esp + 0x10]
push ebx
push 0x5a5b4c
push eax
mov ecx, 0x5b8c78
call fcn.00498ca0
mov edi, 1
mov ecx, dword [esp + 0x14]
push str.start_menu
push ecx
call fcn.004f9670
add esp, 8
cmp eax, ebx
jne 0x4ba570
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.004f9670
add esp, 8
cmp eax, ebx
je 0x4ba70e
push str.Settings.Desktop.StartMenu
mov ecx, 0x5bc868
call fcn.00469c40
test eax, eax
jne 0x4ba556
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x4c]
call fcn.00510fd7
jmp 0x4ba70e
mov edx, dword [esp + 0x10]
push ebx
push 0x5a5b4c
push edx
mov ecx, 0x5b8c78
call fcn.00498ca0
mov edi, 1
test byte [0x5bc5c0], 0x80
jne 0x4ba5ab
mov eax, dword [0x5b8cb4]
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + 0xec]
push eax
push ecx
call fcn.00422ad0
add esp, 8
test eax, eax
je 0x4ba5ab
mov edx, dword [esp + 0x10]
push ebx
push 0x5a5980
push edx
mov ecx, 0x5bc6c0
call fcn.00496850
mov eax, dword [esp + 0x14]
mov esi, str.favorites
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4ba5d8
cmp cl, bl
je 0x4ba5d4
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4ba5d8
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4ba5b4
xor eax, eax
jmp 0x4ba5dd
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4ba621
push str.Settings.Browser.IE.Favorites
mov ecx, 0x5bc868
call fcn.00469c40
test eax, eax
jne 0x4ba607
lea eax, [esp + 0x10]
lea ecx, [esp + 0x48]
push eax
call fcn.00510fd7
jmp 0x4ba70e
mov ecx, dword [esp + 0x10]
push ebx
push 0x5a5980
push ecx
mov ecx, 0x5b8c78
call fcn.00498ca0
mov edi, 1
mov eax, dword [esp + 0x14]
mov esi, str.quick_launch
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4ba64e
cmp cl, bl
je 0x4ba64a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4ba64e
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4ba62a
xor eax, eax
jmp 0x4ba653
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4ba697
push str.Settings.Desktop.QuickLaunch
mov ecx, 0x5bc868
call fcn.00469c40
test eax, eax
jne 0x4ba67d
lea eax, [esp + 0x10]
lea ecx, [esp + 0x48]
push eax
call fcn.00510fd7
jmp 0x4ba70e
mov ecx, dword [esp + 0x10]
push ebx
push 0x5a5b4c
push ecx
mov ecx, 0x5b8c78
call fcn.00498ca0
mov edi, 1
mov eax, dword [esp + 0x14]
mov esi, str.fonts
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4ba6c4
cmp cl, bl
je 0x4ba6c0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4ba6c4
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4ba6a0
xor eax, eax
jmp 0x4ba6c9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4ba6e7
mov eax, dword [esp + 0x10]
push ebx
push 0x5a5b4c
push eax
mov ecx, 0x5b8c78
call fcn.00498ca0
mov edi, 1
mov eax, dword [0x5bc5c0]
test al, 0x80
jne 0x4ba6f5
test ah, 2
je 0x4ba70e
cmp edi, ebx
jne 0x4ba70e
mov ecx, dword [esp + 0x10]
push ebx
push 0x5a5980
push ecx
mov ecx, 0x5b8c78
call fcn.00498ca0
cmp dword [esp + 0x30], ebx
jne 0x4ba1f0
pop edi
mov esi, dword [esp + 0x48]
cmp esi, ebx
je 0x4ba74b
mov eax, esi
mov esi, dword [esi]
add eax, 8
lea ecx, [esp + 0xc]
push eax
call fcn.00512a1d
mov edx, dword [esp + 0xc]
push ebx
push 0x5a2ef8
push edx
mov ecx, 0x5b8c78
call fcn.00498ca0
cmp esi, ebx
jne 0x4ba721
cmp dword [esp + 0x74], ebx
jne 0x4ba7aa
lea ecx, [ebp + 0x54]
call fcn.0048bb30
cmp word [ebp + 0xcc0], bx
je 0x4ba7aa
add ebp, 0x690
push str.HKPRO.RD0
lea eax, [esp + 0x78]
push ebp
push eax
call fcn.00512b79
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x6c], 0xe
call fcn.00512a1d
lea ecx, [esp + 0x74]
mov byte [esp + 0x68], 9
call fcn.005128e4
mov ecx, dword [esp + 0x20]
push ebx
push 0x5a5b18
push ecx
mov ecx, 0x5b8c78
call fcn.00498ca0
lea ecx, [esp + 0x44]
mov byte [esp + 0x68], 8
call fcn.00510e5f
lea ecx, [esp + 0x10]
mov byte [esp + 0x68], 7
call fcn.005128e4
lea ecx, [esp + 0xc]
mov byte [esp + 0x68], 6
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x68], 5
call fcn.005128e4
lea ecx, [esp + 0x30]
mov byte [esp + 0x68], 4
call fcn.005128e4
lea ecx, [esp + 0x34]
mov byte [esp + 0x68], 3
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x68], 2
call fcn.005128e4
lea ecx, [esp + 0x38]
mov byte [esp + 0x68], 1
call fcn.005128e4
lea ecx, [esp + 0x20]
mov byte [esp + 0x68], bl
call fcn.005128e4
lea ecx, [esp + 0x3c]
mov dword [esp + 0x68], 0xffffffff
call fcn.005128e4
mov ecx, dword [esp + 0x60]
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x60
ret 8