Function at 0x4facf8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fb1b1
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 8], 0
jne 0x4fad37
mov eax, dword [ebp - 4]
test byte [eax + 0x3c1], 1
je 0x4fb006
mov byte [ebp - 5], 0
test bl, bl
je 0x4fad4d
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0050c044
test al, al
jne 0x4fad51
xor eax, eax
jmp 0x4fad53
mov al, 1
mov ebx, eax
mov byte [ebp - 6], 0
mov eax, dword [ebp - 4]
call fcn.004f6554
xor eax, eax
push ebp
push 0x4fafff
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov edx, dword [eax]
call dword [edx + 0x38]
mov ecx, eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp ecx, eax
setle al
or al, byte [ebp + 0xc]
je 0x4fadbe
test esi, esi
jle 0x4fada8
mov eax, dword [ebp - 4]
call fcn.004fa528
mov eax, dword [eax + 0x30]
cmp byte [eax + 0xa1], 0
je 0x4fadbe
test esi, esi
jge 0x4fadbe
mov eax, dword [ebp - 4]
call fcn.004fa528
mov eax, dword [eax + 0x30]
cmp byte [eax + 0xa0], 0
xor eax, eax
push ebp
push 0x4fafbf
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x4faf9b
mov eax, dword [ebp - 4]
test byte [eax + 0x3c1], 0x10
je 0x4faf0d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
cmp byte [eax + 0x15], 0
je 0x4faf0d
test bl, bl
je 0x4faf05
mov eax, dword [ebp - 4]
cmp byte [eax + 0x3cd], 0
jne 0x4fae8f
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
call fcn.004c9574
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, 0x3d4
call fcn.004043d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
call fcn.004c946c
mov edx, dword [ebp - 4]
mov byte [edx + 0x4f6], al
mov eax, dword [ebp - 4]
cmp byte [eax + 0x44e], 0
je 0x4fae6f
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x4f6]
xor dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
jmp 0x4fae7f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 4]
mov byte [eax + 0x3cd], 1
mov byte [ebp - 5], 1
jmp 0x4faf0d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.004c9574
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3d4]
mov eax, dword [ebp - 0xc]
call fcn.004c95dc
mov ecx, eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
push eax
mov eax, esi
pop edx
mov edi, edx
cdq
idiv edi
neg eax
cmp ecx, eax
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
jne 0x4faf0d
mov eax, dword [ebp - 4]
cmp byte [eax + 0x44e], 0
je 0x4faef9
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x4f6]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
jmp 0x4faf0d
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
jmp 0x4faf0d
mov eax, dword [ebp - 4]
call fcn.004fac9c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
call fcn.0049dcbc
push eax
mov eax, esi
cdq
xor eax, edx
sub eax, edx
push eax
mov eax, esi
pop edx
mov ecx, edx
cdq
idiv ecx
mov edx, eax
pop eax
call fcn.004a2e20
test eax, eax
jne 0x4faf47
call fcn.00403dac
call fcn.00403dac
jmp 0x4fb196
cmp byte [ebp - 5], 0
je 0x4faf85
mov eax, dword [ebp - 4]
cmp byte [eax + 0x44e], 0
je 0x4faf75
mov eax, dword [ebp - 4]
mov dl, byte [eax + 0x4f6]
xor dl, 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
mov ecx, dword [eax]
call dword [ecx + 0xc]
jmp 0x4faf85
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2dc]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0xc]
cmp byte [ebp + 0xc], 0
jne 0x4faf93
test esi, esi
jle 0x4faf92
dec esi
jmp 0x4faf93
inc esi
test esi, esi
jne 0x4fadd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fafc6
cmp byte [ebp - 6], 0
je 0x4fafbe
mov eax, dword [ebp - 4]
call fcn.004fa528
mov eax, dword [eax + 0x30]
call fcn.004a221c
ret
test bl, bl
je 0x4fb018
mov dl, 2
mov eax, dword [ebp - 4]
call fcn.0050c044
test al, al
jne 0x4fb01c
xor eax, eax
jmp 0x4fb01e
mov al, 1
mov ebx, eax
test bl, bl
jne 0x4fb03e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
call fcn.0049dcbc
mov edx, esi
call fcn.004a2e20
jmp 0x4fb17f
mov eax, dword [ebp - 4]
call fcn.004f6554
xor edx, edx
push ebp
push 0x4fb178
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
cmp byte [eax + 0x10], 2
je 0x4fb0b1
mov eax, dword [eax + 0xc]
call fcn.0050e3d4
push 1
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x11c]
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.0050b844
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004f64ec
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
mov eax, dword [eax + 0xc]
pop ecx
call fcn.0050e910
cmp byte [ebp + 0xc], 0
je 0x4fb0e4
dec esi
jne 0x4fb0cf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
call fcn.0049dcbc
call fcn.004a2d84
jmp 0x4fb0f9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
call fcn.0049dcbc
call fcn.004a2cac
jmp 0x4fb0f9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
call fcn.0049dcbc
mov edx, esi
call fcn.004a2e20
push 1
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x11c]
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.0050b844
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004f64ec
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d0]
mov eax, dword [eax + 0xc]
pop ecx
call fcn.0050e910
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb17f
mov eax, dword [ebp - 4]
call fcn.004fa518
mov eax, dword [ebp - 4]
cmp byte [eax + 0x408], 0
jne 0x4fb177
mov eax, dword [ebp - 4]
cmp byte [eax + 0x43d], 0
je 0x4fb177
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x158]
ret
mov eax, dword [ebp - 4]
cmp byte [eax + 0x408], 0
jne 0x4fb196
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x88]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fb1b8
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004043a8
ret