Function at 0x4a7ff4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4a7ffd
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040403c
xor eax, eax
push ebp
push 0x4a8c55
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x1ad], 0
mov byte [ebp - 0x21], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x20a], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x256], 0
je 0x4a8074
mov eax, dword [0x585ebc]
mov eax, dword [eax]
push eax
mov ebx, dword [ebp - 4]
mov cl, 0xb
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x258]
call dword [ebx + 0x254]
lea eax, [ebp - 0x2c]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040408c
mov eax, dword [ebp - 0x2c]
mov edx, 0x4a8c6c
call fcn.00403f98
jne 0x4a8283
lea eax, [ebp - 8]
mov ecx, 1
mov edx, 1
call fcn.004040cc
push 0
lea eax, [ebp - 0x20]
push eax
xor ecx, ecx
mov edx, 0x4a8c78
mov eax, dword [ebp - 8]
call fcn.004537ac
push 0
lea eax, [ebp - 0x2c]
push eax
xor ecx, ecx
mov edx, 0x4a8c84
mov eax, dword [ebp - 0x20]
call fcn.004537ac
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x20]
call fcn.00403ca4
xor eax, eax
push ebp
push 0x4a813a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov edx, 0x4a8c90
call fcn.00403ed4
mov ecx, dword [ebp - 0x2c]
mov dl, 2
mov eax, dword [ebp - 4]
call fcn.0057c374
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov edx, 0x4a8c90
call fcn.00403ed4
mov edx, dword [ebp - 0x2c]
mov cl, 1
mov eax, dword [ebp - 4]
call fcn.004a728c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8141
ret
xor ecx, ecx
push ebp
push 0x4a8c20
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x576fc4]
call fcn.00577378
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x190], ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
mov dword [ebx + 0xc0], eax
mov eax, dword [ebp - 4]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x2c], 0x4ab7c8
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x94]
mov dword [ebx + 0x94], edx
mov edx, dword [eax + 0x98]
mov dword [ebx + 0x98], edx
mov eax, dword [ebp - 4]
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x34], 0x4ab614
mov eax, ebx
mov dl, 1
call fcn.0057794c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
add eax, 0x1d8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1d8]
call fcn.00403c60
mov eax, dword [ebp - 4]
cmp word [eax + 0x11a], 0
je 0x4a834e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x118]
mov dword [eax + 0x118], ecx
mov ecx, dword [edx + 0x11c]
mov dword [eax + 0x11c], ecx
mov edx, dword [ebp - 4]
cmp byte [edx + 0x158], 1
je 0x4a837b
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x158]
cmp al, 2
je 0x4a836b
cmp al, 3
jne 0x4a8377
mov eax, dword [ebp - 4]
test byte [eax + 0x2b8], 1
jne 0x4a837b
xor edx, edx
jmp 0x4a837d
mov dl, 1
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x190]
mov byte [esi + 0x150], dl
test dl, dl
je 0x4a839f
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x158]
mov byte [esi + 0x158], al
mov eax, dword [ebp - 4]
cmp word [eax + 0x24e], 0
je 0x4a83cc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
mov cl, byte [eax + 0xc4]
mov edx, eax
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x250]
call dword [ebx + 0x24c]
mov eax, dword [ebp - 4]
mov byte [eax + 0x209], 1
mov eax, dword [ebp - 4]
call fcn.00579870
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
jne 0x4a83f4
call fcn.00403720
jmp 0x4a8c2a
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004a7b44
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
jne 0x4a842e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ae], 0
jne 0x4a842e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
je 0x4a842e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 0
jne 0x4a8466
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
je 0x4a8446
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
je 0x4a8452
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 2
jmp 0x4a845c
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
call fcn.00403720
jmp 0x4a8c2a
cmp byte [ebp - 9], 0
jne 0x4a848d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
mov al, byte [eax + 0xdc]
add al, 0xf6
sub al, 2
jb 0x4a848d
sub al, 1
je 0x4a848d
sub al, 3
jne 0x4a853e
mov byte [ebp - 9], 1
mov edx, 0x4a8cb0
mov eax, dword [ebp - 4]
call fcn.004aa85c
test al, al
je 0x4a84b1
xor ecx, ecx
mov edx, 0x4a8cc0
mov eax, dword [ebp - 4]
call fcn.004a728c
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004aae90
test al, al
je 0x4a84e1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
je 0x4a84e1
mov eax, dword [ebp - 0x18]
mov edx, dword [0x585ebc]
mov edx, dword [edx]
call fcn.00403f98
jne 0x4a84e5
mov byte [ebp - 9], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
jne 0x4a853e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ae], 0
jne 0x4a853e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
je 0x4a853e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 0
je 0x4a853e
mov eax, dword [ebp - 4]
cmp word [eax + 0x256], 0
je 0x4a853e
mov eax, dword [0x585ebc]
mov eax, dword [eax]
push eax
mov ebx, dword [ebp - 4]
mov cl, 0xb
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x258]
call dword [ebx + 0x254]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
jne 0x4a856e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ae], 0
jne 0x4a856e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
je 0x4a856e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 0
jne 0x4a85a6
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
je 0x4a8586
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
je 0x4a8592
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 2
jmp 0x4a859c
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
call fcn.00403720
jmp 0x4a8c2a
cmp byte [ebp - 9], 0
je 0x4a85da
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004a7dd0
test al, al
jne 0x4a86e1
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
call fcn.00403720
jmp 0x4a8c2a
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x2d4]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x2d0]
mov eax, dword [ebp - 4]
call fcn.004ada3c
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x190]
mov dword [ebx + 0xf4], eax
mov eax, ebx
mov dl, 1
call fcn.0057aa60
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
jne 0x4a8630
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ae], 0
jne 0x4a8630
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
jne 0x4a8668
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
je 0x4a8648
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
je 0x4a8654
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 2
jmp 0x4a865e
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
call fcn.00403720
jmp 0x4a8c2a
mov eax, dword [ebp - 4]
call fcn.004ab1bc
test al, al
jne 0x4a8688
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
call fcn.00403720
jmp 0x4a8c2a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
jne 0x4a86e1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ae], 0
jne 0x4a86e1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
je 0x4a86e1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 0
je 0x4a86e1
mov eax, dword [ebp - 4]
cmp word [eax + 0x256], 0
je 0x4a86e1
mov eax, dword [0x585ebc]
mov eax, dword [eax]
push eax
mov ebx, dword [ebp - 4]
mov cl, 0xb
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x258]
call dword [ebx + 0x254]
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x17c]
cmp ax, 0x12c
jle 0x4a8750
cmp ax, 0x258
jge 0x4a8750
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
jne 0x4a8750
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
jne 0x4a871b
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 2
jmp 0x4a8725
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x266], 0
jne 0x4a8746
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4a4b2c]
call fcn.0040bb58
call fcn.00403680
call fcn.00403720
jmp 0x4a8c2a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 0
jne 0x4a8770
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
call fcn.00403720
jmp 0x4a8c2a
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 9]
mov byte [eax + 0x2c1], dl
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0x170], edx
mov dword [eax + 0x16c], 0x4a7bc0
lea edx, [ebp - 0x2c]
mov eax, 0x4a4ab4
call fcn.00405c64
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 8]
call fcn.00403e90
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004a728c
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
jne 0x4a8810
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ae], 0
jne 0x4a8810
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
je 0x4a8810
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 0
je 0x4a8810
mov eax, dword [ebp - 4]
cmp word [eax + 0x256], 0
je 0x4a8810
mov eax, dword [0x585ebc]
mov eax, dword [eax]
push eax
mov ebx, dword [ebp - 4]
mov cl, 0xb
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x258]
call dword [ebx + 0x254]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 0
jne 0x4a8830
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
call fcn.00403720
jmp 0x4a8c2a
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x17c]
cmp ax, 0x12c
jle 0x4a892a
cmp ax, 0x258
jge 0x4a892a
cmp ax, 0x1aa
je 0x4a892a
cmp ax, 0x1a9
je 0x4a892a
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
je 0x4a892a
mov eax, dword [ebp - 8]
mov edx, dword [0x585ebc]
mov edx, dword [edx]
call fcn.00403f98
je 0x4a88f5
lea edx, [ebp - 0x2c]
mov eax, 0x4a4ab4
call fcn.00405c64
mov edx, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004a728c
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x17c]
cmp ax, 0x12c
jle 0x4a88b4
cmp ax, 0x258
jl 0x4a88c0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
jne 0x4a892a
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x266], 0
jne 0x4a88eb
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4a4b2c]
call fcn.0040bb58
call fcn.00403680
call fcn.00403720
jmp 0x4a8c2a
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x266], 0
jne 0x4a8920
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4a4b2c]
call fcn.0040bb58
call fcn.00403680
call fcn.00403720
jmp 0x4a8c2a
mov eax, dword [ebp - 4]
cmp word [eax + 0x17c], 0x12c
jle 0x4a8985
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
je 0x4a8985
mov eax, dword [ebp - 4]
cmp byte [eax + 0x168], 0
jne 0x4a8985
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 2
mov eax, dword [ebp - 4]
cmp word [eax + 0x266], 0
jne 0x4a897b
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4a4b2c]
call fcn.0040bb58
call fcn.00403680
call fcn.00403720
jmp 0x4a8c2a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 0
jne 0x4a89a5
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
call fcn.00403720
jmp 0x4a8c2a
mov eax, dword [ebp - 4]
test byte [eax + 0x2b8], 1
jne 0x4a8a2b
mov eax, dword [ebp - 4]
cmp word [eax + 0x17c], 0x12c
jge 0x4a8a2b
mov eax, dword [ebp - 4]
cmp word [eax + 0x17c], 0x258
jge 0x4a8a2b
cmp byte [ebp - 9], 0
jne 0x4a8a2b
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004ac060
jmp 0x4a8a2b
lea ecx, [ebp - 0x2c]
mov eax, ebx
xor edx, edx
call fcn.00579bac
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.004ab668
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0057c8b4
mov eax, dword [ebp - 4]
cmp word [eax + 0x6e], 0
je 0x4a8a16
lea edx, [ebp - 0x21]
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x70]
call dword [ebx + 0x6c]
cmp byte [ebp - 0x21], 0
je 0x4a8a2b
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
jmp 0x4a8ab5
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x190]
test ebx, ebx
je 0x4a8ab5
mov eax, dword [ebp - 4]
cmp byte [eax + 0x200], 0
je 0x4a8ab5
cmp byte [ebx + 0x200], 0
je 0x4a8ab5
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ae], 0
jne 0x4a8ab5
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
jne 0x4a8ab5
cmp byte [ebx + 0x1ae], 0
je 0x4a89df
jmp 0x4a8ab5
lea ecx, [ebp - 0x20]
mov eax, ebx
xor edx, edx
call fcn.00579bac
mov eax, dword [ebp - 0x20]
mov edx, dword [0x585ebc]
mov edx, dword [edx]
call fcn.00403f98
je 0x4a8ae3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
jne 0x4a8ae3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ae], 0
jne 0x4a8ae3
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.004ab668
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x190]
test ebx, ebx
je 0x4a8ae3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ae], 0
jne 0x4a8ae3
cmp byte [ebx + 0x1ae], 0
jne 0x4a8ae3
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
je 0x4a8a74
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ad], 0
jne 0x4a8b16
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1ae], 0
jne 0x4a8b16
mov eax, dword [ebp - 4]
cmp word [eax + 0x17c], 0xc7
jge 0x4a8b16
mov edx, 0xa
mov eax, dword [ebp - 4]
call fcn.004adae0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8c2a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 0
je 0x4a8bbd
mov eax, dword [ebp - 4]
cmp word [eax + 0x17c], 0xc8
jge 0x4a8b52
push 1
mov cl, 1
mov edx, 0x4a8cd4
mov eax, dword [ebp - 4]
call fcn.004aa930
mov eax, dword [ebp - 4]
cmp word [eax + 0x286], 0
je 0x4a8b71
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x288]
call dword [ebx + 0x284]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 0
je 0x4a8bbd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
cmp byte [eax + 0x1ad], 0
jne 0x4a8b98
cmp byte [eax + 0x1ae], 0
je 0x4a8ba2
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x190]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x190], edx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x168], 0
jne 0x4a8c1f
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x1ad]
test al, al
jne 0x4a8be2
mov edx, dword [ebp - 4]
cmp byte [edx + 0x20a], 0
jne 0x4a8bfe
test al, al
je 0x4a8bf2
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 2
jmp 0x4a8c1f
mov eax, dword [ebp - 4]
mov byte [eax + 0x168], 1
jmp 0x4a8c1f
mov eax, dword [ebp - 4]
cmp word [eax + 0x25e], 0
je 0x4a8c1f
mov ebx, dword [ebp - 4]
mov cl, 0xb
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x260]
call dword [ebx + 0x25c]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a8c5c
lea eax, [ebp - 0x2c]
call fcn.00403c0c
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00403c30
lea eax, [ebp - 8]
call fcn.00403c0c
ret