Function at 0x49b644
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
test dl, dl
je 0x49b65e
add esp, 0xfffffff0
call fcn.004034c4
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x49c303
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.00418ce8
lea eax, [esi + 0x50]
mov edx, 0x49c334
call fcn.00403dcc
test byte [esi + 0x20], 0x10
je 0x49b6c6
xor ecx, ecx
mov dl, 1
mov eax, dword [0x4975c0]
call fcn.00497b40
mov ebx, eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x49c344
mov edx, 0x49c358
mov eax, ebx
call fcn.00497b90
mov edx, dword [ebp - 8]
lea eax, [esi + 0x54]
call fcn.00403dcc
mov eax, ebx
call fcn.0040318c
mov byte [esi + 0x58], 1
mov byte [esi + 0x5a], 1
mov dword [esi + 0x5c], 0x79e
mov dword [esi + 0x60], 0x10000
mov dl, 1
mov eax, dword [0x498328]
call fcn.0040315c
mov ebx, eax
mov dword [esi + 0x48], ebx
lea eax, [ebx + 4]
mov edx, 0x49c380
call fcn.00403dcc
lea eax, [ebx + 8]
mov edx, 0x49c398
call fcn.00403dcc
lea eax, [ebx + 0x10]
mov edx, 0x49c3c8
call fcn.00403dcc
lea eax, [ebx + 0x14]
mov edx, 0x49c3dc
call fcn.00403dcc
lea eax, [ebx + 0x18]
mov edx, 0x49c3f8
call fcn.00403dcc
lea eax, [ebx + 0x1c]
mov edx, 0x49c40c
call fcn.00403dcc
lea eax, [ebx + 0x20]
mov edx, 0x49c458
call fcn.00403dcc
lea eax, [ebx + 0x24]
mov edx, 0x49c46c
call fcn.00403dcc
lea eax, [ebx + 0x28]
mov edx, 0x49c480
call fcn.00403dcc
lea eax, [ebx + 0x2c]
mov edx, 0x49c490
call fcn.00403dcc
lea eax, [ebx + 0x30]
mov edx, 0x49c4a4
call fcn.00403dcc
lea eax, [ebx + 0x34]
mov edx, 0x49c4bc
call fcn.00403dcc
lea eax, [ebx + 0x40]
mov edx, 0x49c4d4
call fcn.00403dcc
lea eax, [ebx + 0x44]
mov edx, 0x49c4e4
call fcn.00403dcc
lea eax, [ebx + 0x48]
mov edx, 0x49c4d4
call fcn.00403dcc
lea eax, [ebx + 0x38]
mov edx, 0x49c4f4
call fcn.00403dcc
lea eax, [ebx + 0x3c]
mov edx, 0x49c51c
call fcn.00403dcc
lea eax, [ebx + 0x4c]
mov edx, 0x49c544
call fcn.00403dcc
lea eax, [ebx + 0x50]
mov edx, 0x49c56c
call fcn.00403dcc
lea eax, [ebx + 0x54]
mov edx, 0x49c594
call fcn.00403dcc
lea eax, [ebx + 0x58]
mov edx, 0x49c5c4
call fcn.00403dcc
lea eax, [ebx + 0x5c]
mov edx, 0x49c5d8
call fcn.00403dcc
lea eax, [ebx + 0x60]
mov edx, 0x49c5ec
call fcn.00403dcc
lea eax, [ebx + 0x64]
mov edx, 0x49c604
call fcn.00403dcc
lea eax, [ebx + 0x68]
mov edx, 0x49c628
call fcn.00403dcc
lea eax, [ebx + 0x6c]
mov edx, 0x49c63c
call fcn.00403dcc
lea eax, [ebx + 0x70]
mov edx, 0x49c674
call fcn.00403dcc
lea eax, [ebx + 0x74]
mov edx, 0x49c68c
call fcn.00403dcc
lea eax, [ebx + 0x78]
mov edx, 0x49c6b0
call fcn.00403dcc
lea eax, [ebx + 0x7c]
mov edx, 0x49c6d0
call fcn.00403dcc
lea eax, [ebx + 0x80]
mov edx, 0x49c6e8
call fcn.00403dcc
lea eax, [ebx + 0x84]
mov edx, 0x49c70c
call fcn.00403dcc
lea eax, [ebx + 0x88]
mov edx, 0x49c72c
call fcn.00403dcc
lea eax, [ebx + 0x8c]
mov edx, 0x49c76c
call fcn.00403dcc
lea eax, [ebx + 0x90]
mov edx, 0x49c628
call fcn.00403dcc
lea eax, [ebx + 0x94]
mov edx, 0x49c77c
call fcn.00403dcc
lea eax, [ebx + 0x98]
call fcn.00403d78
lea eax, [ebx + 0x9c]
mov edx, 0x49c78c
call fcn.00403dcc
lea eax, [ebx + 0xa0]
mov edx, 0x49c79c
call fcn.00403dcc
lea eax, [ebx + 0xa4]
mov edx, 0x49c7c8
call fcn.00403dcc
lea eax, [ebx + 0xc]
mov edx, 0x49c804
call fcn.00403dcc
mov dl, 1
mov eax, dword [0x499e28]
call fcn.0040315c
mov ebx, eax
mov dword [esi + 0x4c], ebx
lea eax, [ebx + 4]
mov edx, 0x49c810
call fcn.00403dcc
lea eax, [ebx + 8]
mov edx, 0x49c844
call fcn.00403dcc
lea eax, [ebx + 0xc]
mov edx, 0x49c880
call fcn.00403dcc
lea eax, [ebx + 0x10]
mov edx, 0x49c8a8
call fcn.00403dcc
lea eax, [ebx + 0x14]
mov edx, 0x49c8c8
call fcn.00403dcc
lea eax, [ebx + 0x18]
mov edx, 0x49c8e8
call fcn.00403dcc
lea eax, [ebx + 0x1c]
mov edx, 0x49c914
call fcn.00403dcc
lea eax, [ebx + 0x20]
mov edx, 0x49c93c
call fcn.00403dcc
lea eax, [ebx + 0x24]
mov edx, 0x49c97c
call fcn.00403dcc
lea eax, [ebx + 0x28]
mov edx, 0x49c9c0
call fcn.00403dcc
lea eax, [ebx + 0x2c]
call fcn.00403d78
lea eax, [ebx + 0x30]
mov edx, 0x49c9e8
call fcn.00403dcc
lea eax, [ebx + 0x34]
mov edx, 0x49ca14
call fcn.00403dcc
lea eax, [ebx + 0x38]
mov edx, 0x49ca48
call fcn.00403dcc
lea eax, [ebx + 0x3c]
mov edx, 0x49ca98
call fcn.00403dcc
lea eax, [ebx + 0x40]
mov edx, 0x49cad0
call fcn.00403dcc
lea eax, [ebx + 0x44]
mov edx, 0x49cb08
call fcn.00403dcc
lea eax, [ebx + 0x48]
mov edx, 0x49cb40
call fcn.00403dcc
lea eax, [ebx + 0x4c]
mov edx, 0x49cb7c
call fcn.00403dcc
lea eax, [ebx + 0x50]
mov edx, 0x49cbb8
call fcn.00403dcc
lea eax, [ebx + 0x54]
mov edx, 0x49cbf0
call fcn.00403dcc
lea eax, [ebx + 0x58]
mov edx, 0x49cc24
call fcn.00403dcc
lea eax, [ebx + 0x5c]
mov edx, 0x49cc34
call fcn.00403dcc
lea eax, [ebx + 0x60]
mov edx, 0x49cc54
call fcn.00403dcc
lea eax, [ebx + 0x64]
mov edx, 0x49cc74
call fcn.00403dcc
lea eax, [ebx + 0x68]
mov edx, 0x49cc94
call fcn.00403dcc
lea eax, [ebx + 0x6c]
mov edx, 0x49ccc8
call fcn.00403dcc
lea eax, [ebx + 0x70]
mov edx, 0x49ccec
call fcn.00403dcc
lea eax, [ebx + 0x74]
mov edx, 0x49cd10
call fcn.00403dcc
lea eax, [ebx + 0x78]
mov edx, 0x49cd38
call fcn.00403dcc
lea eax, [ebx + 0x7c]
mov edx, 0x49cd60
call fcn.00403dcc
lea eax, [ebx + 0x80]
mov edx, 0x49cd78
call fcn.00403dcc
lea eax, [ebx + 0x84]
mov edx, 0x49cda4
call fcn.00403dcc
lea eax, [ebx + 0x88]
mov edx, 0x49cdd8
call fcn.00403dcc
mov dl, 1
mov eax, dword [0x498be0]
call fcn.0040315c
mov edi, eax
mov dword [ebx + 0x8c], edi
lea eax, [edi + 4]
mov edx, 0x49cdec
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 8
mov edx, 0x49cdfc
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0xc
mov edx, 0x49ce0c
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x10
mov edx, 0x49ce20
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x14
mov edx, 0x49ce38
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x18
mov edx, 0x49ce48
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x1c
mov edx, 0x49ce5c
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x20
mov edx, 0x49ce6c
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x24
mov edx, 0x49ce7c
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x28
mov edx, 0x49ce8c
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x2c
mov edx, 0x49ce9c
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x30
mov edx, 0x49ceac
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x34
mov edx, 0x49cebc
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x38
mov edx, 0x49cecc
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x3c
mov edx, 0x49cee0
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x40
mov edx, 0x49cef0
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x44
mov edx, 0x49cf04
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x48
mov edx, 0x49cf18
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x58
mov edx, 0x49cf2c
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x5c
mov edx, 0x49cf3c
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x60
mov edx, 0x49cf50
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x64
mov edx, 0x49cf64
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x68
mov edx, 0x49cf78
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x6c
mov edx, 0x49cf8c
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x70
mov edx, 0x49cf9c
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x74
mov edx, 0x49cfac
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x78
mov edx, 0x49cfc4
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x7c
mov edx, 0x49cfd8
call fcn.00403dcc
mov eax, dword [ebx + 0x8c]
add eax, 0x80
mov edx, 0x49cfe8
call fcn.00403dcc
mov dl, 1
mov eax, dword [0x49928c]
call fcn.0040315c
mov edi, eax
mov dword [ebx + 0x90], edi
lea eax, [edi + 4]
mov edx, 0x49ce6c
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 8
mov edx, 0x49cf2c
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0xc
mov edx, 0x49ce8c
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0x10
mov edx, 0x49ce9c
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0x14
mov edx, 0x49ceac
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0x18
mov edx, 0x49cf9c
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0x1c
mov edx, 0x49cfac
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0x20
mov edx, 0x49cff8
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0x24
mov edx, 0x49d008
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0x28
mov edx, 0x49d018
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0x2c
mov edx, 0x49d02c
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0x30
mov edx, 0x49cfd8
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0x34
mov edx, 0x49d040
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0x38
mov edx, 0x49d050
call fcn.00403dcc
mov eax, dword [ebx + 0x90]
add eax, 0x3c
mov edx, 0x49d064
call fcn.00403dcc
lea eax, [ebx + 0x9c]
mov edx, 0x49d080
call fcn.00403dcc
lea eax, [ebx + 0xa0]
mov edx, 0x49d08c
call fcn.00403dcc
mov dl, 1
mov eax, dword [0x499610]
call fcn.0040315c
mov edi, eax
mov dword [ebx + 0x94], edi
lea eax, [edi + 4]
mov edx, 0x49d098
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 8
mov edx, 0x49d0ac
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0xc
mov edx, 0x49d0c0
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x10
mov edx, 0x49d0d0
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x14
mov edx, 0x49d0e0
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x18
mov edx, 0x49d0f4
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x28
mov edx, 0x49d108
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x2c
mov edx, 0x49d118
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x30
mov edx, 0x49d128
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x34
mov edx, 0x49d138
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x38
mov edx, 0x49d150
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x1c
mov edx, 0x49d15c
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x20
mov edx, 0x49d178
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x24
mov edx, 0x49d194
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x3c
mov edx, 0x49d1c0
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x40
mov edx, 0x49d1e8
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x44
mov edx, 0x49d1f8
call fcn.00403dcc
mov eax, dword [ebx + 0x94]
add eax, 0x48
mov edx, 0x49d208
call fcn.00403dcc
mov dl, 1
mov eax, dword [0x499b84]
call fcn.0040315c
mov edi, eax
mov dword [ebx + 0x98], edi
lea eax, [edi + 4]
mov edx, 0x49d218
call fcn.00403dcc
mov eax, dword [ebx + 0x98]
add eax, 8
mov edx, 0x49d224
call fcn.00403dcc
mov eax, dword [ebx + 0x98]
add eax, 0xc
mov edx, 0x49d240
call fcn.00403dcc
mov eax, dword [ebx + 0x98]
add eax, 0x10
mov edx, 0x49d24c
call fcn.00403dcc
mov eax, dword [ebx + 0x98]
add eax, 0x14
mov edx, 0x49d25c
call fcn.00403dcc
mov eax, dword [ebx + 0x98]
add eax, 0x18
mov edx, 0x49d270
call fcn.00403dcc
mov eax, dword [ebx + 0x98]
add eax, 0x1c
mov edx, 0x49d290
call fcn.00403dcc
mov eax, dword [ebx + 0x98]
add eax, 0x20
mov edx, 0x49d2bc
call fcn.00403dcc
mov eax, dword [ebx + 0x98]
add eax, 0x24
mov edx, 0x49d2dc
call fcn.00403dcc
mov eax, dword [ebx + 0x98]
add eax, 0x28
mov edx, 0x49d304
call fcn.00403dcc
mov dl, 1
mov eax, dword [0x49b144]
call fcn.0049d7fc
mov dword [esi + 0x24], eax
mov dl, 1
mov eax, dword [0x49a838]
call fcn.0040315c
mov ebx, eax
mov dword [esi + 0x30], ebx
lea eax, [ebx + 4]
mov edx, 0x49d320
call fcn.00403dcc
lea eax, [ebx + 8]
mov edx, 0x49d334
call fcn.00403dcc
mov dl, 1
mov eax, dword [0x49a638]
call fcn.0040315c
mov ebx, eax
mov dword [esi + 0x28], ebx
lea eax, [ebx + 4]
mov edx, 0x49d350
call fcn.00403dcc
lea eax, [ebx + 8]
mov edx, 0x49d36c
call fcn.00403dcc
lea eax, [ebx + 0xc]
mov edx, 0x49d384
call fcn.00403dcc
lea eax, [ebx + 0x10]
mov edx, 0x49d398
call fcn.00403dcc
lea eax, [ebx + 0x14]
mov edx, 0x49d3a8
call fcn.00403dcc
lea eax, [ebx + 0x18]
mov edx, 0x49d3b4
call fcn.00403dcc
lea eax, [ebx + 0x1c]
mov edx, 0x49d3e4
call fcn.00403dcc
mov dl, 1
mov eax, dword [0x49a940]
call fcn.0040315c
mov ebx, eax
mov dword [esi + 0x2c], ebx
lea eax, [ebx + 4]
mov edx, 0x49c5ec
call fcn.00403dcc
lea eax, [ebx + 8]
mov edx, 0x49d414
call fcn.00403dcc
lea eax, [ebx + 0xc]
mov edx, 0x49d42c
call fcn.00403dcc
lea eax, [ebx + 0x10]
mov edx, 0x49c674
call fcn.00403dcc
lea eax, [ebx + 0x14]
mov edx, 0x49c68c
call fcn.00403dcc
lea eax, [ebx + 0x18]
mov edx, 0x49d444
call fcn.00403dcc
lea eax, [ebx + 0x1c]
mov edx, 0x49c78c
call fcn.00403dcc
lea eax, [ebx + 0x20]
mov edx, 0x49d464
call fcn.00403dcc
lea eax, [ebx + 0x24]
mov edx, 0x49d474
call fcn.00403dcc
lea eax, [ebx + 0x28]
mov edx, 0x49d484
call fcn.00403dcc
lea eax, [ebx + 0x2c]
mov edx, 0x49c604
call fcn.00403dcc
lea eax, [ebx + 0x30]
mov edx, 0x49c6e8
call fcn.00403dcc
lea eax, [ebx + 0x34]
mov edx, 0x49d494
call fcn.00403dcc
lea eax, [ebx + 0x38]
mov edx, 0x49d4cc
call fcn.00403dcc
lea eax, [ebx + 0x3c]
mov edx, 0x49d50c
call fcn.00403dcc
lea eax, [ebx + 0x40]
mov edx, 0x49d544
call fcn.00403dcc
lea eax, [ebx + 0x44]
mov edx, 0x49d560
call fcn.00403dcc
lea eax, [ebx + 0x48]
mov edx, 0x49d58c
call fcn.00403dcc
mov dl, 1
mov eax, dword [0x49809c]
call fcn.0040315c
mov ebx, eax
mov dword [esi + 0x44], ebx
lea eax, [ebx + 4]
mov edx, 0x49d5b4
call fcn.00403dcc
lea eax, [ebx + 8]
mov edx, 0x49d5dc
call fcn.00403dcc
lea eax, [ebx + 0xc]
mov edx, 0x49d604
call fcn.00403dcc
lea eax, [ebx + 0x10]
mov edx, 0x49d620
call fcn.00403dcc
lea eax, [ebx + 0x14]
mov edx, 0x49d640
call fcn.00403dcc
lea eax, [ebx + 0x18]
mov edx, 0x49d684
call fcn.00403dcc
lea eax, [ebx + 0x1c]
mov edx, 0x49d6c8
call fcn.00403dcc
lea eax, [ebx + 0x20]
mov edx, 0x49d6e4
call fcn.00403dcc
lea eax, [ebx + 0x24]
mov edx, 0x49d684
call fcn.00403dcc
mov byte [esi + 0x34], 1
lea eax, [esi + 0x38]
mov edx, 0x49d718
call fcn.00403dcc
lea eax, [esi + 0x3c]
mov edx, 0x49d484
call fcn.00403dcc
mov byte [esi + 0x59], 0
mov al, byte [0x49d71c]
mov byte [esi + 0x35], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c30a
lea eax, [ebp - 8]
call fcn.00403d78
ret