Function at 0x48ab6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx - 0xc]
xor eax, eax
push ebp
push 0x48b040
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0048ab38
xor eax, eax
mov dword [0x4f0244], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
add ecx, dword [ebx + 0x10]
add ecx, 4
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0041c564
lea edx, [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebp - 0xfc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, 0xe0
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp + 8]
mov esi, dword [eax - 8]
add esi, dword [ebx + 0x10]
add esi, 4
add esi, 0x14
movzx eax, word [ebp - 0xc]
add esi, eax
movzx eax, word [ebp - 0xb6]
mov dword [ebx + 0x44], eax
xor eax, eax
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx], eax
mov eax, dword [ebp - 0xec]
sub eax, dword [ebp - 0xe8]
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x20], eax
xor eax, eax
mov dword [ebx + 0x24], eax
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x50], eax
xor eax, eax
mov dword [ebx + 0x54], eax
xor eax, eax
mov dword [ebx + 0x58], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x68], eax
xor eax, eax
mov dword [ebx + 0x6c], eax
lea eax, [ebx + 0x60]
call fcn.004054ec
movzx eax, word [ebp - 0x1c]
sub ax, 0x14c
je 0x48ac7c
sub ax, 0xb4
je 0x48ac99
sub ax, 0x8464
je 0x48ac82
jmp 0x48ac9f
mov byte [ebx + 0x40], 1
jmp 0x48aca3
cmp word [ebp - 0xfc], 0x20b
jne 0x48ac93
mov byte [ebx + 0x40], 3
jmp 0x48aca3
mov byte [ebx + 0x40], 2
jmp 0x48aca3
mov byte [ebx + 0x40], 4
jmp 0x48aca3
mov byte [ebx + 0x40], 0
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebx + 0x28]
push eax
movzx edx, word [ebp - 0x1a]
mov ecx, dword [ebp - 0xec]
mov eax, esi
call fcn.0048a724
pop ecx
cmp dword [ebx + 0x28], 0
jl 0x48ad17
lea ecx, [ebp - 4]
lea eax, [ebp - 0x124]
mov dx, 8
call fcn.00489b14
mov eax, dword [ebp - 0x11c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp - 4]
mov edx, 0x48b058
call fcn.00405914
jne 0x48acff
mov eax, dword [ebp - 0x110]
mov dword [ebx + 0x24], eax
jmp 0x48ad17
mov eax, dword [ebp - 4]
mov edx, 0x48b068
call fcn.00405914
jne 0x48ad17
mov eax, dword [ebp - 0x110]
mov dword [ebx + 0x20], eax
movzx eax, word [ebp - 0x1a]
dec eax
test eax, eax
jl 0x48aff1
inc eax
mov dword [ebp - 8], eax
mov eax, esi
cdq
push edx
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0041c564
lea edx, [ebp - 0x14c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, 0x28
mov edi, dword [eax]
call dword [edi + 0xc]
lea ecx, [ebp - 4]
lea eax, [ebp - 0x14c]
mov dx, 8
call fcn.00489b14
test byte [ebp - 0x128], 0x20
je 0x48ad8a
cmp dword [ebx + 8], 0
jne 0x48ae0f
mov eax, dword [ebp - 0x144]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x138]
mov dword [ebx + 4], eax
jmp 0x48ae0f
mov eax, dword [ebp - 4]
mov edx, 0x48b078
call fcn.00405914
jne 0x48ada8
cmp dword [ebx], 0
jne 0x48ae0f
mov eax, dword [ebp - 0x144]
mov dword [ebx], eax
jmp 0x48ae0f
mov eax, dword [ebp - 4]
mov edx, 0x48b088
call fcn.00405914
jne 0x48adcb
mov eax, dword [ebp - 0x138]
mov dword [ebx + 0x48], eax
mov eax, dword [ebp - 0x144]
mov dword [ebx + 0x4c], eax
jmp 0x48ae0f
mov eax, dword [ebp - 4]
mov edx, 0x48b098
call fcn.00405914
jne 0x48adee
mov eax, dword [ebp - 0x138]
mov dword [ebx + 0x50], eax
mov eax, dword [ebp - 0x144]
mov dword [ebx + 0x54], eax
jmp 0x48ae0f
mov eax, dword [ebp - 4]
mov edx, 0x48b0a8
call fcn.00405914
jne 0x48ae0f
mov eax, dword [ebp - 0x138]
mov dword [ebx + 0x58], eax
mov eax, dword [ebp - 0x144]
mov dword [ebx + 0x5c], eax
lea eax, [ebp - 0x150]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004059e4
mov eax, dword [ebp - 0x150]
mov edx, 0x48b0bc
call fcn.00405914
jne 0x48afe5
mov eax, dword [ebp - 4]
mov edx, 0x48b0c8
call fcn.00405914
je 0x48afd1
mov eax, dword [ebp - 4]
mov edx, 0x48b0d8
call fcn.00405914
jne 0x48aef6
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, dword [ebp - 0x138]
push eax
mov edx, dword [ebp - 0x13c]
push edx
push 0
mov edx, dword [ebx + 0x2c]
push edx
lea edx, [ebx + 0x60]
push edx
mov edx, dword [ebp + 8]
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x140]
call fcn.0048a160
pop ecx
test eax, eax
jle 0x48afd1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
add edx, eax
mov dword [ebx + 0x38], edx
test eax, 0x1ff
je 0x48aec1
and eax, 0xfffffe00
add eax, 0x200
mov edx, eax
sub edx, dword [ebp - 0x138]
cmp edx, dword [ebp - 0x13c]
jge 0x48afd1
mov edx, dword [ebp + 8]
mov edx, dword [edx - 8]
add edx, eax
mov dword [ebx + 0x30], edx
sub eax, dword [ebp - 0x138]
mov edx, dword [ebp - 0x13c]
sub edx, eax
mov dword [ebx + 0x34], edx
jmp 0x48afd1
cmp dword [ebp - 0x138], 0
je 0x48afd1
cmp dword [ebp - 0x128], 0x80
je 0x48afd1
mov edx, dword [0x489bbc]
mov eax, 0x24
call fcn.004065bc
mov edx, dword [0x4f0244]
mov dword [eax], edx
mov dword [0x4f0244], eax
mov eax, dword [0x4f0244]
mov edx, dword [ebp - 0x140]
mov dword [eax + 4], edx
mov eax, dword [0x4f0244]
add eax, 0x14
mov edx, dword [ebp - 4]
call fcn.00405540
mov eax, dword [ebp - 0x140]
add eax, dword [ebp - 0xe0]
mov edx, dword [0x4f0244]
mov dword [edx + 8], eax
mov eax, dword [0x4f0244]
mov edx, dword [ebp - 0x13c]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, dword [ebp - 0x138]
mov edx, dword [0x4f0244]
mov dword [edx + 0xc], eax
mov eax, dword [0x4f0244]
add eax, 0x18
call fcn.004054ec
mov eax, dword [ebp - 4]
mov edx, 0x48b0e8
call fcn.00405914
jne 0x48afae
mov eax, dword [0x4f0244]
xor edx, edx
mov dword [eax + 0x20], edx
jmp 0x48afd1
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
add eax, dword [ebp - 0x138]
mov edx, dword [0x4f0244]
mov dword [edx + 0x1c], eax
mov eax, dword [0x4f0244]
mov edx, dword [ebp - 0x13c]
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 0x138]
add eax, dword [ebp - 0x13c]
cmp eax, dword [ebx + 0x10]
jle 0x48afe5
mov dword [ebx + 0x10], eax
add esi, 0x28
dec dword [ebp - 8]
jne 0x48ad28
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x48b00b
mov ecx, dword [ebx + 0x2c]
mov edx, eax
mov eax, dword [ebp - 0x94]
call fcn.0048a988
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x48b01b
mov dword [ebx + 0x68], eax
mov eax, dword [ebp - 0x28]
mov dword [ebx + 0x6c], eax
mov byte [ebx + 0x18], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48b047
lea eax, [ebp - 0x150]
call fcn.004054ec
lea eax, [ebp - 4]
call fcn.004054ec
ret