Function at 0x4ef6c3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x34], eax
mov ebx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [edx]
movzx esi, byte [ecx + 8]
mov edx, esi
test ax, ax
js 0x4ef6f6
inc eax
and eax, 0xf
mov edx, eax
movzx eax, dl
mov word [ebx], ax
cmp dword [ebp - 0x20], 0
je 0x4ef98e
cmp byte [ecx + 2], 0
je 0x4ef87a
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
mov dword [ebp - 0x1c], eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x20], eax
jae 0x4ef762
cmp dword [0x5af048], 0
je 0x4ef98e
mov dword [0x611418], 1
mov dword [0x611414], 2
mov eax, dword [ebp - 0x20]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], str._MPEG_2_TS__Invalid_section_start___ptr_field_d___data_size_d__n
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004268ea
cmp word [ebx + 8], 0
jne 0x4ef7ae
mov ax, word [ebx + 0xa]
test ax, ax
je 0x4ef7ae
mov esi, dword [ebx + 4]
mov edi, dword [ebp - 0x24]
movsx edx, byte [edi + 1]
movsx edi, byte [esi]
dec ax
jne 0x4ef78c
mov eax, dword [ebp - 0x24]
movsx ecx, byte [eax + 2]
jmp 0x4ef794
movsx eax, byte [esi + 1]
mov ecx, edx
mov edx, eax
mov eax, edi
call fcn.004ec855
mov word [ebx + 8], ax
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov dword [ebx + 4], eax
mov edx, dword [ebx + 8]
test dx, dx
je 0x4ef82e
movzx eax, word [ebx + 0xa]
mov word [ebp - 0x2e], ax
mov edi, dword [ebp - 0x1c]
lea esi, [eax + edi]
movzx ecx, dx
cmp esi, ecx
jb 0x4ef82e
sub ecx, eax
mov dword [ebp - 0x28], ecx
add eax, dword [ebx + 4]
mov edi, dword [ebp - 0x24]
lea esi, [edi + 1]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
sub dx, word [ebp - 0x2e]
add word [ebx + 0xa], dx
mov edi, dword [ebp - 0x1c]
cmp dword [ebp - 0x28], edi
jae 0x4ef821
cmp dword [0x5af048], 0
je 0x4ef821
mov dword [0x611418], 1
mov dword [0x611414], 2
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], str._MPEG_2_TS__Invalid_pointer_field___ptr_field_d___remaining_d__n
call fcn.004268ea
mov ecx, dword [ebp - 0x38]
mov edx, ebx
mov eax, dword [ebp - 0x34]
call fcn.004ef183
mov edi, dword [ebp - 0x2c]
add dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
sub eax, esi
dec eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x4ef84f
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor edx, edx
mov dword [ebx + 8], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov dword [ebx + 4], eax
mov edi, eax
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
jmp 0x4ef8ff
mov ecx, dword [ebx + 4]
mov eax, esi
cmp al, dl
je 0x4ef89c
test ecx, ecx
je 0x4ef88f
mov dword [esp], ecx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
jmp 0x4ef98e
test ecx, ecx
je 0x4ef98e
movzx eax, word [ebx + 8]
movzx edx, word [ebx + 0xa]
mov edi, dword [ebp - 0x20]
lea esi, [edx + edi]
test ax, ax
je 0x4ef8c5
mov dword [ebp - 0x1c], edi
cmp eax, esi
jae 0x4ef8ec
sub eax, edx
mov dword [ebp - 0x1c], eax
jmp 0x4ef8ec
mov dword [esp + 4], esi
mov dword [esp], ecx
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov dword [ebx + 4], eax
movzx edx, word [ebx + 0xa]
add eax, edx
mov edi, eax
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jmp 0x4ef8f8
add edx, ecx
mov edi, edx
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x1c]
add dx, word [ebx + 0xa]
mov word [ebx + 0xa], dx
mov eax, dword [ebx + 8]
test ax, ax
jne 0x4ef95b
cmp dx, 2
jbe 0x4ef98e
mov esi, dword [ebx + 4]
movsx ecx, byte [esi + 2]
movsx edx, byte [esi + 1]
movsx eax, byte [esi]
call fcn.004ec855
mov word [ebx + 8], ax
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov dword [ebx + 4], eax
movzx edx, word [ebx + 0xa]
mov eax, dword [ebx + 8]
cmp ax, dx
jae 0x4ef956
movzx ecx, ax
sub edx, ecx
sub dword [ebp - 0x1c], edx
mov word [ebx + 0xa], ax
test ax, ax
jne 0x4ef961
jmp 0x4ef98e
test ax, ax
je 0x4ef98e
cmp word [ebx + 0xa], ax
jb 0x4ef98e
mov ecx, dword [ebp - 0x38]
mov edx, ebx
mov eax, dword [ebp - 0x34]
call fcn.004ef183
mov esi, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], esi
jae 0x4ef98e
mov esi, dword [ebp - 0x1c]
add dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
cmp byte [eax], 0xff
je 0x4ef98e
mov eax, dword [ebp - 0x20]
sub eax, esi
jmp 0x4ef83d
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret