Function at 0x490620
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5df4a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
mov eax, dword [0x5f5614]
push ebx
push esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x3c], eax
xor ebx, ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x64], ebx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x64], 3
call fcn.00473c60
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x64], 4
mov dword [esp + 0x14], 1
mov ecx, dword [esi]
lea edx, [esi + 4]
mov dword [esp + 0x18], ecx
mov eax, dword [edx]
mov dword [esp + 0x1c], eax
mov ecx, dword [edx + 4]
mov dword [esp + 0x20], ecx
mov eax, dword [edx + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x18]
mov ecx, dword [edx + 0xc]
mov edx, dword [esi + 0x14]
mov dword [esp + 0x28], ecx
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], edx
mov edx, dword [esi + 0x20]
lea eax, [esi + 0x2c]
mov dword [esp + 0x34], ecx
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x3c], edx
call fcn.0046d230
xor ecx, ecx
mov cl, byte [esi + 0x24]
lea edx, [esi + ecx*2 + 0x2e]
lea ecx, [esp + 0x40]
push edx
call fcn.0046d230
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 0x24]
mov cl, byte [esi + 0x25]
add eax, ecx
lea ecx, [esp + 0x44]
lea edx, [esi + eax*2 + 0x30]
push edx
call fcn.0046d230
xor eax, eax
xor ecx, ecx
mov al, byte [esi + 0x24]
mov cl, byte [esi + 0x25]
xor edx, edx
add eax, ecx
mov dl, byte [esi + 0x26]
lea ecx, [esp + 0x48]
add eax, edx
lea eax, [esi + eax*2 + 0x32]
push eax
call fcn.0046d230
mov al, byte [esi + 0x28]
mov dword [esp + 8], ebx
cmp al, bl
jbe 0x490800
push ebp
push edi
xor edi, edi
mov ecx, dword [0x5f5614]
mov dword [esp + 0x74], ecx
xor ecx, ecx
xor edx, edx
mov cl, byte [esi + 0x27]
mov dl, byte [esi + 0x26]
mov ebp, edx
xor edx, edx
mov dl, byte [esi + 0x25]
lea ebx, [edi + ecx]
xor eax, eax
add ebx, ebp
mov al, byte [esi + 0x24]
add ebx, edx
mov dword [esp + 0x14], eax
add eax, ebx
xor ebx, ebx
add ecx, edi
mov bl, byte [esi + eax*2 + 0x39]
add ecx, ebp
mov ebp, dword [esp + 0x14]
push ebx
xor ebx, ebx
add ecx, edx
mov bl, byte [esi + eax*2 + 0x38]
add ecx, ebp
push ebx
xor ebx, ebx
mov bl, byte [esi + eax*2 + 0x37]
xor edx, edx
mov dl, byte [esi + ecx*2 + 0x36]
push ebx
push edx
xor ecx, ecx
mov cl, byte [esi + eax*2 + 0x35]
xor edx, edx
mov dl, byte [esi + eax*2 + 0x34]
push ecx
push edx
lea eax, [esp + 0x8c]
push str._02x__02x__02x__02x__02x__02x
push eax
mov byte [esp + 0x8c], 5
call fcn.0046ff60
add esp, 0x20
lea ecx, [esp + 0x74]
call fcn.0046e210
mov edx, dword [esp + 0x58]
lea ecx, [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x5c]
call fcn.004743c0
lea ecx, [esp + 0x74]
mov byte [esp + 0x6c], 4
call fcn.0046cf50
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov cl, byte [esi + 0x28]
inc eax
add edi, 3
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x49073b
pop edi
pop ebp
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov esi, dword [edx]
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x18]
mov dword [esi + 8], ecx
mov eax, dword [esp + 0x1c]
lea edx, [esi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [edx + 4], ecx
mov eax, dword [esp + 0x24]
mov dword [edx + 8], eax
mov ecx, dword [esp + 0x28]
mov dword [edx + 0xc], ecx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x1c], edx
mov eax, dword [esp + 0x30]
mov dword [esi + 0x20], eax
mov ecx, dword [esp + 0x34]
mov dword [esi + 0x24], ecx
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x3c]
lea ecx, [esi + 0x2c]
push eax
mov dword [esi + 0x28], edx
call fcn.0046d100
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esi + 0x30]
call fcn.0046d100
lea edx, [esp + 0x44]
lea ecx, [esi + 0x34]
push edx
call fcn.0046d100
lea eax, [esp + 0x48]
lea ecx, [esi + 0x38]
push eax
call fcn.0046d100
lea ecx, [esp + 0x4c]
push ecx
lea ecx, [esi + 0x3c]
call fcn.00474100
lea ecx, [esp + 0x4c]
mov dword [esp + 0x64], 9
call fcn.00473c70
lea ecx, [esp + 0x48]
mov byte [esp + 0x64], 8
call fcn.0046cf50
lea ecx, [esp + 0x44]
mov byte [esp + 0x64], 7
call fcn.0046cf50
lea ecx, [esp + 0x40]
mov byte [esp + 0x64], 6
call fcn.0046cf50
lea ecx, [esp + 0x3c]
mov dword [esp + 0x64], 0xffffffff
call fcn.0046cf50
mov ecx, dword [esp + 0x5c]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x60
ret 4