Function at 0x4fec30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x740860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
mov ebp, ecx
mov ecx, dword [ebp + 4]
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
sub eax, 2
push esi
sub ecx, 2
mov dword [esp + 0x40], eax
push edi
mov edx, 1
lea eax, [esp + 0x38]
mov dword [esp + 0x40], ecx
push eax
lea ecx, [esp + 0x5c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
call fcn.00432f00
mov esi, dword [ebp + 4]
mov edx, dword [esi]
mov ecx, esi
mov dword [esp + 0x30], esi
call dword [edx + 0x24]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp + 0x50], 0
mov dword [esp + 0x34], ebx
call dword [eax + 0x24]
mov eax, dword [esp + 0x5c]
cmp eax, dword [esp + 0x64]
mov edi, eax
mov byte [esp + 0x50], 1
mov dword [esp + 0x24], edi
jg 0x4fee1e
lea ecx, [ecx]
mov ecx, dword [ebp + 4]
mov esi, dword [esp + 0x58]
mov edx, dword [ecx]
push edi
push esi
call dword [edx + 0x44]
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x3ea8]
mov ebx, dword [ecx]
cdq
sub eax, edx
sar eax, 1
add eax, edi
push eax
mov eax, dword [ebp + 0x3ea4]
cdq
sub eax, edx
sar eax, 1
add eax, esi
push eax
call dword [ebx + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x60]
cmp esi, eax
jg 0x4fee05
sub eax, esi
add eax, 1
mov dword [esp + 0x20], eax
nop
mov eax, dword [esp + 0x10]
mov al, byte [eax]
test al, al
mov byte [esp + 0x28], al
je 0x4fede9
mov ecx, dword [ebp + 4]
mov ecx, dword [ecx + 0x14]
mov eax, dword [esp + 0x10]
sub eax, ecx
or edi, 0xffffffff
sub eax, 2
mov bl, 0x20
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], eax
jmp 0x4fed44
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
or esi, 0xffffffff
jmp 0x4fed50
mov edx, dword [esp + 0x14]
mov al, byte [edx]
mov ecx, dword [esp + 0x28]
push eax
push ecx
mov ecx, ebp
call fcn.004fb0a0
test al, al
je 0x4fed81
movzx eax, al
lea edx, [edi + eax*2]
lea eax, [eax + edx - 2]
lea ecx, [esi + eax*2]
mov al, byte [eax + ecx + 0x85fe1d]
cmp bl, al
jbe 0x4fed81
mov bl, al
add dword [esp + 0x14], 1
add esi, 1
cmp esi, 1
jle 0x4fed50
mov edx, dword [esp + 0x2c]
add dword [esp + 0x18], edx
add edi, 1
cmp edi, 1
jle 0x4fed40
cmp bl, 0x20
jae 0x4fede9
movzx eax, word [ebp + 0x3e48]
mov edx, dword [esp + 0x1c]
movzx esi, word [edx]
mov ecx, eax
shl ecx, 0x10
or ecx, eax
mov eax, esi
shl eax, 0x10
or eax, esi
and eax, 0x7e0f81f
and ecx, 0x7e0f81f
sub eax, ecx
movzx esi, bl
imul eax, esi
shl ecx, 5
add eax, ecx
shr eax, 5
and eax, 0x7e0f81f
mov ecx, eax
shr ecx, 0x10
or ecx, eax
mov word [edx], cx
add dword [esp + 0x1c], 2
mov eax, 1
add dword [esp + 0x10], eax
sub dword [esp + 0x20], eax
jne 0x4fed10
mov edi, dword [esp + 0x24]
add edi, 1
cmp edi, dword [esp + 0x64]
mov dword [esp + 0x24], edi
jle 0x4fecc0
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov edx, dword [ebx]
mov ecx, ebx
mov byte [esp + 0x50], 0
call dword [edx + 0x28]
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x50], 0xffffffff
call dword [eax + 0x28]
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 0x10