Function at 0x46f417
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x100745b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x144
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x168]
mov esi, ecx
mov eax, edi
push 0xff
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x10]
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x58]
push eax
push ecx
mov dword [esp + 0x2c], edx
call dword [0x10075698]
mov eax, dword [edi + 4]
mov edx, dword [edi]
mov ecx, dword [edi + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x24], edx
mov edx, dword [edi + 0xc]
push eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
call fcn.0043e377
add esp, 4
mov dword [esi + 0x188], eax
test eax, eax
jne 0x46f4b1
mov ecx, dword [0x100a1ba8]
mov eax, dword [esp + 0x24]
sub eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x60]
mov edi, dword [esi + 0x18c]
test eax, eax
je 0x46f4c6
add edi, 0x11c0
jmp 0x46f4cc
add edi, 0x1208
lea edx, [esp + 0x54]
lea ecx, [esp + 0x10]
push edx
call fcn.00478ab3
mov eax, dword [esi + 0x18c]
push 0
push 0
push edi
mov edi, dword [esp + 0x170]
add eax, 0x1180
lea ecx, [esp + 0x30]
push eax
mov eax, dword [edi + 4]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [0x10091710]
push edx
push eax
mov dword [esp + 0x178], 0
call fcn.0040fc17
lea ecx, [esp + 0x10]
mov dword [esp + 0x15c], 0xffffffff
call fcn.00478aa1
mov eax, dword [esi + 0x130]
test eax, eax
je 0x46f68a
mov eax, dword [esi + 0x18c]
mov ecx, dword [eax + 0x1258]
mov ebp, dword [eax + 0x1200]
mov ebx, dword [eax + 0x1204]
test ecx, ecx
je 0x46f68a
mov ecx, dword [eax + 0x1254]
test ecx, ecx
je 0x46f60b
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], eax
lea edx, [esp + 0x14]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x44]
push edx
push eax
mov dword [esp + 0x48], ecx
call dword [0x1007578c]
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x14]
call fcn.00478ab3
mov eax, dword [esi + 0x18c]
lea edx, [esp + 0x34]
push 0
push edx
lea ecx, [eax + 0x11c0]
add eax, 0x1180
push ecx
mov ecx, dword [edi + 4]
push eax
lea edx, [esp + 0x54]
lea eax, [esp + 0x20]
push edx
push eax
push ecx
mov ecx, dword [0x10091710]
mov dword [esp + 0x178], 1
call fcn.0040fc17
lea ecx, [esp + 0x10]
mov dword [esp + 0x15c], 0xffffffff
call fcn.00478aa1
mov edx, dword [esi + 0x18c]
mov edi, dword [esp + 0x34]
sub edi, dword [edx + 0x1250]
sub edi, 0x10
jmp 0x46f616
mov edi, dword [eax + 0x1250]
mov eax, dword [esi + 0x6c]
add edi, eax
mov eax, dword [esi + 0x68]
mov ecx, dword [0x100a1b7c]
sub eax, ecx
sub eax, ebx
sub eax, ebp
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
add ebx, ebp
jns 0x46f632
xor ebx, ebx
mov eax, dword [0x100a1ba8]
lea edx, [esi + 0x120]
add eax, edi
add ecx, ebx
mov dword [edx], edi
mov dword [edx + 4], ebx
mov dword [edx + 8], eax
mov eax, dword [esi + 0x188]
test eax, eax
mov dword [edx + 0xc], ecx
je 0x46f68a
mov ecx, dword [0x100a1b7c]
mov edx, dword [0x100a1ba8]
push 3
push 0
push 0
push ecx
push edx
push eax
mov eax, dword [esp + 0x17c]
push ebx
push edi
mov ecx, dword [eax + 4]
push ecx
call dword [0x10075620]
mov dword [esi + 0x134], edi
mov dword [esi + 0x138], ebx
mov ecx, dword [esp + 0x154]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x150
ret 8