Function at 0x549048
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
add eax, 0xc
cmp edx, eax
je 0x549072
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x30], eax
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x34], eax
jmp 0x549080
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [0x90f9a0]
mov ebx, dword [eax + 0xc]
lea edi, [eax + 0xc]
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], ebx
je 0x5490d4
test edx, edx
je 0x5490cb
mov edi, dword [ebx + 0x30]
xor esi, esi
add edi, 2
movzx eax, word [edi - 2]
test ax, ax
je 0x5490c7
mov dword [esp], eax
mov dword [ebp - 0x38], edx
call fcn.00549018
mov edx, dword [ebp - 0x38]
movzx eax, ax
add esi, eax
jmp 0x5490a6
cmp edx, esi
jne 0x5490d0
mov ebx, dword [ebx + 0x18]
jmp 0x5490d6
mov ebx, dword [ebx]
jmp 0x549098
xor ebx, ebx
mov eax, dword [0x90f980]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], eax
test ebx, ebx
je 0x549142
mov eax, dword [ebx + 0x3c]
mov esi, dword [ebx + eax + 0x78]
add esi, ebx
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x18]
add ecx, ebx
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x2c], eax
je 0x54913b
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov edi, dword [ecx + eax*4]
add edi, ebx
mov cl, byte [edi]
cmp cl, byte [edx]
jne 0x5492dd
inc edi
inc edx
test cl, cl
jne 0x549112
add eax, eax
add eax, ebx
add eax, dword [esi + 0x24]
movzx eax, word [eax]
lea eax, [ebx + eax*4]
add eax, dword [esi + 0x1c]
mov edi, dword [eax]
add edi, ebx
mov dword [ebp - 0x2c], edi
jmp 0x549142
mov dword [ebp - 0x2c], 0
mov esi, dword [0x90f984]
cmp dword [esi], 0
je 0x54917e
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call fcn.00549004
cmp byte [esi], al
je 0x549165
cmp byte [esi + 1], al
jne 0x549251
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call fcn.0054902e
cmp dword [esi + 4], eax
je 0x54917e
cmp dword [esi + 8], eax
jne 0x549251
mov esi, dword [0x90f9b4]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
sub esp, 0xc
xor eax, eax
mov edx, dword [0x90f9b0]
cmp edx, eax
jbe 0x5491c6
mov edx, dword [str.VirtualProtect]
mov edx, dword [edx + eax]
mov dword [esi + eax], edx
mov edx, dword [0x90f98c]
add eax, edx
jmp 0x5491a6
test ebx, ebx
je 0x549251
mov eax, dword [ebx + 0x3c]
mov edi, dword [ebx + eax + 0x78]
add edi, ebx
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x18]
add ecx, ebx
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x38], eax
je 0x549251
mov edx, dword [ebp - 0x3c]
mov ecx, dword [edx + eax*4]
mov edx, esi
add ecx, ebx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov cl, byte [ecx]
cmp cl, byte [edx]
jne 0x5492d7
inc dword [ebp - 0x30]
inc edx
test cl, cl
jne 0x5491f9
jmp 0x549266
mov edx, dword [0x90f990]
mov eax, dword [0x90f9b8]
mov dword [esi + eax*4], edx
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x90f9ac]
mov dword [esp], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call ebx
mov eax, dword [0x90f998]
mov edx, dword [0x90f998]
sub esp, 0x10
add eax, dword [esi + 0xc]
add eax, esi
add esi, edx
mov dword [esp], esi
call eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], 1
call eax
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, eax
add eax, ebx
add eax, dword [edi + 0x24]
movzx eax, word [eax]
lea eax, [ebx + eax*4]
add eax, dword [edi + 0x1c]
add ebx, dword [eax]
je 0x549251
mov esi, dword [0x90f97c]
lea edi, [ebp - 0x1c]
mov edx, dword [0x90f9b0]
mov dword [esp + 0xc], edi
mov eax, dword [0x90f9ac]
mov dword [esp], esi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call ebx
mov edx, dword [0x90f9c4]
add edx, dword [ebp - 0x34]
sub esp, 0x10
mov eax, dword [edx + 4]
mov dword [ebp - 0x30], eax
mov eax, dword [0x90f994]
mov ecx, dword [0x90f9ac]
cmp ecx, eax
jbe 0x549210
mov ecx, dword [ebp - 0x30]
add ecx, dword [edx + eax]
mov dword [esi + eax], ecx
mov ecx, dword [0x90f98c]
add eax, ecx
jmp 0x5492b6
inc eax
jmp 0x5491e7
inc eax
jmp 0x549102