Function at 0x4ef2f2
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
lea eax, [ebp - 0x18]
mov esi, ecx
mov ebx, edx
mov dl, byte [ebp + 0x10]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x5049d0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov byte [esi + 0x48], dl
mov ecx, dword [esi]
mov edx, dword [esi + 4]
call fcn.004ef2d3
mov edx, dword [ebp + 8]
mov edi, eax
mov ecx, ebx
push 0xf423f
push 0
push 0
push dword [ebp + 0xc]
call fcn.004e32d0
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, edx
mov edx, dword [edi + 0x44]
mov ebx, ecx
mov ecx, dword [edi + 0x40]
push ebx
mov ebx, esi
push eax
push dword [ebp - 0x20]
push dword [edi + 0x48]
call fcn.004ee011
add esp, 0x10
mov ecx, eax
lea eax, [esi + 0x18]
mov edi, edx
mov dword [ebp - 0x24], eax
movq xmm0, qword [esi + 0x30]
push 0xfffffffffffffffd
pop edx
cmp ecx, edx
mov eax, edx
mov dword [ebp - 0x28], ecx
cmovb eax, ecx
cmp edi, 0xffffffff
cmovne edx, ecx
cmove edx, eax
movd eax, xmm0
pshufd xmm0, xmm0, 0x55
mov dword [ebp - 0x20], edx
movd edx, xmm0
cmp dword [ebp - 0x20], eax
mov ecx, edi
sbb ecx, edx
jb 0x4ef3cf
mov ecx, edi
mov esi, edi
mov edi, ebx
mov ebx, dword [ebp - 0x28]
lock cmpxchg8b qword [edi + 0x30]
mov ebx, edi
mov edi, esi
jne 0x4ef3ad
jmp 0x4ef55e
cmp byte [ebp + 0x10], 0
je 0x4ef55e
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
or dword [ebp - 0x10], 0xffffffff
call fcn.004ef2d3
mov edx, eax
mov eax, dword [ebx + 4]
cmp dword [ebx], 0
mov dword [ebp - 0x34], eax
push 0x70
pop eax
mov ecx, 0xa0
mov dword [ebp - 0x20], edx
cmove ecx, eax
mov dword [ebp - 0x30], ecx
mov ecx, edx
call fcn.004e8cd4
movq xmm0, qword [ebx + 0x30]
movd eax, xmm0
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
and ecx, eax
cmp ecx, 0xffffffff
je 0x4ef441
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], edi
add ecx, 0x18
call fcn.004efac0
mov edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov al, byte [ecx + 0x38]
test al, al
je 0x4ef456
mov ecx, dword [ebp - 0x24]
xor edx, edx
inc edx
jmp 0x4ef53a
movd xmm0, dword [ebp - 0x28]
movd xmm1, edi
mov esi, ecx
punpckldq xmm0, xmm1
movq qword [ebx + 0x30], xmm0
movq qword [ebx + 0x20], xmm0
movq xmm0, qword [ebx + 0x30]
movd edi, xmm0
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
mov eax, edi
and eax, ecx
cmp eax, 0xffffffff
je 0x4ef582
movd xmm0, edi
movd xmm1, ecx
punpckldq xmm0, xmm1
movq qword [ebx + 0x20], xmm0
mov ebx, ecx
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
cmp ecx, edi
mov edx, eax
sbb edx, ebx
jae 0x4ef535
xor ecx, edi
xor eax, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], edi
or ecx, 0x3f
mov edx, eax
cmp ecx, 0xfffffffe
sbb edx, 0xf
push 0xfffffffffffffffe
pop edx
cmovb edx, ecx
push 0xf
pop ecx
cmovb ecx, eax
bsr edx, edx
xor edx, 0x1f
bsr eax, ecx
or dl, 0x20
xor eax, 0x1f
test ecx, ecx
movzx ecx, dl
cmovne ecx, eax
xor cl, 0x3e
movzx eax, cl
mov cl, 6
div cl
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
and dword [ebp - 0x10], 0
movzx eax, al
push 0x581878
push eax
call fcn.004ece70
mov edx, dword [ebp - 0x24]
add esp, 8
mov ecx, eax
call fcn.004ecec4
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
add eax, 0xffffffff
adc ecx, 0xffffffff
xor edi, edi
cmp eax, dword [ebp - 0x28]
sbb ecx, dword [ebp - 0x2c]
jae 0x4ef56f
jmp 0x4ef547
mov ecx, dword [ebp - 0x24]
xor edx, edx
call fcn.004ecf21
or dword [ebp - 0x10], 0xffffffff
mov edi, eax
mov esi, edx
mov ecx, dword [ebp - 0x20]
or dword [ebp - 0x10], 0xffffffff
call fcn.00473415
test edi, edi
je 0x4ef55e
push esi
call dword [edi + 4]
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
lea ecx, [eax + ecx + 0x50]
call fcn.004ed104
xor edi, edi
jmp 0x4ef547
and dword [ebp - 0x10], 0
push 0x13
pop edx
mov ecx, 0x58172c
push 0x581740
call fcn.00526cb0
pop eax
ud2