Function at 0x4f0c80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
test byte [0x630720], 1
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
mov dword [esp + 0x24], ebx
jne 0x4f0e09
mov ecx, 0x630720
lock bts dword [ecx], 0x1f
setb al
test al, al
jne 0x4f0cbb
mov al, 1
jmp 0x4f0ccd
test byte [0x630720], 1
jne 0x4f0ccb
xor edx, edx
call sym.SystemInformer.exe_Ordinal_1388
xor al, al
test al, al
je 0x4f0e09
push 0
call sym.SystemInformer.exe_Ordinal_1944
push eax
mov dword [esp + 0x14], eax
call sym.SystemInformer.exe_Ordinal_1089
mov ecx, dword fs:[0x18]
mov dword [esp + 0x30], 0x1c
mov dword [esp + 0x34], str.kernelbase.dll
mov byte [esp + 0xf], 0
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0xa0]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov esi, dword [ebx]
cmp esi, ebx
je 0x4f0d5d
mov dword [esp + 0x18], 0x1c
nop
cmp word [esi + 0x2c], 0x1c
mov eax, dword [esi + 0x30]
mov dword [esp + 0x1c], eax
jb 0x4f0d57
push 1
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x20]
push eax
call sym.SystemInformer.exe_Ordinal_1351
test al, al
jne 0x4f0e78
mov esi, dword [esi]
cmp esi, ebx
jne 0x4f0d30
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x20]
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0xa0]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
or esi, 0xffffffff
cmp byte [esp + 0xf], 0
je 0x4f0db8
push dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cdq
push edx
push eax
push ebx
push dword [esp + 0x20]
call sym.SystemInformer.exe_Ordinal_1949
lea ecx, [ebx - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4f0db8
call fcn.004fe1e0
lea eax, [esp + 0x40]
push eax
push str.GetAppModelPolicy
push dword [esp + 0x18]
call sym.SystemInformer.exe_Ordinal_1948
test al, al
je 0x4f0de4
mov ebx, dword [esp + 0x40]
mov edx, ebx
call fcn.0051e540
test eax, eax
js 0x4f0de4
mov dword [0x635658], ebx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], esi
dec esi
jne 0x4f0df8
call fcn.004fe1e0
mov ecx, 0x630720
nop dword [eax]
call sym.SystemInformer.exe_Ordinal_1358
mov ebx, dword [esp + 0x24]
mov esi, dword [0x635658]
test esi, esi
je 0x4f0ee3
mov eax, dword [0x62db64]
nop dword [eax]
cmp edi, 0x38
jl 0x4f0e2a
cmp eax, 0x72
jb 0x4f0e6a
cmp edi, 0x30
jl 0x4f0e34
cmp eax, 0x6d
jb 0x4f0e6a
cmp edi, 0x2e
jl 0x4f0e3e
cmp eax, 0x6b
jb 0x4f0e6a
nop
cmp edi, 0x2d
jl 0x4f0e4a
cmp eax, 0x6a
jb 0x4f0e6a
cmp edi, 0x2a
jl 0x4f0e54
cmp eax, 0x69
jb 0x4f0e6a
cmp edi, 0x23
jl 0x4f0e5e
cmp eax, 0x68
jb 0x4f0e6a
nop
cmp edi, 0x1f
jl 0x4f0ec9
cmp eax, 0x67
jae 0x4f0ec9
mov eax, 0xc0000003
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
nop dword [eax + eax]
test esi, esi
je 0x4f0d5d
mov eax, dword [esi + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 0x14], eax
movzx eax, word [esi + 0x24]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_Ordinal_1483
mov ebx, eax
test ebx, ebx
je 0x4f0ebf
mov byte [esp + 0xf], 1
jmp 0x4f0d71
mov byte [esp + 0xf], 0
jmp 0x4f0d6d
push dword [ebp + 8]
mov ecx, esi
push edi
push ebx
call dword [0x5a9914]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 0xc000007a
pop ebx
mov esp, ebp
pop ebp
ret 4