Function at 0x4f9f10
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5f1199
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x667050]
xor eax, esp
mov dword [esp + 0x20], eax
push edi
mov eax, dword [0x667050]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
cmp byte [0x66d120], 0
jne 0x4f9f53
call fcn.004f9370
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push ecx
mov ecx, esi
call fcn.004539c0
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], 0
mov dword [eax], eax
mov eax, dword [esi + 4]
lea ecx, [esp + 0xc]
mov dword [eax + 8], eax
call dword [0x61049c]
push str.program_files
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
call dword [0x610598]
push 0x611348
lea edi, [esp + 0x10]
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x26
call fcn.00503de0
push eax
mov eax, edi
push eax
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.common_program_files
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x2b
call fcn.00503de0
push eax
mov edx, edi
push edx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.system_driver
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x102
call fcn.00503de0
push eax
mov ecx, edi
push ecx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.windows
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x24
call fcn.00503de0
push eax
mov eax, edi
push eax
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.fonts
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x14
call fcn.00503de0
push eax
mov edx, edi
push edx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.cookies
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x21
call fcn.00503de0
push eax
mov ecx, edi
push ecx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.all_users
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x101
call fcn.00503de0
push eax
mov eax, edi
push eax
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.all_appdata
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x23
call fcn.00503de0
push eax
mov edx, edi
push edx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.all_programs_menu
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x17
call fcn.00503de0
push eax
mov ecx, edi
push ecx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.all_docs
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x2e
call fcn.00503de0
push eax
mov eax, edi
push eax
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.all_desktop
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x19
call fcn.00503de0
push eax
mov edx, edi
push edx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.all_menu
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x16
call fcn.00503de0
push eax
mov ecx, edi
push ecx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.all_startup
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x18
call fcn.00503de0
push eax
mov eax, edi
push eax
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.all_favorites
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x1f
call fcn.00503de0
push eax
mov edx, edi
push edx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.my_user
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea eax, [esp + 8]
mov dword [esp + 8], 0x28
push eax
call fcn.00503de0
push eax
mov ecx, edi
push ecx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.my_appdata
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x1a
call fcn.00503de0
push eax
mov eax, edi
push eax
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.my_desktop
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x10
call fcn.00503de0
push eax
mov edx, edi
push edx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.my_favorites
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 6
call fcn.00503de0
push eax
mov ecx, edi
push ecx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.my_doc
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 5
call fcn.00503de0
push eax
mov eax, edi
push eax
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.my_menu
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0xb
call fcn.00503de0
push eax
mov edx, edi
push edx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.my_programs_menu
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 2
call fcn.00503de0
push eax
mov ecx, edi
push ecx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.my_startup
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 7
call fcn.00503de0
push eax
mov eax, edi
push eax
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
push str.my_local_appdata
mov ecx, edi
call dword [0x610598]
push 0x611348
call fcn.004ce4c0
add esp, 4
push 0x611348
call fcn.004ce520
add esp, 4
call fcn.004ce5c0
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x1c
call fcn.00503de0
push eax
mov edx, edi
push edx
mov ecx, esi
call fcn.00452080
mov ecx, eax
call dword [0x61059c]
mov ecx, edi
mov dword [esp + 0x38], 0xffffffff
call dword [0x6105a0]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.005e693f
mov esp, ebp
pop ebp
ret