Function at 0x4dd970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x862dcc
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x8ce6f4]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x58]
mov edi, ecx
mov ecx, dword [esp + 0x5c]
push edx
push ecx
push eax
mov ecx, edi
mov dword [esp + 0x30], edi
call fcn.004dab50
mov dword [edi + 0xd8], 0x408f04
xor ebx, ebx
mov dword [edi], 0x409068
mov dword [edi + 0xc], 0x408fec
mov dword [edi + 0x10], 0x408fd0
mov dword [edi + 0xd8], 0x408fa8
mov dword [edi + 0xdc], 0x408f8c
mov dword [esp + 0x50], ebx
mov dword [edi + 0xe0], ebx
mov dword [edi + 0xe4], ebx
mov dword [edi + 0xe8], ebx
fld dword [0x404c6c]
fstp dword [edi + 0xf8]
lea ecx, [edi + 0xec]
fld dword [0x404c68]
mov dword [edi + 0xec], ebx
fstp dword [edi + 0xfc]
mov dword [edi + 0xf0], ebx
fld dword [0x404c64]
mov dword [edi + 0xf4], 0x11
fstp dword [edi + 0x100]
mov dword [edi + 0x104], 0xffffffff
mov dword [edi + 0x108], ebx
mov dword [edi + 0x10c], ebx
mov dword [edi + 0x110], 0xa
mov dword [edi + 0x114], ebx
mov dword [edi + 0x118], ebx
call fcn.005ea230
mov byte [esp + 0x50], 4
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4dda98
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi + 0x124], eax
mov dword [edi + 0x12c], ebx
mov ebp, 1
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x8b7020
mov byte [esp + 0x34], bl
mov dword [esp + 0x38], 0x4090b8
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebx
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [edi + 0xec]
mov byte [esp + 0x60], 7
call fcn.004dc5d0
cmp eax, ebx
jne 0x4ddb48
cmp dword [edi + 0xec], ebx
jne 0x4ddb2e
mov edx, dword [edi + 0xf4]
push ebp
push edx
lea ecx, [edi + 0xec]
call fcn.00635dd0
cmp al, bl
jne 0x4ddb2e
push 0x8007000e
call fcn.004a8210
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x1c]
push edx
lea ecx, [edi + 0xec]
call fcn.004dd590
lea ecx, [eax + 4]
lea eax, [esp + 0x28]
push eax
call fcn.004dcdd0
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x50], 6
cmp eax, ebx
je 0x4ddb6a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4ddb7a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x8b7068
mov byte [esp + 0x34], bl
mov dword [esp + 0x38], 0x4090ac
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [edi + 0xec]
mov byte [esp + 0x60], 8
call fcn.004dc5d0
cmp eax, ebx
jne 0x4ddc0d
cmp dword [edi + 0xec], ebx
jne 0x4ddbf3
mov ecx, dword [edi + 0xf4]
push ebp
push ecx
lea ecx, [edi + 0xec]
call fcn.00635dd0
cmp al, bl
jne 0x4ddbf3
push 0x8007000e
call fcn.004a8210
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [edi + 0xec]
call fcn.004dd590
lea edx, [esp + 0x28]
lea ecx, [eax + 4]
push edx
call fcn.004dcdd0
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x50], 6
cmp eax, ebx
je 0x4ddc2f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4ddc3f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], 2
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x8b70b0
mov byte [esp + 0x34], bl
mov dword [esp + 0x38], 0x4090a4
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [edi + 0xec]
mov byte [esp + 0x60], 9
call fcn.004dc5d0
cmp eax, ebx
jne 0x4ddcd6
cmp dword [edi + 0xec], ebx
jne 0x4ddcbc
mov ecx, dword [edi + 0xf4]
push ebp
push ecx
lea ecx, [edi + 0xec]
call fcn.00635dd0
cmp al, bl
jne 0x4ddcbc
push 0x8007000e
call fcn.004a8210
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [edi + 0xec]
call fcn.004dd590
lea edx, [esp + 0x28]
lea ecx, [eax + 4]
push edx
call fcn.004dcdd0
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x50], 6
cmp eax, ebx
je 0x4ddcf8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4ddd08
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], 3
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x8b70f8
mov byte [esp + 0x34], bl
mov dword [esp + 0x38], 0x40909c
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [edi + 0xec]
mov byte [esp + 0x60], 0xa
call fcn.004dc5d0
cmp eax, ebx
jne 0x4ddd9f
cmp dword [edi + 0xec], ebx
jne 0x4ddd85
mov ecx, dword [edi + 0xf4]
push ebp
push ecx
lea ecx, [edi + 0xec]
call fcn.00635dd0
cmp al, bl
jne 0x4ddd85
push 0x8007000e
call fcn.004a8210
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [edi + 0xec]
call fcn.004dd590
lea edx, [esp + 0x28]
lea ecx, [eax + 4]
push edx
call fcn.004dcdd0
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x50], 6
cmp eax, ebx
je 0x4dddc1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4dddd1
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x8b7140
mov byte [esp + 0x34], bl
mov dword [esp + 0x38], 0x409090
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [edi + 0xec]
mov byte [esp + 0x60], 0xb
call fcn.004dc5d0
cmp eax, ebx
jne 0x4dde68
cmp dword [edi + 0xec], ebx
jne 0x4dde4e
mov ecx, dword [edi + 0xf4]
push ebp
push ecx
lea ecx, [edi + 0xec]
call fcn.00635dd0
cmp al, bl
jne 0x4dde4e
push 0x8007000e
call fcn.004a8210
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [edi + 0xec]
call fcn.004dd590
lea edx, [esp + 0x28]
lea ecx, [eax + 4]
push edx
call fcn.004dcdd0
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x50], 6
cmp eax, ebx
je 0x4dde8a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4dde9a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], 0x80
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x8b7188
mov byte [esp + 0x34], 1
mov dword [esp + 0x38], 0x409088
mov dword [esp + 0x3c], 2
mov dword [esp + 0x40], ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [edi + 0xec]
mov byte [esp + 0x60], 0xc
call fcn.004dc5d0
cmp eax, ebx
jne 0x4ddf36
cmp dword [edi + 0xec], ebx
jne 0x4ddf1c
mov ecx, dword [edi + 0xf4]
push ebp
push ecx
lea ecx, [edi + 0xec]
call fcn.00635dd0
cmp al, bl
jne 0x4ddf1c
push 0x8007000e
call fcn.004a8210
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [edi + 0xec]
call fcn.004dd590
lea edx, [esp + 0x28]
lea ecx, [eax + 4]
push edx
call fcn.004dcdd0
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x50], 6
cmp eax, ebx
je 0x4ddf58
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4ddf68
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], 0x81
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x8b71d0
mov byte [esp + 0x34], 1
mov dword [esp + 0x38], 0x409080
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [edi + 0xec]
mov byte [esp + 0x60], 0xd
call fcn.004dc5d0
cmp eax, ebx
jne 0x4de000
cmp dword [edi + 0xec], ebx
jne 0x4ddfe6
mov ecx, dword [edi + 0xf4]
push ebp
push ecx
lea ecx, [edi + 0xec]
call fcn.00635dd0
cmp al, bl
jne 0x4ddfe6
push 0x8007000e
call fcn.004a8210
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [edi + 0xec]
call fcn.004dd590
lea edx, [esp + 0x28]
lea ecx, [eax + 4]
push edx
call fcn.004dcdd0
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x50], 6
cmp eax, ebx
je 0x4de022
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4de032
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], 0x82
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x8b7218
mov byte [esp + 0x34], bl
mov dword [esp + 0x38], 0x409078
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [edi + 0xec]
mov byte [esp + 0x60], 0xe
call fcn.004dc5d0
cmp eax, ebx
jne 0x4de0c9
cmp dword [edi + 0xec], ebx
jne 0x4de0af
mov ecx, dword [edi + 0xf4]
push ebp
push ecx
lea ecx, [edi + 0xec]
call fcn.00635dd0
cmp al, bl
jne 0x4de0af
push 0x8007000e
call fcn.004a8210
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [edi + 0xec]
call fcn.004dd590
lea edx, [esp + 0x28]
lea ecx, [eax + 4]
push edx
call fcn.004dcdd0
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x50], 6
cmp eax, ebx
je 0x4de0eb
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4de0fb
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [0x8d4594], 0x600
mov dword [esp + 0x18], 0x83
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0x8b72a8
mov byte [esp + 0x34], bl
mov dword [esp + 0x38], 0x404bc4
mov dword [esp + 0x40], ebx
jb 0x4de13a
mov dword [esp + 0x3c], ebp
mov byte [esp + 0x50], 0xf
jmp 0x4de147
mov dword [esp + 0x3c], 3
mov byte [esp + 0x50], 0x10
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [edi + 0xec]
call fcn.004dd900
mov ecx, eax
call fcn.004dcdd0
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x50], 6
cmp eax, ebx
je 0x4de178
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4de188
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ebp, dword [edi + 0x90]
mov dword [edi + 0x11c], ebx
mov dword [edi + 0x120], 2
mov byte [edi + 0x128], bl
cmp ebp, ebx
je 0x4de1fc
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x10]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x14]
lea ecx, [esp + 0x28]
push 0x407dc8
push ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], eax
call fcn.004c17a0
add esp, 8
test eax, eax
jne 0x4de1e6
mov ebp, dword [ebp]
cmp ebp, ebx
jne 0x4de1a8
jmp 0x4de1fc
push ebp
lea ecx, [edi + 0x90]
call fcn.00855e60
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
mov eax, edi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0080262b
add esp, 0x40
ret 0xc