Function at 0x4f8f40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61e868
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebp
push esi
mov esi, dword [esp + 0x4c]
push edi
lea eax, [esp + 0xc]
push eax
push esi
call fcn.005d9170
add esp, 8
mov edi, eax
call fcn.0046ce90
test al, al
jne 0x4f8f83
test edi, edi
jl 0x4f8f81
cmp edi, 8
jle 0x4f8f83
xor edi, edi
test edi, edi
setne al
test al, al
je 0x4f9027
push 0x468
call fcn.005f7f03
add esp, 4
test eax, eax
je 0x4f9027
mov ecx, eax
call fcn.004f8d30
mov ebp, eax
test ebp, ebp
je 0x4f9027
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push 0
push ecx
push edi
push edx
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.005d9840
mov eax, dword [esp + 0x6c]
add esp, 0x18
add esi, 0x28
cmp eax, 0x28
jb 0x4f9003
add eax, 0xffffffd8
shr eax, 2
push eax
push esi
lea edx, [esp + 0x1c]
push edx
mov ecx, ebp
call fcn.004f8d90
pop edi
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
xor eax, eax
push eax
push esi
lea edx, [esp + 0x1c]
push edx
mov ecx, ebp
call fcn.004f8d90
pop edi
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
cmp dword [esi + 0x10], 3
jne 0x4f908d
movzx eax, word [esi + 0xe]
cmp ax, 0x10
je 0x4f903d
cmp ax, 0x20
jne 0x4f908d
push 0x1050
call fcn.005f7f03
mov edi, eax
add esp, 4
test edi, edi
je 0x4f908d
mov dword [edi], 0x64aac4
mov dword [edi + 0xc], 0
cmp word [esi + 0xe], 0x20
mov edx, dword [esi + 8]
sete cl
lea eax, [esi + 0x28]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov ecx, edi
call fcn.004f72d0
mov eax, edi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
cmp byte [esp + 0x58], 0
jne 0x4f90af
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x4c]
push ecx
push esi
push edx
call fcn.005e3690
add esp, 0xc
test eax, eax
jne 0x4f91d9
mov eax, dword [esi + 8]
cdq
push ebx
mov ebx, dword [esi + 4]
mov edi, eax
mov eax, dword [esi + 0x10]
xor edi, edx
push 0x47504a4d
push eax
sub edi, edx
call fcn.00461fd0
add esp, 8
test al, al
jne 0x4f90e7
mov ecx, dword [esi + 0x10]
push 0x31626d64
push ecx
call fcn.00461fd0
add esp, 8
test al, al
je 0x4f9140
push 0x6d2d10
push 0x14
call fcn.005f846a
xor ecx, ecx
add esp, 8
cmp eax, ecx
je 0x4f910c
mov dword [eax], 0x64aa90
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov ebp, eax
jmp 0x4f910e
xor ebp, ebp
mov dword [esp + 0x14], ebp
cmp ebp, ecx
mov dword [esp + 0x48], ecx
je 0x4f9138
push edi
push ebx
mov ecx, ebp
call fcn.004f8940
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
mov dword [esp + 0x48], 0xffffffff
mov edx, dword [esi + 0x10]
push 0x64737664
push edx
call fcn.00461fd0
add esp, 8
test al, al
je 0x4f917f
cmp ebx, 0x2d0
jne 0x4f917f
cmp edi, 0x1e0
je 0x4f916d
cmp edi, 0x240
jne 0x4f917f
push edi
push 0x2d0
call fcn.005e3df0
add esp, 8
test eax, eax
jne 0x4f91d8
mov eax, dword [esi + 0x10]
push 0x75796668
push eax
call fcn.00461fd0
add esp, 8
test al, al
je 0x4f91b8
test bl, 1
jne 0x4f91b8
mov ecx, dword [esp + 0x58]
movzx eax, word [esi + 0xe]
add ecx, 0xffffffd8
push ecx
lea edx, [esi + 0x28]
push edx
push eax
push edi
push ebx
call fcn.005e3b30
add esp, 0x14
test eax, eax
jne 0x4f91d8
cmp byte [esp + 0x5c], 0
je 0x4f91d6
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x50]
push ecx
push esi
push edx
call fcn.005e3690
add esp, 0xc
test eax, eax
jne 0x4f91d8
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x3c
ret