Function at 0x497120
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3db0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x571180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov ebx, dword fs:[0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [0x582550]
mov esi, dword [ebx]
cmp eax, dword [esi + 0xc]
jle 0x497219
push 0x582550
call fcn.004c2c88
add esp, 4
cmp dword [0x582550], 0xffffffff
jne 0x497219
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2070]
mov dword [ebp - 0x2c], 0x6a2d157
mov dword [ebp - 0x28], 0x441e467c
mov word [ebp - 0x24], 0xa355
test al, 1
jne 0x4971f9
or eax, 1
mov dword [esi + 0x2070], eax
mov byte [ebp - 4], 1
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov byte [esi + 0x1fea], 1
mov al, byte [ebp + ecx - 0x2c]
mov byte [esi + ecx + 0x1fe0], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x4971ec
cmp ecx, 0xa
jb 0x4971d2
push 0x5123d0
call fcn.004c3147
add esp, 4
lea esi, [esi + 0x1fe0]
mov ecx, esi
call fcn.00497ce0
push 0x582550
mov dword [0x58256c], esi
call fcn.004c2c37
add esp, 4
mov esi, dword [ebx]
mov edi, esi
mov eax, dword [0x582544]
cmp eax, dword [esi + 0xc]
jle 0x4972d5
push 0x582544
call fcn.004c2c88
add esp, 4
cmp dword [0x582544], 0xffffffff
jne 0x4972d5
mov dword [ebp - 4], 2
mov eax, dword [esi + 0x217c]
mov dword [ebp - 0x3c], 0xff8a8e8f
mov word [ebp - 0x38], 0x8feb
test al, 1
jne 0x4972b3
or eax, 1
mov dword [esi + 0x217c], eax
mov byte [ebp - 4], 3
lea esi, [esi + 0x2174]
xorps xmm0, xmm0
mov byte [esi + 6], 1
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x3c]
mov byte [esi + ecx], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x4972a6
cmp ecx, 6
jb 0x497290
push 0x512390
call fcn.004c3147
add esp, 4
mov edi, dword [ebx]
lea esi, [edi + 0x2174]
mov ecx, esi
call fcn.00497c80
push 0x582544
mov dword [0x58255c], esi
call fcn.004c2c37
add esp, 4
mov eax, dword [0x58254c]
mov ebx, edi
cmp eax, dword [edi + 0xc]
jle 0x4973a0
push 0x58254c
call fcn.004c2c88
add esp, 4
cmp dword [0x58254c], 0xffffffff
jne 0x4973a0
mov dword [ebp - 4], 4
mov eax, dword [edi + 0x2028]
mov dword [ebp - 0x40], 0x70a2048d
mov dword [ebp - 0x3c], 0xcf565f05
mov word [ebp - 0x38], 0x6d8c
test al, 1
jne 0x497377
or eax, 1
mov dword [edi + 0x2028], eax
mov byte [ebp - 4], 5
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [edi + 0x2092], 1
nop dword [eax]
mov al, byte [ebp + ecx - 0x40]
mov byte [ecx + edi + 0x2088], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x49736a
cmp ecx, 0xa
jb 0x497350
push 0x512350
call fcn.004c3147
add esp, 4
mov ebx, dword fs:[0x2c]
mov ebx, dword [ebx]
lea esi, [ebx + 0x2088]
mov ecx, esi
call fcn.00497c20
push 0x58254c
mov dword [0x582568], esi
call fcn.004c2c37
add esp, 4
mov eax, dword [0x582538]
mov edi, ebx
cmp eax, dword [ebx + 0xc]
jle 0x49745f
push 0x582538
call fcn.004c2c88
add esp, 4
cmp dword [0x582538], 0xffffffff
jne 0x49745f
mov dword [ebp - 4], 6
mov eax, dword [ebx + 0x2054]
mov dword [ebp - 0x38], 0x4e8d805
mov byte [ebp - 0x34], 0x4d
test al, 1
jne 0x497437
or eax, 1
mov dword [ebx + 0x2054], eax
mov byte [ebp - 4], 7
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [ebx + 0x215d], 1
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x38]
mov byte [ebx + ecx + 0x2158], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x49742a
cmp ecx, 5
jb 0x497410
push 0x512310
call fcn.004c3147
add esp, 4
mov eax, dword fs:[0x2c]
mov edi, dword [eax]
lea esi, [edi + 0x2158]
mov ecx, esi
call fcn.00497bc0
push 0x582538
mov dword [0x582560], esi
call fcn.004c2c37
add esp, 4
mov eax, dword [0x582558]
mov ebx, edi
cmp eax, dword [edi + 0xc]
jle 0x497523
push 0x582558
call fcn.004c2c88
add esp, 4
cmp dword [0x582558], 0xffffffff
jne 0x497523
mov dword [ebp - 4], 8
mov eax, dword [edi + 0x1fd0]
mov dword [ebp - 0x3c], 0x7512a26e
mov dword [ebp - 0x38], 0x61d8b752
mov byte [ebp - 0x34], 0xd
test al, 1
jne 0x4974f8
or eax, 1
mov dword [edi + 0x1fd0], eax
mov byte [ebp - 4], 9
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [edi + 0x20e1], 1
mov al, byte [ebp + ecx - 0x3c]
mov byte [edi + ecx + 0x20d8], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x4974eb
cmp ecx, 9
jb 0x4974d1
push 0x5122d0
call fcn.004c3147
add esp, 4
mov edi, dword fs:[0x2c]
mov ebx, dword [edi]
lea esi, [ebx + 0x20d8]
mov ecx, esi
call fcn.00497b60
push 0x582558
mov dword [0x582564], esi
call fcn.004c2c37
add esp, 4
jmp 0x49752a
mov edi, dword fs:[0x2c]
mov eax, dword [0x582540]
mov dword [ebp - 0x38], ebx
cmp eax, dword [ebx + 0xc]
jle 0x4975eb
push 0x582540
call fcn.004c2c88
add esp, 4
mov dword [ebp - 0x38], ebx
cmp dword [0x582540], 0xffffffff
jne 0x4975eb
mov dword [ebp - 4], 0xa
mov eax, dword [ebx + 0x200c]
mov dword [ebp - 0x3c], 0x5c040616
mov word [ebp - 0x38], 0xbc69
mov byte [ebp - 0x36], 0x6d
test al, 1
jne 0x4975c7
or eax, 1
mov dword [ebx + 0x200c], eax
mov byte [ebp - 4], 0xb
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov byte [ebx + 0x2167], 1
nop
mov al, byte [ebp + ecx - 0x3c]
mov byte [ebx + ecx + 0x2160], al
add ecx, 1
adc edx, 0
test edx, edx
jne 0x4975ba
cmp ecx, 7
jb 0x4975a0
push 0x512290
call fcn.004c3147
add esp, 4
mov ebx, dword [edi]
lea esi, [ebx + 0x2160]
mov ecx, esi
call fcn.00497b00
push 0x582540
mov dword [0x582554], esi
call fcn.004c2c37
add esp, 4
jmp 0x4975ee
mov ebx, dword [ebp - 0x38]
mov eax, dword [0x582548]
cmp eax, dword [ebx + 0xc]
jle 0x4976b9
push 0x582548
call fcn.004c2c88
add esp, 4
cmp dword [0x582548], 0xffffffff
jne 0x4976b9
mov dword [ebp - 4], 0xc
mov eax, dword [ebx + 0x2008]
mov dword [ebp - 0x40], 0x4ebb6874
mov dword [ebp - 0x3c], 0xa0ff0336
mov dword [ebp - 0x38], 0x55ac6f6a
mov byte [ebp - 0x34], 0x57
test al, 1
jne 0x497697
or eax, 1
mov dword [ebx + 0x2008], eax
mov byte [ebp - 4], 0xd
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov byte [ebx + 0x1fa9], 1
nop word [eax + eax]
mov cl, byte [ebp + eax - 0x40]
mov byte [ebx + eax + 0x1f9c], cl
add eax, 1
adc edx, 0
test edx, edx
jne 0x49768a
cmp eax, 0xd
jb 0x497670
push 0x512250
call fcn.004c3147
add esp, 4
mov esi, dword [edi]
add esi, 0x1f9c
mov ecx, esi
call fcn.00497aa0
push 0x582548
mov dword [0x58253c], esi
call fcn.004c2c37
add esp, 4
mov dword [ebp - 4], 0xe
lea ecx, [ebp - 0x18]
push 0
mov byte [ebp - 0x20], 0
call fcn.00489770
mov ebx, dword [ebp - 0x44]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0xf
xorps xmm0, xmm0
mov edx, ebx
mov byte [ebp - 0x30], 0
movq qword [ebp - 0x28], xmm0
call fcn.00495710
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x20]
push dword [0x58256c]
call fcn.00489bb0
mov edi, eax
movzx eax, byte [ebp - 0x30]
mov cl, byte [edi]
mov byte [edi], al
mov edx, dword [edi + 8]
mov esi, dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 0x44], cl
mov byte [ebp - 0x30], cl
mov ecx, dword [ebp - 0x24]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], esi
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x11
call fcn.0047d570
mov byte [ebp - 4], 0xf
lea edx, [ebx + 0x18]
xorps xmm0, xmm0
mov byte [ebp - 0x30], 0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x28], xmm0
call fcn.00495710
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x20]
push dword [0x58255c]
call fcn.00489bb0
mov edi, eax
movzx eax, byte [ebp - 0x30]
mov cl, byte [edi]
mov byte [edi], al
mov edx, dword [edi + 8]
mov esi, dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 0x44], cl
mov byte [ebp - 0x30], cl
mov ecx, dword [ebp - 0x24]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], esi
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x13
call fcn.0047d570
mov byte [ebp - 4], 0xf
lea edx, [ebx + 0x30]
xorps xmm0, xmm0
mov byte [ebp - 0x30], 0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x28], xmm0
call fcn.00495710
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x20]
push dword [0x582568]
call fcn.00489bb0
mov edi, eax
movzx eax, byte [ebp - 0x30]
mov cl, byte [edi]
mov byte [edi], al
mov edx, dword [edi + 8]
mov esi, dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 0x44], cl
mov byte [ebp - 0x30], cl
mov ecx, dword [ebp - 0x24]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], esi
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x15
call fcn.0047d570
mov byte [ebp - 4], 0xf
lea edx, [ebx + 0x48]
xorps xmm0, xmm0
mov byte [ebp - 0x30], 0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x28], xmm0
call fcn.00495710
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x20]
push dword [0x582560]
call fcn.00489bb0
mov edi, eax
movzx eax, byte [ebp - 0x30]
mov cl, byte [edi]
mov byte [edi], al
mov edx, dword [edi + 8]
mov esi, dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 0x44], cl
mov byte [ebp - 0x30], cl
mov ecx, dword [ebp - 0x24]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], esi
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
call fcn.0047d570
mov byte [ebp - 4], 0xf
lea edx, [ebx + 0x60]
xorps xmm0, xmm0
mov byte [ebp - 0x30], 0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x28], xmm0
call fcn.00495710
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20]
push dword [0x582564]
call fcn.00489bb0
mov edi, eax
movzx eax, byte [ebp - 0x30]
mov cl, byte [edi]
mov byte [edi], al
mov edx, dword [edi + 8]
mov esi, dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 0x44], cl
mov byte [ebp - 0x30], cl
mov ecx, dword [ebp - 0x24]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], esi
push dword [ebp - 0x44]
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x28]
call fcn.0047d570
mov byte [ebp - 4], 0xf
lea edx, [ebx + 0x78]
xorps xmm0, xmm0
mov byte [ebp - 0x30], 0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x28], xmm0
call fcn.00495710
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x20]
push dword [0x582554]
call fcn.00489bb0
mov edi, eax
movzx eax, byte [ebp - 0x30]
mov cl, byte [edi]
mov byte [edi], al
mov edx, dword [edi + 8]
mov esi, dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 0x44], cl
mov byte [ebp - 0x30], cl
mov ecx, dword [ebp - 0x24]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], esi
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1b
call fcn.0047d570
mov byte [ebp - 4], 0xf
lea edx, [ebx + 0x90]
xorps xmm0, xmm0
mov byte [ebp - 0x30], 0
lea ecx, [ebp - 0x30]
movq qword [ebp - 0x28], xmm0
call fcn.00495710
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x20]
push dword [0x58253c]
call fcn.00489bb0
mov edi, eax
movzx eax, byte [ebp - 0x30]
mov cl, byte [edi]
mov byte [edi], al
mov edx, dword [edi + 8]
mov esi, dword [edi + 0xc]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 0x44], cl
mov byte [ebp - 0x30], cl
mov ecx, dword [ebp - 0x24]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], esi
push dword [ebp - 0x44]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1d
call fcn.0047d570
mov esi, dword [ebp - 0x48]
lea ecx, [ebp - 0x20]
sub esp, 0xc
mov byte [ebp - 4], 0xf
push 0xffffffffffffffff
push esi
call fcn.00487a10
mov dword [ebp - 4], 0x1e
lea ecx, [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.0047d570
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c2b19
mov esp, ebp
pop ebp
ret 4