Function at 0x4bbfd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x54d050
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5a9e98]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov ecx, ebp
call fcn.00401f70
mov esi, dword [esp + 0x28]
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.00403c60
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
mov ebx, dword [esi + 0x224]
mov ecx, edi
call edx
and ebx, 0xffff0000
cmp ebx, 0x80000
jne 0x4bc032
xor eax, eax
jmp 0x4bc274
mov ecx, esi
call fcn.004de4b0
test eax, eax
jne 0x4bc269
mov ecx, edi
call fcn.00403c60
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
mov ebx, dword [esi + 0x224]
mov ecx, edi
call edx
and ebx, 0xfff
cmp ebx, 2
je 0x4bc1a4
mov ecx, edi
call fcn.00403c60
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
mov ebx, dword [esi + 0x224]
mov ecx, edi
call edx
and ebx, 0xfff
cmp ebx, 3
je 0x4bc1a4
mov ecx, esi
call fcn.004ae9e0
and eax, 0xfff
cmp eax, 5
jne 0x4bc0cb
cmp dword [esp + 0x2c], 0
je 0x4bc0c4
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
call fcn.004b4db0
mov ecx, dword [eax]
push ecx
mov dword [esp + 0x24], 3
push 0xe220
jmp 0x4bc247
push 0x20
jmp 0x4bc260
mov ecx, esi
call fcn.004ae9e0
and eax, 0xfff
cmp eax, 9
jne 0x4bc269
mov ecx, esi
call fcn.004aeb90
test eax, eax
jne 0x4bc147
cmp dword [esp + 0x2c], eax
je 0x4bc269
lea edx, [esp + 0x30]
push edx
mov ecx, esi
call fcn.004b4db0
mov edi, eax
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
mov dword [esp + 0x24], 4
call fcn.004b4e40
mov ecx, dword [edi]
mov edx, dword [eax]
push ecx
push edx
push 0xe224
push ebp
mov byte [esp + 0x30], 5
call fcn.0041b330
add esp, 0x10
lea ecx, [esp + 0x2c]
call fcn.00401f50
lea ecx, [esp + 0x30]
call fcn.00401f50
jmp 0x4bc269
cmp dword [esp + 0x2c], 0
je 0x4bc269
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.004b4db0
mov edi, eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov dword [esp + 0x24], 6
call fcn.004b4e40
mov edx, dword [edi]
mov eax, dword [eax]
push edx
push eax
push 0xe223
push ebp
mov byte [esp + 0x30], 7
call fcn.0041b330
add esp, 0x10
lea ecx, [esp + 0x28]
call fcn.00401f50
lea ecx, [esp + 0x14]
call fcn.00401f50
jmp 0x4bc269
mov ecx, esi
call fcn.004aeb90
test eax, eax
jne 0x4bc1d7
cmp dword [esp + 0x2c], eax
je 0x4bc25b
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.004b4db0
mov edx, dword [eax]
push edx
mov dword [esp + 0x24], 0
push 0xe21f
jmp 0x4bc247
cmp dword [esp + 0x2c], 0
je 0x4bc25b
mov ecx, esi
call fcn.004ad8f0
test eax, eax
mov ecx, esi
je 0x4bc22d
lea eax, [esp + 0x2c]
push eax
call fcn.004b4db0
mov edi, eax
mov ecx, esi
mov dword [esp + 0x20], 1
call fcn.004ae7c0
push edx
push eax
mov ecx, esi
call fcn.004ae820
mov ecx, dword [edi]
push edx
push eax
push ecx
push 0xe227
push ebp
call fcn.0041b330
add esp, 0x1c
lea ecx, [esp + 0x2c]
call fcn.00401f50
jmp 0x4bc269
lea edx, [esp + 0x2c]
push edx
call fcn.004b4db0
mov eax, dword [eax]
push eax
mov dword [esp + 0x24], 2
push 0xe213
push ebp
call fcn.0041b330
add esp, 0xc
lea ecx, [esp + 0x2c]
call fcn.00401f50
jmp 0x4bc269
push 0x153f
push ebp
call fcn.0041b330
add esp, 8
mov ecx, dword [ebp]
xor eax, eax
cmp dword [ecx - 0xc], eax
setne al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc