Function at 0x4f1660
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
lea eax, [ebp - 0x18]
mov esi, ecx
mov ebx, edx
mov dl, byte [ebp + 0x10]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x506b20
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov byte [esi + 0x48], dl
mov ecx, dword [esi]
mov edx, dword [esi + 4]
call fcn.004f1644
mov edx, dword [ebp + 8]
mov edi, eax
mov ecx, ebx
push 0xf423f
push 0
push 0
push dword [ebp + 0xc]
call fcn.004e5a90
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, edx
mov edx, dword [edi + 0x44]
mov ebx, ecx
mov ecx, dword [edi + 0x40]
push ebx
mov ebx, esi
push eax
push dword [ebp - 0x20]
push dword [edi + 0x48]
call fcn.004f03a9
add esp, 0x10
mov ecx, eax
lea eax, [esi + 0x18]
mov edi, edx
mov dword [ebp - 0x24], eax
movq xmm0, qword [esi + 0x30]
push 0xfffffffffffffffd
pop edx
cmp ecx, edx
mov eax, edx
mov dword [ebp - 0x28], ecx
cmovb eax, ecx
cmp edi, 0xffffffff
cmovne edx, ecx
cmove edx, eax
movd eax, xmm0
pshufd xmm0, xmm0, 0x55
mov dword [ebp - 0x20], edx
movd edx, xmm0
cmp dword [ebp - 0x20], eax
mov ecx, edi
sbb ecx, edx
jb 0x4f173d
mov ecx, edi
mov esi, edi
mov edi, ebx
mov ebx, dword [ebp - 0x28]
lock cmpxchg8b qword [edi + 0x30]
mov ebx, edi
mov edi, esi
jne 0x4f171b
jmp 0x4f18ca
cmp byte [ebp + 0x10], 0
je 0x4f18ca
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
or dword [ebp - 0x10], 0xffffffff
call fcn.004f1644
mov edx, eax
mov eax, dword [ebx + 4]
cmp dword [ebx], 0
mov dword [ebp - 0x34], eax
push 0x78
pop eax
push 8
pop ecx
cmove ecx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x30], ecx
mov ecx, edx
call fcn.004eaff1
movq xmm0, qword [ebx + 0x30]
movd eax, xmm0
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
and ecx, eax
cmp ecx, 0xffffffff
je 0x4f17ad
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], edi
add ecx, 0x18
call fcn.004f1e63
mov edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov al, byte [ecx + 0x38]
test al, al
je 0x4f17c2
mov ecx, dword [ebp - 0x24]
xor edx, edx
inc edx
jmp 0x4f18a6
movd xmm0, dword [ebp - 0x28]
movd xmm1, edi
mov esi, ecx
punpckldq xmm0, xmm1
movq qword [ebx + 0x30], xmm0
movq qword [ebx + 0x20], xmm0
movq xmm0, qword [ebx + 0x30]
movd edi, xmm0
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
mov eax, edi
and eax, ecx
cmp eax, 0xffffffff
je 0x4f18ee
movd xmm0, edi
movd xmm1, ecx
punpckldq xmm0, xmm1
movq qword [ebx + 0x20], xmm0
mov ebx, ecx
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
cmp ecx, edi
mov edx, eax
sbb edx, ebx
jae 0x4f18a1
xor ecx, edi
xor eax, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], edi
or ecx, 0x3f
mov edx, eax
cmp ecx, 0xfffffffe
sbb edx, 0xf
push 0xfffffffffffffffe
pop edx
cmovb edx, ecx
push 0xf
pop ecx
cmovb ecx, eax
bsr edx, edx
xor edx, 0x1f
bsr eax, ecx
or dl, 0x20
xor eax, 0x1f
test ecx, ecx
movzx ecx, dl
cmovne ecx, eax
xor cl, 0x3e
movzx eax, cl
mov cl, 6
div cl
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
and dword [ebp - 0x10], 0
movzx eax, al
push 0x592ff0
push eax
call fcn.004ef206
mov edx, dword [ebp - 0x24]
add esp, 8
mov ecx, eax
call fcn.004ef25a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
add eax, 0xffffffff
adc ecx, 0xffffffff
xor edi, edi
cmp eax, dword [ebp - 0x28]
sbb ecx, dword [ebp - 0x2c]
jae 0x4f18db
jmp 0x4f18b3
mov ecx, dword [ebp - 0x24]
xor edx, edx
call fcn.004ef2b7
or dword [ebp - 0x10], 0xffffffff
mov edi, eax
mov esi, edx
mov ecx, dword [ebp - 0x20]
or dword [ebp - 0x10], 0xffffffff
call fcn.00471357
test edi, edi
je 0x4f18ca
push esi
call dword [edi + 4]
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
lea ecx, [eax + ecx + 0x50]
call fcn.004ef4c8
xor edi, edi
jmp 0x4f18b3
and dword [ebp - 0x10], 0
push 0x13
pop edx
mov ecx, 0x592ea4
push 0x592eb8
call fcn.005376f0
pop eax
ud2