Function at 0x4fa948
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4fad13
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x496de0]
call fcn.00406c9c
add esp, 4
push 0
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0x496de0]
call fcn.00406c9c
add esp, 4
push 0
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x496de0]
call fcn.00406c9c
add esp, 4
push 0
lea eax, [ebp - 0x14]
mov ecx, 1
mov edx, dword [0x496de0]
call fcn.00406c9c
add esp, 4
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0xc]
call fcn.00406ae0
test eax, eax
jle 0x4facf2
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0xc]
call fcn.00406ae0
dec eax
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x496de0]
call fcn.00406c9c
add esp, 4
mov eax, dword [ebp - 4]
call fcn.00406ae0
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0xc]
inc eax
call fcn.0040312c
cmp dword [ebx + 0x118], 0
je 0x4faa30
lea eax, [ebx + 0x118]
call fcn.00499db4
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x28]
mov esi, dword [eax + 4]
mov eax, esi
mov edx, dword [0x4f7640]
call fcn.004045f4
test al, al
je 0x4faab5
mov ecx, dword [ebx + 0x48]
mov dl, 1
mov eax, dword [0x4ed5b8]
call fcn.004efcb4
mov esi, eax
mov dword [ebx + 0x118], esi
mov dl, 1
mov eax, esi
call fcn.004f08ec
mov eax, dword [ebp - 4]
call fcn.00406ae0
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x118]
mov esi, dword [eax]
call dword [esi + 0x2c]
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x14]
mov eax, dword [ebx + 0x118]
call fcn.004f082c
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x18]
mov eax, dword [ebx + 0x118]
call fcn.004f088c
jmp 0x4facf2
mov eax, esi
mov edx, dword [0x4f76ac]
call fcn.004045f4
test al, al
je 0x4fab24
mov ecx, dword [ebx + 0x48]
mov dl, 1
mov eax, dword [0x4ed5b8]
call fcn.004efcb4
mov esi, eax
mov dword [ebx + 0x118], esi
mov eax, dword [ebp - 4]
call fcn.00406ae0
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0x2c]
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x14]
mov eax, dword [ebx + 0x118]
call fcn.004f088c
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x18]
mov eax, dword [ebx + 0x118]
call fcn.004f080c
jmp 0x4facf2
mov eax, esi
mov edx, dword [0x4f75ac]
call fcn.004045f4
test al, al
je 0x4fab72
mov ecx, dword [ebx + 0x48]
mov dl, 1
mov eax, dword [0x4ed5b8]
call fcn.004efcb4
mov esi, eax
mov dword [ebx + 0x118], esi
mov dl, 1
mov eax, esi
call fcn.004f08ec
mov eax, dword [ebp - 4]
call fcn.00406ae0
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x118]
mov ebx, dword [eax]
call dword [ebx + 0x2c]
jmp 0x4facf2
mov eax, esi
mov edx, dword [0x4f7734]
call fcn.004045f4
test al, al
je 0x4fac48
mov ecx, dword [ebx + 0x48]
mov dl, 1
mov eax, dword [0x4ed76c]
call fcn.004f3180
mov dword [ebx + 0x118], eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + 0x28]
mov edx, dword [edx + 4]
mov edx, dword [edx + 8]
mov ecx, dword [0x496de0]
call fcn.00406dd8
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + 0x28]
mov edx, dword [edx + 4]
mov edx, dword [edx + 0xc]
mov ecx, dword [0x496de0]
call fcn.00406dd8
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + 0x28]
mov edx, dword [edx + 4]
mov edx, dword [edx + 0x10]
mov ecx, dword [0x496de0]
call fcn.00406dd8
lea eax, [ebp - 0x14]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + 0x28]
mov edx, dword [edx + 4]
mov edx, dword [edx + 0x14]
mov ecx, dword [0x496de0]
call fcn.00406dd8
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
call fcn.00406ae0
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00406ae0
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00406ae0
push eax
mov eax, dword [ebp - 8]
call fcn.00406ae0
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x118]
call fcn.004f3adc
jmp 0x4facf2
mov eax, esi
mov edx, dword [0x4f77d8]
call fcn.004045f4
test al, al
je 0x4facf2
mov ecx, dword [ebx + 0x48]
mov dl, 1
mov eax, dword [0x4ed924]
call fcn.004f48c0
mov dword [ebx + 0x118], eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + 0x28]
mov edx, dword [edx + 4]
mov edx, dword [edx + 8]
mov ecx, dword [0x496de0]
call fcn.00406dd8
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + 0x28]
mov edx, dword [edx + 4]
mov edx, dword [edx + 0x10]
mov ecx, dword [0x496de0]
call fcn.00406dd8
lea eax, [ebp - 0x14]
mov edx, dword [ebx + 0x30]
mov edx, dword [edx + 0x28]
mov edx, dword [edx + 4]
mov edx, dword [edx + 0x14]
mov ecx, dword [0x496de0]
call fcn.00406dd8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00406ae0
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00406ae0
push eax
mov eax, dword [ebp - 8]
call fcn.00406ae0
mov ecx, eax
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x118]
call fcn.004f4960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fad1a
lea eax, [ebp - 0x14]
mov edx, dword [0x496de0]
mov ecx, 5
call fcn.00406130
ret