Function at 0x4cedc4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4cf0d1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4cf0e8
call fcn.004041f0
push 0
mov ecx, 0x4cf0f8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa578
mov edx, dword [ebx + 0x100]
mov dword [edx + 4], eax
push 0
mov ecx, 0x4cf10c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa578
mov edx, dword [ebx + 0x100]
mov dword [edx + 0xc], eax
push 0
mov ecx, 0x4cf120
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa578
mov edx, dword [ebx + 0x100]
mov dword [edx + 8], eax
push 0
mov ecx, 0x4cf134
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa578
mov edx, dword [ebx + 0x100]
mov dword [edx + 0x10], eax
push 0
mov ecx, 0x4cf14c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa578
mov esi, dword [ebx + 0x100]
mov dword [esi + 0x18], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4cf15c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa448
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 0x14]
mov eax, ebx
call fcn.004cd904
push 0
mov ecx, 0x4cf16c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa578
mov esi, dword [ebx + 0x100]
mov dword [esi + 0x1c], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4cf17c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa448
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi + 0x44]
mov eax, ebx
call fcn.004cd904
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4cf190
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa448
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x100]
mov edx, dword [eax + 0x48]
mov eax, ebx
call fcn.004cd904
push 0xffffffffffffffff
mov ecx, 0x4cf1a4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa578
mov edx, dword [ebx + 0x100]
mov dword [edx + 0x2c], eax
push 0xffffffffffffffff
mov ecx, 0x4cf1bc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa578
mov edx, dword [ebx + 0x100]
mov dword [edx + 0x30], eax
push 0xffffffffffffffff
mov ecx, 0x4cf1d4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa578
mov edx, dword [ebx + 0x100]
mov dword [edx + 0x34], eax
push 0
mov ecx, 0x4cf1ec
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa578
mov edx, dword [ebx + 0x100]
mov dword [edx + 0x4c], eax
push 0
mov ecx, 0x4cf208
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa578
mov esi, dword [ebx + 0x100]
mov dword [esi + 0x50], eax
cmp dword [esi + 0x1c], 1
jle 0x4cef93
xor eax, eax
mov dword [esi + 0x1c], eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4cf224
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa448
cmp dword [ebp - 8], 0
je 0x4cefbb
mov eax, dword [ebx + 0x100]
mov byte [eax + 0x54], 1
jmp 0x4cefc5
mov eax, dword [ebx + 0x100]
mov byte [eax + 0x54], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4cf23c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa448
cmp dword [ebp - 8], 0
je 0x4cefed
mov eax, dword [ebx + 0x100]
mov byte [eax + 0x55], 1
jmp 0x4ceff7
mov eax, dword [ebx + 0x100]
mov byte [eax + 0x55], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4cf258
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa448
cmp dword [ebp - 8], 0
je 0x4cf01f
mov eax, dword [ebx + 0x100]
mov byte [eax + 0x56], 1
jmp 0x4cf029
mov eax, dword [ebx + 0x100]
mov byte [eax + 0x56], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4cf224
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa448
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebx + 0xb0]
mov eax, ebx
call fcn.004d0020
mov edx, dword [ebx + 0x100]
mov dword [edx + 0x38], eax
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4cf23c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa448
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0xb0]
mov eax, ebx
call fcn.004d0020
mov edx, dword [ebx + 0x100]
mov dword [edx + 0x3c], eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x4cf258
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004aa448
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebx + 0xb0]
mov eax, ebx
call fcn.004d0020
mov edx, dword [ebx + 0x100]
mov dword [edx + 0x40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cf0d8
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.0040417c
ret