Function at 0x4787c0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5242b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ecx
mov dword [ecx], 0x59c244
mov dword [ebp - 4], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
mov dword [ebp - 4], 3
mov dword [ebp - 4], 4
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
mov dword [ebp - 4], 7
mov dword [ebp - 4], 8
mov dword [ebp - 4], 9
push ecx
mov ecx, 0x573058
call fcn.0043939c
push dword [ebp - 0x2c]
mov ecx, 0x571e1c
call fcn.0043939c
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x2c]
test edx, edx
je 0x478917
push edi
call fcn.00478bdc
pop ecx
mov esi, eax
test esi, esi
je 0x478901
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov ebx, eax
mov eax, 0x572fcc
test eax, eax
je 0x478b30
mov eax, 0x572fcc
cmp eax, ebx
je 0x4788a3
mov ecx, dword [ebx + 0xc]
test ecx, ecx
je 0x4788aa
push 0x572fcc
call fcn.0042ef14
movzx eax, al
test eax, eax
je 0x4788aa
mov edx, 1
jmp 0x4788c9
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x478b30
push 0x572fcc
call fcn.0042ef14
movzx eax, al
xor edx, edx
test eax, eax
setne dl
test edx, edx
je 0x478901
test esi, esi
je 0x478901
mov eax, dword [ebp - 0x2c]
mov edx, dword [esi + 0x154]
cmp edx, eax
je 0x478b1e
test edx, edx
je 0x478afc
cmp eax, dword [esi + 0x150]
je 0x478aed
mov dword [esi + 0x154], edx
mov ecx, dword [eax + 0x2c]
jmp 0x478907
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x478917
push eax
mov edx, dword [ecx]
call dword [edx + 0xe8]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0xa0]
test ecx, ecx
je 0x47892a
push 1
mov eax, dword [ecx]
call dword [eax]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x60]
test ecx, ecx
je 0x47893b
push 1
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
call fcn.00478c10
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 0xb8]
test eax, eax
je 0x478978
push eax
call fcn.00478cdc
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 0xb8]
test eax, eax
je 0x47896e
push 1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0xb8], 0
mov eax, dword [ecx + 0xc4]
test eax, eax
je 0x47898d
push ecx
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x28]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 0xc0]
test eax, eax
je 0x4789a3
push 1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 0x64]
test eax, eax
je 0x4789b5
push 1
mov edx, dword [eax]
mov ecx, eax
call dword [edx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ecx + 0xb4]
test eax, eax
je 0x4789cb
push 1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 4]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [0x573e04]
test eax, eax
je 0x4789df
push ecx
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x14]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 4], 8
add ecx, 0xe0
call fcn.004afb34
mov eax, dword [ebp - 0x2c]
add eax, 0xd4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xa
mov dword [ebp - 4], 7
mov edx, dword [eax]
mov eax, dword [edx - 0xc]
lea ecx, [edx - 0xc]
cmp eax, 0xffffffff
je 0x478a27
add eax, 0xffffffff
mov dword [edx - 0xc], eax
jne 0x478a27
push ecx
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov eax, dword [ebp - 0x2c]
add eax, 0xac
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0xb
mov dword [ebp - 4], 6
mov dword [eax], 0x588888
mov ecx, dword [ebp - 0x18]
call fcn.0042eb08
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x2c]
add ecx, 0xa4
call fcn.004b5fdc
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x2c]
add ecx, 0x8c
call fcn.004666f4
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x2c]
add ecx, 0x78
call fcn.004666f4
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x2c]
add ecx, 0x70
call fcn.00467624
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x2c]
add ecx, 0x68
call fcn.004a9094
mov ecx, dword [ebp - 0x2c]
add ecx, 0x30
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xc
mov dword [ebp - 4], 0
call fcn.00438c08
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
call fcn.00431f80
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x150], 0
jmp 0x4788f6
cmp eax, dword [esi + 0x150]
je 0x478b0c
mov ecx, dword [eax + 0x2c]
jmp 0x478907
mov dword [esi + 0x150], 0
mov ecx, dword [eax + 0x2c]
jmp 0x478907
mov dword [esi + 0x154], 0
mov ecx, dword [eax + 0x2c]
jmp 0x478907
xor edx, edx
jmp 0x4788c9