Function at 0x496a08
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x496d15
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x496d2c
call fcn.004051b8
push 0
mov ecx, 0x496d3c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004707e0
mov edx, dword [ebx + 0x11c]
mov dword [edx + 4], eax
push 0
mov ecx, 0x496d50
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004707e0
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0xc], eax
push 0
mov ecx, 0x496d64
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004707e0
mov edx, dword [ebx + 0x11c]
mov dword [edx + 8], eax
push 0
mov ecx, 0x496d78
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004707e0
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x10], eax
push 0
mov ecx, 0x496d90
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004707e0
mov esi, dword [ebx + 0x11c]
mov dword [esi + 0x18], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x496da0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004706b0
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 0x14]
mov eax, ebx
call fcn.00495544
push 0
mov ecx, 0x496db0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004707e0
mov esi, dword [ebx + 0x11c]
mov dword [esi + 0x1c], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x496dc0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004706b0
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi + 0x44]
mov eax, ebx
call fcn.00495544
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x496dd4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004706b0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x11c]
mov edx, dword [eax + 0x48]
mov eax, ebx
call fcn.00495544
push 0xffffffffffffffff
mov ecx, 0x496de8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004707e0
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x2c], eax
push 0xffffffffffffffff
mov ecx, 0x496e00
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004707e0
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x30], eax
push 0xffffffffffffffff
mov ecx, 0x496e18
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004707e0
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x34], eax
push 0
mov ecx, 0x496e30
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004707e0
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x4c], eax
push 0
mov ecx, 0x496e4c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004707e0
mov esi, dword [ebx + 0x11c]
mov dword [esi + 0x50], eax
cmp dword [esi + 0x1c], 1
jle 0x496bd7
xor eax, eax
mov dword [esi + 0x1c], eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x496e68
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004706b0
cmp dword [ebp - 8], 0
je 0x496bff
mov eax, dword [ebx + 0x11c]
mov byte [eax + 0x54], 1
jmp 0x496c09
mov eax, dword [ebx + 0x11c]
mov byte [eax + 0x54], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x496e80
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004706b0
cmp dword [ebp - 8], 0
je 0x496c31
mov eax, dword [ebx + 0x11c]
mov byte [eax + 0x55], 1
jmp 0x496c3b
mov eax, dword [ebx + 0x11c]
mov byte [eax + 0x55], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x496e9c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004706b0
cmp dword [ebp - 8], 0
je 0x496c63
mov eax, dword [ebx + 0x11c]
mov byte [eax + 0x56], 1
jmp 0x496c6d
mov eax, dword [ebx + 0x11c]
mov byte [eax + 0x56], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x496e68
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004706b0
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebx + 0xb8]
mov eax, ebx
call fcn.00497e48
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x38], eax
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x496e80
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004706b0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0xb8]
mov eax, ebx
call fcn.00497e48
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x3c], eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x496e9c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004706b0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebx + 0xb8]
mov eax, ebx
call fcn.00497e48
mov edx, dword [ebx + 0x11c]
mov dword [edx + 0x40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496d1c
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00405144
ret