Function at 0x475d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xe
push 0
push 0
dec ecx
jne 0x475d99
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x476196
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [ebx + 0x34], eax
xor eax, eax
mov dword [ebx + 0x38], eax
lea eax, [ebx + 0x3c]
call fcn.0040477c
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 4]
call fcn.004047d0
cmp dword [ebx + 0x40], 0
jne 0x475e7c
mov edx, dword [ebp - 4]
mov eax, 0x4761b4
call fcn.00404d80
mov esi, eax
test esi, esi
jle 0x475e52
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404c9c
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov eax, ebx
call fcn.00475a94
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004047d0
lea eax, [ebp - 0x1c]
push eax
lea edx, [esi + 1]
mov ecx, 6
mov eax, dword [ebp - 4]
call fcn.00404c9c
mov eax, dword [ebp - 0x1c]
mov edx, 0x50
call fcn.004094d0
mov word [ebx + 0x1c], ax
jmp 0x475e70
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00475a94
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x10]
call fcn.004047d0
mov word [ebx + 0x1c], 0x50
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404814
jmp 0x475ea4
cmp byte [ebx + 0x51], 0
je 0x475e9a
push 0x4761c0
push dword [ebp - 4]
push edi
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404afc
jmp 0x475ea4
lea eax, [ebp - 0x10]
mov edx, edi
call fcn.00404814
mov eax, ebx
call fcn.0047599c
test al, al
je 0x476166
mov cx, word [ebx + 0x1c]
mov edx, dword [ebx + 0x10]
mov eax, ebx
call fcn.00475b64
test al, al
je 0x476166
mov eax, edi
call fcn.00404a3c
mov esi, eax
cmp esi, 1
jl 0x475ef7
cmp byte [edi + esi - 1], 0x2f
jne 0x475ef2
lea eax, [ebx + 0x14]
push eax
mov ecx, esi
mov edx, 1
mov eax, edi
call fcn.00404c9c
jmp 0x475ef7
dec esi
test esi, esi
jne 0x475ed7
push 0x4761c0
push dword [ebp - 4]
push edi
lea eax, [ebx + 0x18]
mov edx, 3
call fcn.00404afc
push 0x4761d0
push dword [ebx + 0x28]
push 0x4761e8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404afc
cmp dword [ebx + 0x20], 0
je 0x475f4a
push dword [ebp - 0xc]
push 0x4761f4
push dword [ebx + 0x20]
push 0x4761e8
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404afc
cmp dword [ebx + 0x24], 0
je 0x475f6d
push dword [ebp - 0xc]
push 0x476208
push dword [ebx + 0x24]
push 0x4761e8
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404afc
cmp dword [ebp + 8], 0
jne 0x475fb3
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea edx, [ebp - 0x3c]
mov ecx, 2
mov eax, 0x47621c
call fcn.0040a47c
mov edx, dword [ebp - 0x24]
mov eax, ebx
call fcn.00475c8c
jmp 0x47600b
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x5c], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x54], 0xb
mov eax, dword [ebp + 8]
call fcn.00404a3c
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x4c], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x44], 0xb
lea edx, [ebp - 0x60]
mov ecx, 3
mov eax, 0x47628c
call fcn.0040a47c
lea eax, [ebp - 0x40]
mov edx, dword [ebp + 8]
call fcn.00404a44
mov edx, dword [ebp - 0x40]
mov eax, ebx
call fcn.00475c8c
push 0x3e8
call sub.kernel32.dll_Sleep_1
mov eax, ebx
call fcn.004763d0
mov byte [ebp - 5], al
mov eax, ebx
call fcn.00475a68
cmp byte [ebx + 0x50], 0
je 0x476166
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x476340
mov edx, 0x47634c
mov eax, dword [ebx + 0x3c]
call fcn.00475730
cmp dword [ebp - 0x10], 0
je 0x476166
mov edx, dword [ebp - 0x10]
mov eax, 0x476360
call fcn.00404d80
test eax, eax
jle 0x4760b9
push 0
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x47636c
mov edx, 0x4761c0
mov eax, dword [ebp - 0x10]
call fcn.00475730
mov edx, dword [ebp - 0x64]
lea eax, [ebx + 0xc]
call fcn.004047d0
push 0
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
mov ecx, 0x476340
mov edx, dword [ebp - 0x10]
call fcn.00404a88
mov eax, dword [ebp - 0x6c]
mov ecx, 0x476340
mov edx, dword [ebx + 0xc]
call fcn.00475730
mov edx, dword [ebp - 0x68]
lea eax, [ebp - 0x10]
call fcn.00404814
jmp 0x476113
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 0x10]
call fcn.00408f9c
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x10]
call fcn.00404814
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0x2f
je 0x476113
mov eax, edi
call fcn.00404a3c
mov esi, eax
cmp esi, 1
jl 0x476113
cmp byte [edi + esi - 1], 0x2f
jne 0x47610e
lea eax, [ebp - 0x74]
push eax
mov ecx, esi
mov edx, 1
mov eax, edi
call fcn.00404c9c
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
call fcn.00404a88
jmp 0x476113
dec esi
test esi, esi
jne 0x4760e5
cmp dword [ebx + 0x54], 0
je 0x47614b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebx + 0x54]
call fcn.00404d80
test eax, eax
jle 0x47614b
mov al, byte [0x476370]
push eax
lea eax, [ebp - 0x78]
push eax
mov ecx, dword [ebx + 0x58]
mov edx, dword [ebx + 0x54]
mov eax, dword [ebp - 0x10]
call fcn.0040e4c4
mov edx, dword [ebp - 0x78]
lea eax, [ebp - 0x10]
call fcn.00404814
cmp dword [ebx + 0x4c], 9
jge 0x476166
inc dword [ebx + 0x4c]
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebx + 0xc]
mov eax, ebx
call fcn.00475d90
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47619d
lea eax, [ebp - 0x78]
mov edx, 6
call fcn.004047a0
lea eax, [ebp - 0x40]
call fcn.0040477c
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.004047a0
ret