Function at 0x4d6250
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x55a016
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x6397d4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push 0x3d
lea eax, [esi + 0x34]
push ebx
push eax
mov dword [esi], vtable.COBalloonName.0
mov dword [esi + 0x74], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0xfc], ebx
mov word [esi + 0xf8], bx
mov dword [esi + 0x100], ebx
mov byte [esi + 0x104], bl
mov dword [esi + 0x78], 0xffffff
mov dword [esi + 0x80], 0xff00
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call sub.MSVCR80.dll_memset
xor eax, eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
mov byte [esi + 0x94], al
mov dword [esi + 0x95], eax
mov dword [esi + 0x99], eax
mov dword [esi + 0x9d], eax
mov dword [esi + 0xa1], eax
mov dword [esi + 0xa5], eax
mov dword [esi + 0xa9], eax
mov dword [esi + 0xad], eax
mov dword [esi + 0xb1], eax
mov byte [esi + 0xb5], al
mov dword [esi + 0xb6], eax
mov dword [esi + 0xba], eax
mov dword [esi + 0xbe], eax
mov dword [esi + 0xc2], eax
mov dword [esi + 0xc6], eax
mov dword [esi + 0xca], eax
mov dword [esi + 0xce], eax
mov dword [esi + 0xd2], eax
mov byte [esi + 0xd6], al
mov dword [esi + 0xd7], eax
mov dword [esi + 0xdb], eax
mov dword [esi + 0xdf], eax
mov dword [esi + 0xe3], eax
mov dword [esi + 0xe7], eax
mov dword [esi + 0xeb], eax
mov dword [esi + 0xef], eax
mov dword [esi + 0xf3], eax
mov byte [esi + 0xf7], al
mov dword [esi + 0x158], eax
mov dword [esi + 0x15c], eax
mov dword [esi + 0x160], eax
mov dword [esi + 0x164], eax
mov dword [esi + 0x168], eax
mov dword [esi + 0x16c], eax
mov dword [esi + 0x170], eax
mov dword [esi + 0x174], eax
mov byte [esi + 0x178], al
mov dword [esi + 0x12c], eax
mov dword [esi + 0x130], eax
mov dword [esi + 0x134], eax
mov dword [esi + 0x138], eax
mov dword [esi + 0x13c], eax
mov dword [esi + 0x140], eax
mov dword [esi + 0x144], eax
mov dword [esi + 0x148], eax
push 0x184
mov byte [esi + 0x14c], al
call fcn.00551850
add esp, 0x10
mov dword [esp + 0xc], eax
cmp eax, ebx
mov dword [esp + 0x18], ebx
je 0x4d642a
mov ecx, eax
call fcn.00423720
jmp 0x4d642c
xor eax, eax
push 0x20
mov dword [esp + 0x1c], 0xffffffff
mov dword [esi + 0x10c], eax
mov dword [esi + 0x108], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x154], ebx
call fcn.00551850
add esp, 4
mov dword [esp + 0xc], eax
cmp eax, ebx
mov dword [esp + 0x18], 1
je 0x4d64ab
mov ecx, eax
call fcn.0041fed0
mov dword [esi + 0x17c], eax
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
mov dword [esi + 0x17c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret