Function at 0x4ff070
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x740888
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
sub eax, 1
sub ecx, 1
push edi
mov dword [esp + 0x40], eax
lea eax, [esp + 0x34]
xor edi, edi
mov dword [esp + 0x3c], ecx
push eax
lea ecx, [esp + 0x58]
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
call fcn.00432f00
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov dword [esp + 0x30], ecx
call dword [edx + 0x24]
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov dword [esp + 0x4c], edi
mov dword [esp + 0x2c], ecx
call dword [eax + 0x24]
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov byte [esp + 0x4c], 1
mov dword [esp + 0x28], ecx
call dword [edx + 0x24]
cmp dword [esi + 0x3e8c], edi
mov byte [esp + 0x4c], 2
jne 0x4ff6ed
mov eax, dword [esi + 0x3e78]
cmp eax, 7
jne 0x4ff21e
mov ebp, dword [esp + 0x58]
cmp ebp, dword [esp + 0x60]
jg 0x4ff880
mov edi, dword [esp + 0x54]
lea esp, [esp]
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
push ebp
push edi
call dword [eax + 0x44]
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x3ea8]
mov ebx, dword [ecx]
cdq
sub eax, edx
sar eax, 1
add eax, ebp
push eax
mov eax, dword [esi + 0x3ea4]
cdq
sub eax, edx
sar eax, 1
add eax, edi
push eax
call dword [ebx + 0x44]
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
push ebp
push edi
mov ebx, eax
call dword [edx + 0x44]
mov ecx, dword [esi + 0xc]
push ebp
mov dword [esp + 0x1c], eax
mov eax, dword [ecx]
push edi
call dword [eax + 0x44]
mov ecx, dword [esp + 0x5c]
cmp edi, ecx
mov dword [esp + 0x1c], eax
jg 0x4ff20c
sub ecx, edi
add ecx, 1
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x14]
mov al, byte [edx]
test al, al
je 0x4ff1e1
cmp al, 0xe0
jae 0x4ff1e1
movzx eax, al
mov al, byte [eax + esi + 0x20]
cmp al, 0xff
je 0x4ff1e1
movzx eax, al
lea edx, [eax*8]
sub edx, eax
add edx, edx
sub edx, eax
mov ax, word [esi + edx*4 + 0x12c]
cmp ax, word [esi + 0x3e7c]
jne 0x4ff1e1
mov ecx, dword [esp + 0x18]
mov dx, word [ecx]
mov eax, dword [esp + 0x1c]
mov word [ebx], dx
mov cl, byte [eax]
push 0
push ebx
push ecx
call fcn.004faf30
mov ecx, dword [esp + 0x2c]
add esp, 0xc
jmp 0x4ff1eb
mov edx, dword [esp + 0x18]
mov ax, word [edx]
mov word [ebx], ax
add dword [esp + 0x18], 2
mov eax, 1
add dword [esp + 0x14], eax
add dword [esp + 0x1c], eax
add ebx, 2
sub ecx, eax
mov dword [esp + 0x20], ecx
jne 0x4ff185
add ebp, 1
cmp ebp, dword [esp + 0x60]
jle 0x4ff120
jmp 0x4ff880
cmp eax, 8
jne 0x4ff3b7
mov eax, dword [esp + 0x58]
cmp eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
jg 0x4ff880
mov ebx, dword [esp + 0x54]
lea ecx, [ecx]
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
push eax
push ebx
call dword [edx + 0x44]
mov ebp, eax
mov eax, dword [esi + 0x3ea8]
mov ecx, dword [esi + 0x10]
mov edi, dword [ecx]
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x3ea4]
cdq
sub eax, edx
sar eax, 1
add eax, ebx
push eax
call dword [edi + 0x44]
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov edi, eax
mov eax, dword [esp + 0x14]
push eax
push ebx
call dword [edx + 0x44]
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
push eax
push ebx
call dword [edx + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
cmp ebx, eax
jg 0x4ff39d
sub eax, ebx
add eax, 1
mov dword [esp + 0x24], eax
mov al, byte [ebp]
test al, al
je 0x4ff376
cmp al, 0xe0
jae 0x4ff376
movzx ecx, al
cmp byte [ecx + esi + 0x20], 0xff
je 0x4ff376
mov edx, dword [esp + 0x18]
mov ax, word [edx]
mov word [edi], ax
movzx ecx, byte [ebp]
movzx eax, byte [ecx + esi + 0x20]
lea ecx, [ecx + esi + 0x20]
lea edx, [eax*8]
sub edx, eax
add edx, edx
sub edx, eax
lea eax, [esi + edx*4]
mov dx, word [eax + 0x14e]
cmp dx, word [eax + 0x14c]
movzx eax, byte [ecx]
lea ecx, [eax*8]
je 0x4ff35a
sub ecx, eax
add ecx, ecx
sub ecx, eax
movzx edx, word [esi + ecx*4 + 0x14e]
lea eax, [esi + ecx*4]
mov ecx, dword [esp + 0x1c]
mov word [esp + 0x20], dx
mov dl, byte [ecx]
shr dl, 3
add dl, 1
lea ecx, [esp + 0x20]
push edx
mov dx, word [eax + 0x14c]
push ecx
push edx
call fcn.0042f0f0
mov eax, dword [esp + 0x2c]
push 0x12
push edi
push eax
call fcn.0042f0f0
add esp, 0x18
jmp 0x4ff380
sub ecx, eax
add ecx, ecx
sub ecx, eax
mov dx, word [esi + ecx*4 + 0x14e]
push 0x12
push edi
push edx
call fcn.0042f0f0
add esp, 0xc
jmp 0x4ff380
mov eax, dword [esp + 0x18]
mov cx, word [eax]
mov word [edi], cx
add dword [esp + 0x18], 2
mov eax, 1
add dword [esp + 0x1c], eax
add ebp, eax
add edi, 2
sub dword [esp + 0x24], eax
jne 0x4ff2b1
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
jle 0x4ff240
jmp 0x4ff880
cmp eax, 0xa
je 0x4ff4f5
cmp eax, 0x10
je 0x4ff4f5
cmp eax, 0x13
je 0x4ff4f5
cmp eax, 0xf
jne 0x4ff3fb
mov eax, dword [esi + 0x3e9c]
mov edx, eax
shl edx, 6
sub edx, eax
add edx, edx
sub edx, eax
mov eax, dword [0x914298]
cmp dword [eax + edx*4 + 0xedb4], 2
je 0x4ff4f5
mov ebp, dword [esp + 0x58]
cmp ebp, dword [esp + 0x60]
mov dword [esp + 0x14], ebp
jg 0x4ff880
jmp 0x4ff413
mov ebp, dword [esp + 0x14]
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0x54]
mov edx, dword [ecx]
push ebp
push eax
call dword [edx + 0x44]
mov ebx, eax
mov eax, dword [esi + 0x3ea8]
mov ecx, dword [esi + 0x10]
mov edi, dword [ecx]
cdq
sub eax, edx
sar eax, 1
add eax, ebp
push eax
mov eax, dword [esi + 0x3ea4]
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x58]
push eax
call dword [edi + 0x44]
mov ecx, dword [esi + 0x1c]
mov edx, dword [ecx]
mov edi, eax
mov eax, dword [esp + 0x54]
push ebp
push eax
call dword [edx + 0x44]
mov ecx, dword [esp + 0x5c]
mov ebp, eax
mov eax, dword [esp + 0x54]
cmp eax, ecx
jg 0x4ff4db
sub ecx, eax
add ecx, 1
mov dword [esp + 0x24], ecx
mov al, byte [ebx]
test al, al
je 0x4ff4c2
cmp al, 0xe0
jae 0x4ff4c2
movzx edx, al
cmp byte [edx + esi + 0x20], 0xff
je 0x4ff4c2
mov ax, word [ebp]
mov word [edi], ax
movzx ecx, byte [ebx]
movzx eax, byte [ecx + esi + 0x20]
lea edx, [eax*8]
sub edx, eax
add edx, edx
sub edx, eax
mov cl, byte [esi + edx*4 + 0x130]
lea eax, [esi + edx*4]
mov dx, word [eax + 0x12e]
push ecx
push edi
push edx
call fcn.0042f0f0
mov ecx, dword [esp + 0x30]
add esp, 0xc
jmp 0x4ff4c9
mov ax, word [ebp]
mov word [edi], ax
add ebx, 1
add edi, 2
add ebp, 2
sub ecx, 1
mov dword [esp + 0x24], ecx
jne 0x4ff470
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
jle 0x4ff40f
jmp 0x4ff880
mov eax, dword [esp + 0x58]
cmp eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
jg 0x4ff880
jmp 0x4ff510
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 4]
mov ebp, dword [esp + 0x54]
mov edx, dword [ecx]
push eax
push ebp
call dword [edx + 0x44]
mov ebx, eax
mov eax, dword [esi + 0x3ea8]
mov ecx, dword [esi + 0x10]
mov edi, dword [ecx]
cdq
sub eax, edx
sar eax, 1
add eax, dword [esp + 0x14]
push eax
mov eax, dword [esi + 0x3ea4]
cdq
sub eax, edx
sar eax, 1
add eax, ebp
push eax
call dword [edi + 0x44]
mov ecx, dword [esi + 8]
mov edx, dword [ecx]
mov edi, eax
mov eax, dword [esp + 0x14]
push eax
push ebp
call dword [edx + 0x44]
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
push eax
push ebp
call dword [edx + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
cmp ebp, eax
jg 0x4ff6d3
sub eax, ebp
add eax, 1
mov dword [esp + 0x20], eax
mov al, byte [ebx]
test al, al
je 0x4ff6ac
cmp al, 0xe0
jae 0x4ff6ac
movzx ecx, al
cmp byte [ecx + esi + 0x20], 0xff
je 0x4ff6ac
mov edx, dword [esp + 0x18]
mov dx, word [edx]
mov word [edi], dx
movzx eax, byte [ebx]
movzx eax, byte [eax + esi + 0x20]
lea ecx, [eax*8]
sub ecx, eax
add ecx, ecx
sub ecx, eax
lea eax, [esi + ecx*4]
mov cl, byte [eax + 0x130]
movzx eax, word [eax + 0x12e]
mov byte [esp + 0x10], cl
mov ecx, eax
movzx edx, dx
shl ecx, 0x10
or ecx, eax
mov eax, edx
shl eax, 0x10
or eax, edx
movzx edx, byte [esp + 0x10]
and ecx, 0x7e0f81f
and eax, 0x7e0f81f
sub eax, ecx
imul eax, edx
shl ecx, 5
add eax, ecx
shr eax, 5
and eax, 0x7e0f81f
mov ecx, eax
shr ecx, 0x10
or ecx, eax
mov word [edi], cx
movzx edx, byte [ebx]
movzx eax, byte [edx + esi + 0x20]
lea ecx, [edx + esi + 0x20]
lea edx, [eax*8]
sub edx, eax
add edx, edx
sub edx, eax
cmp word [esi + edx*4 + 0x150], 0
lea ebp, [esi + edx*4]
je 0x4ff67e
mov ecx, dword [esp + 0x1c]
mov dl, byte [ecx]
mov cx, word [ebp + 0x150]
mov ax, word [ebp + 0x12e]
shr dl, 3
add dl, 1
mov word [esp + 0x24], ax
lea eax, [esp + 0x24]
push edx
push eax
push ecx
call fcn.0042f0f0
mov dl, byte [ebp + 0x130]
mov eax, dword [esp + 0x30]
push edx
push edi
push eax
call fcn.0042f0f0
add esp, 0x18
jmp 0x4ff6b6
movzx eax, byte [ecx]
lea ecx, [eax*8]
sub ecx, eax
add ecx, ecx
sub ecx, eax
mov dl, byte [esi + ecx*4 + 0x130]
lea eax, [esi + ecx*4]
mov ax, word [eax + 0x12e]
push edx
push edi
push eax
call fcn.0042f0f0
add esp, 0xc
jmp 0x4ff6b6
mov ecx, dword [esp + 0x18]
mov dx, word [ecx]
mov word [edi], dx
add dword [esp + 0x18], 2
mov eax, 1
add dword [esp + 0x1c], eax
add ebx, eax
add edi, 2
sub dword [esp + 0x20], eax
jne 0x4ff585
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
jle 0x4ff510
jmp 0x4ff880
mov edi, dword [esp + 0x58]
cmp edi, dword [esp + 0x60]
mov dword [esp + 0x14], edi
jg 0x4ff880
jmp 0x4ff705
mov edi, dword [esp + 0x14]
mov ecx, dword [esi + 4]
mov ebx, dword [esp + 0x54]
mov eax, dword [ecx]
push edi
push ebx
call dword [eax + 0x44]
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
push edi
push ebx
mov ebp, eax
call dword [edx + 0x44]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 8]
push edx
mov edi, eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x44]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0xc]
push edx
mov dword [esp + 0x1c], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
cmp ebx, eax
jg 0x4ff86b
sub eax, ebx
add eax, 1
mov dword [esp + 0x24], eax
lea ebx, [ebx]
mov al, byte [ebp]
test al, al
je 0x4ff844
cmp al, 0xe0
jae 0x4ff844
movzx eax, al
cmp byte [eax + esi + 0x20], 0xff
je 0x4ff844
mov ecx, dword [esp + 0x18]
movzx edx, word [ecx]
mov word [edi], dx
movzx eax, byte [ebp]
movzx eax, byte [eax + esi + 0x20]
lea ecx, [eax*8]
sub ecx, eax
add ecx, ecx
sub ecx, eax
mov dl, byte [esi + ecx*4 + 0x130]
sub dl, byte [esi + 0x3e4a]
lea eax, [esi + ecx*4]
neg dl
sbb dl, dl
and dl, 0xe7
add dl, 0x1a
mov byte [esp + 0x20], dl
mov dx, word [eax + 0x12e]
mov ecx, dword [esp + 0x20]
push ecx
push edi
push edx
call fcn.004fae90
movzx eax, byte [ebp]
movzx eax, byte [eax + esi + 0x20]
lea ecx, [eax*8]
sub ecx, eax
add ecx, ecx
sub ecx, eax
mov ax, word [esi + ecx*4 + 0x150]
add esp, 0xc
test ax, ax
je 0x4ff84e
movzx ebx, word [edi]
mov edx, dword [esp + 0x1c]
mov dl, byte [edx]
movzx eax, ax
mov ecx, eax
shl ecx, 0x10
or ecx, eax
shr dl, 3
mov eax, ebx
shl eax, 0x10
or eax, ebx
and eax, 0x7e0f81f
and ecx, 0x7e0f81f
sub eax, ecx
add dl, 1
movzx edx, dl
imul eax, edx
shl ecx, 5
add eax, ecx
shr eax, 5
and eax, 0x7e0f81f
mov ecx, eax
shr ecx, 0x10
or ecx, eax
mov word [edi], cx
jmp 0x4ff84e
mov edx, dword [esp + 0x18]
mov ax, word [edx]
mov word [edi], ax
add dword [esp + 0x18], 2
mov eax, 1
add dword [esp + 0x1c], eax
add ebp, eax
add edi, 2
sub dword [esp + 0x24], eax
jne 0x4ff760
mov eax, dword [esp + 0x14]
add eax, 1
cmp eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
jle 0x4ff701
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx]
mov byte [esp + 0x4c], 1
call dword [edx + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx]
mov byte [esp + 0x4c], 0
call dword [eax + 0x28]
mov ecx, dword [esp + 0x30]
mov edx, dword [ecx]
mov dword [esp + 0x4c], 0xffffffff
call dword [edx + 0x28]
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 0x10