Function at 0x4d3ae4
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404d84
lea esi, [ebp - 0x10]
xor eax, eax
push ebp
push 0x4d3e45
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x4d3e22
xor edx, edx
push ebp
push 0x4d3e09
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [0x4ce5f0]
mov eax, 0x5c
call fcn.00405918
mov ebx, eax
mov edx, 0x5c
mov eax, ebx
call fcn.00407bb8
lea eax, [ebp - 0x2e]
mov edx, 0x1e
call fcn.00407bb8
mov dword [ebx], edi
jmp 0x4d3cae
mov ecx, esi
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cf490
mov eax, dword [esi]
cmp eax, 0xb
jg 0x4d3b9b
cmp byte [ebp + eax - 0x2f], 0
jne 0x4d3b97
mov byte [ebp + eax - 0x2f], 1
jmp 0x4d3b9b
xor eax, eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, 0xb
ja case.0x4d3ba6.0
jmp dword [eax*4 + 0x4d3bad]
lea ecx, [ebp - 0x34]
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cf608
mov edx, dword [ebp - 0x34]
lea eax, [ebx + 4]
call fcn.00404928
jmp 0x4d3cae
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cf518
mov dword [ebx + 0xc], eax
jmp 0x4d3cae
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cf518
mov dword [ebx + 0x10], eax
jmp 0x4d3cae
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cf518
mov dword [ebx + 0x14], eax
jmp 0x4d3cae
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cf518
mov dword [ebx + 0x2c], eax
jmp 0x4d3cae
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cf518
mov dword [ebx + 0x18], eax
jmp 0x4d3cae
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cf518
mov dword [ebx + 0x1c], eax
jmp 0x4d3cae
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cf518
mov dword [ebx + 0x20], eax
jmp 0x4d3cae
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cf518
mov dword [ebx + 0x34], eax
jmp 0x4d3cae
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cf518
mov dword [ebx + 0x38], eax
jmp 0x4d3cae
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004cf518
mov dword [ebx + 0x3c], eax
jmp 0x4d3cae
lea edx, [ebp - 8]
mov ecx, esi
mov eax, dword [ebp - 4]
call fcn.004cf968
mov eax, dword [ebp - 8]
call fcn.00404b94
cmp eax, 2
jge 0x4d3b75
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4d3d2b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
mov edx, esi
call fcn.0041a550
mov edi, eax
test edi, edi
jne 0x4d3cf9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
mov edx, esi
call fcn.0041a3f0
jmp 0x4d3d25
mov eax, dword [edi + 4]
mov edx, dword [ebx + 4]
call fcn.00404ce0
jne 0x4d3d25
mov edx, dword [0x4ce5f0]
mov eax, edi
call fcn.0040592c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
mov edx, esi
call fcn.0041a3f0
jmp 0x4d3d2b
dec esi
cmp esi, 0xffffffff
jne 0x4d3cd1
push 0x4d3e5c
push 0
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x3c]
mov eax, dword [ebx + 0xc]
call fcn.004094d8
mov ecx, dword [ebp - 0x3c]
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.004d530c
mov eax, dword [ebp - 0x38]
call fcn.00409614
mov dword [ebx + 0x28], eax
push 0x4d3e70
push 0
lea eax, [ebp - 0x40]
push eax
lea edx, [ebp - 0x44]
mov eax, dword [ebx + 0xc]
call fcn.004094d8
mov ecx, dword [ebp - 0x44]
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.004d530c
mov edx, dword [ebp - 0x40]
lea eax, [ebx + 8]
call fcn.00404928
push 0x4d3e70
push 0
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x4c]
mov eax, dword [ebx + 0x18]
call fcn.004094d8
mov ecx, dword [ebp - 0x4c]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004d530c
mov edx, dword [ebp - 0x48]
lea eax, [ebx + 0x30]
call fcn.00404928
push 0x4d3e80
push 0
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x54]
mov eax, dword [ebx + 0x18]
call fcn.004094d8
mov ecx, dword [ebp - 0x54]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004d530c
mov eax, dword [ebp - 0x50]
call fcn.00409614
mov dword [ebx + 0x24], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc0]
mov edx, ebx
call fcn.0041a3a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d3e22
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3e4c
lea eax, [ebp - 0x54]
mov edx, 9
call fcn.004048f8
lea eax, [ebp - 8]
call fcn.004048d4
ret