Function at 0x471e40
Capabilities:
Access peb ldr_data
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bc61b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ea160]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
lea eax, [ebx + 8]
mov dword [ebx], vtable.FCOasys.0
mov dword [ebp - 0x14], eax
lea esi, [eax + 8]
mov dword [eax], vtable.FCVWin.0
mov ecx, esi
mov dword [eax + 4], 0
mov dword [esi], vtable.FCString.0
call fcn.00451b70
push 0
push 0x100
mov ecx, esi
call fcn.00450e40
mov dword [ebp - 4], 1
mov dword [ebx + 0x1c], vtable.FCEvent.0
mov dword [ebx + 0x20], 0
mov byte [ebp - 4], 2
mov dword [ebx + 0x24], vtable.FCEvent.0
mov dword [ebx + 0x28], 0
mov byte [ebp - 4], 3
mov dword [ebx + 0x2c], vtable.FCEvent.0
mov dword [ebx + 0x30], 0
mov byte [ebp - 4], 4
mov dword [ebx + 0x34], vtable.FCEvent.0
mov dword [ebx + 0x38], 0
mov byte [ebp - 4], 5
mov dword [ebx + 0x50], vtable.FCThread.0
mov dword [ebx + 0x54], 0
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov byte [ebp - 4], 6
lea eax, [ebx + 0x6c]
push eax
mov dword [ebx + 0x68], vtable.FCCriticalSection.0
mov dword [ebx + 0x84], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 7
lea ecx, [ebx + 0x88]
mov dword [ebx + 0x88], vtable.FCString.0
call fcn.00451b70
push 0
push 0x100
lea ecx, [ebx + 0x88]
call fcn.00450e40
mov byte [ebp - 4], 8
lea ecx, [ebx + 0x94]
mov dword [ebx + 0x94], vtable.FCString.0
call fcn.00451b70
push 0
push 0x100
lea ecx, [ebx + 0x94]
call fcn.00450e40
mov byte [ebp - 4], 9
lea ecx, [ebx + 0xa0]
call fcn.00471ad0
mov byte [ebp - 4], 0xa
mov dword [ebx + 0xb4], vtable.FCThread.0
mov dword [ebx + 0xb8], 0
mov dword [ebx + 0xbc], 0
mov dword [ebx + 0xc0], 0
mov dword [ebx + 0xc4], 0
mov byte [ebp - 4], 0xb
mov dword [ebx + 0xc8], vtable.FCXList_class_FCVWin_.0
mov dword [ebx + 0xcc], 0
mov dword [ebx + 0xd0], 0
mov byte [ebp - 4], 0xc
mov dword [ebx + method.FCString.virtual_0], vtable.FCString.0
lea ecx, [ebx + 0x104]
call fcn.00451b70
push 0
push 0x100
lea ecx, [ebx + 0x104]
call fcn.00450e40
mov byte [ebp - 4], 0xd
lea edi, [ebx + 0x110]
lea eax, [edi + 0x28]
mov dword [ebp - 0x14], edi
push eax
mov dword [edi + 0x24], vtable.FCRect.0
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov byte [ebp - 4], 0xe
lea ecx, [edi + 0x38]
mov dword [edi + 0x38], vtable.FCString.0
call fcn.00451b70
push 0
push 0x100
lea ecx, [edi + 0x38]
call fcn.00450e40
mov byte [ebp - 4], 0xf
lea ecx, [edi + 0x44]
mov dword [edi + 0x44], vtable.FCString.0
call fcn.00451b70
push 0
push 0x100
lea ecx, [edi + 0x44]
call fcn.00450e40
mov byte [ebp - 4], 0x10
mov dword [edi], 0
mov dword [edi + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x1c], 0
mov byte [ebp - 4], 0x11
lea eax, [ebx + 0x164]
push 0x4ce828
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [ebp + 8]
lea eax, [ebx + 0xd8]
push eax
mov dword [ebx + 4], 0
mov dword [ebx + 0x268], 0
mov dword [ebx + 0x264], 0
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x100], 0
mov dword [ebx + 0x4c], 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebx + 0x1c]
mov ecx, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov eax, dword [eax + 4]
cmp eax, method.FCEvent.virtual_4
jne 0x472153
cmp dword [ebx + 0x20], 0
jne 0x472162
push 0
push 1
push 1
push 0
call ecx
mov dword [ebx + 0x20], eax
jmp 0x47215c
push 1
push 1
lea ecx, [ebx + 0x1c]
call eax
mov ecx, dword [sym.imp.KERNEL32.dll_CreateEventA]
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + 4]
cmp eax, method.FCEvent.virtual_4
jne 0x472184
cmp dword [ebx + 0x28], 0
jne 0x47218d
push 0
push 1
push 1
push 0
call ecx
mov dword [ebx + 0x28], eax
jmp 0x47218d
push 1
push 1
lea ecx, [ebx + 0x24]
call eax
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 4]
cmp eax, method.FCEvent.virtual_4
jne 0x4721b3
cmp dword [ebx + 0x30], 0
jne 0x4721bc
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x30], eax
jmp 0x4721bc
push 1
push 1
lea ecx, [ebx + 0x2c]
call eax
mov eax, dword [ebx + 0x34]
mov dword [ebx + 0xd4], 0
mov dword [ebx + 0xfc], 0
mov eax, dword [eax + 4]
cmp eax, method.FCEvent.virtual_4
jne 0x4721f6
cmp dword [ebx + 0x38], 0
jne 0x4721ff
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebx + 0x38], eax
jmp 0x4721ff
push 0
push 1
lea ecx, [ebx + 0x34]
call eax
push 4
push ebx
push 0x474450
lea ecx, [ebx + 0x50]
call fcn.00471900
mov edi, dword [sym.imp.USER32.dll_GetParent]
push esi
mov dword [ebx + 0x64], 0
mov dword [0x4f3724], ebx
call edi
test eax, eax
je 0x47223c
nop dword [eax]
push esi
call edi
mov esi, eax
push esi
call edi
test eax, eax
jne 0x472230
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0x473d70
push 0xfffffffffffffffc
push esi
mov dword [0x4f3720], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea ecx, [ebx + 0x50]
call fcn.004719e0
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4