Function at 0x4f24f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fc0f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5e4ce0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
push 0x5aed5c
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0
mov dword [esp + 0x20], 0
call fcn.00407fe3
mov esi, dword [esp + 0x30]
push eax
mov ecx, esi
mov byte [esp + 0x28], 1
call fcn.004038a3
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
or edi, 0xffffffff
mov byte [esp + 0x24], 0
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4f2576
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
push 0x5af400
push eax
call fcn.004da2f9
add esp, 8
test eax, eax
sete al
test al, al
jne 0x4f264d
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
jge 0x4f25a5
push 0x80070057
call fcn.004012b7
cmp byte [eax], 0x2e
jne 0x4f25f0
mov eax, dword [eax - 0xc]
add eax, 0xffffffff
push eax
push 1
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
call fcn.004081ee
push eax
mov ecx, esi
mov byte [esp + 0x28], 2
call fcn.004038a3
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4f25f0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push ecx
push 0x5aed5c
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x38]
call fcn.00407fe3
mov eax, dword [esp + 0x10]
push 0x5af400
mov bl, 3
push eax
mov byte [esp + 0x2c], bl
call fcn.004da2f9
add esp, 8
test eax, eax
sete al
test al, al
je 0x4f2685
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f264d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x24], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x4f266e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8
mov ecx, dword [esp + 0x10]
push str.TRUE
push ecx
call fcn.004d9dd7
add esp, 8
test eax, eax
lea eax, [esp + 0x14]
push eax
push 0x5aed5c
lea ecx, [esp + 0x38]
sete dl
push ecx
lea ecx, [esp + 0x38]
mov byte [esi + 4], dl
call fcn.00407fe3
lea edi, [esi + 8]
push eax
mov ecx, edi
mov byte [esp + 0x28], 4
call fcn.004038a3
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x24], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4f26eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [edi]
push 0x5af400
push edi
call fcn.004da2f9
add esp, 8
test eax, eax
sete al
test al, al
je 0x4f274a
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f2729
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4f2662
lea ecx, [esp + 0x14]
push ecx
push 0x5aed5c
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x38]
call fcn.00407fe3
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 5
call fcn.004038a3
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x24], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f2795
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x10]
push 0x5af400
push ecx
call fcn.004da2f9
add esp, 8
test eax, eax
sete al
test al, al
je 0x4f27c7
lea ecx, [esp + 0x10]
call fcn.004010f8
lea ecx, [esp + 0x2c]
call fcn.004010f8
jmp 0x4f266e
mov edx, dword [esp + 0x10]
push str.TRUE
push edx
call fcn.004d9dd7
add esp, 8
lea ecx, [esp + 0x14]
push ecx
test eax, eax
push 0x5aed5c
lea edx, [esp + 0x38]
sete al
push edx
lea ecx, [esp + 0x38]
mov byte [esi + 0xc], al
call fcn.00407fe3
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 6
call fcn.004038a3
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.004010f8
lea eax, [esp + 0x10]
push 0x5af400
push eax
call fcn.0040363e
add esp, 8
test al, al
lea ecx, [esp + 0x10]
jne 0x4f27b4
call fcn.0041cfbb
push eax
call fcn.004db617
add esp, 4
cdq
lea ecx, [esp + 0x14]
push ecx
mov dword [esi + 0x14], edx
push 0x5aed5c
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x38]
mov dword [esi + 0x10], eax
call fcn.00407fe3
lea edi, [esi + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x28], 7
call fcn.00403891
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], bl
call fcn.004010f8
push 0x5af400
push edi
call fcn.0040363e
add esp, 8
test al, al
jne 0x4f27b0
lea eax, [esp + 0x14]
push eax
push 0x5aed5c
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x38]
call fcn.00407fe3
add esi, 0x1c
push eax
mov ecx, esi
mov byte [esp + 0x28], 8
call fcn.00403891
lea ecx, [esp + 0x30]
call fcn.004010f8
push 0x5af400
push esi
call fcn.0040363e
add esp, 8
test al, al
lea ecx, [esp + 0x10]
jne 0x4f27b4
call fcn.004010f8
lea ecx, [esp + 0x2c]
call fcn.004010f8
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8