Function at 0x4f0f60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6706ff
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6d7160]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
mov eax, esi
call fcn.004ca650
mov ecx, dword [esp + 0x34]
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov eax, dword [esp + 0x30]
mov dword [esi], vtable.ytXMPReader.0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], ebp
mov byte [esp + 0x24], 1
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], ebp
mov byte [esp + 0x24], 2
mov dword [esi + 0x40], ebp
lea eax, [esi + 0x44]
mov byte [esp + 0x24], 3
call fcn.00495bc0
fldz
mov dword [eax], vtable.RegionInfo.0
fst dword [eax + 8]
fst dword [eax + 0xc]
mov dword [eax + 0x18], ebp
fst dword [eax + 0x10]
fstp dword [eax + 0x14]
mov byte [esp + 0x24], 4
mov dword [esi + 0x60], 0xffffffff
mov dword [esi + 0x64], ebp
mov dword [esi + 0x68], ebp
mov byte [esp + 0x24], 5
mov byte [esi + 0x25], 1
mov eax, dword [esi + 0x3c]
mov ecx, eax
shr eax, 1
and ecx, 1
cmp eax, 0xb
je 0x4f1240
cmp ecx, ebp
je 0x4f110c
xor ecx, ecx
mov eax, 0xb
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
call fcn.00457920
cmp eax, ebp
je 0x4f10fb
lea edi, [eax + 4]
mov dword [eax], 0xb
push 4
mov ebx, 0x401810
lea eax, [ebp + 0xb]
mov ecx, edi
mov dword [esp + 0x1c], edi
call fcn.00401380
cmp edi, ebp
je 0x4f10fb
mov eax, dword [esi + 0x3c]
shr eax, 1
cmp eax, 0xb
mov dword [esp + 0x30], 0xb
ja 0x4f1089
mov dword [esp + 0x30], eax
xor eax, eax
cmp dword [esp + 0x30], ebp
mov dword [esp + 0x34], eax
jbe 0x4f10ec
mov ecx, dword [esi + 0x38]
mov edx, dword [edi]
cmp edx, dword [ecx + eax*4]
lea ebx, [ecx + eax*4]
je 0x4f10d4
call fcn.00401700
mov eax, dword [ebx]
cmp eax, ebp
mov dword [edi], eax
je 0x4f10d4
movzx ecx, byte [eax]
cmp ecx, 0x80
jae 0x4f10cd
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
cmp eax, 0xff
jne 0x4f10d4
mov eax, edi
call fcn.00459380
mov eax, dword [esp + 0x34]
add eax, 1
add edi, 4
cmp eax, dword [esp + 0x30]
mov dword [esp + 0x34], eax
jb 0x4f1095
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x38]
cmp eax, ebp
je 0x4f10f8
call fcn.004012e0
mov dword [esi + 0x38], edi
mov edx, dword [esi + 0x3c]
and edx, 1
or edx, 0x16
mov dword [esi + 0x3c], edx
jmp 0x4f1240
mov edi, 1
add edi, edi
cmp edi, 0xb
jbe 0x4f1111
mov ecx, eax
test ecx, ecx
mov dword [esp + 0x30], ecx
fild dword [esp + 0x30]
jge 0x4f112c
fadd dword [0x6c0a38]
fstp dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
shr ecx, 0x17
and ecx, 0xff
add ecx, 0xffffff81
cmp ecx, ebp
jl 0x4f114d
mov edx, 1
shl edx, cl
jmp 0x4f114f
xor edx, edx
cmp edx, eax
jae 0x4f1155
add edx, edx
cmp edx, edi
je 0x4f1234
xor ebx, ebx
cmp edi, ebp
je 0x4f1221
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
call fcn.00457920
cmp eax, ebp
je 0x4f1262
lea ebp, [eax + 4]
mov dword [eax], edi
push 4
mov ebx, 0x401810
mov eax, edi
mov ecx, ebp
call fcn.00401380
mov ecx, ebp
test ecx, ecx
mov dword [esp + 0x34], ecx
je 0x4f1260
mov eax, dword [esi + 0x3c]
shr eax, 1
cmp eax, edi
mov dword [esp + 0x30], edi
ja 0x4f11c6
mov dword [esp + 0x30], eax
xor ebp, ebp
cmp dword [esp + 0x30], ebp
jbe 0x4f121b
mov edi, ecx
mov eax, dword [esi + 0x38]
mov ecx, dword [edi]
cmp ecx, dword [eax + ebp*4]
lea ebx, [eax + ebp*4]
je 0x4f120f
call fcn.00401700
mov eax, dword [ebx]
test eax, eax
mov dword [edi], eax
je 0x4f120f
movzx edx, byte [eax]
cmp edx, 0x80
jae 0x4f1208
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
and eax, 0xff
cmp eax, 0xff
jne 0x4f120f
mov eax, edi
call fcn.00459380
add ebp, 1
add edi, 4
cmp ebp, dword [esp + 0x30]
jb 0x4f11d0
mov ebx, dword [esp + 0x34]
xor ebp, ebp
mov eax, dword [esi + 0x38]
cmp eax, ebp
je 0x4f122d
call fcn.004012e0
cmp ebx, ebp
mov dword [esi + 0x38], ebx
je 0x4f1240
mov eax, dword [esi + 0x3c]
and eax, 1
or eax, 0x16
mov dword [esi + 0x3c], eax
mov dword [esp + 0x24], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
xor ebp, ebp
mov eax, dword [esi + 0x38]
cmp eax, ebp
je 0x4f1240
call fcn.004012e0
and dword [esi + 0x3c], 1
mov dword [esi + 0x38], ebp
jmp 0x4f1240