Function at 0x4ca0b8
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43d7e8
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x446040]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x446040]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x38], edi
call 0x4ddb98
mov dword [esp + 0x30], eax
mov byte [eax + 0x35], 1
mov eax, dword [esp + 0x30]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x30]
mov dword [eax], eax
mov eax, dword [esp + 0x30]
xor esi, esi
mov dword [eax + 8], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x88], esi
cmp dword [edi + 0x24], 8
jb 0x4ca131
mov edi, dword [edi + 0x10]
jmp 0x4ca134
add edi, 0x10
push edi
call dword [0x43e1e8]
mov ebx, eax
cmp ebx, esi
mov dword [esp + 0x3c], ebx
jne 0x4ca166
call dword [0x43e1ec]
lea eax, [esp + 0x2c]
mov dword [esp + 0x88], 0xffffffff
call 0x4dc5a8
xor eax, eax
jmp 0x4ca566
push 0x4407dc
push 0x440804
push ebx
call dword [0x43e200]
mov edi, eax
cmp edi, esi
je 0x4ca14b
push edi
push ebx
call dword [0x43e1fc]
push eax
call dword [0x43e1f8]
mov ebx, eax
mov eax, dword [esp + 0x3c]
push edi
push eax
call dword [0x43e1f4]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, ebx
call 0x4db708
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
lea edx, [esp + 0x1c]
push edx
lea edi, [esp + 0x30]
mov byte [esp + 0x8c], 1
call 0x4db698
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
lea ebx, [ebx]
mov ebx, dword [esp + 0x20]
cmp ebx, esi
je 0x4ca510
mov ecx, dword [esp + 0x24]
sub ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x4ca510
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
add eax, ebx
push esi
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 7
mov dword [esp + 0x5c], esi
mov word [esp + 0x4c], si
call 0x4c6168
mov byte [esp + 0x88], 2
mov esi, dword [esp + 0x58]
cmp esi, 8
jb 0x4ca3d4
mov ecx, dword [esp + 0x44]
test ecx, ecx
mov edx, ecx
mov dword [esp + 0x18], edx
je 0x4ca270
cmp esi, 8
mov eax, ecx
jae 0x4ca256
lea eax, [esp + 0x44]
cmp eax, edx
ja 0x4ca270
cmp esi, 8
mov eax, ecx
jae 0x4ca265
lea eax, [esp + 0x44]
mov ebx, dword [esp + 0x54]
lea eax, [eax + ebx*2]
cmp edx, eax
jbe 0x4ca281
call 0x4ef573
mov esi, dword [esp + 0x58]
mov ecx, dword [esp + 0x44]
mov ebx, dword [esp + 0x54]
cmp esi, 8
mov eax, ecx
jae 0x4ca28c
lea eax, [esp + 0x44]
lea edi, [eax + ebx*2]
test edi, edi
je 0x4ca2b4
cmp esi, 8
mov eax, ecx
jae 0x4ca29e
lea eax, [esp + 0x44]
cmp eax, edi
ja 0x4ca2b4
cmp esi, 8
mov eax, ecx
jae 0x4ca2ad
lea eax, [esp + 0x44]
lea edx, [eax + ebx*2]
cmp edi, edx
jbe 0x4ca2c1
call 0x4ef573
mov esi, dword [esp + 0x58]
mov ecx, dword [esp + 0x44]
cmp esi, 8
jb 0x4ca3e9
test ecx, ecx
mov ebx, ecx
je 0x4ca2f5
cmp esi, 8
mov eax, ecx
jae 0x4ca2db
lea eax, [esp + 0x44]
cmp eax, ebx
ja 0x4ca2f5
cmp esi, 8
mov eax, ecx
jae 0x4ca2ea
lea eax, [esp + 0x44]
mov edx, dword [esp + 0x54]
lea eax, [eax + edx*2]
cmp ebx, eax
jbe 0x4ca302
call 0x4ef573
mov esi, dword [esp + 0x58]
mov ecx, dword [esp + 0x44]
mov eax, edi
sub eax, ebx
lea edx, [esp + 0x40]
sar eax, 1
cmp edx, 0xfffffffe
je 0x4ca346
cmp esi, 8
jae 0x4ca31a
lea ecx, [esp + 0x44]
mov edx, dword [esp + 0x18]
lea eax, [edx + eax*2]
mov edx, dword [esp + 0x54]
lea ecx, [ecx + edx*2]
cmp eax, ecx
ja 0x4ca33d
cmp esi, 8
mov ecx, dword [esp + 0x44]
jae 0x4ca339
lea ecx, [esp + 0x44]
cmp eax, ecx
jae 0x4ca346
call 0x4ef573
mov esi, dword [esp + 0x58]
cmp ebx, edi
je 0x4ca373
mov esi, dword [esp + 0x18]
sub esi, ebx
jmp 0x4ca358
movzx edx, word [ebx]
push edx
call 0x4efb6b
mov word [ebx + esi], ax
add ebx, 2
add esp, 4
cmp ebx, edi
jne 0x4ca358
mov esi, dword [esp + 0x58]
push 0x44081c
mov ebx, 5
xor eax, eax
lea edx, [esp + 0x44]
call 0x4d5518
cmp eax, 0xffffffff
je 0x4ca4cb
mov ebx, dword [esp + 0x20]
xor esi, esi
cmp ebx, esi
je 0x4ca3ba
mov ecx, dword [esp + 0x24]
sub ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x14], eax
jb 0x4ca3c3
call 0x4ef573
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp dword [ebx + eax + 0x18], 8
jb 0x4ca3f2
mov ebx, dword [ebx + eax + 4]
jmp 0x4ca3f6
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x18]
jmp 0x4ca24b
lea ebx, [esp + 0x44]
jmp 0x4ca2d0
lea ebx, [ebx + eax + 4]
lea eax, [esp + 0x2c]
push eax
mov ecx, 0x440828
mov edx, ebx
call 0x4dabf8
mov ecx, eax
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], esi
mov word [esp + 0x60], si
lea ebx, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, si
jne 0x4ca41d
sub ecx, ebx
sar ecx, 1
push ecx
push eax
lea esi, [esp + 0x64]
call 0x4c6028
mov esi, dword [esp + 0x20]
xor edi, edi
cmp esi, edi
je 0x4ca460
mov ecx, dword [esp + 0x24]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x14], eax
jb 0x4ca469
call 0x4ef573
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov ebx, 8
cmp dword [esi + eax + 0x18], ebx
jb 0x4ca47e
mov esi, dword [esi + eax + 4]
jmp 0x4ca482
lea esi, [esi + eax + 4]
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx + 4]
push esi
push edi
push 0x180
push 0x3f7
push edx
call dword [0x43e320]
push eax
call dword [0x43e238]
cmp dword [esp + 0x74], ebx
jb 0x4ca4b6
mov eax, dword [esp + 0x60]
push eax
call 0x4ef5fe
add esp, 4
mov esi, dword [esp + 0x58]
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], edi
mov word [esp + 0x60], di
cmp esi, 8
mov ebx, 1
mov byte [esp + 0x88], bl
jb 0x4ca4e9
mov ecx, dword [esp + 0x44]
push ecx
call 0x4ef5fe
add esp, 4
add dword [esp + 0x14], ebx
add dword [esp + 0x10], 0x1c
mov edi, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], eax
mov word [esp + 0x44], ax
xor esi, esi
jmp 0x4ca1d8
mov edx, dword [esp + 0x3c]
push edx
call dword [0x43e1f0]
mov eax, dword [esp + 0x20]
cmp eax, esi
je 0x4ca541
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x24]
push ecx
call 0x4c6528
mov edx, dword [esp + 0x24]
add esp, 4
push edx
call 0x4ef5fe
add esp, 4
lea eax, [esp + 0x2c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x88], 0xffffffff
call 0x4dc5a8
mov eax, 1
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call 0x4ef43a
mov esp, ebp
pop ebp
ret