Function at 0x4900f8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49043d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x2a], 2
mov eax, dword [ebp - 4]
mov byte [eax + 0x20fc], dl
mov eax, dword [ebp - 4]
mov byte [eax + 0x2058], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0xffffffff
mov eax, dword [ebp - 4]
mov word [eax + 0x205a], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x2059], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x2054], edx
mov eax, dword [ebp - 4]
add eax, 0x34
xor ecx, ecx
mov edx, 0x2001
call fcn.00403144
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
mov eax, 0x10000
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x20f4], eax
mov eax, 0x10102
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x2048], eax
mov eax, 0x8000
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x20e8], eax
mov eax, 0x1000
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x20dc], eax
mov eax, 0x8f4
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x2060], eax
mov eax, 0xd6e
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x2098], eax
mov eax, 0x16e
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x209c], eax
mov eax, 0x6c0
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x20d4], eax
mov eax, 0xb4
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x20d8], eax
mov eax, 0xea
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x208c], eax
mov eax, 0x74
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x20f0], eax
mov eax, 0x78
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x20ec], eax
mov eax, pe_nt_image_headers32
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x20e4], eax
mov eax, 0x200
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x20f8], eax
mov eax, 0x20
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x206c], eax
mov eax, 0x23d
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x205c], eax
mov eax, 0x10000
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x204c], eax
mov eax, 0x10000
call fcn.00408b00
mov edx, dword [ebp - 4]
mov dword [edx + 0x2050], eax
mov eax, dword [ebp - 4]
call fcn.0048e968
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x16]
mov word [ebp - 6], ax
lea ecx, [ebp - 6]
mov eax, dword [ebp - 4]
xor edx, edx
mov dl, byte [eax + 0x20fc]
mov eax, dword [ebp - 4]
call fcn.0049071c
mov eax, dword [ebp - 4]
mov dx, word [ebp - 6]
mov word [eax + 0x16], dx
mov eax, dword [ebp - 4]
call fcn.0048fe24
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490447
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2048]
call fcn.004027c4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x2048], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x204c]
call fcn.004027c4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x204c], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2050]
call fcn.004027c4
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x2050], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20f0]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20ec]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20e4]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20f8]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x206c]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x205c]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2098]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x209c]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20d4]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20d8]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x208c]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20f4]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20e8]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20dc]
call fcn.004027c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2060]
call fcn.004027c4
ret