Function at 0x4676b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x543ff6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004bf9f0
mov dword [esi + 4], eax
mov ecx, 1
mov byte [eax + 0x1d], cl
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
xor edi, edi
mov dword [eax + 8], eax
mov dword [esi + 8], edi
mov dword [esi + 0xdc], 0x41400000
mov dword [esi + 0xe0], 0x7d3
mov dword [esi + 0xe4], 0xa
mov dword [esi + 0xe8], 0x15
mov dword [esi + 0xec], 0xab
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], 0xe
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0x108], edi
mov byte [esi + 0x10c], cl
mov dword [esi + 0x110], edi
mov dword [esi + 0x11c], 0xbf800000
mov dword [esi + 0x120], edi
mov dword [esi + 0x124], edi
mov dword [esi + 0x128], edi
mov dword [esi + 0x12c], edi
mov dword [esi + 0x130], edi
mov dword [esi + 0x134], 2
mov dword [esi + 0x138], ecx
mov dword [esp + 0x2c], edi
mov dword [esi + 0x140], edi
mov dword [esi + 0x144], edi
mov dword [esi + 0x148], edi
mov eax, ecx
mov dword [esp + 0x18], eax
mov byte [esp + 0x2c], cl
mov dword [esi + 0x14c], ecx
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
mov edx, 0x1f
push ecx
mov ecx, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], edx
call fcn.004674a0
mov edx, 0x3b
mov eax, 0x20
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
lea edx, [esp + 0x14]
mov ecx, 2
mov dword [esp + 0x18], eax
push edx
lea eax, [esp + 0x10]
mov dword [esp + 0x20], ecx
push eax
mov ecx, esi
call fcn.004674a0
mov ecx, 3
mov edx, 0x58
mov dword [esp + 0x1c], ecx
mov eax, 0x3c
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
push ecx
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.004674a0
mov eax, 0x59
mov ecx, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
mov edx, 0x76
push ecx
mov ecx, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], edx
call fcn.004674a0
mov edx, 0x95
mov eax, 0x77
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
lea edx, [esp + 0x14]
mov ecx, 5
mov dword [esp + 0x18], eax
push edx
lea eax, [esp + 0x10]
mov dword [esp + 0x20], ecx
push eax
mov ecx, esi
call fcn.004674a0
mov ecx, 6
mov edx, 0xb3
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
push ecx
lea edx, [esp + 0x10]
mov eax, 0x96
push edx
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.004674a0
mov eax, 0xb4
mov ecx, 7
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
mov edx, 0xd2
push ecx
mov ecx, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], edx
call fcn.004674a0
mov edx, 0xf1
mov eax, 0xd3
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
lea edx, [esp + 0x14]
mov ecx, 8
mov dword [esp + 0x18], eax
push edx
lea eax, [esp + 0x10]
mov dword [esp + 0x20], ecx
push eax
mov ecx, esi
call fcn.004674a0
mov ecx, 9
mov edx, 0x110
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
push ecx
lea edx, [esp + 0x10]
mov eax, 0xf2
push edx
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.004674a0
mov eax, 0x111
mov ecx, 0xa
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
mov edx, 0x12f
push ecx
mov ecx, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], edx
call fcn.004674a0
mov edx, 0x14d
mov eax, 0x130
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
lea edx, [esp + 0x14]
mov ecx, 0xb
mov dword [esp + 0x18], eax
push edx
lea eax, [esp + 0x10]
mov dword [esp + 0x20], ecx
push eax
mov ecx, esi
call fcn.004674a0
mov ecx, 0xc
mov edx, 0x16d
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], edx
push ecx
lea edx, [esp + 0x10]
mov eax, 0x14e
push edx
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.004674a0
mov edx, 0x19
mov eax, 0x23
mov ecx, 0x1e
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], edx
mov edx, 0xf
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 5
mov dword [esi + 0x14], 0xa
mov dword [esi + 0x18], 0x14
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x38], 0xa
mov dword [esi + 0x3c], 5
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], 5
mov dword [esi + 0x80], edx
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], edx
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], edi
mov dword [esi + 0x94], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x9c], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
mov dword [esi + 0xc4], edi
mov dword [esi + 0xc8], edi
mov dword [esi + 0xcc], edx
mov dword [esi + 0xd0], ecx
mov dword [esi + 0xd4], 0x14
mov dword [esi + 0xd8], edi
mov eax, dword [esi + 0x140]
cmp eax, edi
je 0x467b16
push eax
call sub.MFC71.DLL_operator_delete_1
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x140], edi
mov dword [esi + 0x144], edi
mov dword [esi + 0x148], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret