Function at 0x4f0b80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
test byte [0x63071c], 1
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
mov dword [esp + 0x24], ebx
jne 0x4f0d09
mov ecx, 0x63071c
lock bts dword [ecx], 0x1f
setb al
test al, al
jne 0x4f0bbb
mov al, 1
jmp 0x4f0bcd
test byte [0x63071c], 1
jne 0x4f0bcb
xor edx, edx
call sym.SystemInformer.exe_Ordinal_1388
xor al, al
test al, al
je 0x4f0d09
push 0
call sym.SystemInformer.exe_Ordinal_1944
push eax
mov dword [esp + 0x14], eax
call sym.SystemInformer.exe_Ordinal_1089
mov ecx, dword fs:[0x18]
mov dword [esp + 0x30], 0x1c
mov dword [esp + 0x34], str.kernelbase.dll
mov byte [esp + 0xf], 0
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0xa0]
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov esi, dword [ebx]
cmp esi, ebx
je 0x4f0c5d
mov dword [esp + 0x18], 0x1c
nop
cmp word [esi + 0x2c], 0x1c
mov eax, dword [esi + 0x30]
mov dword [esp + 0x1c], eax
jb 0x4f0c57
push 1
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x20]
push eax
call sym.SystemInformer.exe_Ordinal_1351
test al, al
jne 0x4f0d78
mov esi, dword [esi]
cmp esi, ebx
jne 0x4f0c30
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x20]
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0xa0]
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
or esi, 0xffffffff
cmp byte [esp + 0xf], 0
je 0x4f0cb8
push dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cdq
push edx
push eax
push ebx
push dword [esp + 0x20]
call sym.SystemInformer.exe_Ordinal_1949
lea ecx, [ebx - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4f0cb8
call fcn.004fe0c0
lea eax, [esp + 0x40]
push eax
push str.GetAppModelPolicy
push dword [esp + 0x18]
call sym.SystemInformer.exe_Ordinal_1948
test al, al
je 0x4f0ce4
mov ebx, dword [esp + 0x40]
mov edx, ebx
call fcn.0051e460
test eax, eax
js 0x4f0ce4
mov dword [0x63567c], ebx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], esi
dec esi
jne 0x4f0cf8
call fcn.004fe0c0
mov ecx, 0x63071c
nop dword [eax]
call sym.SystemInformer.exe_Ordinal_1358
mov ebx, dword [esp + 0x24]
mov esi, dword [0x63567c]
test esi, esi
je 0x4f0de3
mov eax, dword [0x62db64]
nop dword [eax]
cmp edi, 0x38
jl 0x4f0d2a
cmp eax, 0x72
jb 0x4f0d6a
cmp edi, 0x30
jl 0x4f0d34
cmp eax, 0x6d
jb 0x4f0d6a
cmp edi, 0x2e
jl 0x4f0d3e
cmp eax, 0x6b
jb 0x4f0d6a
nop
cmp edi, 0x2d
jl 0x4f0d4a
cmp eax, 0x6a
jb 0x4f0d6a
cmp edi, 0x2a
jl 0x4f0d54
cmp eax, 0x69
jb 0x4f0d6a
cmp edi, 0x23
jl 0x4f0d5e
cmp eax, 0x68
jb 0x4f0d6a
nop
cmp edi, 0x1f
jl 0x4f0dc9
cmp eax, 0x67
jae 0x4f0dc9
mov eax, 0xc0000003
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
nop dword [eax + eax]
test esi, esi
je 0x4f0c5d
mov eax, dword [esi + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x20]
mov dword [esp + 0x14], eax
movzx eax, word [esi + 0x24]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
push eax
call sym.SystemInformer.exe_Ordinal_1483
mov ebx, eax
test ebx, ebx
je 0x4f0dbf
mov byte [esp + 0xf], 1
jmp 0x4f0c71
mov byte [esp + 0xf], 0
jmp 0x4f0c6d
push dword [ebp + 8]
mov ecx, esi
push edi
push ebx
call dword [0x5a9914]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov eax, 0xc000007a
pop ebx
mov esp, ebp
pop ebp
ret 4