Function at 0x464760
Capabilities:
Access peb ldr_data

Disassembly:
sub esp, 0xcc
mov eax, dword [0x51fdf4]
mov ecx, dword fs:[0x2c]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 8]
push ebx
mov ebx, dword [esp + 0xd8]
push ebp
push esi
mov esi, dword [ebx + 0x50]
mov dword [esp + 0xc], eax
mov eax, esi
imul eax, eax, 0x44
xor ebp, ebp
add eax, 4
push edi
lea ecx, [esp + 0x28]
lea edx, [esp + 0x34]
push eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ecx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], edx
call fcn.004b64f8
add esp, 4
cmp eax, ebp
je 0x4647ed
lea ecx, [esi - 1]
cmp ecx, ebp
lea edi, [eax + 4]
mov dword [eax], esi
mov dword [esp + 0x18], edi
jl 0x4647e9
lea eax, [edi + 0x30]
inc ecx
mov dword [eax - 4], ebp
mov dword [eax + 4], ebp
mov dword [eax], ebp
mov dword [eax + 8], ebp
add eax, 0x44
dec ecx
jne 0x4647d8
cmp edi, ebp
jne 0x4647fb
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xcc
ret
mov ecx, dword [ebx]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
push 4
push eax
call dword [edx + 0x9c]
mov ecx, dword [ebx]
mov edx, dword [ecx]
push 0xe
call dword [edx + 0x94]
mov eax, dword [esp + 0xe0]
mov ecx, dword [eax]
mov edx, dword [ecx]
push 0x10
call dword [edx + 0x90]
mov edx, dword [esp + 0xe0]
mov edx, dword [edx]
mov ecx, dword [ebx]
mov edx, dword [edx + 0x20]
mov eax, dword [ecx]
push edx
call dword [eax + 0xd4]
mov esi, dword [ebx + 4]
mov eax, dword [esi]
test eax, eax
mov ebp, dword [esp + 0xe8]
mov dword [esp + 0x14], edi
je 0x464885
mov ecx, dword [ebp]
test ecx, ecx
je 0x464862
mov ebp, ecx
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + 0x2c]
test edx, edx
je 0x464877
push 0
push edx
mov ecx, edi
push eax
add edi, 0x44
call fcn.00409310
mov eax, dword [esi + 4]
add esi, 4
test eax, eax
jne 0x464856
mov dword [esp + 0x14], edi
mov ebp, dword [esp + 0xf0]
xor eax, eax
cmp ebp, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
je 0x46496c
push 0x28
push 0x50
call fcn.0047fff0
mov ecx, dword [esp + 0xe8]
mov dword [ecx + 0x184], eax
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x6c], eax
mov ecx, dword [eax + 0x15c]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x54], ecx
mov edx, dword [eax + 0x154]
push ebp
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x38]
mov dword [esp + 0x58], edx
push ecx
lea edx, [esp + 0x58]
push edx
push eax
mov esi, 1
call fcn.0045af50
add esp, 0x1c
test eax, eax
jne 0x464acf
lea ecx, [esp + 0x24]
push ecx
push ebp
call fcn.0045a850
add esp, 8
test eax, eax
je 0x464acf
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x40]
push edx
push 0xffffffffffffffff
push 0
push 0
push ecx
push eax
lea edx, [esp + 0xf8]
push edx
call fcn.00409df0
mov ecx, dword [esp + 0xfc]
mov dword [ecx + 0x18c], eax
mov edx, dword [esp + 0xfc]
mov eax, dword [edx + 0x18c]
add esp, 0x1c
cmp eax, 0xffffffff
je 0x464acf
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
push 0
push esi
call fcn.00473c00
add esp, 8
test eax, eax
jne 0x464aca
push 1
push 1
push eax
mov eax, dword [esp + 0xec]
push eax
lea ecx, [esp + 0x98]
push esi
push ecx
call fcn.00431b10
mov eax, dword [esp + 0x104]
add esp, 0x18
cmp eax, 2
je 0x4649b2
cmp eax, 1
jne 0x4649be
mov ecx, dword [ebx]
mov edx, dword [ecx]
push 0x19
call dword [edx + 0x94]
mov ebp, dword [ebx + 0x108]
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0x18], ebp
call dword [esp + 0x98]
mov esi, eax
add esp, 4
test esi, esi
je 0x464b20
mov ebp, dword [esp + 0x18]
lea eax, [esp + 0x88]
push eax
call fcn.00431d00
mov ecx, dword [esp + 0xe4]
push ecx
call fcn.0043dcf0
mov ecx, dword [ebp - 4]
lea edx, [ebp - 4]
mov eax, ecx
imul eax, eax, 0x44
add esp, 8
add eax, ebp
dec ecx
mov dword [esp + 0x14], edx
js 0x464a31
lea edi, [eax + 0x2c]
lea ebp, [ecx + 1]
nop
sub edi, 0x44
mov ecx, edi
call fcn.00412340
dec ebp
jne 0x464a20
mov edx, dword [esp + 0x14]
push edx
call fcn.004b6506
mov ecx, dword [ebx]
mov edx, dword [ecx]
add esp, 4
push 4
call dword [edx + 0x94]
test eax, eax
je 0x464a59
mov ecx, dword [ebx]
mov edx, dword [ecx]
push 0
push eax
call dword [edx + 4]
mov esi, 1
mov ecx, dword [ebx]
mov eax, dword [ecx]
push 0x1a
call dword [eax + 0x94]
mov ecx, dword [ebx]
mov edi, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
call dword [edx + 0xd8]
test eax, eax
je 0x464a7d
mov esi, 1
push 1
push edi
call fcn.00473c00
lea eax, [edi + 0x520]
push eax
push edi
call fcn.00473c00
add esp, 0x10
test eax, eax
je 0x464a9e
mov esi, 1
lea ecx, [edi + 0x510]
push ecx
push edi
call fcn.00473c00
add esp, 8
test eax, eax
je 0x464ab7
mov esi, 1
mov ebx, dword [ebx]
mov edx, dword [ebx]
push 0
push edi
mov ecx, ebx
call dword [edx + 0x9c]
test eax, eax
je 0x464acf
mov esi, 1
mov eax, dword [esp + 0x10]
push 1
push eax
call fcn.00473c00
mov ecx, dword [esp + 0xe8]
push ecx
call fcn.0043dcf0
mov edx, dword [esp + 0x100]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x104]
add esp, 0xc
mov dword [edx], eax
mov edx, dword [esp + 0x20]
xor eax, eax
test esi, esi
setle al
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
dec eax
add esp, 0xcc
ret
mov ebp, dword [esp + 0x14]
lea esp, [esp]
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 0x630]
test eax, eax
jne 0x464bac
test ebp, ebp
je 0x464b3a
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0x30]
mov ebp, dword [esp + 0x18]
cmp ebp, edi
mov esi, ebp
je 0x464b52
push esi
call dword [esi + 0x3c]
add esi, 0x44
add esp, 4
cmp esi, edi
jne 0x464b44
mov ecx, dword [ebx]
mov edx, dword [ebx + 0x44]
mov eax, dword [ecx]
push edx
call dword [eax + 0x38]
mov esi, eax
test esi, esi
je 0x464b87
mov eax, dword [esp + 0xec]
cmp eax, 2
je 0x464b74
cmp eax, 1
jne 0x464bc5
cmp esi, 0x79
je 0x464b81
cmp esi, 0x8d
jne 0x464bc5
inc dword [esp + 0x20]
jmp 0x464b8b
inc dword [esp + 0x1c]
lea eax, [esp + 0x88]
push eax
call dword [esp + 0x98]
mov esi, eax
add esp, 4
test esi, esi
je 0x464b18
jmp 0x4649e4
push 0
push 0x41d
call fcn.0047fe20
add esp, 8
mov esi, 1
jmp 0x4649e4
mov ecx, dword [ebx]
mov edx, dword [ecx]
push 0
push esi
call dword [edx + 4]
jmp 0x4649e8