Function at 0x48db10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x64e7fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [esp + 0x48]
push edi
lea eax, [esp + 0xc]
mov edi, ecx
push esi
push eax
mov dword [esp + 0x18], edi
call fcn.004b5410
add esp, 8
mov eax, dword [esp + 0xc]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x44], ebx
jne 0x48db78
lea ecx, [esp + 0xc]
mov dword [esp + 0x44], 0xffffffff
call fcn.00490f90
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
push 0x2c
call fcn.0048b430
add esp, 4
mov dword [esp + 0x4c], eax
cmp eax, ebx
mov byte [esp + 0x44], 1
je 0x48db9e
push esi
push edi
mov ecx, eax
call fcn.0049bd60
mov dword [esp + 0x4c], eax
jmp 0x48dba2
mov dword [esp + 0x4c], ebx
mov eax, dword [esp + 0xc]
mov byte [esp + 0x44], 0
cmp eax, ebx
je 0x48dbb4
add eax, 0xc
jmp 0x48dbb9
mov eax, 0x730504
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00492310
add esp, 0xc
mov eax, dword [esp + 0x18]
mov byte [esp + 0x44], 2
cmp eax, ebx
je 0x48dbe6
lea edx, [eax + 0xc]
mov dword [esp + 0x1c], edx
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
jmp 0x48dbee
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0x1c]
push ebp
push ecx
lea ecx, [edi + 0x40]
call fcn.00492d30
mov edx, dword [esp + 0x50]
mov edi, str.Kids
mov dword [eax], edx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x28], edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], ecx
push eax
mov ecx, esi
call fcn.00490140
mov ebp, eax
cmp ebp, ebx
jne 0x48dca9
mov edi, str.Subtype
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x28], edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x28]
push ecx
push edx
mov ecx, esi
call fcn.0048ff10
mov edx, eax
mov edi, str.Widget
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x20], edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x24], ecx
push eax
mov ecx, edx
mov byte [esp + 0x4c], 3
call fcn.00491280
lea ecx, [esp + 0x18]
mov bl, al
mov byte [esp + 0x48], 2
call fcn.00490f90
test bl, bl
je 0x48dd58
mov ecx, dword [esp + 0x50]
push esi
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0048dd90
jmp 0x48dd58
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp ecx, ebx
mov dword [esp + 0x18], eax
jbe 0x48dd58
jmp 0x48dcbe
xor ebx, ebx
push eax
mov ecx, ebp
call fcn.0048fa90
mov esi, eax
cmp esi, ebx
je 0x48dd44
mov edi, str.Subtype
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x30], edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x30]
lea eax, [esp + 0x20]
mov dword [esp + 0x34], ecx
push edx
push eax
mov ecx, esi
call fcn.0048ff10
mov edx, eax
mov edi, str.Widget
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x38], edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x48], 4
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x38]
push ecx
mov ecx, edx
call fcn.00491280
test al, al
lea ecx, [esp + 0x20]
mov byte [esp + 0x48], 2
sete bl
call fcn.00490f90
test bl, bl
jne 0x48dd44
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x14]
push esi
push edx
call fcn.0048dd90
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jb 0x48dcbc
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], 0
call fcn.00490f90
lea ecx, [esp + 0x10]
mov dword [esp + 0x48], 0xffffffff
call fcn.00490f90
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x50]
pop ebp
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 4