Function at 0x4b8ff0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4efb3f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0045ae70
lea ebx, [esi + 0x24]
lea ebp, [esi + 0x20]
push ebx
xor edi, edi
push ebp
push 0x474
mov dword [esp + 0x38], edi
mov dword [esi], 0x4fb288
mov dword [esi + 0x9c], edi
mov dword [esi + 8], str.Stringquery_gump
mov dword [esi + 0x60], edi
mov dword [esi + 0x54], 0x474
mov dword [esi + 0x64], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x40], edi
call fcn.004447f0
push str.framedata_for_CStringQueryGump
push 8
mov dword [esi + 0x30], 0x79
mov dword [esi + 0x34], 0x66
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 1
call fcn.00479630
mov ecx, dword [esi + 0x18]
mov edi, eax
shl ecx, 3
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esi + 0x3c], edi
push str.dumb_frame0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp]
imul eax, dword [ebx]
lea ecx, [eax + eax + 4]
push ecx
call fcn.00479630
mov edx, dword [esi + 0x3c]
mov dword [edx + 4], eax
mov eax, dword [esi + 0x3c]
mov dx, word [ebp]
mov ecx, dword [eax + 4]
mov word [ecx], dx
mov eax, dword [esi + 0x3c]
mov dx, word [ebx]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x50]
mov word [ecx + 2], dx
mov cx, word [esp + 0x54]
mov word [esi + 0xa4], cx
mov ecx, dword [ebp]
imul ecx, dword [ebx]
mov dl, byte [esp + 0x60]
mov dword [esi + 0xa0], eax
mov al, byte [esp + 0x5c]
mov byte [esi + 0xa6], dl
mov edx, dword [esi + 0x3c]
mov byte [esi + 0xa7], al
shl ecx, 1
mov edi, dword [edx + 4]
mov edx, ecx
xor eax, eax
add edi, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx]
mov edx, dword [esi + 0x3c]
mov ecx, dword [ebp]
push eax
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [esi + 0x54]
add eax, 4
xor edi, edi
push eax
push edi
push edi
push ecx
push fcn.004c00b0
call fcn.00444850
mov edx, dword [ebx]
mov eax, dword [ebp]
mov dword [esp + 0x58], edx
mov edx, dword [esi + 0x3c]
push edi
push edi
lea ecx, [esp + 0x54]
push edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], edi
push ecx
mov ecx, dword [edx + 4]
mov edx, dword [esp + 0x84]
push eax
add ecx, 4
add eax, 0xffffff88
push ecx
push eax
push edx
push 0x386
push 2
push 0x32
push 0x3c
call fcn.004424b0
mov edx, dword [esi + 0x3c]
mov ecx, dword [ebp]
add esp, 0x68
lea eax, [esp + 0x14]
push eax
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [esp + 0x54]
add eax, 4
push eax
push ecx
push 0x386
push 2
push 0x7d
push 0x3c
call fcn.00442410
mov al, byte [esi + 0xa6]
add esp, 0x20
cmp al, 1
mov bl, 5
jne 0x4b9275
push 0x1cc
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x44], eax
cmp eax, edi
mov byte [esp + 0x2c], 1
je 0x4b9208
mov edx, dword [esp + 0x48]
push edi
push edi
push 1
push 0x386
push 1
push edx
push edi
push 0x475
push 0x475
push esi
push 0x82
push 0x3c
mov ecx, eax
call fcn.0042ac40
jmp 0x4b920a
xor eax, eax
mov dword [esi + 0xa8], eax
mov word [eax + 0xea], 0x476
mov eax, dword [esi + 0xa8]
push 1
push esi
mov byte [esp + 0x34], 0
mov word [eax + 0xec], 0x477
mov ecx, dword [esi + 0xa8]
mov byte [ecx + 0xee], 0xc
mov edx, dword [esi + 0xa8]
mov byte [edx + 0xef], bl
mov ecx, dword [esi + 0xa8]
call fcn.0045a530
mov eax, dword [esi + 0xa8]
mov dword [eax + 0xe4], 1
mov ecx, dword [esi + 0xa8]
mov dword [0xb6612c], ecx
jmp 0x4b932b
cmp al, 2
jne 0x4b9339
push 0x1cc
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x44], eax
cmp eax, edi
mov byte [esp + 0x2c], 2
je 0x4b92c4
mov ecx, dword [esp + 0x48]
push edi
push edi
push 1
push 0x386
push 1
push ecx
push 1
push 0x475
push 0x475
push esi
push 0x82
push 0x3c
mov ecx, eax
call fcn.0042ac40
jmp 0x4b92c6
xor eax, eax
mov dword [esi + 0xa8], eax
mov word [eax + 0xea], 0x476
mov edx, dword [esi + 0xa8]
push 1
push esi
mov byte [esp + 0x34], 0
mov word [edx + 0xec], 0x477
mov eax, dword [esi + 0xa8]
mov byte [eax + 0xee], 0xc
mov ecx, dword [esi + 0xa8]
mov byte [ecx + 0xef], bl
mov ecx, dword [esi + 0xa8]
call fcn.0045a530
mov edx, dword [esi + 0xa8]
mov dword [edx + 0xe4], 1
mov eax, dword [esi + 0xa8]
mov dword [0xb6612c], eax
mov ecx, dword [esi + 0xa8]
mov edx, dword [ecx]
call dword [edx + 0x178]
mov al, byte [esi + 0xa7]
push 0xec
test al, 1
je 0x4b941b
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x44], eax
cmp eax, edi
mov byte [esp + 0x2c], 3
je 0x4b9393
mov edx, dword [esi + 0x34]
mov ebx, dword [esi + 0x30]
push edi
push 0x47c
mov ecx, 0x124
push 0x47b
push 0x422110
sub ecx, edx
push edi
mov edx, 0xee
push edi
push esi
sub edx, ebx
push ecx
push edx
mov ecx, eax
call fcn.00422990
jmp 0x4b9395
xor eax, eax
push 1
push esi
mov ecx, eax
mov byte [esp + 0x34], 0
mov dword [eax + 0xac], 0x47d
call fcn.0045a530
push 0xec
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x44], eax
cmp eax, edi
mov byte [esp + 0x2c], 4
je 0x4b9409
mov ebp, dword [esi + 0x34]
push edi
push 0x479
push 0x478
push 0x4221a0
push edi
push edi
mov edi, dword [esi + 0x30]
mov ecx, 0x124
mov edx, 0x145
sub ecx, ebp
push esi
sub edx, edi
push ecx
push edx
mov ecx, eax
call fcn.00422990
mov byte [esp + 0x2c], 0
mov dword [eax + 0xac], 0x47a
jmp 0x4b9472
xor eax, eax
mov byte [esp + 0x2c], al
mov dword [eax + 0xac], 0x47a
jmp 0x4b9472
call fcn.004ddf8e
add esp, 4
mov dword [esp + 0x44], eax
cmp eax, edi
mov byte [esp + 0x2c], bl
je 0x4b9461
mov ebp, dword [esi + 0x34]
push edi
push 0x47c
push 0x47b
push 0x422110
push edi
push edi
mov edi, dword [esi + 0x30]
mov ecx, 0x124
mov edx, 0x11a
sub ecx, ebp
push esi
sub edx, edi
push ecx
push edx
mov ecx, eax
call fcn.00422990
jmp 0x4b9463
xor eax, eax
mov byte [esp + 0x2c], 0
mov dword [eax + 0xac], 0x47d
push 1
push esi
mov ecx, eax
call fcn.0045a530
mov ecx, dword [esp + 0x24]
mov dword [0xb66128], esi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x1c