Function at 0x4f9780
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x6c], esp
mov dword [esi + 0x78], 0xffffffff
lea eax, [esi + 0x70]
mov dword [esi + 0x74], 0x55d2f0
mov edx, dword fs:[0]
mov dword [esi + 0x70], edx
mov dword fs:[0], eax
mov eax, dword [0x599248]
mov edx, dword [0x59924c]
lea edi, [eax + 1]
imul edi, eax
not edi
or edi, 0xfffffffe
cmp edi, 0xffffffff
sete byte [esi + 6]
cmp edx, 0xa
setl byte [esi + 7]
mov edi, ecx
mov eax, dword [ebp + 8]
add ecx, 0x1c
mov dword [esi + 0x3c], ecx
lea ecx, [eax + 0x1c]
mov dword [esi + 0x24], ecx
lea ecx, [edi + 0x34]
mov dword [esi + 0x38], ecx
lea ecx, [eax + 0x34]
mov dword [esi + 0x20], ecx
lea ecx, [edi + 0x3c]
mov dword [esi + 0x34], ecx
lea ecx, [eax + 0x3c]
mov dword [esi + 0x1c], ecx
lea ecx, [edi + 0x54]
mov dword [esi + 0x30], ecx
lea ecx, [eax + 0x54]
mov dword [esi + 0x18], ecx
lea ecx, [eax + 0x70]
mov dword [esi + 0x14], ecx
lea ecx, [edi + 0x70]
mov dword [esi + 0x2c], ecx
lea ecx, [edi + 0x98]
mov dword [esi + 0x28], ecx
add eax, 0x98
mov dword [esi + 0x10], eax
mov eax, 0x8130899c
mov dword [esi + 0xc], edi
nop word cs:[eax + eax]
cmp eax, 0x337e3baa
jg 0x4f9860
cmp eax, 0x8130899c
je 0x4f9990
cmp eax, 0xa5e0ef85
jne 0x4f9840
jmp 0x4f9b72
cmp eax, 0x337e3bab
je 0x4f99bf
cmp eax, 0x56688377
jne 0x4f9840
mov dword [esi + 0x78], 0xffffffff
mov ecx, edi
mov ebx, dword [ebp + 8]
push ebx
call fcn.004a41c0
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x18], eax
mov ecx, dword [esi + 0x3c]
push dword [esi + 0x24]
call fcn.004a41c0
mov ecx, dword [esi + 0x38]
push dword [esi + 0x20]
call fcn.004acf70
mov ecx, dword [esi + 0x34]
push dword [esi + 0x1c]
call fcn.004a41c0
mov ecx, dword [esi + 0x30]
push dword [esi + 0x18]
call fcn.004a41c0
mov eax, dword [ebx + 0x6c]
mov dword [edi + 0x6c], eax
mov dword [esi + 0x64], 0
mov dword [esi + 0x78], 2
lea ecx, [esi + 0x40]
push dword [esi + 0x14]
call fcn.004bec70
lea edi, [esi + 0x40]
mov ecx, edi
push dword [esi + 0x2c]
call fcn.004f8b60
mov ecx, edi
call fcn.004bedb0
mov eax, dword [0x599250]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x599254], 0xa
setl dl
mov dword [esi + 0x64], 0
test dl, al
jne 0x4f991c
xor dl, al
je 0x4f9b50
mov dword [esi + 0x78], 3
mov ecx, edi
push dword [esi + 0x10]
call fcn.004f9d00
mov eax, dword [0x599250]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
setne al
sete dl
cmp dword [0x599254], 0xa
setge cl
setl ah
xor ah, dl
mov edi, dword [esi + 0xc]
jne 0x4f9961
or cl, al
jne 0x4f9b70
lea ebx, [esi + 0x40]
mov ecx, ebx
push dword [esi + 0x28]
call fcn.004fa6f0
mov ecx, ebx
call fcn.004fa210
mov eax, dword [ebp + 8]
movzx eax, word [eax + 0xc0]
mov word [edi + 0xc0], ax
mov eax, 0x337e3bab
jmp 0x4f9840
movzx ecx, byte [esi + 6]
movzx eax, byte [esi + 7]
mov edx, ecx
xor dl, al
test al, al
mov eax, 0x56688377
mov ebx, 0x337e3bab
cmovne eax, ebx
test cl, cl
mov ecx, 0x56688377
cmove eax, ecx
test dl, dl
cmovne eax, ebx
jmp 0x4f9840
mov dword [esi], edi
mov ecx, dword [esi]
mov dword [esi + 0x78], 0xffffffff
mov edi, dword [ebp + 8]
push edi
call fcn.004a41c0
mov eax, dword [edi + 0x18]
mov ecx, dword [esi]
mov dword [ecx + 0x18], eax
mov ecx, dword [esi]
add ecx, 0x1c
push dword [esi + 0x24]
call fcn.004a41c0
mov ecx, dword [esi]
add ecx, 0x34
push dword [esi + 0x20]
call fcn.004acf70
mov ecx, dword [esi]
add ecx, 0x3c
push dword [esi + 0x1c]
call fcn.004a41c0
mov ecx, dword [esi]
add ecx, 0x54
push dword [esi + 0x18]
call fcn.004a41c0
mov eax, dword [edi + 0x6c]
mov ecx, dword [esi]
mov dword [ecx + 0x6c], eax
mov eax, dword [esi]
mov dword [esi + 8], eax
mov dword [esi + 0x64], 0
mov dword [esi + 0x78], 0
lea ecx, [esi + 0x40]
push dword [esi + 0x14]
call fcn.004bec70
mov eax, dword [esi + 8]
add eax, 0x70
lea ebx, [esi + 0x40]
mov ecx, ebx
push eax
call fcn.004f8b60
mov ecx, ebx
call fcn.004bedb0
mov edi, dword [esi]
mov eax, 0x98
add edi, eax
mov eax, dword [0x599250]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete al
cmp dword [0x599254], 0xa
setl dl
mov dword [esi + 0x64], 0
test dl, al
jne 0x4f9a88
xor dl, al
je 0x4f9b40
mov dword [esi + 8], edi
mov dword [esi + 0x78], 1
mov ecx, ebx
push dword [esi + 0x10]
call fcn.004f9d00
mov ecx, dword [0x599250]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete dl
cmp dword [0x599254], 0xa
setl ch
setge cl
cmp ch, dl
jne 0x4f9ac9
or cl, al
test cl, 1
jne 0x4f9b60
lea edi, [esi + 0x40]
mov ecx, edi
push dword [esi + 8]
call fcn.004fa6f0
mov ecx, edi
call fcn.004fa210
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx + 0xc0]
mov word [eax + 0xc0], cx
mov edx, dword [0x599248]
mov ecx, dword [0x59924c]
lea eax, [edx + 1]
imul eax, edx
mov edx, eax
xor edx, 0xfffffffe
test edx, eax
sete bl
cmp ecx, 0xa
setl bh
xor bh, bl
mov edi, 0x56688377
mov ebx, 0xa5e0ef85
cmovne edi, ebx
test edx, eax
mov eax, edi
cmove eax, ebx
cmp ecx, 0xa
cmovge eax, edi
mov edi, dword [esi + 0xc]
jmp 0x4f9840
jmp 0x4f9b40
jmp 0x4f9b50
jmp 0x4f9b60
jmp 0x4f9b70
mov eax, dword [esi]
mov ecx, dword [esi + 0x70]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4