Function at 0x4d70c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
call fcn.004040cc
mov eax, dword [ebp - 8]
call fcn.004040cc
xor eax, eax
push ebp
push 0x4d7b33
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 0
mov byte [ebp - 0x21], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x215], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x331], 1
mov eax, dword [ebp - 4]
call fcn.005a9470
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d7b10
mov byte [ebp - 0x23], 0
mov eax, dword [ebp - 4]
cmp word [eax + 0x316], 0
je 0x4d7164
lea eax, [ebp - 0x23]
push eax
mov ebx, dword [ebp - 4]
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x318]
call dword [ebx + 0x314]
mov dl, byte [ebp - 0x23]
mov eax, dword [ebp - 4]
call fcn.004d4af0
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004d50f4
xor eax, eax
push ebp
push 0x4d71a5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x40f87c]
call fcn.00413ee4
mov dword [ebp - 0x20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d71ed
mov eax, dword [ebp - 0x20]
call fcn.00413948
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x160], eax
mov dword [ecx + 0x164], edx
lea eax, [ebp - 0x20]
call fcn.004690c0
xor ecx, ecx
push ebp
push 0x4d7b06
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x5a6340]
call fcn.005a6728
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x1f8], ebx
mov eax, ebx
mov dl, 2
call fcn.005a74fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x1f8]
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x240]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x240]
call fcn.00403cf0
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1a8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
mov dword [eax + 0x1a8], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x360]
mov dword [eax + 0xc0], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x30], edx
mov dword [eax + 0x2c], 0x4d8ffc
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x94]
mov dword [eax + 0x94], ecx
mov ecx, dword [edx + 0x98]
mov dword [eax + 0x98], ecx
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x203]
mov byte [eax + 0x203], dl
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x208]
mov dword [eax + 0x208], edx
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0x273]
mov byte [eax + 0x1ac], dl
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1c0], 0
je 0x4d72f7
mov eax, dword [ebp - 4]
test byte [eax + 0x1c1], 2
jne 0x4d72fb
xor eax, eax
jmp 0x4d72fd
mov al, 1
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x1f8]
mov byte [edx + 0x1b8], al
test al, al
je 0x4d731f
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x1c0]
mov byte [edx + 0x1c0], al
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xe0]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
call fcn.005a7490
mov eax, dword [ebp - 4]
cmp word [eax + 0x2b6], 0
je 0x4d7363
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
mov cl, byte [eax + 0xc4]
mov edx, eax
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x2b8]
call dword [ebx + 0x2b4]
mov eax, dword [ebp - 4]
mov dword [eax + 0x320], 0
mov dword [eax + 0x324], 0
cmp byte [ebp + 0x14], 1
je 0x4d73a1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
mov al, byte [eax + 0xdc]
add al, 0xf6
sub al, 2
jb 0x4d73a1
sub al, 1
je 0x4d73a1
sub al, 3
jne 0x4d747a
mov byte [ebp + 0x14], 1
mov edx, 0x4d7b4c
mov eax, dword [ebp - 4]
call fcn.004d7ff0
test al, al
je 0x4d740e
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x4d73ed
mov eax, dword [ebp - 4]
cmp byte [eax + 0x338], 0
je 0x4d73ed
push 0
push 1
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov edx, 0x4d7b5c
call fcn.00403f64
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004d473c
jmp 0x4d740e
push 0
push 1
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov edx, 0x4d7b70
call fcn.00403f64
mov edx, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 4]
call fcn.004d473c
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004d8624
test al, al
je 0x4d743e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d743e
mov eax, dword [ebp - 0x14]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
jne 0x4d747a
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x1e4]
cmp ax, 0xe2
je 0x4d7453
test ax, ax
jne 0x4d7476
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
mov ecx, dword [0x5bc024]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x407e94]
call fcn.0040bbf8
call fcn.00403710
mov byte [ebp + 0x14], 0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
jne 0x4d749a
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 2
call fcn.004037b0
jmp 0x4d7b10
cmp byte [ebp + 0x14], 0
je 0x4d752f
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28c]
call fcn.00408a4c
mov edx, dword [ebp - 0x28]
mov eax, 0x4d7b84
call fcn.00404200
test eax, eax
jle 0x4d74e3
push ebp
call fcn.004d6ecc
pop ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1d0], 2
jne 0x4d74e3
call fcn.004037b0
jmp 0x4d7b10
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.004d5414
test al, al
jne 0x4d75b2
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 2
mov eax, dword [ebp - 4]
mov byte [eax + 0x215], 1
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4d1ddc]
call fcn.0040bbf8
call fcn.00403710
call fcn.004037b0
jmp 0x4d7b10
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x340]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x33c]
mov eax, dword [ebp - 4]
call fcn.004db378
mov edx, dword [ebp - 4]
mov ebx, dword [edx + 0x1f8]
mov dword [ebx + 0xf4], eax
mov eax, ebx
mov dl, 1
call fcn.005aa6c0
mov eax, dword [ebp - 4]
cmp word [eax + 0x182], 0
je 0x4d7592
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x180]
mov dword [eax + 0x180], ecx
mov ecx, dword [edx + 0x184]
mov dword [eax + 0x184], ecx
mov eax, dword [ebp - 4]
call fcn.004d895c
test al, al
jne 0x4d75b2
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 2
call fcn.004037b0
jmp 0x4d7b10
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
jne 0x4d75d2
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 2
call fcn.004037b0
jmp 0x4d7b10
mov dl, 0xf
mov eax, dword [ebp - 4]
call fcn.004d92c8
test al, al
je 0x4d75ea
call fcn.004037b0
jmp 0x4d7b10
mov eax, dword [ebp - 4]
cmp word [eax + 0x182], 0
je 0x4d761b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x180]
mov dword [eax + 0x180], ecx
mov ecx, dword [edx + 0x184]
mov dword [eax + 0x184], ecx
cmp byte [ebp + 0x14], 0
je 0x4d7643
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28c]
call fcn.00408a4c
mov edx, dword [ebp - 0x28]
mov eax, 0x4d7b84
call fcn.00404200
test eax, eax
jne 0x4d7660
push ebp
call fcn.004d6ecc
pop ecx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1d0], 2
jne 0x4d7660
call fcn.004037b0
jmp 0x4d7b10
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x1e4]
cmp ax, 0x12c
jle 0x4d76c2
cmp ax, 0x258
jge 0x4d76c2
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
mov eax, dword [ebp - 4]
cmp word [eax + 0x2ce], 0
jne 0x4d7697
call fcn.004037b0
jmp 0x4d7b10
mov byte [ebp - 0x22], 0
push 0xf
lea ecx, [ebp - 0x22]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2d0]
call dword [ebx + 0x2cc]
cmp byte [ebp - 0x22], 0
jne 0x4d76c2
call fcn.004037b0
jmp 0x4d7b10
mov eax, dword [ebp - 4]
test byte [eax + 0x1c1], 2
jne 0x4d76de
cmp byte [ebp + 0x14], 0
jne 0x4d76de
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004d98a0
mov eax, dword [ebp - 4]
cmp word [eax + 0x296], 0
je 0x4d76fd
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x298]
call dword [ebx + 0x294]
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x218], ebx
mov eax, dword [ebp - 4]
mov dword [eax + 0x21c], ebx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
jne 0x4d7745
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d7745
push dword [ebp + 0xc]
push dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
mov edx, dword [ebp - 0xc]
call fcn.005a9cc0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
xor ecx, ecx
xor edx, edx
call fcn.005ac530
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
jne 0x4d788f
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d788f
mov eax, dword [ebp - 4]
cmp word [eax + 0x1e4], 0xc7
jge 0x4d788f
mov edx, 0x1d4c0
mov eax, dword [ebp - 4]
call fcn.005aa9ac
mov eax, dword [ebp - 4]
mov byte [eax + 0x214], 1
xor edx, edx
push ebp
push 0x4d7888
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x224]
call fcn.00403d34
jmp 0x4d7837
push 0
push 1
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004d82f0
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x224]
call fcn.00404028
je 0x4d7837
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00404028
je 0x4d7837
lea eax, [ebp - 0x1c]
mov edx, dword [0x5bc024]
mov edx, dword [edx]
call fcn.00403d34
mov eax, dword [ebp - 4]
cmp word [eax + 0x29e], 0
je 0x4d7829
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2a0]
call dword [ebx + 0x29c]
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x21c], eax
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x1e4]
cmp ax, 0xc7
jge 0x4d7868
test ax, ax
je 0x4d7868
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
je 0x4d7868
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
je 0x4d77c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d78bc
mov eax, dword [ebp - 4]
call fcn.005aaa04
mov eax, dword [ebp - 4]
mov byte [eax + 0x214], 0
ret
mov eax, dword [ebp - 4]
cmp word [eax + 0x29e], 0
je 0x4d78ae
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2a0]
call dword [ebx + 0x29c]
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 4]
mov dword [edx + 0x21c], eax
mov byte [ebp - 0x21], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7b10
cmp byte [ebp - 0x21], 0
jne 0x4d78e5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
xor ecx, ecx
xor edx, edx
call fcn.005ac530
mov eax, dword [ebp - 4]
cmp dword [eax + 0x334], 0
jle 0x4d78fb
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004db4e4
cmp byte [ebp - 0x21], 0
jne 0x4d7a02
mov edx, dword [ebp - 4]
cmp byte [edx + 0x215], 0
jne 0x4d7a02
mov edx, dword [ebp - 4]
cmp byte [edx + 0x216], 0
jne 0x4d7a02
mov edx, dword [ebp - 4]
cmp word [edx + 0x1e4], 0xc7
jge 0x4d7a02
mov edx, dword [ebp - 4]
cmp dword [edx + 0x1f8], 0
je 0x4d7961
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
test eax, eax
je 0x4d7a02
cmp byte [eax + 0x215], 0
jne 0x4d7a02
mov edx, 0x1d4c0
mov eax, dword [ebp - 4]
call fcn.005aa9ac
mov eax, dword [ebp - 4]
mov byte [eax + 0x214], 1
xor eax, eax
push ebp
push 0x4d79fb
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4d799c
push 0
push 1
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004d82f0
mov eax, dword [ebp - 4]
cmp byte [eax + 0x215], 0
jne 0x4d79db
mov eax, dword [ebp - 4]
cmp byte [eax + 0x216], 0
jne 0x4d79db
mov eax, dword [ebp - 4]
cmp word [eax + 0x1e4], 0xc7
jge 0x4d79db
mov eax, dword [ebp - 4]
cmp word [eax + 0x1e4], 0
je 0x4d79db
mov eax, dword [ebp - 4]
cmp byte [eax + 0x268], 0
jne 0x4d7988
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7a02
mov eax, dword [ebp - 4]
call fcn.005aaa04
mov eax, dword [ebp - 4]
mov byte [eax + 0x214], 0
ret
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1d0], 0
jne 0x4d7a9a
mov eax, dword [ebp - 4]
mov bx, word [eax + 0x1e4]
cmp bx, 0x12c
jle 0x4d7a7a
cmp bx, 0x258
jge 0x4d7a7a
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x224]
call fcn.00408a4c
mov edx, dword [ebp - 0x28]
mov eax, 0x4d7b94
call fcn.00404200
test eax, eax
jg 0x4d7a6e
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x224]
call fcn.00408a4c
mov edx, dword [ebp - 0x28]
mov eax, 0x4d7ba8
call fcn.00404200
test eax, eax
jle 0x4d7a7a
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 1
jmp 0x4d7a9a
mov eax, dword [ebp - 4]
mov ax, word [eax + 0x1e4]
cmp ax, 0x12c
jle 0x4d7a9a
cmp ax, 0x258
jge 0x4d7a9a
mov eax, dword [ebp - 4]
mov byte [eax + 0x1d0], 2
cmp byte [ebp - 0x21], 0
jne 0x4d7abf
mov eax, dword [ebp - 4]
cmp word [eax + 0x29e], 0
je 0x4d7abf
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2a0]
call dword [ebx + 0x29c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1f8]
test eax, eax
je 0x4d7ade
mov dl, 1
mov ecx, dword [eax]
call dword [ecx - 4]
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x1f8], edx
cmp byte [ebp - 0x21], 0
je 0x4d7b05
mov eax, dword [ebp - 4]
cmp word [eax + 0x2c6], 0
je 0x4d7b05
mov ebx, dword [ebp - 4]
mov cl, 0xf
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2c8]
call dword [ebx + 0x2c4]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7b3a
lea eax, [ebp - 0x28]
call fcn.00403c9c
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00403cc0
ret