Function at 0x502e40
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c60cc
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x692c00]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.0042a6b0
lea ecx, [ebx + 0x20]
mov dword [ebp - 4], 0
call fcn.0042a1e0
lea ecx, [ebx + 0xbc]
mov byte [ebp - 4], 1
mov dword [ebx], vtable.TlsProtocol.0
mov dword [ebx + 0x20], vtable.TlsProtocol.1.0
mov byte [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 3
mov dword [ebx + 0x34], 3
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov byte [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x80], 0
mov word [ebx + 0x84], 0
mov byte [ebx + 0x86], 1
mov word [ebx + 0xb7], 0x101
mov byte [ebx + 0xb9], 1
call fcn.0042aaf0
lea ecx, [ebx + 0x130]
mov byte [ebp - 4], 2
call fcn.0042aaf0
lea ecx, [ebx + 0x1d0]
mov byte [ebp - 4], 3
mov dword [ebx + 0x1a4], 0x200
mov dword [ebx + 0x1a8], 0
mov byte [ebx + 0x1ac], 0
mov dword [ebx + 0x1b0], 0
mov dword [ebx + 0x1b4], 0
mov dword [ebx + 0x1b8], 0
mov dword [ebx + 0x1bc], 0
mov byte [ebx + 0x1c8], 0
mov dword [ebx + 0x1cc], 0
call fcn.00434d00
lea ecx, [ebx + 0x1f0]
mov byte [ebp - 4], 4
mov byte [ebx + 0x1ec], 1
call fcn.00434d00
lea ecx, [ebx + 0x20c]
mov byte [ebp - 4], 5
call fcn.00434d00
lea ecx, [ebx + 0x228]
mov byte [ebp - 4], 6
call fcn.00434d00
lea ecx, [ebx + 0x244]
mov byte [ebp - 4], 7
call fcn.00434d00
lea ecx, [ebx + 0x260]
mov byte [ebp - 4], 8
call fcn.00434d00
lea ecx, [ebx + 0x27c]
mov byte [ebp - 4], 9
call fcn.00434d00
lea ecx, [ebx + 0x298]
mov byte [ebp - 4], 0xa
call fcn.00434d00
lea ecx, [ebx + 0x2b4]
mov byte [ebp - 4], 0xb
call fcn.00434d00
lea ecx, [ebx + 0x2d0]
mov byte [ebp - 4], 0xc
call fcn.00434d00
mov byte [ebp - 4], 0xd
lea ecx, [ebx + 0x2ec]
call fcn.00434d00
lea ecx, [ebx + 0x308]
mov byte [ebp - 4], 0xe
call fcn.00434d00
lea ecx, [ebx + 0x324]
mov byte [ebp - 4], 0xf
call fcn.00434d00
lea ecx, [ebx + 0x354]
mov byte [ebp - 4], 0x10
mov dword [ebx + 0x340], 0
mov dword [ebx + 0x344], 0
mov dword [ebx + 0x348], 0
mov dword [ebx + 0x34c], 0
mov byte [ebx + 0x350], 0
call fcn.00434d00
lea ecx, [ebx + 0x374]
mov byte [ebp - 4], 0x11
mov byte [ebx + 0x370], 0
call fcn.00434d00
lea ecx, [ebx + 0x390]
mov byte [ebp - 4], 0x12
call fcn.00434d00
lea ecx, [ebx + 0x3ac]
mov byte [ebp - 4], 0x13
call fcn.00434d00
lea ecx, [ebx + 0x3c8]
mov byte [ebp - 4], 0x14
call fcn.00434d00
lea ecx, [ebx + 0x434]
mov byte [ebp - 4], 0x15
mov dword [ebx + 0x3e4], 0
mov dword [ebx + 0x3e8], 0
mov dword [ebx + 0x3ec], 0
mov dword [ebx + 0x3f4], 0
mov dword [ebx + 0x3f8], 0
mov dword [ebx + 0x3fc], 0
mov dword [ebx + 0x400], 0
mov dword [ebx + 0x404], 0
mov dword [ebx + 0x408], 0
mov dword [ebx + 0x40c], 0
mov dword [ebx + 0x410], 0
mov dword [ebx + 0x414], 0
mov dword [ebx + 0x418], 1
mov dword [ebx + 0x41c], 0
mov dword [ebx + 0x420], 0
mov byte [ebx + 0x424], 0
mov dword [ebx + 0x430], 0
call fcn.00434d00
lea ecx, [ebx + 0x450]
mov byte [ebp - 4], 0x16
call fcn.0045be60
lea ecx, [ebx + 0x478]
mov byte [ebp - 4], 0x17
mov dword [ebx + 0x474], 0
call fcn.00434d00
lea ecx, [ebx + 0x498]
mov byte [ebp - 4], 0x18
mov dword [ebx + 0x494], 0
call fcn.00434d00
lea esi, [ebx + 0x4b8]
mov word [ebx + 0x4b4], 0
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 0x19
mov dword [esi], vtable.TlsRawRecord.0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
lea ecx, [esi + 0x14]
call fcn.00434d00
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 0x1a
call fcn.00434d00
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 0x1b
call fcn.00434d00
mov byte [esi + 0x68], 0
push 3
push 0x6101d4
lea ecx, [ebx + 0xbc]
mov byte [ebp - 4], 0x1c
call fcn.0042bc50
call fcn.0050e630
mov dword [ebx + 0x1c0], eax
test eax, eax
je 0x503239
cmp dword [eax + 0x94], 0xab450092
je 0x503239
push 0
call fcn.00401520
add esp, 4
call fcn.0050e630
mov dword [ebx + 0x1c4], eax
test eax, eax
je 0x50325e
cmp dword [eax + 0x94], 0xab450092
je 0x50325e
push 0
call fcn.00401520
add esp, 4
call fcn.004601c0
mov dword [ebx + 0x3f0], eax
call fcn.0050e630
mov dword [ebx + 0x428], eax
test eax, eax
je 0x50328e
cmp dword [eax + 0x94], 0xab450092
je 0x50328e
push 0
call fcn.00401520
add esp, 4
call fcn.0050e630
mov dword [ebx + 0x42c], eax
test eax, eax
je 0x5032b3
cmp dword [eax + 0x94], 0xab450092
je 0x5032b3
push 0
call fcn.00401520
add esp, 4
xor eax, eax
mov dword [ebx + 0x58], 5
mov word [ebx + 0x4c], ax
mov dword [ebx + 0x54], eax
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], eax
mov dword [ebx + 0x64], eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], eax
mov eax, ebx
mov dword [ebx + 0x50], str.NULL
mov byte [ebx + 0x3c4], 1
mov byte [ebx + 0x3e0], 1
mov byte [ebx + 0x1e8], 1
mov byte [ebx + 0x208], 1
mov byte [ebx + 0x224], 1
mov byte [ebx + 0x240], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret