Function at 0x4f0b80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
lea eax, [ebp - 0x18]
mov esi, ecx
mov ebx, edx
mov dl, byte [ebp + 0x10]
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x506040
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov byte [esi + 0x48], dl
mov ecx, dword [esi]
mov edx, dword [esi + 4]
call fcn.004f0b64
mov edx, dword [ebp + 8]
mov edi, eax
mov ecx, ebx
push 0xf423f
push 0
push 0
push dword [ebp + 0xc]
call fcn.004e4fb0
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, edx
mov edx, dword [edi + 0x44]
mov ebx, ecx
mov ecx, dword [edi + 0x40]
push ebx
mov ebx, esi
push eax
push dword [ebp - 0x20]
push dword [edi + 0x48]
call fcn.004ef8c9
add esp, 0x10
mov ecx, eax
lea eax, [esi + 0x18]
mov edi, edx
mov dword [ebp - 0x24], eax
movq xmm0, qword [esi + 0x30]
push 0xfffffffffffffffd
pop edx
cmp ecx, edx
mov eax, edx
mov dword [ebp - 0x28], ecx
cmovb eax, ecx
cmp edi, 0xffffffff
cmovne edx, ecx
cmove edx, eax
movd eax, xmm0
pshufd xmm0, xmm0, 0x55
mov dword [ebp - 0x20], edx
movd edx, xmm0
cmp dword [ebp - 0x20], eax
mov ecx, edi
sbb ecx, edx
jb 0x4f0c5d
mov ecx, edi
mov esi, edi
mov edi, ebx
mov ebx, dword [ebp - 0x28]
lock cmpxchg8b qword [edi + 0x30]
mov ebx, edi
mov edi, esi
jne 0x4f0c3b
jmp 0x4f0dea
cmp byte [ebp + 0x10], 0
je 0x4f0dea
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
or dword [ebp - 0x10], 0xffffffff
call fcn.004f0b64
mov edx, eax
mov eax, dword [ebx + 4]
cmp dword [ebx], 0
mov dword [ebp - 0x34], eax
push 0x78
pop eax
push 8
pop ecx
cmove ecx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x30], ecx
mov ecx, edx
call fcn.004ea513
movq xmm0, qword [ebx + 0x30]
movd eax, xmm0
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
and ecx, eax
cmp ecx, 0xffffffff
je 0x4f0ccd
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], edi
add ecx, 0x18
call fcn.004f1383
mov edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov al, byte [ecx + 0x38]
test al, al
je 0x4f0ce2
mov ecx, dword [ebp - 0x24]
xor edx, edx
inc edx
jmp 0x4f0dc6
movd xmm0, dword [ebp - 0x28]
movd xmm1, edi
mov esi, ecx
punpckldq xmm0, xmm1
movq qword [ebx + 0x30], xmm0
movq qword [ebx + 0x20], xmm0
movq xmm0, qword [ebx + 0x30]
movd edi, xmm0
pshufd xmm0, xmm0, 0x55
movd ecx, xmm0
mov eax, edi
and eax, ecx
cmp eax, 0xffffffff
je 0x4f0e0e
movd xmm0, edi
movd xmm1, ecx
punpckldq xmm0, xmm1
movq qword [ebx + 0x20], xmm0
mov ebx, ecx
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x1c]
cmp ecx, edi
mov edx, eax
sbb edx, ebx
jae 0x4f0dc1
xor ecx, edi
xor eax, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], edi
or ecx, 0x3f
mov edx, eax
cmp ecx, 0xfffffffe
sbb edx, 0xf
push 0xfffffffffffffffe
pop edx
cmovb edx, ecx
push 0xf
pop ecx
cmovb ecx, eax
bsr edx, edx
xor edx, 0x1f
bsr eax, ecx
or dl, 0x20
xor eax, 0x1f
test ecx, ecx
movzx ecx, dl
cmovne ecx, eax
xor cl, 0x3e
movzx eax, cl
mov cl, 6
div cl
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
and dword [ebp - 0x10], 0
movzx eax, al
push 0x5920a4
push eax
call fcn.004ee726
mov edx, dword [ebp - 0x24]
add esp, 8
mov ecx, eax
call fcn.004ee77a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
add eax, 0xffffffff
adc ecx, 0xffffffff
xor edi, edi
cmp eax, dword [ebp - 0x28]
sbb ecx, dword [ebp - 0x2c]
jae 0x4f0dfb
jmp 0x4f0dd3
mov ecx, dword [ebp - 0x24]
xor edx, edx
call fcn.004ee7d7
or dword [ebp - 0x10], 0xffffffff
mov edi, eax
mov esi, edx
mov ecx, dword [ebp - 0x20]
or dword [ebp - 0x10], 0xffffffff
call fcn.00470887
test edi, edi
je 0x4f0dea
push esi
call dword [edi + 4]
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
lea ecx, [eax + ecx + 0x50]
call fcn.004ee9e8
xor edi, edi
jmp 0x4f0dd3
and dword [ebp - 0x10], 0
push 0x13
pop edx
mov ecx, 0x591f58
push 0x591f6c
call fcn.005363f0
pop eax
ud2