Function at 0x51f6d8
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
xor eax, eax
push ebp
push 0x51fc8d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x5c4e7c], 0
je 0x51fc72
mov eax, dword [0x5c6498]
mov byte [eax], 0
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [0x5c6dd0]
mov eax, dword [eax]
call fcn.00410774
test eax, eax
jne 0x51f738
lea edx, [ebp - 0x14]
mov eax, dword [0x5c6dd0]
mov eax, dword [eax]
mov ecx, 4
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [0x5c6dd0]
mov eax, dword [eax]
call fcn.00410774
mov dword [ebp - 0xc], eax
mov eax, dword [0x5c4e7c]
call fcn.00403c8c
mov ebx, eax
lea eax, [ebx + 0x50]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.004026a8
mov dword [ebp - 4], eax
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x358]
mov eax, dword [eax + 0x134]
call fcn.00475090
push ebp
push 0x51fc6b
push dword fs:[0]
mov dword fs:[0], esp
push ebp
push 0x51fc28
push dword fs:[0]
mov dword fs:[0], esp
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 8]
call fcn.00402b14
xor eax, eax
mov edx, dword [ebp - 4]
mov word [edx + 0xe], 1
add eax, 0x10
mov ecx, dword [ebp - 4]
mov edx, ecx
add edx, eax
mov dword [edx], 1
mov esi, dword [ebp - 0xc]
add esi, eax
add esi, 8
mov dword [edx + 4], esi
add eax, 8
mov edx, ecx
add edx, eax
mov word [edx + 0xe], 1
add eax, 0x10
mov edx, ecx
add edx, eax
mov dword [edx], 0x409
mov esi, dword [ebp - 0xc]
add esi, eax
add esi, 8
mov dword [edx + 4], esi
add eax, 8
mov dword [ebp - 0x10], eax
mov edx, ecx
add edx, eax
add eax, 0x10
mov esi, dword [ebp - 0xc]
add esi, eax
mov edi, dword [0x5c64b4]
add esi, dword [edi]
mov dword [edx], esi
mov dword [edx + 4], ebx
mov ebx, ecx
add ebx, eax
mov eax, dword [0x5c4e7c]
call fcn.00403e50
mov edx, eax
mov eax, ebx
call fcn.00407b68
mov eax, 0x3c
call fcn.004026a8
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x3c
call fcn.00402b14
mov eax, dword [0x5c6578]
mov eax, dword [eax]
mov edx, ebx
call fcn.0040dff4
mov eax, dword [0x5c6dd0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx + 0x14], 0xffffffff
mov byte [ebx + 0x18], 1
mov word [ebx + 0x19], 0x409
mov word [ebx + 0x1b], 0
xor eax, eax
mov dword [ebx + 0x1d], eax
mov dword [ebx + 0x21], 0x18
mov dword [ebx + 0x10], 0x18
mov byte [ebx + 0x25], 1
mov byte [ebx + 0x2b], 1
lea eax, [ebx + 0x34]
call fcn.00403a10
xor eax, eax
mov dword [ebx + 0x38], eax
push ebx
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x358]
mov eax, dword [eax + 0x134]
mov ecx, 0x51fca4
xor edx, edx
call fcn.00474e08
mov esi, eax
mov dword [ebx + 0x30], esi
mov edx, dword [esi + 8]
mov eax, dword [0x5c6190]
mov eax, dword [eax]
mov ecx, esi
mov edi, dword [eax]
call dword [edi + 0x38]
mov eax, dword [0x5c6190]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
mov dword [ebx + 0x26], eax
xor edx, edx
mov eax, esi
call fcn.00474048
mov edx, 1
mov eax, esi
call fcn.0047407c
or edx, 0xffffffff
mov eax, esi
call fcn.004740f4
mov eax, 0x3c
call fcn.004026a8
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x3c
call fcn.00402b14
mov eax, dword [0x5c6578]
mov eax, dword [eax]
mov edx, ebx
call fcn.0040dff4
mov eax, dword [0x5c6dd0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebx + 0x14], 0x2710
mov byte [ebx + 0x18], 0
mov word [ebx + 0x19], 0x409
mov word [ebx + 0x1b], 1
xor eax, eax
mov dword [ebx + 0x1d], eax
mov dword [ebx + 0x21], 1
mov dword [ebx + 0x10], 0x18
mov byte [ebx + 0x25], 0
mov byte [ebx + 0x2b], 1
lea eax, [ebx + 0x34]
call fcn.00403a10
mov dword [ebx + 0x38], 1
push ebx
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x358]
mov eax, dword [eax + 0x134]
mov ecx, 0x51fcb8
mov edx, esi
call fcn.00474d98
mov esi, eax
mov dword [ebx + 0x30], esi
mov edx, dword [esi + 8]
mov eax, dword [0x5c6190]
mov eax, dword [eax]
mov ecx, esi
mov edi, dword [eax]
call dword [edi + 0x38]
mov eax, dword [0x5c6190]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
mov dword [ebx + 0x26], eax
mov edx, 0x30
mov eax, esi
call fcn.00474048
mov edx, 0x30
mov eax, esi
call fcn.0047407c
or edx, 0xffffffff
mov eax, esi
call fcn.004740f4
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x358]
call fcn.00475c34
mov esi, eax
mov eax, dword [0x5c6a6c]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [0x5c686c]
mov byte [eax], 1
mov edx, dword [ebp - 4]
mov eax, dword [0x5c6dd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
xor edi, edi
jmp 0x51fa70
mov eax, dword [0x5c6578]
mov eax, dword [eax]
mov edx, edi
call fcn.0040e1ac
mov ebx, eax
cmp dword [ebx + 8], 0
je 0x51fa6f
cmp dword [ebx + 0x10], 0xffffffff
je 0x51fa6f
mov eax, dword [0x5c6dd0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebx + 8], eax
inc edi
mov eax, dword [0x5c6578]
mov eax, dword [eax]
cmp edi, dword [eax + 8]
jl 0x51fa46
mov eax, dword [0x5c6dd0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [0x5c6eb8]
mov dword [edx], eax
mov eax, dword [0x5c6dd0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
inc word [eax + 0xe]
push 0
push 1
push 0
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
xor ecx, ecx
xor edx, edx
call fcn.0053e68c
mov eax, dword [0x5c6dd0]
mov eax, dword [eax]
call fcn.00410774
mov ebx, eax
sub ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x51fb59
mov edi, 2
push 0x51fcc4
mov eax, dword [0x5c6558]
push dword [eax + edi*4]
push 0x51fce0
push 0x51fcf0
mov eax, dword [0x5c63ac]
mov eax, dword [eax + 4]
mov eax, dword [eax + edi*8 + 4]
lea ecx, [ebp - 0x1c]
mov edx, 8
call fcn.00407490
push dword [ebp - 0x1c]
push 0x51fd08
push 0x51fd14
lea ecx, [ebp - 0x20]
mov eax, dword [0x5c6a6c]
mov eax, dword [eax]
mov edx, 8
call fcn.00407490
push dword [ebp - 0x20]
push 0x51fd2c
lea eax, [ebp - 0x18]
mov edx, 9
call fcn.00403d4c
mov edx, dword [ebp - 0x18]
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
call fcn.005287d8
mov eax, dword [0x5c63ac]
mov eax, dword [eax + 4]
mov edx, dword [0x5c6a6c]
mov edx, dword [edx]
mov dword [eax + edi*8 + 4], edx
mov eax, dword [0x5c6dd0]
mov eax, dword [eax]
call fcn.00410774
mov edx, dword [0x5c6228]
mov edx, dword [edx]
lea edx, [edx + edx*4]
mov ecx, dword [0x5c63d4]
mov ecx, dword [ecx + 8]
mov dword [ecx + edx*8 + 0x10], eax
mov eax, dword [0x5c6228]
mov eax, dword [eax]
lea eax, [eax + eax*4]
mov edx, dword [0x5c63d4]
mov edx, dword [edx + 8]
mov ecx, dword [0x5c6a6c]
mov ecx, dword [ecx]
mov dword [edx + eax*8 + 8], ecx
test ebx, ebx
je 0x51fbb9
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
mov edx, dword [eax + 0x274]
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
call fcn.00538850
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
mov edx, dword [eax + 0x358]
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
mov ecx, esi
call fcn.0053c844
mov eax, dword [0x5c686c]
mov byte [eax], 0
mov eax, dword [0x5c6610]
mov byte [eax], 1
mov edx, dword [0x5c6610]
mov dl, byte [edx]
xor dl, 1
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x5c8]
call fcn.004220bc
mov edx, dword [0x5c6610]
mov dl, byte [edx]
xor dl, 1
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x5a8]
call fcn.00429af8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51fc32
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51fc72
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004026c0
mov eax, dword [0x5c64a4]
mov eax, dword [eax]
mov eax, dword [eax + 0x358]
mov eax, dword [eax + 0x134]
call fcn.004750d8
mov eax, dword [0x5c61f8]
mov byte [eax], 1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51fc94
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403a34
ret