Function at 0x476ca4
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x476fa6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x476fbc
call fcn.00403f88
push 0
mov ecx, 0x476fcc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045baec
mov edx, dword [ebx + 0xec]
mov dword [edx + 4], eax
push 0
mov ecx, 0x476fe0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045baec
mov edx, dword [ebx + 0xec]
mov dword [edx + 0xc], eax
push 0
mov ecx, 0x476ff4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045baec
mov edx, dword [ebx + 0xec]
mov dword [edx + 8], eax
push 0
mov ecx, 0x477008
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045baec
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x10], eax
push 0
mov ecx, 0x477020
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045baec
mov esi, dword [ebx + 0xec]
mov dword [esi + 0x18], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x477030
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045b9bc
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 0x14]
mov eax, ebx
call fcn.00475854
push 0
mov ecx, 0x477040
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045baec
mov esi, dword [ebx + 0xec]
mov dword [esi + 0x1c], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x477050
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045b9bc
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi + 0x44]
mov eax, ebx
call fcn.00475854
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x477064
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045b9bc
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebx + 0xec]
mov edx, dword [eax + 0x48]
mov eax, ebx
call fcn.00475854
push 0xffffffffffffffff
mov ecx, 0x477078
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045baec
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x2c], eax
push 0xffffffffffffffff
mov ecx, 0x477090
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045baec
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x30], eax
push 0xffffffffffffffff
mov ecx, 0x4770a8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045baec
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x34], eax
push 0
mov ecx, 0x4770c0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045baec
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x4c], eax
push 0
mov ecx, 0x4770dc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045baec
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x50], eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4770f8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045b9bc
cmp dword [ebp - 8], 0
je 0x476e90
mov eax, dword [ebx + 0xec]
mov byte [eax + 0x54], 1
jmp 0x476e9a
mov eax, dword [ebx + 0xec]
mov byte [eax + 0x54], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x477110
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045b9bc
cmp dword [ebp - 8], 0
je 0x476ec2
mov eax, dword [ebx + 0xec]
mov byte [eax + 0x55], 1
jmp 0x476ecc
mov eax, dword [ebx + 0xec]
mov byte [eax + 0x55], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x47712c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045b9bc
cmp dword [ebp - 8], 0
je 0x476ef4
mov eax, dword [ebx + 0xec]
mov byte [eax + 0x56], 1
jmp 0x476efe
mov eax, dword [ebx + 0xec]
mov byte [eax + 0x56], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4770f8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045b9bc
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebx + 0xa0]
mov eax, ebx
call fcn.00477b48
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x38], eax
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x477110
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045b9bc
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0xa0]
mov eax, ebx
call fcn.00477b48
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x3c], eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x47712c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.0045b9bc
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebx + 0xa0]
mov eax, ebx
call fcn.00477b48
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476fad
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00403f14
ret