Function at 0x4b4ce8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b4fea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4b5000
call fcn.0040499c
push 0
mov ecx, 0x4b5010
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004717f0
mov edx, dword [ebx + 0xec]
mov dword [edx + 4], eax
push 0
mov ecx, 0x4b5024
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004717f0
mov edx, dword [ebx + 0xec]
mov dword [edx + 0xc], eax
push 0
mov ecx, 0x4b5038
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004717f0
mov edx, dword [ebx + 0xec]
mov dword [edx + 8], eax
push 0
mov ecx, 0x4b504c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004717f0
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x10], eax
push 0
mov ecx, 0x4b5064
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004717f0
mov esi, dword [ebx + 0xec]
mov dword [esi + 0x18], eax
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x4b5074
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004716c0
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 0x14]
mov eax, ebx
call fcn.004b385c
push 0
mov ecx, 0x4b5084
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004717f0
mov esi, dword [ebx + 0xec]
mov dword [esi + 0x1c], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4b5094
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004716c0
mov ecx, dword [ebp - 0x10]
mov edx, dword [esi + 0x44]
mov eax, ebx
call fcn.004b385c
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4b50a8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004716c0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebx + 0xec]
mov edx, dword [eax + 0x48]
mov eax, ebx
call fcn.004b385c
push 0xffffffffffffffff
mov ecx, 0x4b50bc
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004717f0
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x2c], eax
push 0xffffffffffffffff
mov ecx, 0x4b50d4
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004717f0
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x30], eax
push 0xffffffffffffffff
mov ecx, 0x4b50ec
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004717f0
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x34], eax
push 0
mov ecx, 0x4b5104
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004717f0
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x4c], eax
push 0
mov ecx, 0x4b5120
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004717f0
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x50], eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4b513c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004716c0
cmp dword [ebp - 8], 0
je 0x4b4ed4
mov eax, dword [ebx + 0xec]
mov byte [eax + 0x54], 1
jmp 0x4b4ede
mov eax, dword [ebx + 0xec]
mov byte [eax + 0x54], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4b5154
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004716c0
cmp dword [ebp - 8], 0
je 0x4b4f06
mov eax, dword [ebx + 0xec]
mov byte [eax + 0x55], 1
jmp 0x4b4f10
mov eax, dword [ebx + 0xec]
mov byte [eax + 0x55], 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4b5170
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004716c0
cmp dword [ebp - 8], 0
je 0x4b4f38
mov eax, dword [ebx + 0xec]
mov byte [eax + 0x56], 1
jmp 0x4b4f42
mov eax, dword [ebx + 0xec]
mov byte [eax + 0x56], 0
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x4b513c
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004716c0
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebx + 0xa0]
mov eax, ebx
call fcn.004b5b94
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x38], eax
push 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4b5154
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004716c0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0xa0]
mov eax, ebx
call fcn.004b5b94
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x3c], eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x4b5170
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x34]
call fcn.004716c0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebx + 0xa0]
mov eax, ebx
call fcn.004b5b94
mov edx, dword [ebx + 0xec]
mov dword [edx + 0x40], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4ff1
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00404928
ret