Function at 0x406550
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
mov si, 0x9f8b
mov word [esp + 0x92], 0x6100
mov dword [esp + 0x78], 0x4165c778
mov dword [esp + 0x34], 0x6ecb4872
mov di, word [esp + 0x92]
sub si, di
mov word [esp + 0x6a], si
cmp eax, 0
sete bl
cmp ecx, 0
sete bh
and bh, bl
mov dword [esp + 0x58], edx
test bh, 1
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
mov byte [esp + 0x1f], bl
mov word [esp + 0x1c], di
jne 0x40684a
mov ecx, dword fs:[0x18]
xor eax, eax
mov edx, ecx
sub edx, 0x1000
cmovb ecx, eax
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x80]
mov esi, dword [esp + 0x84]
add ecx, ecx
adc esi, esi
mov edi, dword [eax]
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], esi
mov dword [esp + 0x6c], edi
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x58], 0
cmp ecx, eax
mov dword [esp + 0x18], edx
je 0x40684a
jmp 0x406701
mov al, byte [esp + 0x61]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x58], ecx
test al, 1
jne 0x40684a
jmp 0x406875
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x38], eax
jmp 0x406780
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x54]
mov si, word [edx + eax*2]
mov di, si
add di, 0xffbf
mov bx, si
add bx, 0x20
cmp di, 0x1a
cmovb si, bx
mov di, word [esp + 0x1c]
imul bx, di, 0x351c
mov eax, dword [esp + 0x78]
xor eax, 0x4165c779
mov word [esp + 0x7e], bx
mov edx, dword [esp + 0x20]
cmp word [edx + ecx*2], si
sete cl
mov ch, byte [esp + 0x91]
mov dword [esp + 0x14], eax
mov al, ch
mul byte [esp + 0x91]
mov byte [esp + 0x91], al
and cl, 1
mov byte [esp + 0x61], cl
imul eax, dword [esp + 0x8c], 0x1c4ff59
mov cl, byte [esp + 0x61]
cmp si, 0
setne ch
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
add edx, dword [esp + 0x48]
cmp edx, eax
setb al
and cl, ch
and cl, al
mov dword [esp + 0x64], edx
test cl, 1
jne 0x406936
jmp 0x40662c
mov al, byte [esp + 0x1f]
test al, 1
jne 0x4067da
jmp 0x406645
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x44]
imul eax, eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x5c]
mov dx, word [esp + 0x6a]
mov si, word [esp + 0x1c]
mov cx, si
xor ecx, 0xe3c2
mov di, cx
mov word [esp + 0x7e], di
mov di, word [eax + 0x24]
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0x590e2d41
mov word [esp + 0x62], di
mov eax, dword [esp + 0x5c]
add eax, 0x28
mov dword [esp + 0x3c], eax
cmp dx, 0xf9d5
jne 0x4067ad
jmp 0x4068b5
mov eax, dword [esp + 0x38]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x4c]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x4c]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x50], eax
je 0x4067e7
jmp 0x4068b5
mov eax, dword [esp + 0x3c]
mov eax, dword [eax]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + 0x10]
mov dword [esp + 0x40], eax
mov cx, word [esp + 0x62]
shr cx, 1
movzx eax, cx
mov dword [esp + 0x28], eax
cmp cx, 0
je 0x406856
jmp 0x40683d
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x44], eax
jmp 0x406712
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff8
mov dword [esp + 0x58], eax
jmp 0x40684a
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0x77194608
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x80]
add ecx, ecx
adc eax, eax
mov edx, dword [esp + 0x40]
mov bl, byte [esp + 0x60]
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], eax
mov dword [esp + 0x58], edx
test bl, 1
jne 0x40684a
jmp 0x406856
mov dword [esp + 0x70], 0
jmp 0x406966
mov eax, dword [esp + 0x58]
lea esp, [ebp - 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, dword [esp + 0x5c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x44], eax
mov dword [esp + 0x58], 0
cmp eax, ecx
je 0x40684a
jmp 0x406712
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x8c], 0xd001502
mov eax, dword [eax]
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0x5d0fb421
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x38], eax
mov dword [esp + 0x58], 0
cmp eax, ecx
je 0x40684a
jmp 0x406780
mov cx, word [esp + 0x1c]
mov ax, cx
not eax
mov dx, ax
mov eax, dword [esp + 0x4c]
mov word [esp + 0x7e], dx
mov esi, dword [esp + 0x80]
mov edi, dword [esp + 0x84]
mov ebx, 0x5b8ddfb2
mov dword [esp + 0x10], eax
mov eax, esi
mul ebx
imul esi, edi, 0x5b8ddfb2
add edx, esi
mov cx, word [esp + 0x92]
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], edx
xor cx, 0x6101
mov eax, dword [esp + 0x10]
mov si, word [eax + 0x24]
shr si, cl
movzx edx, si
mov cx, word [esp + 0x92]
xor cx, 0x6100
mov dword [esp + 0x2c], edx
cmp si, cx
je 0x406875
jmp 0x4069e8
mov eax, 0x45ca2bd6
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x44], 0
mov dx, word [esp + 0x1c]
mov word [esp + 0x7e], dx
cmp eax, ecx
jae 0x406712
jmp 0x406652
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x30]
movzx ecx, word [ecx + eax*2]
mov dx, cx
mov esi, ecx
add esi, 0xffffffbf
add ecx, 0x20
mov di, cx
mov bx, si
movzx ecx, bx
sub ecx, 0x1a
cmovb dx, di
mov esi, dword [esp + 0x20]
mov di, word [esi + eax*2]
sub di, dx
sete byte [esp + 0x60]
mov bl, byte [esp + 0x60]
test dx, dx
setne bh
and bl, bh
inc eax
mov esi, dword [esp + 0x28]
mov edx, eax
sub edx, esi
setb bh
and bl, bh
mov dword [esp + 0x70], eax
mov dword [esp + 0x84], 0
mov dword [esp + 0x80], 0xba92737
test bl, 1
mov word [esp + 0xe], di
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
jne 0x406966
jmp 0x4067f4
mov dword [esp + 0x64], 0
jmp 0x406936