Function at 0x406cb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x442b77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, ecx
mov eax, dword [esi]
mov dword [esp + 0x14], edi
mov dword [edi], eax
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov edx, dword [esi + 8]
lea eax, [esi + 0xc]
lea ecx, [edi + 0xc]
push eax
mov dword [edi + 8], edx
call fcn.00435da1
lea ecx, [esi + 0x10]
mov dword [esp + 0x24], 0
push ecx
lea ecx, [edi + 0x10]
call fcn.00435da1
lea edx, [esi + 0x14]
lea ecx, [edi + 0x14]
push edx
mov byte [esp + 0x28], 1
call fcn.00435da1
mov al, byte [esi + 0x18]
lea ecx, [esi + 0x1c]
push ecx
lea ecx, [edi + 0x1c]
mov byte [esp + 0x28], 2
mov byte [edi + 0x18], al
call fcn.00435da1
mov dl, byte [esi + 0x20]
lea eax, [esi + 0x24]
push eax
lea ecx, [edi + 0x24]
mov byte [esp + 0x28], 3
mov byte [edi + 0x20], dl
call fcn.00435da1
lea ecx, [esi + 0x28]
mov byte [esp + 0x24], 4
push ecx
lea ecx, [edi + 0x28]
call fcn.00435da1
lea edx, [esi + 0x2c]
lea ecx, [edi + 0x2c]
push edx
mov byte [esp + 0x28], 5
call fcn.00435da1
lea eax, [esi + 0x30]
lea ecx, [edi + 0x30]
push eax
mov byte [esp + 0x28], 6
call fcn.00435da1
lea ecx, [esi + 0x34]
mov byte [esp + 0x24], 7
push ecx
lea ecx, [edi + 0x34]
call fcn.00435da1
lea edx, [esi + 0x38]
lea ecx, [edi + 0x38]
push edx
mov byte [esp + 0x28], 8
call fcn.00435da1
lea eax, [esi + 0x3c]
lea ecx, [edi + 0x3c]
push eax
mov byte [esp + 0x28], 9
call fcn.00435da1
lea ecx, [esi + 0x40]
mov byte [esp + 0x24], 0xa
push ecx
lea ecx, [edi + 0x40]
call fcn.00435da1
lea edx, [esi + 0x44]
lea ecx, [edi + 0x44]
push edx
mov byte [esp + 0x28], 0xb
call fcn.00435da1
mov al, byte [esi + 0x48]
mov byte [esp + 0x24], 0xc
mov byte [edi + 0x48], al
mov ecx, dword [esi + 0x4c]
test ecx, ecx
jne 0x406de3
xor eax, eax
jmp 0x406deb
mov eax, dword [esi + 0x50]
sub eax, ecx
sar eax, 2
test eax, eax
jge 0x406df1
xor eax, eax
lea ecx, [eax*4]
push ecx
call fcn.0043658d
mov dword [edi + 0x4c], eax
mov ecx, dword [esi + 0x50]
mov ebx, dword [esi + 0x4c]
add esp, 4
mov ebp, eax
cmp ebx, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x10], ebp
je 0x406e3f
mov dword [esp + 0x18], ebp
test ebp, ebp
mov byte [esp + 0x24], 0xd
je 0x406e31
push ebx
mov ecx, ebp
call fcn.00435da1
mov ecx, dword [esp + 0x2c]
add ebx, 4
add ebp, 4
cmp ebx, ecx
mov dword [esp + 0x10], ebp
jne 0x406e18
mov dword [edi + 0x50], ebp
mov dword [edi + 0x54], ebp
mov dl, byte [esi + 0x58]
mov byte [esp + 0x24], 0xe
mov byte [edi + 0x58], dl
mov ecx, dword [esi + 0x5c]
test ecx, ecx
jne 0x406e5b
xor eax, eax
jmp 0x406e63
mov eax, dword [esi + 0x60]
sub eax, ecx
sar eax, 2
test eax, eax
jge 0x406e69
xor eax, eax
shl eax, 2
push eax
call fcn.0043658d
mov dword [edi + 0x5c], eax
mov ecx, dword [esi + 0x60]
mov ebx, dword [esi + 0x5c]
add esp, 4
mov ebp, eax
cmp ebx, ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x10], ebp
je 0x406eb3
mov dword [esp + 0x18], ebp
test ebp, ebp
mov byte [esp + 0x24], 0xf
je 0x406ea5
push ebx
mov ecx, ebp
call fcn.00435da1
mov ecx, dword [esp + 0x2c]
add ebx, 4
add ebp, 4
cmp ebx, ecx
mov dword [esp + 0x10], ebp
jne 0x406e8c
mov dword [edi + 0x60], ebp
mov dword [edi + 0x64], ebp
lea ecx, [esi + 0x68]
mov byte [esp + 0x24], 0x10
push ecx
lea ecx, [edi + 0x68]
call fcn.00435da1
mov dl, byte [esi + 0x6c]
mov ecx, dword [esp + 0x1c]
mov byte [edi + 0x6c], dl
mov al, byte [esi + 0x6d]
mov byte [edi + 0x6d], al
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4