Function at 0x4089b0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x18]
push ebx
push esi
push edi
mov eax, dword [eax + 0x2c]
mov esi, dword [eax - 8]
call fcn.00408370
mov edi, eax
mov dword [ebp - 0x10], 1
mov eax, dword fs:[0x18]
mov dword [ebp - 8], edi
lea ecx, [edi - 1]
mov eax, dword [eax + 0x30]
lea ecx, [ecx + ecx*2]
lea ecx, [ecx*4 + 0x1c]
mov dword [ebp - 0xc], ecx
add ecx, ecx
push ecx
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x408b8d
mov ecx, dword fs:[0x18]
xor eax, eax
mov dword [ebx + 4], 1
mov dword [ebx], 0
cmp esi, dword [ecx + 0x24]
mov dword [ebx + 8], edi
cmove esi, eax
mov dword [ebx + 0xc], esi
xor esi, esi
test edi, edi
je 0x408a77
add ebx, 0x14
mov edi, ebx
nop word [eax + eax]
mov eax, dword fs:[0x18]
push 0x40c
push 8
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [edi], eax
test eax, eax
je 0x408b59
add eax, 8
inc esi
mov dword [edi], eax
add edi, 0xc
cmp esi, dword [ebp - 8]
jb 0x408a40
mov ebx, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push eax
push ebx
lea esi, [ebx + eax]
push esi
mov dword [ebp - 8], esi
call fcn.0040da80
add esp, 0xc
push dword [ebp - 0xc]
push ebx
push 0x23
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
test eax, eax
js 0x408b37
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x48]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
je 0x408b25
lea eax, [ebx + 0x18]
add esi, 0x14
mov dword [ebp - 0xc], eax
mov eax, ebx
sub eax, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
nop dword [eax + eax]
mov eax, dword fs:[0x18]
push 0x14
push 0
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edx, eax
lea ebx, [ebx + 0xc]
mov eax, dword [ebp - 8]
lea esi, [esi + 0xc]
mov ecx, dword [esi + eax - 0xc]
mov dword [edx + 0xc], ecx
mov ecx, dword [esi - 0xc]
mov dword [edx + 0x10], ecx
mov ecx, dword [ebx - 0xc]
mov dword [edx + 8], ecx
mov ecx, dword [0x438ce4]
mov ecx, dword [ecx + 0x48]
add ecx, 0x2c
mov eax, dword [ecx + 4]
mov dword [edx], ecx
mov dword [edx + 4], eax
mov dword [eax], edx
mov dword [ecx + 4], edx
sub edi, 1
jne 0x408ad0
mov ebx, dword [ebp - 4]
mov eax, dword [0x438ce4]
mov eax, dword [eax + 0x48]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword fs:[0x18]
push ebx
push 0
mov ecx, dword [ecx + 0x30]
push dword [ecx + 0x18]
call edi
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
je 0x408b81
mov eax, dword [ebx]
sub eax, 8
push eax
mov eax, dword fs:[0x18]
push 0
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call edi
lea ebx, [ebx + 0xc]
sub esi, 1
jne 0x408b63
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x10], 0
jmp 0x408b3d
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret