Function at 0x40ebc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44fa08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 1
call fcn.00434b58
push 1
push 0x5c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 2
call fcn.0042db11
push 1
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 3
call fcn.0042dcc2
mov esi, dword [esp + 0x14]
mov eax, dword [eax]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
or edi, 0xffffffff
cmp dl, bl
jne 0x40ec49
test cl, cl
je 0x40ec45
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40ec49
add eax, 2
add esi, 2
test cl, cl
jne 0x40ec1e
xor eax, eax
jmp 0x40ec4d
sbb eax, eax
sbb eax, edi
test eax, eax
lea ecx, [esp + 0x18]
setne bl
call fcn.00434de3
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call fcn.00434de3
test bl, bl
je 0x40ec78
push 0x5c
lea ecx, [esp + 0x10]
call fcn.004351e6
lea ecx, [esp + 0xc]
call fcn.00435305
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
call fcn.00434b58
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.00435305
push str.TEMP_
lea ecx, [esp + 0x10]
call fcn.0042ddb6
cmp eax, edi
jg 0x40eee4
push str.TMP_
lea ecx, [esp + 0x10]
call fcn.0042ddb6
cmp eax, edi
jg 0x40eee4
push str.TEMPORARY_INTERNET_FILES_
lea ecx, [esp + 0x10]
call fcn.0042ddb6
cmp eax, edi
jg 0x40eee4
push str.SYSTEM32SPOOLPRINTERS_
lea ecx, [esp + 0x10]
call fcn.0042ddb6
cmp eax, edi
jg 0x40eee4
push str.NETSCAPEUSERSDEFAULTCACHE_
lea ecx, [esp + 0x10]
call fcn.0042ddb6
cmp eax, edi
jg 0x40eee4
push 4
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x18]
call fcn.0042dcc2
mov eax, dword [eax]
mov esi, str..TMP
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40ed4a
test cl, cl
je 0x40ed46
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40ed4a
add eax, 2
add esi, 2
test cl, cl
jne 0x40ed22
xor eax, eax
jmp 0x40ed4e
sbb eax, eax
sbb eax, edi
test eax, eax
lea ecx, [esp + 0x18]
sete bl
call fcn.00434de3
test bl, bl
jne 0x40eee4
push 6
push 1
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call fcn.0042dc2c
mov eax, dword [eax]
mov byte [esp + 0x28], 5
mov esi, str.FASTUN
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40edaa
test cl, cl
je 0x40eda6
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40edaa
add eax, 2
add esi, 2
test cl, cl
jne 0x40ed82
xor eax, eax
jmp 0x40edae
sbb eax, eax
sbb eax, edi
test eax, eax
jne 0x40ee2c
push 4
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call fcn.0042dcc2
push 3
lea ecx, [esp + 0x1c]
push ecx
mov ecx, eax
mov byte [esp + 0x30], 6
call fcn.0042dd3e
mov eax, dword [eax]
mov esi, 0x465274
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40ee04
test cl, cl
je 0x40ee00
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40ee04
add eax, 2
add esi, 2
test cl, cl
jne 0x40eddc
xor eax, eax
jmp 0x40ee08
sbb eax, eax
sbb eax, edi
test eax, eax
lea ecx, [esp + 0x18]
sete bl
call fcn.00434de3
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 5
call fcn.00434de3
test bl, bl
je 0x40ee2c
mov bl, 1
jmp 0x40ee2e
xor bl, bl
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 4
call fcn.00434de3
test bl, bl
jne 0x40eee4
push 9
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
call fcn.0042dcc2
mov eax, dword [eax]
mov esi, str._IE5._
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40ee83
test cl, cl
je 0x40ee7f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40ee83
add eax, 2
add esi, 2
test cl, cl
jne 0x40ee5b
xor eax, eax
jmp 0x40ee87
sbb eax, eax
sbb eax, edi
test eax, eax
lea ecx, [esp + 0x1c]
sete bl
call fcn.00434de3
test bl, bl
mov byte [esp + 0x28], 2
lea ecx, [esp + 0x10]
jne 0x40eeed
call fcn.00434de3
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.00434de3
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.00434de3
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], edi
call fcn.00434de3
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov byte [esp + 0x28], 2
lea ecx, [esp + 0x10]
call fcn.00434de3
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], 1
call fcn.00434de3
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.00434de3
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], edi
call fcn.00434de3
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret