Function at 0x42eb11
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x4c
mov dword [esp], 0x98a8aab4
mov esi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, dword [esp]
cmp eax, 0xe7ce9b64
jle 0x42eb86
cmp eax, 0x3456ed9d
jle 0x42ebe9
cmp eax, 0x549cf101
jle 0x42eccb
cmp eax, 0x7525696f
jg 0x42ee17
cmp eax, 0x549cf102
je 0x42f02c
cmp eax, 0x56b9cd32
je 0x42f038
cmp eax, 0x5ebcf739
jne 0x42eb2d
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov dword [esp], 0xdaa0531d
jmp 0x42eb2d
cmp eax, 0xb7cc514f
jle 0x42ec57
cmp eax, 0xccd5bd96
jle 0x42ed11
cmp eax, 0xd9c19fd9
jg 0x42ee4c
cmp eax, 0xccd5bd97
je 0x42f073
cmp eax, 0xd37ac608
je 0x42f08a
cmp eax, 0xd81fc7f7
jne 0x42eb2d
mov eax, dword [esp + 0x48]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp + 0x34], eax
mov dword [esp], 0x4b3cdc6f
jmp 0x42eb2d
cmp eax, 0x1030f23e
jle 0x42ed5f
cmp eax, 0x160b5711
jg 0x42ee81
cmp eax, 0x1030f23f
je 0x42f0b4
cmp eax, 0x110dded1
je 0x42f0ec
cmp eax, 0x11556db7
jne 0x42eb2d
mov eax, dword [esp + 8]
lea ecx, [eax - 0xcc]
add eax, 0xfffffe5a
imul ecx, ecx
imul edx, ecx, 0x2151
dec edx
shr eax, 4
mov dword [esp + 8], eax
mov eax, 0x5ebcf739
cmp edx, ecx
je 0x42f354
mov eax, 0x7bf30e89
jmp 0x42f354
cmp eax, 0xaafc8079
jg 0x42edb1
cmp eax, 0x95b0cfdd
jle 0x42eed0
cmp eax, 0x95b0cfde
je 0x42f11e
cmp eax, 0x98a8aab4
je 0x42f135
cmp eax, 0xa21c178c
jne 0x42eb2d
mov eax, dword [esp + 8]
shr eax, 0xb
add eax, 0xffffff87
shr eax, 4
imul ecx, eax, 0x6e000
imul eax, eax
imul edx, eax, 0xdfb
add ecx, 0x1a36000
dec edx
mov dword [esp + 8], ecx
mov ecx, 0x95b0cfde
cmp edx, eax
je 0x42ecc3
mov ecx, 0x763911b3
mov dword [esp], ecx
jmp 0x42eb2d
cmp eax, 0x44c588a9
jle 0x42ef12
cmp eax, 0x44c588aa
je 0x42f14e
cmp eax, 0x4692070c
je 0x42f15e
cmp eax, 0x4b3cdc6f
jne 0x42eb2d
cmp dword [esp + 0x34], 0
mov eax, 0x11556db7
je 0x42f354
mov eax, 0xc13b9ec2
jmp 0x42f354
cmp eax, 0xc13b9ec1
jle 0x42ef64
cmp eax, 0xc13b9ec2
je 0x42f18c
cmp eax, 0xc7b1c89b
je 0x42f1ac
cmp eax, 0xcb2b83aa
jne 0x42eb2d
mov eax, dword [esp + 8]
and eax, 0xfffffff0
shl eax, 6
imul eax, eax, 0x45
or eax, 0xc1
mov dword [esp + 8], eax
mov dword [esp], 0x160b5712
jmp 0x42eb2d
cmp eax, 0x54f56c1
jle 0x42efa9
cmp eax, 0x54f56c2
je 0x42f1d7
cmp eax, 0x64e7634
je 0x42f1e9
cmp eax, 0xbbb17cb
jne 0x42eb2d
imul eax, dword [esp + 4], 0x3940000
add eax, 0xf2fc0151
mov dword [esp + 4], eax
push eax
call fcn.0042dde7
add esp, 4
mov dword [esp], 0xc7b1c89b
jmp 0x42eb2d
cmp eax, 0xadd46c8e
jle 0x42eff9
cmp eax, 0xadd46c8f
je 0x42f207
cmp eax, 0xae0305b6
je 0x42f231
cmp eax, 0xb6fdb17d
jne 0x42eb2d
mov eax, dword [esp + 4]
shr eax, 5
add eax, 0xffffffe4
shr eax, 0xc
imul edi, eax, 0x6f
add edi, 0xffffff82
mov dword [esp + 4], edi
push edi
call fcn.0042dde7
add esp, 4
push 0x22e
push edi
call fcn.0042d41e
add esp, 8
mov dword [esp], 0x4b3cdc6f
jmp 0x42eb2d
cmp eax, 0x75256970
je 0x42f24e
cmp eax, 0x763911b3
je 0x42f293
cmp eax, 0x7bf30e89
jne 0x42eb2d
mov eax, dword [esp + 0x10]
mov dword [esp + 0x44], eax
mov dword [esp], 0xdb40335c
jmp 0x42eb2d
cmp eax, 0xd9c19fda
je 0x42f2bb
cmp eax, 0xdaa0531d
je 0x42f2cb
cmp eax, 0xdb40335c
jne 0x42eb2d
mov dword [esp + 8], 0x7ffff
mov dword [esp], 0xab89a464
jmp 0x42eb2d
cmp eax, 0x160b5712
je 0x42f2e1
cmp eax, 0x2110a627
jne 0x42f37d
mov edi, dword [esp + 4]
shl edi, 0xe
or edi, 0x4ac
mov dword [esp + 4], edi
push edi
push 0x5def
call fcn.0042d330
add esp, 8
push edi
push 0x30ef
call fcn.0042d41e
add esp, 8
mov dword [esp], 0xccd5bd97
jmp 0x42eb2d
cmp eax, 0x80b32db4
je 0x42f2f8
cmp eax, 0x9295e03a
jne 0x42eb2d
mov edi, dword [esp + 4]
mov eax, 0xfffffeee
add edi, eax
mov dword [esp + 4], edi
call fcn.0042eb11
mov eax, 0x64e7634
cmp edi, 0x13
jge 0x42f354
mov eax, 0xbbb17cb
jmp 0x42f354
cmp eax, 0x3456ed9e
je 0x42f30e
cmp eax, 0x43df6cf0
jne 0x42eb2d
mov ecx, dword [esp + 8]
shr ecx, 6
and ecx, 0x3fffff
add ecx, 0x91
imul ecx, ecx
imul edx, ecx, 0x8077
dec edx
mov dword [esp + 8], 0
mov eax, 0x75256970
cmp edx, ecx
je 0x42f354
mov eax, 0x54f56c2
jmp 0x42f354
cmp eax, 0xb7cc5150
je 0x42f31a
cmp eax, 0xbb577eb4
jne 0x42eb2d
imul eax, dword [esp + 4], 0x82b8
shr eax, 0xc
and eax, 0xfffffffe
add eax, 0x11c
and eax, 0xfffffff8
mov dword [esp + 4], eax
push eax
call fcn.0042dde7
add esp, 4
mov dword [esp], 0xf8ff86f3
jmp 0x42eb2d
cmp eax, 0xe7ce9b65
je 0x42f337
cmp eax, 0xf8ff86f3
jne 0x42eb2d
mov eax, dword [esp + 4]
shl eax, 0xd
add eax, 0x460000
shr eax, 6
mov edi, 0xdaa0531d
and eax, 0x3ffff00
mov dword [esp + 4], eax
je 0x42efe3
mov edi, 0x64e7634
push 0x1268
push eax
call fcn.0042d330
add esp, 8
mov dword [esp], edi
jmp 0x42eb2d
cmp eax, 0xaafc807a
je 0x42f35c
cmp eax, 0xab89a464
jne 0x42eb2d
mov ecx, dword [esp + 0x14]
mov eax, 0xaafc807a
cmp ecx, dword [esp + 0x44]
je 0x42f354
mov eax, 0xb7cc5150
jmp 0x42f354
mov dword [esp], 0x95b0cfde
jmp 0x42eb2d
mov edi, dword [esp + 4]
shl edi, 7
add edi, 0xffffc180
mov dword [esp + 4], edi
push edi
call fcn.0042dde7
add esp, 4
push edi
call fcn.0042dde7
add esp, 4
mov eax, 0xd81fc7f7
cmp edi, 0x13
jl 0x42f354
mov eax, 0x5ebcf739
jmp 0x42f354
mov eax, dword [esp + 0x28]
add eax, 0x10
mov dword [esp + 0x2c], eax
mov dword [esp], 0x64e7634
jmp 0x42eb2d
mov eax, dword [esp + 4]
shl eax, 8
or eax, 0xf0
mov dword [esp + 4], eax
push eax
call fcn.0042dde7
add esp, 4
call fcn.0042eb11
mov dword [esp], 0x64e7634
jmp 0x42eb2d
imul eax, dword [esp + 8], 0xa3
lea ecx, [eax + 0x40]
add eax, 0xb9
imul ecx, ecx
imul edx, ecx, 0x385f
dec edx
mov dword [esp + 8], eax
mov eax, 0xdaa0531d
cmp edx, ecx
je 0x42f0e0
mov eax, 0x44c588aa
mov dword [esp], eax
mov ebp, dword [esp + 0x30]
jmp 0x42eb2d
mov ecx, dword [esp + 8]
add ecx, 0x44
imul eax, ecx, 0x1129200
imul ecx, ecx
imul edx, ecx, 0xbeb
dec edx
mov dword [esp + 8], eax
mov eax, 0xdaa0531d
cmp edx, ecx
je 0x42f354
mov eax, 0xccd5bd97
jmp 0x42f354
mov eax, dword [esp + 0x10]
add eax, 0x30
mov dword [esp + 0x38], eax
mov dword [esp], 0xa21c178c
jmp 0x42eb2d
mov eax, dword fs:[0x30]
add eax, 0xc
mov dword [esp + 0x20], eax
mov dword [esp], 0x5ebcf739
jmp 0x42eb2d
mov dword [esp + 0x48], ebp
mov dword [esp], 0x3456ed9e
jmp 0x42eb2d
imul eax, dword [esp + 4], 0xaf00
and eax, 0xffff0000
lea eax, [eax + eax*4]
mov dword [esp + 4], eax
push eax
push 0x1f00
call fcn.0042d330
add esp, 8
mov dword [esp], 0xbb577eb4
jmp 0x42eb2d
imul eax, dword [esp + 8], 0xcad0
add eax, 0x2418
shr eax, 0xb
mov dword [esp + 8], eax
mov dword [esp], 0x549cf102
jmp 0x42eb2d
mov edx, dword [esp + 0x14]
mov eax, 0xcb2b83aa
mov ecx, 0xcb2b83aa
cmp edx, dword [esp + 0x3c]
je 0x42f1c5
mov ecx, 0xd9c19fda
cmp byte [esp + 0xf], 0
jne 0x42f354
mov eax, ecx
jmp 0x42f354
mov eax, dword [esp + 0x40]
mov esi, dword [eax]
mov dword [esp], 0x244d4894
jmp 0x42eb2d
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov dword [esp], 0x1030f23f
jmp 0x42eb2d
imul eax, dword [esp + 4], 0xd000
mov edi, 0x5ebcf739
add eax, 0xfec18000
mov dword [esp + 4], eax
je 0x42f224
mov edi, 0xd37ac608
call fcn.0042eb11
mov dword [esp], edi
jmp 0x42eb2d
mov eax, dword [esp + 4]
shr eax, 0xb
imul eax, eax, 0x1d2a8e
mov dword [esp + 4], eax
mov dword [esp], 0xc7b1c89b
jmp 0x42eb2d
imul eax, dword [esp + 4], 0xee
add eax, 0xe816
shr eax, 2
imul edi, eax, 0x882
mov dword [esp + 4], edi
call fcn.0042eb11
push edi
push 0x1b2c
call fcn.0042d330
add esp, 8
mov eax, 0xae0305b6
cmp edi, 0xe
jge 0x42f354
mov eax, 0x2110a627
jmp 0x42f354
mov eax, dword [esp + 0x38]
push 0x452350
push dword [eax]
call ebx
test eax, eax
sete byte [esp + 0xf]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp], 0xc7b1c89b
jmp 0x42eb2d
mov dword [esp], 0x44c588aa
mov ebp, dword [esp + 0x10]
jmp 0x42eb2d
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
mov dword [esp], 0x110dded1
jmp 0x42eb2d
mov eax, dword [esp + 0x10]
add eax, 0x18
mov dword [esp + 0x40], eax
mov dword [esp], 0x43df6cf0
jmp 0x42eb2d
mov eax, dword [esp + 4]
shr eax, 4
imul eax, eax, 0x94
add eax, 0x16a
mov dword [esp + 4], eax
mov dword [esp], 0xd81fc7f7
jmp 0x42eb2d
imul eax, dword [esp + 8], 0x2137b0
add eax, 0x19f3820e
mov dword [esp + 8], eax
mov dword [esp], 0xd9c19fda
jmp 0x42eb2d
mov ecx, dword [esp + 4]
shl ecx, 0x14
mov eax, 0x763911b3
and ecx, 0xfe000000
mov dword [esp + 4], ecx
je 0x42f354
mov eax, 0x9295e03a
mov dword [esp], eax
jmp 0x42eb2d
mov eax, dword [esp + 8]
lea eax, [eax + eax*2]
shl eax, 4
add eax, 0x9f0
mov dword [esp + 8], eax
mov dword [esp], 0x244d4894
xor esi, esi
jmp 0x42eb2d
cmp eax, 0x244d4894
jne 0x42eb2d
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebp
mov eax, esi
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret