Function at 0x4015a0
Capabilities:
Access peb ldr_data
Get common file path
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x41aad8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 0x100
lea edi, [esi + 8]
push 0x100
mov ecx, edi
call fcn.00414619
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00414668
push 0x422134
mov ecx, edi
call fcn.004134e0
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.00413446
push eax
mov ecx, edi
mov dword [esp + 0x18], 0
call fcn.00414322
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.00414235
mov ecx, dword [esi + 0x3c]
lea edi, [esi + 0x34]
push 0x422118
push ecx
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x422188
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push str.d.anwrlSo_tcgiejkqmfpbhzyxvsu
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42214c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422140
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422184
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422180
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422120
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
call fcn.004145c5
mov edx, dword [edi + 8]
push 0x422144
push edx
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x42212c
add ecx, 4
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422184
add ecx, 4
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push str.d.anwrlSo_tcgiejkqmfpbhzyxvsu
add ecx, 4
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 4
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422178
add ecx, 4
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 4
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 4
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 4
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 4
call fcn.004145c5
mov eax, dword [edi + 8]
push 0x422150
push eax
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x422180
add ecx, 8
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 8
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push str.d.anwrlSo_tcgiejkqmfpbhzyxvsu
add ecx, 8
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 8
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422118
add ecx, 8
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422174
add ecx, 8
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422118
add ecx, 8
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 8
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 8
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 8
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 8
call fcn.004145c5
mov ecx, dword [edi + 8]
push 0x422170
push ecx
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x422138
add ecx, 0xc
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422184
add ecx, 0xc
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422140
add ecx, 0xc
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42211c
add ecx, 0xc
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42216c
add ecx, 0xc
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422144
add ecx, 0xc
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 0xc
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0xc
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 0xc
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0xc
call fcn.004145c5
mov edx, dword [edi + 8]
push 0x42214c
push edx
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x422168
add ecx, 0x10
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422180
add ecx, 0x10
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push str.d.anwrlSo_tcgiejkqmfpbhzyxvsu
add ecx, 0x10
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push str.d.anwrlSo_tcgiejkqmfpbhzyxvsu
add ecx, 0x10
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x10
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 0x10
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x10
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 0x10
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x10
call fcn.004145c5
mov eax, dword [edi + 8]
push 0x42212c
push eax
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x42214c
add ecx, 0x14
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422148
add ecx, 0x14
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push str.d.anwrlSo_tcgiejkqmfpbhzyxvsu
add ecx, 0x14
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422164
add ecx, 0x14
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422148
add ecx, 0x14
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 0x14
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x14
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 0x14
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x14
call fcn.004145c5
mov ecx, dword [edi + 8]
push 0x42212c
push ecx
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x422138
add ecx, 0x18
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push str.d.anwrlSo_tcgiejkqmfpbhzyxvsu
add ecx, 0x18
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422164
add ecx, 0x18
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42211c
add ecx, 0x18
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422170
add ecx, 0x18
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42214c
add ecx, 0x18
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 0x18
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x18
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 0x18
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x18
call fcn.004145c5
mov edx, dword [edi + 8]
push 0x422160
push edx
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x42215c
add ecx, 0x1c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422140
add ecx, 0x1c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push str.d.anwrlSo_tcgiejkqmfpbhzyxvsu
add ecx, 0x1c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422154
add ecx, 0x1c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422158
add ecx, 0x1c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 0x1c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x1c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 0x1c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x1c
call fcn.004145c5
mov eax, dword [edi + 8]
push 0x42211c
push eax
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x422140
add ecx, 0x20
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422158
add ecx, 0x20
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422124
add ecx, 0x20
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42212c
add ecx, 0x20
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422160
add ecx, 0x20
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 0x20
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x20
call fcn.004145c5
push 0x42217c
mov ecx, dword [esi + 0x38]
add ecx, 0x20
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x20
call fcn.004145c5
mov ecx, dword [edi + 8]
push 0x422124
push ecx
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x422184
add ecx, 0x24
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422160
add ecx, 0x24
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422184
add ecx, 0x24
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422118
add ecx, 0x24
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42211c
add ecx, 0x24
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422138
add ecx, 0x24
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 0x24
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x24
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 0x24
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x24
call fcn.004145c5
mov edx, dword [edi + 8]
push 0x422184
push edx
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push str.d.anwrlSo_tcgiejkqmfpbhzyxvsu
add ecx, 0x28
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push str.d.anwrlSo_tcgiejkqmfpbhzyxvsu
add ecx, 0x28
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42214c
add ecx, 0x28
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42211c
add ecx, 0x28
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422168
add ecx, 0x28
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42215c
add ecx, 0x28
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 0x28
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x28
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 0x28
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x28
call fcn.004145c5
mov eax, dword [edi + 8]
push 0x422140
push eax
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x422118
add ecx, 0x2c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422184
add ecx, 0x2c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 0x2c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422124
add ecx, 0x2c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422184
add ecx, 0x2c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 0x2c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x2c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 0x2c
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x2c
call fcn.004145c5
mov ecx, dword [edi + 8]
push 0x422120
push ecx
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x422154
add ecx, 0x30
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422180
add ecx, 0x30
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42214c
add ecx, 0x30
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422140
add ecx, 0x30
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422188
add ecx, 0x30
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 0x30
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x30
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 0x30
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x30
call fcn.004145c5
mov edx, dword [edi + 8]
push 0x422160
push edx
mov ecx, edi
call fcn.00413bd7
mov ecx, dword [esi + 0x38]
push 0x422118
add ecx, 0x34
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422184
add ecx, 0x34
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422158
add ecx, 0x34
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422180
add ecx, 0x34
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422120
add ecx, 0x34
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422114
add ecx, 0x34
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x34
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x42217c
add ecx, 0x34
call fcn.004145c5
mov ecx, dword [esi + 0x38]
push 0x422150
add ecx, 0x34
call fcn.004145c5
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret