Function at 0x40687c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x416644]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x150], 0xc0000001
and dword [ebp - 0x124], 0
push 0x1a
pop eax
mov word [ebp - 0x15c], ax
push 0x1c
pop eax
mov word [ebp - 0x15a], ax
mov dword [ebp - 0x158], 0x409e52
push 0x24
pop eax
mov word [ebp - 0x168], ax
push 0x26
pop eax
mov word [ebp - 0x166], ax
mov dword [ebp - 0x164], 0x409e6e
push 0x18
pop eax
mov word [ebp - 0x174], ax
push 0x1a
pop eax
mov word [ebp - 0x172], ax
mov dword [ebp - 0x170], 0x409e94
push 0x22
pop eax
mov word [ebp - 0x180], ax
push 0x24
pop eax
mov word [ebp - 0x17e], ax
mov dword [ebp - 0x17c], 0x409eae
push 0x1a
pop eax
mov word [ebp - 0x18c], ax
push 0x1c
pop eax
mov word [ebp - 0x18a], ax
mov dword [ebp - 0x188], 0x409ed2
push 0x30
pop eax
mov word [ebp - 0x198], ax
push 0x32
pop eax
mov word [ebp - 0x196], ax
mov dword [ebp - 0x194], 0x409eee
and dword [ebp - 0x144], 0
and dword [ebp - 0x140], 0
and dword [ebp - 0x138], 0
and dword [ebp - 0x134], 0
and dword [ebp - 0x13c], 0
and dword [ebp - 0x128], 0
and dword [ebp - 0x148], 0
and dword [ebp - 0x14c], 0
and dword [ebp - 0x1a0], 0
and dword [ebp - 0x1a4], 0
and dword [ebp - 0x19c], 0
push 0x11c
push 0
lea eax, [ebp - 0x120]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
push 0
push dword [sym.imp.ntoskrnl.exe_NtBuildNumber]
lea eax, [ebp - 0x120]
push eax
call fcn.00405a20
test eax, eax
jne 0x4069d4
jmp 0x406d61
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [ebp - 0x144], eax
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x180]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x18c]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x144], 0
je 0x406aa0
cmp dword [0x41751c], 0
je 0x406aa0
push dword [0x41751c]
push 0x417520
push dword [ebp - 0x144]
call fcn.00409b1a
add esp, 0xc
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
je 0x406aa0
push dword [0x41751c]
push 0x417520
push dword [ebp - 0x144]
call fcn.00406ea8
mov dword [ebp - 0x124], 1
cmp dword [ebp - 0x140], 0
je 0x406afa
cmp dword [0x4175a0], 0
je 0x406afa
push dword [0x4175a0]
push 0x4175a4
push dword [ebp - 0x140]
call fcn.00409b1a
add esp, 0xc
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
je 0x406afa
push dword [0x4175a0]
push 0x4175a4
push dword [ebp - 0x140]
call fcn.00406ea8
mov dword [ebp - 0x124], 1
cmp dword [ebp - 0x138], 0
je 0x406b54
cmp dword [0x417624], 0
je 0x406b54
push dword [0x417624]
push 0x417628
push dword [ebp - 0x138]
call fcn.00409b1a
add esp, 0xc
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
je 0x406b54
push dword [0x417624]
push 0x417628
push dword [ebp - 0x138]
call fcn.00406ea8
mov dword [ebp - 0x124], 1
cmp dword [ebp - 0x134], 0
je 0x406bae
cmp dword [0x4176a8], 0
je 0x406bae
push dword [0x4176a8]
push 0x4176ac
push dword [ebp - 0x134]
call fcn.00409b1a
add esp, 0xc
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
je 0x406bae
push dword [0x4176a8]
push 0x4176ac
push dword [ebp - 0x134]
call fcn.00406ea8
mov dword [ebp - 0x124], 1
cmp dword [ebp - 0x13c], 0
je 0x406c08
cmp dword [0x41772c], 0
je 0x406c08
push dword [0x41772c]
push 0x417730
push dword [ebp - 0x13c]
call fcn.00409b1a
add esp, 0xc
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x406c08
push dword [0x41772c]
push 0x417730
push dword [ebp - 0x13c]
call fcn.00406ea8
mov dword [ebp - 0x124], 1
cmp dword [ebp - 0x128], 0
je 0x406c62
cmp dword [0x4177b0], 0
je 0x406c62
push dword [0x4177b0]
push 0x4177b4
push dword [ebp - 0x128]
call fcn.00409b1a
add esp, 0xc
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0
je 0x406c62
push dword [0x4177b0]
push 0x4177b4
push dword [ebp - 0x128]
call fcn.00406ea8
mov dword [ebp - 0x124], 1
mov eax, dword [0x4174e4]
or eax, dword [0x4174e8]
je 0x406cde
and dword [ebp - 0x12c], 0
mov eax, dword [0x4174e4]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x406ca6
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x118]
jb 0x406cba
mov eax, dword [ebp - 0x118]
add eax, dword [ebp - 0x114]
cmp dword [ebp - 0x12c], eax
jbe 0x406cde
mov eax, dword [0x4174f4]
or eax, dword [0x4174f8]
je 0x406cd4
mov eax, dword [0x4174f4]
mov ecx, dword [ebp - 0x148]
mov dword [ecx], eax
mov dword [ebp - 0x124], 1
mov eax, dword [0x4174ec]
or eax, dword [0x4174f0]
je 0x406d5a
and dword [ebp - 0x130], 0
mov eax, dword [0x4174ec]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x406d22
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x118]
jb 0x406d36
mov eax, dword [ebp - 0x118]
add eax, dword [ebp - 0x114]
cmp dword [ebp - 0x130], eax
jbe 0x406d5a
mov eax, dword [0x4174fc]
or eax, dword [0x417500]
je 0x406d50
mov eax, dword [0x4174fc]
mov ecx, dword [ebp - 0x14c]
mov dword [ecx], eax
mov dword [ebp - 0x124], 1
and dword [ebp - 0x150], 0
cmp dword [ebp + 8], 0
je 0x406d72
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x124]
mov dword [eax], ecx
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409b6a
mov esp, ebp
pop ebp
ret 4