Function at 0x40443c
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44ef9f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
call fcn.0040f7ca
lea ecx, [esp + 0x28]
mov dword [esp + 0xa8], 0
call fcn.0040f7ca
lea ecx, [esp + 0x20]
mov byte [esp + 0xa8], 1
call fcn.0040f7ca
push 0x45f3a0
lea eax, [esp + 0xc]
push 0x462f44
push eax
mov byte [esp + 0xb4], 2
call fcn.0040f824
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xac], 3
call fcn.0040f806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 2
call fcn.0040f7be
lea ecx, [esp + 0x18]
call fcn.0040f7ca
lea ecx, [esp + 0xc]
mov byte [esp + 0xa8], 4
call fcn.0040f7ca
push 0x45f260
lea ecx, [esp + 0x10]
mov byte [esp + 0xac], 5
call fcn.0040f81e
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
call fcn.0040f83c
push 0x45f260
lea ecx, [esp + 0x10]
call fcn.0040f800
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push edx
push 0x45f644
push eax
call fcn.0040f836
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xac], 6
call fcn.0040f806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 5
call fcn.0040f7be
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call fcn.0040f7ee
call fcn.0040e760
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x40]
push eax
call fcn.0040f7ee
push 0x45f504
lea ecx, [esp + 0x44]
mov byte [esp + 0xac], 7
call fcn.0040f800
lea ecx, [esp + 0x30]
call fcn.0040f7ca
mov byte [esp + 0xa8], 8
lea ecx, [esp + 0x1c]
call fcn.0040f7ca
push 0x45f634
lea ecx, [esp + 0x34]
mov byte [esp + 0xac], 9
call fcn.0040f81e
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x20]
call fcn.0040f806
lea edx, [esp + 0x1c]
lea eax, [esp + 8]
push edx
push 0x45f260
push eax
call fcn.0040f836
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xac], 0xa
call fcn.0040f806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 9
call fcn.0040f7be
push 0x45f260
lea ecx, [esp + 0x20]
call fcn.0040f800
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x34]
call fcn.0040f83c
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call fcn.0040f7ee
call fcn.0040e760
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
call fcn.0040f7ee
push 0x462d70
lea ecx, [esp + 0x30]
mov byte [esp + 0xac], 0xb
call fcn.0040f83c
lea ecx, [esp + 0x24]
call fcn.0040f7ca
lea ecx, [esp + 0x14]
mov byte [esp + 0xa8], 0xc
call fcn.0040f7ca
mov bl, 0xd
push 0x45f634
lea ecx, [esp + 0x28]
mov byte [esp + 0xac], bl
call fcn.0040f81e
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x18]
call fcn.0040f806
lea edx, [esp + 0x14]
lea eax, [esp + 8]
push edx
push 0x45f260
push eax
call fcn.0040f836
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xac], 0xe
call fcn.0040f806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], bl
call fcn.0040f7be
push 0x45f260
lea ecx, [esp + 0x18]
call fcn.0040f800
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x28]
call fcn.0040f83c
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call fcn.0040f7ee
call fcn.0040e760
add esp, 4
lea eax, [esp + 0x2c]
lea ecx, [esp + 8]
push 0x45f5d4
push eax
push ecx
call fcn.0040f824
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0xac], 0xf
call fcn.0040f806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], bl
call fcn.0040f7be
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push edx
push 0x45f260
push eax
call fcn.0040f836
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0xac], 0x10
call fcn.0040f806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], bl
call fcn.0040f7be
push 0x45f260
lea ecx, [esp + 0x10]
call fcn.0040f800
push 0x45f634
lea ecx, [esp + 0x1c]
call fcn.0040f81e
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040f83c
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call fcn.0040f7ee
call fcn.0040e760
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x3c]
push 0x462d70
push eax
push ecx
call fcn.0040f8d2
push 0x45f5d4
lea ecx, [esp + 0x40]
mov byte [esp + 0xac], 0x11
call fcn.0040f800
push ecx
lea edx, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call fcn.0040f7ee
push ecx
mov byte [esp + 0xb0], 0x12
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x462f44
call fcn.0040f7ee
mov ecx, esi
mov byte [esp + 0xb0], 0x11
call fcn.00405070
lea ecx, [esp + 0x34]
mov esi, eax
call fcn.0040f7ca
lea ecx, [esp + 0x38]
mov byte [esp + 0xa8], 0x13
call fcn.0040f7ca
push 0x45f624
lea eax, [esp + 0xc]
push 0x462f04
push eax
mov byte [esp + 0xb4], 0x14
call fcn.0040f824
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0xac], 0x15
call fcn.0040f806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 0x14
call fcn.0040f7be
push 0x45f5b8
lea ecx, [esp + 0xc]
push 0x462f44
push ecx
call fcn.0040f824
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0xac], 0x16
call fcn.0040f806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 0x14
call fcn.0040f7be
test esi, esi
je 0x404a74
push 0x45f61c
lea ecx, [esp + 0x24]
call fcn.0040f81e
lea edx, [esp + 0x10]
push 0x45f2b0
lea eax, [esp + 0xc]
push edx
push eax
call fcn.0040f824
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xac], 0x17
call fcn.0040f806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 0x14
call fcn.0040f7be
mov ecx, dword [0x453568]
mov eax, dword [esp + 0x28]
push 1
mov edx, dword [ecx]
lea ecx, [esp + 0x4c]
push edx
push 2
push eax
call dword [0x453544]
push 0x45f5f4
lea ecx, [esp + 0x24]
mov byte [esp + 0xac], 0x18
call fcn.0040f800
mov esi, dword [0x453530]
push 0x45f5e0
lea ecx, [esp + 0x4c]
call esi
mov ecx, dword [esp + 0x20]
push ecx
lea ecx, [esp + 0x4c]
call esi
lea ecx, [esp + 0x48]
call dword [0x453540]
mov edx, dword [esp + 0x28]
push 1
push edx
call dword [0x4531cc]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push 0
push eax
push ecx
call dword [0x4531a8]
lea ecx, [esp + 0x50]
mov byte [esp + 0xa8], 0x14
call dword [0x45353c]
lea ecx, [esp + 0x50]
call dword [0x453538]
lea ecx, [esp + 0x38]
mov byte [esp + 0xa8], 0x13
call fcn.0040f7be
lea ecx, [esp + 0x34]
mov byte [esp + 0xa8], 0x11
call fcn.0040f7be
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa8], bl
call fcn.0040f7be
lea ecx, [esp + 0x14]
mov byte [esp + 0xa8], 0xc
call fcn.0040f7be
lea ecx, [esp + 0x24]
mov byte [esp + 0xa8], 0xb
call fcn.0040f7be
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], 9
call fcn.0040f7be
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa8], 8
call fcn.0040f7be
lea ecx, [esp + 0x30]
mov byte [esp + 0xa8], 7
call fcn.0040f7be
mov byte [esp + 0xa8], 5
lea ecx, [esp + 0x40]
call fcn.0040f7be
lea ecx, [esp + 0xc]
mov byte [esp + 0xa8], 4
call fcn.0040f7be
lea ecx, [esp + 0x18]
mov byte [esp + 0xa8], 2
call fcn.0040f7be
lea ecx, [esp + 0x20]
mov byte [esp + 0xa8], 1
call fcn.0040f7be
lea ecx, [esp + 0x28]
mov byte [esp + 0xa8], 0
call fcn.0040f7be
lea ecx, [esp + 0x10]
mov dword [esp + 0xa8], 0xffffffff
call fcn.0040f7be
mov eax, 1
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0xa4
ret
lea ecx, [esp + 0x38]
mov byte [esp + 0xa8], 0x13
call fcn.0040f7be
lea ecx, [esp + 0x34]
mov byte [esp + 0xa8], 0x11
call fcn.0040f7be
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa8], bl
call fcn.0040f7be
lea ecx, [esp + 0x14]
mov byte [esp + 0xa8], 0xc
call fcn.0040f7be
lea ecx, [esp + 0x24]
mov byte [esp + 0xa8], 0xb
call fcn.0040f7be
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], 9
call fcn.0040f7be
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa8], 8
call fcn.0040f7be
lea ecx, [esp + 0x30]
mov byte [esp + 0xa8], 7
call fcn.0040f7be
lea ecx, [esp + 0x40]
mov byte [esp + 0xa8], 5
call fcn.0040f7be
lea ecx, [esp + 0xc]
mov byte [esp + 0xa8], 4
call fcn.0040f7be
lea ecx, [esp + 0x18]
mov byte [esp + 0xa8], 2
call fcn.0040f7be
lea ecx, [esp + 0x20]
mov byte [esp + 0xa8], 1
call fcn.0040f7be
lea ecx, [esp + 0x28]
mov byte [esp + 0xa8], 0
call fcn.0040f7be
lea ecx, [esp + 0x10]
mov dword [esp + 0xa8], 0xffffffff
call fcn.0040f7be
mov ecx, dword [esp + 0xa0]
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0xa4
ret