Function at 0x469a40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ac150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
xor eax, eax
push edi
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax - 0xc]
xor edx, edx
mov eax, ebp
div ecx
sub ecx, edx
mov esi, ecx
push esi
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00406a90
mov edi, eax
push esi
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x2c], 1
call fcn.004022c0
push edi
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x30], 2
call fcn.00402310
add esp, 0xc
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x28], 3
call fcn.00402060
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x24], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x469ae6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x24], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x469b09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x469b2c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor edx, edx
mov eax, ebp
mov ecx, 0xa
div ecx
mov eax, ebp
mov esi, 0x1a
xor ebp, ebp
mov ecx, edx
xor edx, edx
div esi
mov eax, dword [esp + 0x34]
mov edi, dword [eax - 0xc]
test edi, edi
mov dword [esp + 0x18], ecx
mov ebx, edx
jg 0x469b90
mov ecx, dword [eax - 0x10]
lea ebp, [eax - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
test edx, edx
lea ecx, [ebp + 0xc]
jl 0x469c67
cmp eax, dword [ebp]
jne 0x469c67
mov eax, ebp
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x469c9c
mov ecx, dword [esp + 0x18]
lea ecx, [ecx]
test ebp, ebp
jl 0x469c5d
cmp ebp, edi
jg 0x469c5d
mov si, word [eax + ebp*2]
cmp si, 0x61
jb 0x469bfe
cmp si, 0x7a
ja 0x469bfe
movzx edx, si
sub edx, ebx
cmp edx, 0x61
jae 0x469bc5
mov ecx, 0x1a
sub ecx, ebx
add esi, ecx
jmp 0x469bc7
sub esi, ebx
cmp ebp, edi
jge 0x469c5d
cmp dword [eax - 4], 1
jle 0x469be6
mov edx, dword [eax - 0xc]
push edx
lea ecx, [esp + 0x38]
call fcn.004012d0
mov eax, dword [esp + 0x34]
test edi, edi
mov word [eax + ebp*2], si
jl 0x469c5d
cmp edi, dword [eax - 8]
jg 0x469c5d
mov dword [eax - 0xc], edi
mov word [eax + edi*2], 0
jmp 0x469c2c
cmp si, 0x41
jb 0x469c41
cmp si, 0x5a
ja 0x469c41
movzx eax, si
sub eax, ebx
cmp eax, 0x41
jae 0x469c3d
mov ecx, 0x1a
sub ecx, ebx
add esi, ecx
push esi
lea ecx, [esp + 0x38]
push ebp
call fcn.004699e0
mov eax, dword [esp + 0x34]
mov edi, dword [eax - 0xc]
inc ebp
cmp ebp, edi
jl 0x469b89
jmp 0x469b57
sub esi, ebx
jmp 0x469c1d
cmp si, 0x30
jb 0x469c2c
cmp si, 0x39
ja 0x469c2c
movzx edx, si
add edx, ecx
cmp edx, 0x39
jbe 0x469c1b
lea esi, [esi + ecx - 0xa]
jmp 0x469c1d
push 0x80070057
call fcn.00401100
mov ecx, dword [ebp + 4]
mov edx, dword [eax]
push 2
push ecx
mov ecx, eax
call dword [edx]
test eax, eax
jne 0x469c7c
jmp fcn.004012c0
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 4]
inc ecx
add ecx, ecx
mov edx, ecx
shr ecx, 2
lea esi, [ebp + 0x10]
lea edi, [eax + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x2c]
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x24], 0xffffffff
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x469cc5
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret