Function at 0x4019a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42d56c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
lea ecx, [edi + 8]
call fcn.00402e20
lea ecx, [edi + 0x1518]
mov dword [ebp - 4], 0
call fcn.00402c00
lea esi, [edi + 0x19a8]
mov ecx, esi
call fcn.0041b680
mov dword [edi + 0x1a9c], 0
mov dword [edi + 0x1a98], 0
mov dword [edi + 0x1aa0], 0
mov dword [edi + 0x1aa8], 0
mov dword [edi + 0x1aa4], 0
mov dword [edi + 0x1aac], 0
mov dword [edi + 0x1ab4], 0
mov dword [edi + 0x1ab0], 0
mov dword [edi + 0x1ab8], 0
mov dword [edi + 0x1ac0], 0
mov dword [edi + 0x1abc], 0
mov dword [edi + 0x1ac4], 0
mov dword [edi + 0x1acc], 0
mov dword [edi + 0x1ac8], 0
mov dword [edi + 0x1ad0], 0
mov dword [edi + 0x1af0], 0
lea eax, [edi + 0x1b58]
mov dword [edi + 0x1aec], 0
mov dword [edi + 0x1b34], 0
mov dword [edi + 0x1b30], 0
push 0x60
push 0
push eax
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x58], 0
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
add esp, 0xc
movups xmmword [edi + 0x1bb8], xmm0
mov dword [edi + 0x1bc8], 0
mov dword [edi + 0x1bd0], 0
mov dword [edi + 0x1bcc], 0
mov dword [edi + 0x1bd4], 0
mov dword [edi + 0x1bdc], 0
mov dword [edi + 0x1bd8], 0
mov dword [edi + 0x1be0], 0
mov dword [edi + 0x1be8], 0
mov dword [edi + 0x1be4], 0
mov dword [edi + 0x1bec], 0
mov dword [edi + 0x1bf4], 0
mov dword [edi + 0x1bf0], 0
mov dword [edi + 0x1bf8], 0
mov dword [edi + 0x1c00], 0
mov dword [edi + 0x1bfc], 0
mov dword [edi + 0x1c04], 0
mov dword [edi + 0x1c3c], 0
mov dword [edi + 0x1c40], 0
mov dword [edi + 0x1c44], 0
mov dword [edi + 0x1c48], 0
mov dword [edi + 0x1c64], 0
mov dword [edi + 0x1c68], 0
mov dword [edi + 0x1c6c], 0
mov dword [edi + 0x1c70], 0
mov dword [edi + 0x1cac], 0
mov dword [edi + 0x1cb0], 0
mov dword [edi + 0x1cb4], 0
mov dword [edi + 0x1c90], 0
mov dword [edi + 0x1c98], 0
mov dword [edi + 0x1c94], 0
mov dword [edi + 0x1ca4], 0x7f7fffff
mov dword [edi + 0x1ca0], 0x7f7fffff
mov dword [edi + 0x1c9c], 0x7f7fffff
movups xmmword [edi + 0x1ca8], xmm0
mov dword [edi + 0x1cd4], 0
mov dword [edi + 0x1cd8], 0
mov dword [edi + 0x1cdc], 0
mov dword [edi + 0x1cb8], 0
mov dword [edi + 0x1cc0], 0
mov dword [edi + 0x1cbc], 0
mov dword [edi + 0x1ccc], 0x7f7fffff
mov dword [edi + 0x1cc8], 0x7f7fffff
mov dword [edi + 0x1cc4], 0x7f7fffff
movups xmmword [edi + 0x1cd0], xmm0
mov dword [edi + 0x1cfc], 0
mov dword [edi + 0x1d00], 0
mov dword [edi + 0x1d04], 0
mov dword [edi + 0x1ce0], 0
mov dword [edi + 0x1ce8], 0
mov dword [edi + 0x1ce4], 0
mov dword [edi + 0x1cf4], 0x7f7fffff
mov dword [edi + 0x1cf0], 0x7f7fffff
mov dword [edi + 0x1cec], 0x7f7fffff
movups xmmword [edi + 0x1cf8], xmm0
mov dword [edi + 0x1d54], 0
mov dword [edi + 0x1d5c], 0
mov dword [edi + 0x1d60], 0
mov eax, dword [edi + 0x1d60]
mov dword [edi + 0x1d64], 0
mov ecx, dword [edi + 0x1d64]
mov byte [edi + 0x1d3c], 0
mov dword [edi + 0x1d40], 0
mov dword [edi + 0x1d48], 0
mov dword [edi + 0x1d4c], 0
mov dword [edi + 0x1d44], 0
mov dword [edi + 0x1d58], eax
mov dword [edi + 0x1d5c], ecx
mov dword [edi + 0x1d50], eax
mov dword [edi + 0x1d54], ecx
push 0x4133b0
push 0x413a40
push 2
lea eax, [edi + 0x1d68]
mov byte [ebp - 4], 0xb
push 0xc
push eax
mov dword [ebp - 0x18], eax
call fcn.0042c52f
lea ecx, [edi + 0x1d84]
mov byte [ebp - 4], 0xc
push esi
call fcn.00401630
lea ecx, [edi + 0x1dfc]
mov byte [ebp - 4], 0xd
push esi
call fcn.00401630
xorps xmm0, xmm0
mov dword [edi + 0x1e94], 0
mov dword [edi + 0x1e90], 0
mov dword [edi + 0x1e88], 0
mov dword [edi + 0x1e8c], 0
movups xmmword [edi + 0x1e9c], xmm0
movups xmmword [edi + 0x1eac], xmm0
mov word [edi + 0x1ebc], 0
mov dword [edi + 0x1e98], 0xffffffff
mov byte [edi + 0x1ebe], 0
mov dword [edi + 0x1ec0], 0
mov dword [edi + 0x1ec4], 0
mov dword [edi + 0x1ec8], 0
mov dword [edi + 0x1ecc], 0
mov dword [edi + 0x1ef0], 0
mov dword [edi + 0x1eec], 0
mov dword [edi + 0x1ef4], 0
mov dword [edi + 0x1f10], 0
mov dword [edi + 0x1f0c], 0
mov dword [edi + 0x1f14], 0
mov dword [edi + 0x1f1c], 0
mov dword [edi + 0x1f18], 0
mov dword [edi + 0x1f20], 0
mov dword [edi + 0x1f24], 0
mov dword [edi + 0x1f2c], 0
mov dword [edi + 0x1f28], 0
mov dword [edi + 0x1f30], 0
mov dword [edi + 0x1f38], 0
mov dword [edi + 0x1f34], 0
mov dword [edi + 0x1f3c], 0
lea eax, [edi + 0x1f48]
mov dword [edi + 0x1f44], 0
mov dword [edi + 0x1f40], 0
push 0xe74
push 0
push eax
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x2c], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [edi + 0x2dbc]
call fcn.00420b40
mov dword [edi + 0x2e40], 0
mov dword [edi + 0x2e3c], 0
mov dword [edi + 0x2e38], 0
mov dword [edi + 0x2e34], 0
mov dword [edi + 0x2e5c], 0
mov dword [edi + 0x2e58], 0
mov dword [edi + 0x2e60], 0
mov dword [edi + 0x2e68], 0
mov dword [edi + 0x2e64], 0
mov dword [edi + 0x2e6c], 0
mov dword [edi + 0x2e74], 0
mov dword [edi + 0x2e70], 0
mov dword [edi + 0x2e7c], 0
mov dword [edi + 0x2e78], 0
mov dword [edi + 0x2e8c], 0
mov dword [edi + 0x2e88], 0
mov dword [edi + 0x2e90], 0
mov dword [edi + 0x2e98], 0
mov dword [edi + 0x2e94], 0
mov dword [edi + 0x2e9c], 0
mov dword [edi + 0x2ea4], 0
mov dword [edi + 0x2ea0], 0
mov dword [edi + 0x2ea8], 0
mov dword [edi + 0x2ebc], 0
mov dword [edi + 0x2eb8], 0
mov dword [edi + 0x2ec0], 0
mov byte [ebp - 4], 0x1a
mov eax, dword [0x4e69d0]
mov word [edi], 0x100
mov dword [edi + 0x199c], 0
mov dword [edi + 0x19a4], 0
mov dword [edi + 0x19a0], 0
test eax, eax
je 0x4020cc
inc dword [eax + 0x374]
push dword [0x4e69d4]
push 0x5c
call fcn.00402bc0
add esp, 8
mov dword [ebp - 0x18], eax
test eax, eax
je 0x402194
mov dword [eax + 0x24], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x54], 0
mov byte [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 1
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x58], 0xffffffff
jmp 0x402196
xor eax, eax
xorps xmm0, xmm0
mov dword [edi + 0x98], eax
movsd qword [edi + 0x1a78], xmm0
mov dword [edi + 0x1a80], 0
mov dword [edi + 0x1a88], 0xffffffff
mov dword [edi + 0x1a84], 0xffffffff
mov word [edi + 0x1a8d], 0
mov byte [edi + 0x1a8c], 0
mov byte [edi + 0x1a8f], 0
mov dword [edi + 0x1a90], 0
mov dword [edi + 0x1a94], 0
mov dword [edi + 0x1ad4], 0
mov dword [edi + 0x1ad8], 0
mov dword [edi + 0x1adc], 0
mov dword [edi + 0x1ae0], 0
mov dword [edi + 0x1ae4], 0
mov dword [edi + 0x1ae8], 0
mov dword [edi + 0x1af4], 0
mov dword [edi + 0x1af8], 0
mov byte [edi + 0x1afc], 0
mov dword [edi + 0x1b00], 0
mov dword [edi + 0x1b08], 0
mov dword [edi + 0x1b04], 0
mov dword [edi + 0x1b0c], 0
mov dword [edi + 0x1b10], 0
mov dword [edi + 0x1b14], 0
mov dword [edi + 0x1b18], 0
mov byte [edi + 0x1b1c], 0
mov dword [edi + 0x1b20], 0
mov dword [edi + 0x1b24], 0
mov dword [edi + 0x1b28], 0
mov dword [edi + 0x1b2c], 0
mov dword [edi + 0x1b30], 0xbf800000
mov dword [edi + 0x1b34], 0xbf800000
mov dword [edi + 0x1b38], 0
mov dword [edi + 0x1b3c], 0
mov dword [edi + 0x1b40], 0
mov dword [edi + 0x1b44], 0
mov word [edi + 0x1b48], 0
mov dword [edi + 0x1b4c], 0
mov dword [edi + 0x1b50], 0
mov dword [edi + 0x1b54], 0
mov dword [edi + 0x1c08], 0
mov dword [edi + 0x1c20], 0
mov dword [edi + 0x1c1c], 0
mov dword [edi + 0x1c18], 0
mov dword [edi + 0x1c14], 0
mov dword [edi + 0x1c10], 0
mov dword [edi + 0x1c0c], 0
mov dword [edi + 0x1c34], 0
mov dword [edi + 0x1c2c], 0
mov dword [edi + 0x1c28], 0
mov dword [edi + 0x1c24], 0
mov dword [edi + 0x1c30], 0
mov dword [edi + 0x1c38], 0
movups xmmword [edi + 0x1c3c], xmm0
mov dword [edi + 0x1c4c], 0
mov dword [edi + 0x1c50], 0
mov dword [edi + 0x1c54], 0x7fffffff
mov dword [edi + 0x1c58], 0x10000
mov word [edi + 0x1c5c], 0
mov byte [edi + 0x1c5e], 0
mov dword [edi + 0x1c60], 0
mov word [edi + 0x1c74], 0
mov dword [edi + 0x1c78], 0
mov dword [edi + 0x1c7c], 0
mov dword [edi + 0x1c80], 0
mov dword [edi + 0x1c8c], 0xffffffff
mov dword [edi + 0x1c88], 0xffffffff
mov dword [edi + 0x1c84], 0xffffffff
mov dword [edi + 0x1d10], 0
mov dword [edi + 0x1d0c], 0
mov dword [edi + 0x1d08], 0
mov dword [edi + 0x1d18], 0
mov dword [edi + 0x1d14], 0
mov byte [edi + 0x1d1c], 0
mov dword [edi + 0x1d24], 0
mov dword [edi + 0x1d20], 0
mov dword [edi + 0x1d2c], 0x7fffffff
mov dword [edi + 0x1d28], 0x7fffffff
mov dword [edi + 0x1d34], 0x7fffffff
mov dword [edi + 0x1d30], 0x7fffffff
mov byte [edi + 0x1d38], 0
mov dword [edi + 0x1d80], 0
mov dword [edi + 0x1db0], 0x42e4ec
mov dword [edi + 0x1e28], 0x42e4fc
mov dword [edi + 0x1e74], 0
mov word [edi + 0x1e79], 0
mov byte [edi + 0x1e78], 0
mov dword [edi + 0x1e7c], 0
mov dword [edi + 0x1e80], 0xffffffff
mov dword [edi + 0x1e84], 0xffffffff
mov dword [edi + 0x1ed0], 0
mov dword [edi + 0x1ed4], 0
mov dword [edi + 0x1ed8], 0
mov dword [edi + 0x1edc], 0
mov dword [edi + 0x1ee0], 0
mov dword [edi + 0x1ee4], 0xffffffff
mov dword [edi + 0x1ee8], 0
movups xmmword [edi + 0x1ef8], xmm0
mov dword [edi + 0x1f08], 0
mov dword [edi + 0x1f40], 0
mov dword [edi + 0x1f44], 0
mov dword [edi + 0x2e18], 0
mov dword [edi + 0x2e1c], 0xa900000
mov dword [edi + 0x2e24], 0
mov dword [edi + 0x2e20], 0
mov dword [edi + 0x2e30], 0x7f7fffff
mov dword [edi + 0x2e2c], 0x7f7fffff
mov dword [edi + 0x2e28], 0x7f7fffff
mov byte [edi + 0x2e44], 0
mov dword [edi + 0x2e48], 0
mov dword [edi + 0x2e4c], 0x3c23d70a
mov dword [edi + 0x2e50], 0
mov dword [edi + 0x2e54], 0
mov dword [edi + 0x2e78], 0x7f7fffff
mov dword [edi + 0x2e7c], 0x7f7fffff
mov eax, dword [edi + 0x2e78]
mov ecx, dword [edi + 0x2e7c]
mov dword [edi + 0x2e70], eax
lea eax, [edi + 0x2ee0]
mov dword [edi + 0x2e74], ecx
mov byte [edi + 0x2e80], 0
mov dword [edi + 0x2e84], 0
mov byte [edi + 0x2eac], 0
mov dword [edi + 0x2eb0], 0
mov dword [edi + 0x2eb4], 0
mov dword [edi + 0x2ec4], 0x7f7fffff
mov byte [edi + 0x2ec8], 0
mov dword [edi + 0x2ecc], 0
mov dword [edi + 0x2ed4], 2
push 0x1e0
mov dword [edi + 0x2ed0], 2
push 0
mov byte [edi + 0x2ed8], 0
push eax
mov dword [edi + 0x2edc], 0
call sub.VCRUNTIME140.dll_memset
mov dword [edi + 0x30c0], 0
lea eax, [edi + 0x30d4]
mov dword [edi + 0x30c4], 0
push 0xc01
mov dword [edi + 0x30d0], 0xffffffff
push 0
mov dword [edi + 0x30cc], 0xffffffff
push eax
mov dword [edi + 0x30c8], 0xffffffff
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0xc]
add esp, 0x18
mov eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4