Function at 0x409f40
Capabilities:
Access peb ldr_data
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45bf71
mov eax, dword fs:[0]
push eax
sub esp, 0xa88
mov eax, dword [0x47b008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa94], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa8c], eax
mov dword [ebp - 0xa4c], 0
mov dword [ebp - 0xa48], 0xf
mov byte [ebp - 0xa5c], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xa34], 0
mov dword [ebp - 0xa30], 0xf
mov byte [ebp - 0xa44], 0
mov dword [ebp - 0xa64], 0
mov dword [ebp - 0xa60], 0xf
mov byte [ebp - 0xa74], 0
lea edx, [ebp - 0xa44]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa5c]
call fcn.00409550
test al, al
jne 0x40a012
push 2
push 0x46db88
lea ecx, [ebp - 0xa5c]
call fcn.004016e0
push 2
push 0x46dbcc
lea ecx, [ebp - 0xa44]
call fcn.004016e0
xor eax, eax
mov dword [ebp - 0xa1c], 0
mov dword [ebp - 0xa18], 7
mov word [ebp - 0xa2c], ax
push eax
push 0x104
lea ecx, [ebp - 0xa2c]
mov byte [ebp - 4], 3
call fcn.00401600
mov ebx, dword [ebp - 0xa18]
lea eax, [ebp - 0xa2c]
mov dword [ebp - 0xa84], ebx
mov dword [ebp - 0xa88], eax
cmp ebx, 8
jb 0x40a06d
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0xa88], eax
cmp dword [0x47db28], 0
jne 0x40a341
push 0x2148
call fcn.0042208d
mov edi, eax
add esp, 4
mov dword [ebp - 0xa80], edi
push str.ntdll.dll
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x40a1c7
push ecx
mov edx, str.RtlAddVectoredExceptionHandler
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.RtlRemoveVectoredExceptionHandler
mov dword [edi + 0xc], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.RtlCaptureContext
mov dword [edi + 0x10], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.RtlFlushSecureMemoryCache
mov dword [edi + 0x14], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.RtlNtStatusToDosError
mov dword [edi + 0x18], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.RtlSetLastWin32Error
mov dword [edi + 0x1c], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.ZwAllocateVirtualMemory
mov dword [edi + 0x20], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.ZwFreeVirtualMemory
mov dword [edi + 0x24], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.ZwFlushInstructionCache
mov dword [edi + 0x28], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.ZwLockVirtualMemory
mov dword [edi + 0x2c], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.ZwProtectVirtualMemory
mov dword [edi + 0x30], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.ZwQueryInformationProcess
mov dword [edi + 0x34], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.ZwQueryVirtualMemory
mov dword [edi], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.ZwReadVirtualMemory
mov dword [edi + 4], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.ZwTerminateProcess
mov dword [edi + 0x38], eax
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.ZwUnlockVirtualMemory
mov dword [edi + 0x3c], eax
mov ecx, esi
call fcn.0040bf90
mov dword [edi + 0x40], eax
push ecx
mov edx, str.ZwUnmapViewOfSection
mov ecx, esi
call fcn.0040bf90
push ecx
mov edx, str.ZwWriteVirtualMemory
mov dword [edi + 8], eax
mov ecx, esi
call fcn.0040bf90
mov dword [edi + 0x44], eax
push 0x2100
xor esi, esi
mov dword [ebp - 0xa78], 0
lea eax, [edi + 0x48]
push esi
push eax
mov dword [ebp - 0xa7c], eax
call fcn.00438c00
add esp, 0xc
lea eax, [ebp - 0xa14]
push eax
push 0x3ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x40a337
cmp eax, 0x400
ja 0x40a337
add eax, 0xfffffffd
mov dword [ebp - 0xa90], eax
je 0x40a337
lea ebx, [ebp - 0x214]
sub ebx, edi
sub ebx, 0x50
lea ebx, [ebx]
lea edi, [ebp - 0xa14]
cmp word [edi + esi*2], 0
lea edi, [edi + esi*2]
je 0x40a32b
cmp dword [ebp - 0xa78], 0x20
jae 0x40a32b
lea eax, [esi*2 + 4]
cmp eax, 0x800
jae 0x40a4a1
xor ecx, ecx
mov word [ebp + eax - 0xa14], cx
lea eax, [ebp - 0x214]
push 0x100
push eax
push edi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x40a2fa
mov eax, 0x5c
xor ecx, ecx
mov word [ebp + esi*2 - 0xa10], ax
mov eax, dword [ebp - 0xa7c]
sub edi, eax
jmp 0x40a2a0
movzx edx, word [edi + eax]
test dx, dx
je 0x40a2b5
mov word [eax], dx
inc ecx
add eax, 2
cmp ecx, 3
jb 0x40a2a0
mov edi, dword [ebp - 0xa7c]
xor eax, eax
mov word [edi + ecx*2], ax
xor ecx, ecx
lea eax, [edi + 8]
movzx edx, word [ebx + eax]
test dx, dx
je 0x40a2db
mov word [eax], dx
inc ecx
add eax, 2
cmp ecx, 0x7f
jb 0x40a2c6
inc dword [ebp - 0xa78]
xor eax, eax
mov word [edi + ecx*2 + 8], ax
add edi, 0x108
mov dword [ebp - 0xa7c], edi
sub ebx, 0x108
mov eax, 0x5c
mov word [ebp + esi*2 - 0xa10], ax
jmp 0x40a310
lea eax, [esi + esi]
inc esi
cmp word [ebp + eax - 0xa14], 0
jne 0x40a310
cmp esi, dword [ebp - 0xa90]
jb 0x40a230
mov edi, dword [ebp - 0xa80]
mov ebx, dword [ebp - 0xa84]
mov byte [ebp - 4], 3
mov dword [0x47db28], edi
mov eax, dword fs:[0x30]
mov edx, ebx
mov ecx, dword [ebp - 0xa88]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0xc]
push dword [esi + 0x28]
call fcn.0040b490
mov ecx, dword [ebp - 0xa88]
add esp, 4
call fcn.0040b5b0
movzx eax, word [esi + 0x24]
cmp eax, ebx
jb 0x40a375
mov eax, ebx
test eax, eax
je 0x40a443
mov edi, dword [ebp - 0xa18]
lea ecx, [ebp - 0xa2c]
mov esi, dword [ebp - 0xa2c]
cmp edi, 8
jb 0x40a396
mov ecx, esi
mov edx, dword [ebp - 0xa1c]
test edx, edx
je 0x40a443
lea eax, [edx - 1]
cmp eax, 0xffffffff
jb 0x40a3af
or eax, 0xffffffff
cmp word [ecx + eax*2], 0x5c
lea eax, [ecx + eax*2]
je 0x40a3cd
lea esp, [esp]
cmp eax, ecx
je 0x40a443
sub eax, 2
cmp word [eax], 0x5c
jne 0x40a3c0
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
je 0x40a443
inc eax
lea ecx, [ebp - 0xa2c]
cmp eax, edx
ja 0x40a3f6
mov dword [ebp - 0xa1c], eax
cmp edi, 8
jb 0x40a3ee
mov ecx, esi
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x40a400
push 0
sub eax, edx
push eax
call fcn.00401600
push 0x1b
push str.EasyAntiCheatLocalization_
lea ecx, [ebp - 0xa2c]
call fcn.0040a810
push dword [ebp - 0xa8c]
mov ecx, dword [ebp - 0xa94]
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0xa44]
push eax
lea eax, [ebp - 0xa5c]
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.004096c0
mov bl, al
jmp 0x40a455
mov ecx, dword [ebp - 0xa8c]
push str.Error_getting_current_executable_path.
call fcn.00401590
xor bl, bl
lea ecx, [ebp - 0xa2c]
call fcn.00401520
lea ecx, [ebp - 0xa74]
call fcn.00401680
lea ecx, [ebp - 0xa44]
call fcn.00401680
lea ecx, [ebp - 0xa5c]
call fcn.00401680
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042207c
mov esp, ebp
pop ebp
ret 4
call fcn.004224b7
int3