Function at 0x40abdc
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cmp dword [0x40f960], 0
je 0x40ac10
xor eax, eax
cmp byte [eax + str.PPTP00W], 0
je 0x40af81
inc eax
cmp eax, 0x1450
jne 0x40abe7
mov eax, dword [0x410b50]
or eax, 0x5bab10d7
mov dword [0x410d54], eax
jmp 0x40af81
push ebp
mov ebp, esp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x4c
mov edi, dword [0x410cc8]
imul eax, dword [0x410d54], 0xadc37e15
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov byte [ebp - 0x1c], 0
mov dword [0x410c9c], eax
xor eax, 0x35aeac8b
mov ecx, dword [0x410b50]
mov dword [0x410d54], eax
mov esi, eax
mov eax, dword [edx + 0xc]
mov byte [ebp - 0x2d], 0
mov dword [ebp - 0x24], eax
imul eax, edi, 0x133888d2
mov dword [ebp - 0x2c], eax
mov eax, edi
or eax, 0x818a9b4f
mov dword [ebp - 0x20], eax
xor eax, eax
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 0x18]
test edx, edx
je 0x40acf3
mov ebx, dword [edx + 0x3c]
mov ebx, dword [edx + ebx + 0x78]
test ebx, ebx
je 0x40acc0
imul esi, esi, 0x35b46a82
lea eax, [edx + ebx]
mov ebx, dword [eax + 0xc]
add ebx, edx
mov ecx, dword [ebx]
or ecx, 0x20202020
cmp ecx, 0x6c64746e
jne 0x40acd3
mov ecx, dword [ebx + 4]
or ecx, 0x20202020
cmp ecx, 0x6c642e6c
jne 0x40acd3
mov esi, dword [ebp - 0x20]
mov ebx, edx
mov dword [0x410b50], esi
jmp 0x40ad2e
or ecx, 0x5489835f
mov dword [ebp - 0x28], ecx
mov ecx, esi
xor ecx, 0x1b4969df
jmp 0x40ace0
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 0x1c], 1
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp - 0x24]
mov byte [ebp - 0x2d], 1
mov ebx, dword [ebx]
mov dword [ebp - 0x24], ebx
mov ebx, edx
jmp 0x40ac6f
cmp byte [ebp - 0x2d], 0
je 0x40af64
mov edx, dword [ebp - 0x28]
cmp byte [ebp - 0x1c], 0
mov dword [0x410c9c], edx
je 0x40ad12
mov dword [0x410d54], esi
mov dword [0x410b50], ecx
test eax, eax
jne 0x40ad2e
lea eax, [edi + 0x6d35fccf]
mov dword [0x410cc8], eax
xor eax, eax
jmp 0x40af79
mov ecx, dword [eax + 0x1c]
mov edx, dword [0x410b50]
mov dword [0x411a28], ebx
mov esi, dword [eax + 0x18]
add ecx, ebx
and edx, 0x275f63c4
mov dword [ebp - 0x24], ecx
mov ecx, dword [eax + 0x20]
mov dword [0x410c9c], edx
add ecx, ebx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0x24]
mov eax, edx
xor eax, 0xba6e63ee
mov dword [esp + 4], edi
imul edx, eax, 0xfd31646e
add ecx, ebx
and eax, 0xb0b3c6dc
mov dword [ebp - 0x20], ecx
mov dword [0x410b50], eax
mov dword [esp], edx
mov dword [0x410d54], edx
call fcn.0040c090
lea edx, [esi - 1]
xor esi, esi
or dword [0x410d54], 0xc87ae0a1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + edx*4]
add eax, ebx
cmp word [eax], 0x775a
jne 0x40ade3
mov dword [esp], eax
lea ecx, [esi*8 + 0x40f964]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
call fcn.0040abb0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov dword [esi*8 + 0x40f964], eax
mov eax, dword [ebp - 0x20]
inc esi
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 4], eax
cmp esi, 0x226
je 0x40adee
lea eax, [edx - 1]
test edx, edx
je 0x40adee
mov edx, eax
jmp 0x40ad8f
mov eax, edi
mov dword [esp + 0x10], str.HKEY_PERFORMANCE_DATA
and eax, 0xbceb6064
mov dword [esp + 0xc], str.HKEY_PERFORMANCE_DATA
mov dword [esp + 8], 0x413348
mov dword [esp + 4], edi
mov dword [esp], 0x413348
mov dword [0x410c9c], eax
mov eax, edi
and eax, 0x18a22000
mov dword [0x410b50], eax
call fcn.0040c5e4
mov dword [0x40f960], esi
dec esi
test esi, esi
je 0x40af5d
mov edx, str.sr_Cyrl_CS
mov ecx, 0x1785
movzx eax, word [edx]
add edx, 2
test ax, ax
je 0x40ae98
add ecx, eax
cmp ecx, 0x1904
jbe 0x40ae47
mov eax, dword [0x410cc8]
mov ebx, dword [0x410d54]
mov dword [esp + 0xc], 0x411430
mov dword [esp + 4], str.Microsoft.Windows.Search.Indexer
mov dword [esp + 0x10], eax
mov eax, dword [0x410c9c]
mov dword [esp + 8], ebx
xor ebx, 0x2bcfb3dc
mov dword [esp], eax
call fcn.0040e6e4
mov dword [0x410cc8], ebx
mov edi, dword [0x410cc8]
xor ebx, ebx
and edi, 0xb1e5465e
imul eax, edi, 0x311bdc8e
mov dword [0x410c9c], edi
mov dword [0x410cc8], eax
imul eax, edi, 0x72e1bb2a
mov dword [0x410d54], eax
mov eax, dword [ebx*8 + 0x40f968]
inc ebx
mov edx, dword [ebx*8 + 0x40f968]
cmp edx, eax
jae 0x40af50
mov dword [ebp - 0x1c], eax
mov eax, dword [0x410cc8]
mov dword [esp + 0x10], str.too_many_files_open_in_system
lea ecx, [eax - 0x11c0c55]
mov dword [esp + 0xc], str.id_ID
mov dword [0x410b50], ecx
lea ecx, [edi - 0x2297ad77]
mov dword [esp + 4], ecx
mov dword [esp + 8], str.too_many_files_open_in_system
mov dword [esp], str.sq_AL
mov dword [ebp - 0x20], edx
mov dword [0x410cc8], ecx
call fcn.0040cde4
mov eax, dword [ebx*8 + 0x40f964]
mov ecx, dword [ebx*8 + 0x40f95c]
mov edx, dword [ebp - 0x20]
mov dword [ebx*8 + 0x40f95c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx*8 + 0x40f960], edx
mov dword [ebx*8 + 0x40f964], ecx
mov dword [ebx*8 + 0x40f968], eax
cmp ebx, esi
jb 0x40aec2
jmp 0x40ae34
mov eax, 1
jmp 0x40af79
cmp byte [ebp - 0x1c], 0
je 0x40ad18
mov dword [0x410d54], esi
jmp 0x40ad18
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
imul eax, dword [0x410c9c], 0x93c989c4
and eax, 0x878a50e8
mov dword [0x410b50], eax
mov eax, 1
ret