Function at 0x416687
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x43b034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov ecx, 0x404f40
mov dword [ebp - 0x28], edi
mov ebx, edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], edi
call fcn.0041aca0
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x4166db
push 0xc1008019
mov edi, 0xc000000d
call fcn.0041ba12
pop ecx
jmp 0x416b19
cmp dword [eax + 0xc], edi
ja 0x4166ef
mov edi, 0xc000000d
push 0xc1008019
jmp 0x416ab0
mov ecx, dword [eax + 0x10]
lea edx, [ebp - 0x14]
call fcn.0041bfb0
test eax, eax
jns 0x41670c
mov esi, 0x405b30
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x41670f
xor ebx, ebx
inc ebx
mov esi, dword [ebp - 0x24]
cmp ebx, dword [esi + 0xc]
jae 0x4166e0
lea ecx, [ebp - 0x14]
call fcn.0041794c
movzx edx, al
lea ecx, [ebp - 0x30]
neg edx
push ecx
sbb edx, edx
and edx, 2
call fcn.0041be69
mov edi, eax
test edi, edi
jns 0x416742
push 0xc1008005
jmp 0x416ab0
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x14]
call fcn.0041fa76
mov edi, eax
test edi, edi
jns 0x416761
push 0xc100800e
jmp 0x416ab0
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x50]
push 0
xor edx, edx
push eax
inc edx
call fcn.0041fcf3
mov edi, eax
test edi, edi
js 0x416757
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x1c]
mov ecx, dword [esi + ebx*4 + 0x10]
push eax
call fcn.00417990
mov edi, eax
test edi, edi
jns 0x416798
push 0xc100801a
jmp 0x416ab0
mov ecx, esi
inc ebx
mov esi, dword [ecx + 0xc]
cmp ebx, esi
jae 0x4166e0
mov edx, dword [ebp - 0x1c]
mov eax, edx
shr eax, 0x18
and eax, 0xf
sub eax, 1
je 0x416a52
sub eax, 1
je 0x4169f0
sub eax, 1
je 0x4169b1
sub eax, 1
je 0x41691b
sub eax, 1
je 0x4168c9
sub eax, 1
je 0x4168a2
sub eax, 1
jne 0x4166e0
sub esi, ebx
shl esi, 3
push esi
push eax
mov eax, dword fs:[0x30]
mov dword [ebp - 0x20], esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x416a2c
mov ecx, dword [ebp - 0x24]
and dword [ebp - 0x38], 0
mov dword [ebp - 0x48], 8
mov eax, dword [ecx + 0xc]
sub eax, ebx
je 0x416a4a
lea ecx, [ecx + ebx*4]
add ecx, 0x10
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x4c]
lea eax, [ebp - 0x48]
mov ecx, dword [ecx]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
call fcn.004173f7
mov edi, eax
test edi, edi
js 0x416898
mov ecx, dword [ebp - 0x34]
mov edi, dword [ebp - 0x38]
push ecx
push 0
mov eax, dword [ecx]
mov dword [esi + edi*8], eax
mov eax, dword [ecx + 4]
mov dword [esi + edi*8 + 4], eax
mov eax, dword fs:[0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0x24]
inc edi
mov ecx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x18]
add ecx, 4
mov dword [ebp - 0x38], edi
mov eax, dword [eax + 0xc]
sub eax, ebx
mov dword [ebp - 0x3c], ecx
cmp edi, eax
jb 0x416838
jmp 0x416a4a
push 0xc100801e
jmp 0x416ab0
mov ecx, dword [ecx + ebx*4 + 0x10]
lea eax, [ebp - 0x20]
push eax
lea edx, [ebp - 0x18]
mov dword [ebp - 0x20], 2
call fcn.004174eb
mov edi, eax
test edi, edi
jns 0x4168eb
push 0xc100801f
jmp 0x416ab0
mov ecx, dword [ecx + ebx*4 + 0x10]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 8
push eax
push edx
mov edx, dword [ebp - 0x4c]
call fcn.004173f7
mov edi, eax
test edi, edi
js 0x416898
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
xor ecx, ecx
call fcn.0041aca0
mov dword [ebp - 0x44], eax
test eax, eax
je 0x416a7d
push dword [eax + 8]
push 0xc100803a
call fcn.0041ba12
pop ecx
mov edi, 0xc000000d
jmp 0x416ab5
mov ecx, 0x405110
call fcn.0041aca0
mov ecx, 0x405124
mov esi, eax
call fcn.0041aca0
mov ecx, 0x405134
mov dword [ebp - 0x34], eax
call fcn.0041aca0
xor ecx, ecx
test esi, esi
je 0x41694c
inc ecx
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x34], 0
je 0x41695a
inc ecx
mov dword [ebp - 0x28], 3
test eax, eax
je 0x416965
xor eax, eax
inc ecx
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov esi, dword [eax + 0xc]
sub esi, ebx
test ecx, ecx
je 0x416985
cmp ecx, 1
ja 0x41697b
cmp esi, 1
je 0x416985
push 0xc1008033
jmp 0x416ab0
lea ecx, [ebp - 0x18]
mov edx, esi
push ecx
lea ecx, [eax + 0x10]
lea ecx, [ecx + ebx*4]
call fcn.0041bf17
mov edi, eax
test edi, edi
jns 0x4169a6
push 0xc100801d
jmp 0x416ab0
shl esi, 4
mov dword [ebp - 0x20], esi
jmp 0x4168eb
push 0x10
pop eax
push eax
mov dword [ebp - 0x20], eax
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
je 0x416a2c
mov eax, dword [ebp - 0x24]
mov edx, esi
mov ecx, dword [eax + ebx*4 + 0x10]
call fcn.0041bfb0
mov edi, eax
test edi, edi
jns 0x416a4a
push 0xc100801c
jmp 0x416ab0
mov ecx, dword [ecx + ebx*4 + 0x10]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4169f9
mov eax, dword fs:[0x30]
sub ecx, edx
sar ecx, 1
lea edi, [ecx*2 + 2]
push edi
push esi
push dword [eax + 0x18]
mov dword [ebp - 0x20], edi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp - 0x18], esi
test esi, esi
jne 0x416a36
mov edi, 0xc000009a
jmp 0x416ab6
mov eax, dword [ebp - 0x24]
shr edi, 1
push dword [eax + ebx*4 + 0x10]
push edi
push esi
call dword [sym.imp.msvcrt.dll_wcscpy_s]
add esp, 0xc
mov ebx, dword [ebp - 0x1c]
jmp 0x4168f1
mov edx, dword [ecx + ebx*4 + 0x10]
lea eax, [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00416f59
mov edi, eax
test edi, edi
jns 0x4168ee
push 0xc100801b
jmp 0x416ab0
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x416a97
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
mov edx, ebx
push esi
push dword [ebp - 0x40]
call fcn.00420448
jmp 0x416aa5
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x14]
push eax
push esi
push ebx
call fcn.0041d18d
mov edi, eax
test edi, edi
jns 0x416ab6
push 0xc1008020
call fcn.0041ba12
pop ecx
push dword [ebp - 0x24]
mov eax, dword fs:[0x30]
xor ebx, ebx
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x416ae3
push eax
mov eax, dword fs:[0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x18], ebx
je 0x416afb
push dword [ebp - 0x18]
mov eax, dword fs:[0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x416b07
call fcn.0041fd66
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x416b19
call fcn.0041e793
test edi, edi
js 0x416b19
mov edi, eax
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call fcn.0041ba5a
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00437a70
leave
ret