Function at 0x4ced20
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6468
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6a0290]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.00438c40
lea ecx, [ebx + 0x9f8]
mov dword [ebp - 4], 0
mov dword [ebx], vtable.CItem.0
call fcn.004af490
lea ecx, [ebx + 0xa18]
mov byte [ebp - 4], 1
call fcn.004af490
lea ecx, [ebx + 0xa38]
mov byte [ebp - 4], 2
call fcn.004af490
lea ecx, [ebx + 0xa58]
mov byte [ebp - 4], 3
call fcn.004af490
lea ecx, [ebx + 0xa78]
mov byte [ebp - 4], 4
call fcn.004af490
lea ecx, [ebx + 0xa98]
mov byte [ebp - 4], 5
call fcn.004af490
lea ecx, [ebx + 0xab8]
mov byte [ebp - 4], 6
call fcn.004af490
lea ecx, [ebx + 0xad8]
mov byte [ebp - 4], 7
call fcn.004af490
lea ecx, [ebx + 0xaf8]
mov byte [ebp - 4], 8
call fcn.004af490
lea ecx, [ebx + 0xb18]
mov byte [ebp - 4], 9
call fcn.004af490
lea ecx, [ebx + 0xb38]
mov byte [ebp - 4], 0xa
call fcn.004af490
lea ecx, [ebx + 0xb58]
mov byte [ebp - 4], 0xb
call fcn.004af490
lea ecx, [ebx + 0xb78]
mov byte [ebp - 4], 0xc
call fcn.004af490
lea ecx, [ebx + 0xb98]
mov byte [ebp - 4], 0xd
call fcn.004af490
lea ecx, [ebx + 0xbb8]
mov byte [ebp - 4], 0xe
call fcn.004af490
lea ecx, [ebx + 0xbd8]
mov byte [ebp - 4], 0xf
call fcn.004af490
lea ecx, [ebx + 0xbf8]
mov byte [ebp - 4], 0x10
call fcn.004af490
lea ecx, [ebx + 0xc18]
mov byte [ebp - 4], 0x11
call fcn.004af490
lea ecx, [ebx + 0xc38]
mov byte [ebp - 4], 0x12
call fcn.004af490
mov byte [ebp - 4], 0x13
lea ecx, [ebx + 0xc58]
call fcn.004af490
lea ecx, [ebx + 0xc78]
mov byte [ebp - 4], 0x14
call fcn.004af490
lea esi, [ebx + 0xc98]
mov byte [ebp - 4], 0x15
mov ecx, esi
call fcn.004af490
lea edi, [ebx + 0xcb8]
mov byte [ebp - 4], 0x16
mov ecx, edi
call fcn.004af490
add ebx, 0xcd8
mov byte [ebp - 4], 0x17
mov ecx, ebx
call fcn.004af490
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0xcf8
mov byte [ebp - 4], 0x18
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0xdf8
mov byte [ebp - 4], 0x19
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0xef8
mov byte [ebp - 4], 0x1a
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0xff8
mov byte [ebp - 4], 0x1b
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0x10f8
mov byte [ebp - 4], 0x1c
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0x11f8
mov byte [ebp - 4], 0x1d
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0x12f8
mov byte [ebp - 4], 0x1e
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0x13f8
mov byte [ebp - 4], 0x1f
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0x14f8
mov byte [ebp - 4], 0x20
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0x15f8
mov byte [ebp - 4], 0x21
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0x16f8
mov byte [ebp - 4], 0x22
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0x17f8
mov byte [ebp - 4], 0x23
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0x18f8
mov byte [ebp - 4], 0x24
push 0x20
push eax
call fcn.0058edc0
mov eax, dword [ebp - 0x10]
push fcn.004af4a0
push fcn.004af490
push 8
add eax, 0x19f8
mov byte [ebp - 4], 0x25
push 0x20
push eax
call fcn.0058edc0
mov byte [ebp - 4], 0x26
mov edx, dword [ebp - 0x10]
mov eax, 0x83
mov ecx, dword [ebp + 8]
mov word [edx + 0xc], ax
mov dword [edx + 0x1af8], 0
movdqu xmm0, xmmword [ecx]
movdqu xmmword [edx + 0x9a8], xmm0
movdqu xmm0, xmmword [ecx + 0x10]
movdqu xmmword [edx + 0x9b8], xmm0
movdqu xmm0, xmmword [ecx + 0x20]
movdqu xmmword [edx + 0x9c8], xmm0
movdqu xmm0, xmmword [ecx + 0x30]
movdqu xmmword [edx + 0x9d8], xmm0
mov eax, dword [ecx + 0x40]
mov dword [edx + 0x9e8], eax
mov ax, word [ecx + 0x44]
mov ecx, 0x6d3ad8
mov word [edx + 0x9ec], ax
xor eax, eax
push eax
mov word [edx + 0x9ee], ax
mov dword [edx + 0x9f4], eax
lea eax, [edx + 0x9f8]
push eax
push 0x7f
mov dword [edx + 0x9f0], 0
call fcn.004b9540
mov eax, dword [ebp - 0x10]
mov ecx, 0x6d3ad8
push 0
add eax, 0xa38
push eax
push 0xde
call fcn.004b9540
mov eax, dword [ebp - 0x10]
mov ecx, 0x6d3ad8
push 0
add eax, 0xa58
push eax
push 0x116
call fcn.004b9540
mov eax, dword [ebp - 0x10]
mov ecx, 0x6d3ad8
push 0
add eax, 0xa78
push eax
push 0x117
call fcn.004b9540
mov eax, dword [ebp - 0x10]
mov ecx, 0x6d3ad8
push 0
add eax, 0xa98
push eax
push 0x118
call fcn.004b9540
mov eax, dword [ebp - 0x10]
mov ecx, 0x6d3ad8
push 0
add eax, 0xab8
push eax
push 0xdf
call fcn.004b9540
mov eax, dword [ebp - 0x10]
mov ecx, 0x6d3ad8
push 0
add eax, 0xad8
push eax
push 0xe0
call fcn.004b9540
mov eax, dword [ebp - 0x10]
mov ecx, 0x6d3ad8
push 0
add eax, 0xaf8
push eax
push 0xe1
call fcn.004b9540
mov eax, dword [ebp - 0x10]
push 0
add eax, 0xb18
push eax
push 0xe2
mov ecx, 0x6d3ad8
call fcn.004b9540
mov eax, dword [ebp - 0x10]
mov ecx, 0x6d3ad8
push 0
add eax, 0xb38
push eax
push 0xe3
call fcn.004b9540
mov eax, dword [ebp - 0x10]
mov ecx, 0x6d3ad8
push 0
add eax, 0xb58
push eax
push 0xe4
call fcn.004b9540
push 0
push esi
push 0x119
mov ecx, 0x6d3ad8
call fcn.004b9540
push 0
push edi
push 0x11a
mov ecx, 0x6d3ad8
call fcn.004b9540
push 0
push ebx
push 0x11b
mov ecx, 0x6d3ad8
call fcn.004b9540
mov ebx, dword [ebp - 0x10]
mov ecx, 0x6d3ad8
push 0
lea eax, [ebx + 0xb78]
push eax
push 0x10d
call fcn.004b9540
push 0
lea eax, [ebx + 0xb98]
mov ecx, 0x6d3ad8
push eax
push 0x10e
call fcn.004b9540
push 0
lea eax, [ebx + 0xbb8]
mov ecx, 0x6d3ad8
push eax
push 0x10f
call fcn.004b9540
push 0
lea eax, [ebx + 0xbd8]
mov ecx, 0x6d3ad8
push eax
push 0x110
call fcn.004b9540
push 0
lea eax, [ebx + 0xbf8]
mov ecx, 0x6d3ad8
push eax
push 0x111
call fcn.004b9540
push 0
lea eax, [ebx + 0xc18]
mov ecx, 0x6d3ad8
push eax
push 0x112
call fcn.004b9540
push 0
lea eax, [ebx + 0xc38]
mov ecx, 0x6d3ad8
push eax
push 0x113
call fcn.004b9540
push 0
lea eax, [ebx + 0xc58]
mov ecx, 0x6d3ad8
push eax
push 0x114
call fcn.004b9540
push 0
lea eax, [ebx + 0xc78]
mov ecx, 0x6d3ad8
push eax
push 0x115
call fcn.004b9540
push 0
lea eax, [ebx + 0xcf8]
mov ecx, 0x6d3ad8
push eax
push 0x125
call fcn.004b9540
push 0
lea eax, [ebx + 0xd18]
mov ecx, 0x6d3ad8
push eax
push 0x126
call fcn.004b9540
push 0
lea eax, [ebx + 0xd38]
mov ecx, 0x6d3ad8
push eax
push 0x127
call fcn.004b9540
push 0
lea eax, [ebx + 0xd58]
mov ecx, 0x6d3ad8
push eax
push pe_nt_image_headers32
call fcn.004b9540
push 0
lea eax, [ebx + 0xd78]
mov ecx, 0x6d3ad8
push eax
push 0x129
call fcn.004b9540
push 0
lea eax, [ebx + 0xdf8]
mov ecx, 0x6d3ad8
push eax
push 0x12a
call fcn.004b9540
push 0
lea eax, [ebx + 0xe18]
mov ecx, 0x6d3ad8
push eax
push 0x12b
call fcn.004b9540
push 0
lea eax, [ebx + 0xe38]
mov ecx, 0x6d3ad8
push eax
push 0x12c
call fcn.004b9540
push 0
lea eax, [ebx + 0xe58]
mov ecx, 0x6d3ad8
push eax
push 0x12d
call fcn.004b9540
push 0
lea eax, [ebx + 0xe78]
mov ecx, 0x6d3ad8
push eax
push 0x12e
call fcn.004b9540
push 0
lea eax, [ebx + 0xef8]
mov ecx, 0x6d3ad8
push eax
push 0x12f
call fcn.004b9540
push 0
lea eax, [ebx + 0xf18]
mov ecx, 0x6d3ad8
push eax
push 0x130
call fcn.004b9540
push 0
lea eax, [ebx + 0xf38]
push eax
push 0x131
mov ecx, 0x6d3ad8
call fcn.004b9540
push 0
lea eax, [ebx + 0xf58]
mov ecx, 0x6d3ad8
push eax
push 0x132
call fcn.004b9540
push 0
lea eax, [ebx + 0xf78]
mov ecx, 0x6d3ad8
push eax
push 0x133
call fcn.004b9540
push 0
lea eax, [ebx + 0xff8]
mov ecx, 0x6d3ad8
push eax
push 0x134
call fcn.004b9540
push 0
lea eax, [ebx + 0x1018]
mov ecx, 0x6d3ad8
push eax
push 0x135
call fcn.004b9540
push 0
lea eax, [ebx + 0x1038]
mov ecx, 0x6d3ad8
push eax
push 0x136
call fcn.004b9540
push 0
lea eax, [ebx + 0x1058]
mov ecx, 0x6d3ad8
push eax
push 0x137
call fcn.004b9540
push 0
lea eax, [ebx + 0x1078]
mov ecx, 0x6d3ad8
push eax
push 0x138
call fcn.004b9540
push 0
lea eax, [ebx + 0x10f8]
mov ecx, 0x6d3ad8
push eax
push 0x139
call fcn.004b9540
push 0
lea eax, [ebx + 0x1118]
mov ecx, 0x6d3ad8
push eax
push 0x13a
call fcn.004b9540
push 0
lea eax, [ebx + 0x1138]
mov ecx, 0x6d3ad8
push eax
push 0x13b
call fcn.004b9540
push 0
lea eax, [ebx + 0x1158]
mov ecx, 0x6d3ad8
push eax
push 0x13c
call fcn.004b9540
push 0
lea eax, [ebx + 0x1178]
mov ecx, 0x6d3ad8
push eax
push 0x13d
call fcn.004b9540
push 0
lea eax, [ebx + 0x11f8]
mov ecx, 0x6d3ad8
push eax
push 0x13e
call fcn.004b9540
push 0
lea eax, [ebx + 0x1218]
mov ecx, 0x6d3ad8
push eax
push 0x13f
call fcn.004b9540
push 0
lea eax, [ebx + 0x1238]
mov ecx, 0x6d3ad8
push eax
push 0x140
call fcn.004b9540
push 0
lea eax, [ebx + 0x1258]
mov ecx, 0x6d3ad8
push eax
push 0x141
call fcn.004b9540
push 0
lea eax, [ebx + 0x1278]
mov ecx, 0x6d3ad8
push eax
push 0x142
call fcn.004b9540
push 0
lea eax, [ebx + 0x12f8]
mov ecx, 0x6d3ad8
push eax
push 0x143
call fcn.004b9540
push 0
lea eax, [ebx + 0x1318]
mov ecx, 0x6d3ad8
push eax
push 0x144
call fcn.004b9540
push 0
lea eax, [ebx + 0x1338]
mov ecx, 0x6d3ad8
push eax
push 0x145
call fcn.004b9540
push 0
lea eax, [ebx + 0x1358]
mov ecx, 0x6d3ad8
push eax
push 0x146
call fcn.004b9540
push 0
lea eax, [ebx + 0x1378]
mov ecx, 0x6d3ad8
push eax
push 0x147
call fcn.004b9540
push 0
lea eax, [ebx + 0x13f8]
mov ecx, 0x6d3ad8
push eax
push 0x148
call fcn.004b9540
push 0
lea eax, [ebx + 0x1418]
mov ecx, 0x6d3ad8
push eax
push 0x149
call fcn.004b9540
push 0
lea eax, [ebx + 0x1438]
mov ecx, 0x6d3ad8
push eax
push 0x14a
call fcn.004b9540
push 0
lea eax, [ebx + 0x1458]
mov ecx, 0x6d3ad8
push eax
push 0x14b
call fcn.004b9540
push 0
lea eax, [ebx + 0x1478]
push eax
push 0x14c
mov ecx, 0x6d3ad8
call fcn.004b9540
push 0
lea eax, [ebx + 0x14f8]
mov ecx, 0x6d3ad8
push eax
push 0x14d
call fcn.004b9540
push 0
lea eax, [ebx + 0x1518]
mov ecx, 0x6d3ad8
push eax
push 0x14e
call fcn.004b9540
push 0
lea eax, [ebx + 0x1538]
mov ecx, 0x6d3ad8
push eax
push 0x14f
call fcn.004b9540
push 0
lea eax, [ebx + 0x1558]
mov ecx, 0x6d3ad8
push eax
push 0x150
call fcn.004b9540
push 0
lea eax, [ebx + 0x1578]
mov ecx, 0x6d3ad8
push eax
push 0x151
call fcn.004b9540
push 0
lea eax, [ebx + 0x15f8]
mov ecx, 0x6d3ad8
push eax
push 0x152
call fcn.004b9540
push 0
lea eax, [ebx + 0x1618]
mov ecx, 0x6d3ad8
push eax
push 0x153
call fcn.004b9540
push 0
lea eax, [ebx + 0x1638]
mov ecx, 0x6d3ad8
push eax
push 0x154
call fcn.004b9540
push 0
lea eax, [ebx + 0x1658]
mov ecx, 0x6d3ad8
push eax
push 0x155
call fcn.004b9540
push 0
lea eax, [ebx + 0x1678]
mov ecx, 0x6d3ad8
push eax
push 0x156
call fcn.004b9540
push 0
lea eax, [ebx + 0x1698]
mov ecx, 0x6d3ad8
push eax
push 0x157
call fcn.004b9540
push 0
lea eax, [ebx + 0x16b8]
mov ecx, 0x6d3ad8
push eax
push 0x158
call fcn.004b9540
push 0
lea eax, [ebx + 0x16d8]
mov ecx, 0x6d3ad8
push eax
push 0x159
call fcn.004b9540
push 0
lea eax, [ebx + 0x16f8]
mov ecx, 0x6d3ad8
push eax
push 0x15a
call fcn.004b9540
push 0
lea eax, [ebx + 0x1718]
mov ecx, 0x6d3ad8
push eax
push 0x15b
call fcn.004b9540
push 0
lea eax, [ebx + 0x1738]
mov ecx, 0x6d3ad8
push eax
push 0x15c
call fcn.004b9540
push 0
lea eax, [ebx + 0x1758]
mov ecx, 0x6d3ad8
push eax
push 0x15d
call fcn.004b9540
push 0
lea eax, [ebx + 0x1778]
mov ecx, 0x6d3ad8
push eax
push 0x15e
call fcn.004b9540
push 0
lea eax, [ebx + 0x1798]
mov ecx, 0x6d3ad8
push eax
push 0x15f
call fcn.004b9540
push 0
lea eax, [ebx + 0x17b8]
mov ecx, 0x6d3ad8
push eax
push 0x160
call fcn.004b9540
push 0
lea eax, [ebx + 0x17d8]
mov ecx, 0x6d3ad8
push eax
push 0x161
call fcn.004b9540
push 0
lea eax, [ebx + 0x17f8]
mov ecx, 0x6d3ad8
push eax
push 0x162
call fcn.004b9540
push 0
lea eax, [ebx + 0x1818]
mov ecx, 0x6d3ad8
push eax
push 0x163
call fcn.004b9540
push 0
lea eax, [ebx + 0x1838]
mov ecx, 0x6d3ad8
push eax
push 0x164
call fcn.004b9540
push 0
lea eax, [ebx + 0x1858]
mov ecx, 0x6d3ad8
push eax
push 0x165
call fcn.004b9540
push 0
lea eax, [ebx + 0x1878]
mov ecx, 0x6d3ad8
push eax
push 0x166
call fcn.004b9540
push 0
lea eax, [ebx + 0x1898]
push eax
push 0x167
mov ecx, 0x6d3ad8
call fcn.004b9540
push 0
lea eax, [ebx + 0x18b8]
mov ecx, 0x6d3ad8
push eax
push 0x168
call fcn.004b9540
push 0
lea eax, [ebx + 0x18d8]
mov ecx, 0x6d3ad8
push eax
push 0x169
call fcn.004b9540
push 0
lea eax, [ebx + 0x18f8]
mov ecx, 0x6d3ad8
push eax
push 0x16a
call fcn.004b9540
push 0
lea eax, [ebx + 0x1918]
mov ecx, 0x6d3ad8
push eax
push 0x16b
call fcn.004b9540
push 0
lea eax, [ebx + 0x1938]
mov ecx, 0x6d3ad8
push eax
push 0x16c
call fcn.004b9540
push 0
lea eax, [ebx + 0x1958]
mov ecx, 0x6d3ad8
push eax
push 0x16d
call fcn.004b9540
push 0
lea eax, [ebx + 0x1978]
mov ecx, 0x6d3ad8
push eax
push 0x16e
call fcn.004b9540
push 0
lea eax, [ebx + 0x1998]
mov ecx, 0x6d3ad8
push eax
push 0x16f
call fcn.004b9540
push 0
lea eax, [ebx + 0x19b8]
mov ecx, 0x6d3ad8
push eax
push 0x170
call fcn.004b9540
push 0
lea eax, [ebx + 0x19d8]
mov ecx, 0x6d3ad8
push eax
push 0x171
call fcn.004b9540
push 0
lea eax, [ebx + 0x19f8]
mov ecx, 0x6d3ad8
push eax
push 0x172
call fcn.004b9540
push 0
lea eax, [ebx + 0x1a18]
mov ecx, 0x6d3ad8
push eax
push 0x173
call fcn.004b9540
push 0
lea eax, [ebx + 0x1a38]
mov ecx, 0x6d3ad8
push eax
push 0x174
call fcn.004b9540
push 0
lea eax, [ebx + 0x1a58]
mov ecx, 0x6d3ad8
push eax
push 0x175
call fcn.004b9540
push 0
lea eax, [ebx + 0x1a78]
mov ecx, 0x6d3ad8
push eax
push 0x176
call fcn.004b9540
push 0
lea eax, [ebx + 0x1a98]
mov ecx, 0x6d3ad8
push eax
push 0x177
call fcn.004b9540
push 0
lea eax, [ebx + 0x1ab8]
mov ecx, 0x6d3ad8
push eax
push 0x178
call fcn.004b9540
push 0
lea eax, [ebx + 0x1ad8]
mov ecx, 0x6d3ad8
push eax
push 0x179
call fcn.004b9540
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4