Function at 0x4020c7
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x42e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.AoZk0__kmZ__Z_mAP1_
lea ecx, [ebp - 0x34]
call fcn.004029ba
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
push 0xf
pop ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0xc], 0
cmp dword [ebp - 0x24], 0
mov dword [ebp - 8], ebx
mov byte [ebp - 0x1c], 0
jbe 0x402135
call fcn.00403052
cmp dword [ebp - 0x20], ebx
lea edx, [ebp - 0x34]
push dword [ebp - 0x24]
cmova edx, dword [ebp - 0x34]
mov ecx, eax
call fcn.00403937
pop ecx
push eax
call fcn.00403215
cmp dword [ebp - 0x20], ebx
lea eax, [ebp - 0x34]
pop ecx
push dword [ebp - 0x24]
cmova eax, dword [ebp - 0x34]
push eax
jmp 0x402143
mov esi, 0x42aabc
push esi
call fcn.0040dd40
pop ecx
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.00402a6d
rol edx, 0x7f
shr ax, 0xc7
inc edx
dec si
inc esi
dec bx
mul edx
imul edx
mul ebx
rcl di, 0x69
mul ax
inc si
add edx, 0x2d7
rcr eax, 0xd5
xor si, dx
rol eax, 0x5e
inc ebx
sub ax, 0x18f
xor edx, edx
inc si
and esi, 0x12c
inc si
mul si
or bx, bx
jb 0x4021a2
test ebx, 0xc
jae 0x402201
add esi, 0x2c4
and ax, cx
jmp 0x4021c0
imul esi
or ax, ax
add ax, 0x1d4
rcl bx, 0xe0
sub di, 0x255
inc eax
rcr dx, 0xcb
sub ebx, eax
add di, 0x267
add edx, edx
sub esi, ebx
sub edx, 0x251
shr dx, 0x35
shr eax, 0x25
imul cx
mov si, di
add bx, 0x1ac
mul dx
jb 0x402201
test ecx, 0
jb 0x40223c
dec esi
mul edi
dec si
mov edi, 0x122
shr edx, 0xc3
mul edi
xor ax, 0x122
rol esi, 0x6c
jmp 0x40220e
add cx, 0x38
or esi, esi
rcl bx, 0x4e
imul di
mul cx
shl ecx, 0x5b
rcr ebx, 0xa4
rcr edx, 0xa
rcr edx, 0x56
mov edi, 0x103
dec ecx
jb 0x40223c
test edx, 0x11
jae 0x402266
inc esi
ror cx, 0x3b
imul di
sub edx, ecx
shr ebx, 0x7e
jmp 0x402248
shl bx, 0xfc
ror cx, 0x58
dec bx
mul edx
shl edx, 0xec
rcr ecx, 0x15
movsx esi, si
jb 0x402266
cmp edi, 3
jne 0x402276
sub edi, esi
ror di, 0xa2
shl ecx, 0x18
rcr eax, 0x5e
jmp 0x40226a
rcl si, 0x72
xor bx, 0x3bd
je 0x402276
mul bx
jmp 0x40229b
mul ecx
add si, bx
imul si
sub edi, 0x1cd
rcl di, 0x31
ror bx, 0x35
add ecx, 0x321
rcr edi, 0x77
ror cx, 0x60
or edx, edx
rcr ebx, 0x27
xor si, 0x1c0
mul bx
dec dx
rcl edi, 0x75
rol cx, 0xd5
ja 0x4022d4
cmp esi, 0
jb 0x402315
rcl edx, 0xe2
imul cx
rcr di, 0xa2
sub edx, eax
ror si, 0x97
shl dx, 0xa8
rol di, 0xf9
shr si, 0x1c
jmp 0x4022e7
and si, di
rcl edi, 0xc8
imul edx
imul ecx
rcl ax, 0xa7
mov edi, 0x284
rcl ecx, 0x69
add si, 0x1d8
add ebx, edx
ror ax, 0x29
or dx, 0x3d1
mov di, 0x1d9
inc cx
dec edi
mov edx, eax
ja 0x402315
test ecx, 0x2a
jb 0x40233a
rcr si, 0x1b
inc bx
jmp 0x402328
and edx, edi
rcl edi, 0x81
dec dx
imul ebx
or ebx, 0x38f
shr di, 0xf1
dec di
jae 0x40233a
test eax, 0x17
jb 0x40237f
imul dx
inc cx
jmp 0x402351
rcr di, 0x6e
mul esi
add ebx, edx
add edx, esi
rcr ax, 0xc
rcr edx, 0xba
rcr ax, 0x8d
add edx, esi
inc ax
mul ecx
movsx ecx, cx
inc di
movsx ecx, bl
or ecx, 0x3b5
ror cx, 0xa6
rcl eax, 0xff
jb 0x40237f
rcl ebx, 0x93
imul edx
rcr ebx, 0x38
xor cx, 0x164
ror cx, 0xc5
jmp 0x40239a
dec eax
rol bx, 0xfe
mov bx, ax
and cx, 0x16f
add ebx, 0x1cc
inc di
rcr di, 0x3c
dec di
movsx eax, bl
rcl edx, 0x8c
shr si, 0xc8
shr edi, 0xa0
rcr cx, 0xb2
inc ecx
inc edi
ja 0x4023c3
test edi, 0x62
jae 0x4023e6
or bx, 0x3ae
add ecx, esi
imul ecx
inc eax
jmp 0x4023cd
or si, 0x3e4
mov edi, 0x26c
rcr cx, 0xc0
jne 0x4023e6
cmp ecx, 0x5c
je 0x40242b
shr di, 0x1e
rol dx, 0xe2
rcl dx, 0x73
jmp 0x4023fc
imul esi
and ebx, ecx
rcl ax, 0x36
mov si, 0x266
shl edx, 0xe
imul bx
rol ax, 0x33
imul bx
add edi, 0x2aa
shl dx, 0x32
and dx, si
inc ebx
shr cx, 0x47
je 0x40242b
inc ebx
rcl ebx, 0x8b
add cx, 0x1cd
shr bx, 0xb7
shr edi, 0x31
mov dx, dx
imul bx
jmp 0x40243a
mul edi
rcl ax, 0xbd
mov edi, edx
mul ebx
and ecx, eax
shr esi, 0x50
shr ax, 0xe6
ror cx, 0xfb
mov ebx, edx
jb 0x402451
rcl ebx, 0x82
imul bx
inc edi
and eax, edi
jmp 0x402468
or bx, 0x2d8
rcl esi, 0x26
dec esi
mul edx
xor ebx, 0x371
and ecx, 0xe2
movsx edi, di
rcl edx, 0xd9
shr di, 0xf1
add di, 0x2b
add si, 0x2d0
add di, di
ror edi, 0x88
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x4882b0], eax
push 0x17
push 0x42ead0
mov edx, 0x4e4
mov ecx, 0x4868f0
call fcn.00401cd2
pop ecx
pop ecx
rcl cx, 0x60
mov eax, esi
inc ax
ror cx, 0x70
xor dx, 0x321
dec esi
mov esi, 0xdf
movsx edi, dl
shl ecx, 0x35
mov cx, 0x2af
and dx, bx
shr ax, 0xed
dec ebx
mul edi
shr ax, 0xbf
add si, si
xor bx, 0x51
ror eax, 0x94
shr edx, 0xc2
rcr cx, 2
and si, 0x65
rcl bx, 7
dec ebx
ror bx, 0x80
jne 0x40250a
or dx, cx
dec eax
dec edi
imul ecx
jmp 0x402516
imul si
inc edi
inc ax
dec si
shr dx, 0x6d
rcl di, 3
imul bx
sub di, 0x257
rcl edi, 0xfe
jae 0x402536
xor ax, ax
ror di, 0xd7
mul dx
xor bx, cx
jmp 0x40254e
mov ebx, 0x31c
inc dx
shr esi, 0x4f
or dx, 0x34e
rcr si, 0xb3
imul bx
mul edi
mul cx
ror eax, 0x3e
jae 0x402577
cmp ecx, 0x15
je 0x4025b7
xor ax, 0x159
xor dx, di
rol cx, 0x3d
inc ecx
imul ecx
dec di
mov di, 0x33a
and ecx, 0x13e
jmp 0x402584
dec ax
sub edx, 0x1c6
imul ax
dec cx
dec cx
dec edi
shl bx, 0x5b
mul cx
imul ecx
xor ax, 0x1ec
rol cx, 0x79
inc cx
rcr ecx, 0x1d
jae 0x4025b7
test esi, 0x50
je 0x4025d8
inc esi
dec ebx
mul ecx
movsx esi, bh
sub si, cx
inc dx
imul ebx
jmp 0x4025bf
add di, 0x379
and ax, si
imul di
shr si, 0x40
mov edi, ecx
rol ecx, 0xdd
jb 0x4025d8
cmp edi, 0x60
jb 0x4025ff
ror di, 0xf5
jmp 0x4025e8
shr ax, 0x73
or di, dx
dec ax
shl ebx, 9
shr ax, 0xe7
movsx eax, bh
rcr bx, 0x6d
shl esi, 0xec
inc ebx
jb 0x4025ff
shl di, 0xe2
rcl dx, 0xbc
jmp 0x402602
rol esi, 0xd9
rol si, 0x1c
jb 0x40262d
test esi, 0x18
je 0x40266d
sub esi, 0x2ef
add eax, edi
or ax, si
dec bx
rol eax, 0x5d
xor esi, 0x323
rcr edi, 0x5a
sub ecx, ecx
jmp 0x402639
and si, 0xa8
mul eax
rcl eax, 0x79
imul ebx
ror si, 0xe6
rcl eax, 0xbe
movsx edi, si
dec si
mov ax, si
imul edx
xor cx, 0xe5
xor si, 0x138
rcr di, 0xdb
rcl edx, 0x5b
jb 0x40266d
shl si, 0x7d
mul dx
rcr bx, 0x37
and di, si
jmp 0x402686
or si, 0xe
rcl eax, 0x92
rcl edi, 0xf6
movsx esi, ax
xor ax, dx
dec ax
mul esi
movsx ebx, cx
inc cx
movsx edx, ax
imul si
inc cx
rcl bx, 0xaf
mov edx, 0x8aafdc01
call fcn.00402019
mov dword [ebp - 0x38], eax
mov dx, dx
dec di
mul dx
rcr ax, 0xcc
inc dx
mul edx
dec eax
rcr edx, 0xb9
imul dx
dec eax
or ebx, 0x4f
mov ebx, 0xd6
and dx, 0x7b
or esi, 0x3d7
rol edi, 0xac
mul edx
mul edi
mul si
imul si
and eax, 0x30c
rcr bx, 0xd6
ror esi, 3
dec esi
rcl ecx, 0xa2
jne 0x402710
cmp esi, 0x2e
je 0x402740
inc bx
shl edi, 0x2d
rol bx, 0x2c
mov cx, 0xe8
imul ecx
mul bx
ror ecx, 0x18
shl ecx, 0x66
mov ecx, 0x259
shl dx, 0x72
jmp 0x40271c
imul dx
ror ebx, 8
sub edx, 0x303
shl cx, 0xfe
rol ecx, 0x5f
rcl esi, 0x21
sub bx, 0x3dd
rcr ecx, 0xcd
jae 0x402740
test edx, 0x57
jne 0x40277a
mul esi
or esi, edi
dec ax
jmp 0x40275b
or edx, 0x289
mov eax, eax
shl ax, 0x48
xor ax, 0x23c
mov edx, edx
shl edx, 0x2f
inc bx
shl si, 0x1b
rol di, 0x11
ror di, 0x8e
rol ecx, 0x92
imul eax
movzx ecx, al
ja 0x40277a
xor ecx, ecx
mul dx
shl esi, 0x17
imul edi
inc ecx
jmp 0x402789
and edx, 0x337
dec edi
xor bx, cx
imul edx
rcl eax, 0xf6
dec di
rol ecx, 0xcf
je 0x40279d
or di, dx
mul edi
sub cx, dx
ror ebx, 0x1f
jmp 0x4027a1
movzx edi, dx
dec eax
xor eax, edx
sub bx, bx
xor edi, 0x38
mul cx
add dx, 0x1ae
jae 0x4027be
shl di, 0x1d
sub si, cx
add edi, edi
jmp 0x4027c6
add eax, 0x284
mul di
inc eax
rol esi, 0xcc
mov cx, 0x211
sub dx, di
jb 0x4027e2
and eax, edx
imul esi
rcl edx, 0x4b
add edi, ebx
mul ebx
inc cx
jmp 0x402802
rcl ecx, 0x20
mul di
shr eax, 0x85
or esi, 0x1bd
mul ecx
mul cx
and ax, 0x79
mov ax, dx
imul eax
imul di
ror di, 0x75
imul di
dec eax
ror edx, 0xa4
jb 0x402825
test edx, 0x4f
je 0x402863
rcr ax, 0x25
rol esi, 0x6f
inc di
imul dx
jmp 0x402833
shr edi, 0x92
movzx edx, bl
sub ebx, edi
inc cx
shl esi, 0xc2
inc edx
shr dx, 0x6c
sub cx, 0x3cb
rcr esi, 0x97
mul edx
mov dx, 0x377
rcl di, 0x34
add esi, 0xe0
inc ecx
dec eax
ja 0x402863
test eax, 0x15
ja 0x40288c
mov cx, 0x219
rcl ebx, 0x8c
jmp 0x40286b
movzx edx, cx
dec edx
rol dx, 0x38
shr ax, 0xbd
and dx, 0x1b4
rol dx, 0xd
dec cx
and si, ax
or edx, edi
jne 0x40288c
mul esi
add ax, dx
shl si, 0xef
jmp 0x4028b0
and ecx, 0x27e
rcl si, 0x9e
dec si
sub dx, 0x226
or esi, 0x2bb
shl di, 0x6b
xor si, si
and edx, 0x95
shl si, 0xa4
rcr di, 0xf4
ror di, 0x33
rcr eax, 0x52
dec esi
inc ecx
inc bx
lea eax, [ebp - 0x40]
push eax
push 0x40
push 0x4e4
push 0x4868f0
call dword [ebp - 0x38]
test eax, eax
je 0x402932
push 0x10
push 0x486de0
mov edx, 0x57e00
mov ecx, str.Y_b0
call fcn.00401cd2
pop ecx
pop ecx
mov esi, str.Y_b0
push esi
mov edx, 0x4868f0
mov ecx, 0x27
xor ecx, 0x1af
add edx, ecx
sub esp, 0xc
mov dword [esp + 4], 1
xor dword [esp + 4], 0x5dc
mov dword [esp], edx
mov byte [esp + 8], 0
lea eax, sym.imp.USER32.dll_CloseWindow
mov eax, dword [eax]
push eax
ret
mov eax, dword [ebp - 8]
push 0xf
pop esi
cmp eax, esi
jbe 0x40296b
mov ecx, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
cmp eax, 0x1000
jb 0x402962
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004012ac
mov eax, dword [ebp - 0x3c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.004070ce
pop ecx
pop ecx
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0x34]
mov dword [ebp - 8], esi
mov byte [ebp - 0x1c], 0
call fcn.00402a47
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040708b
leave
ret 0x10