Function at 0x41b6d0
Capabilities:
Access peb ldr_data
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5f2ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x665ebc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0xc]
xor edi, edi
cmp eax, edi
je 0x41b72a
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 0x18]
mov esi, dword [ecx]
push eax
mov eax, dword [esi + 0x30]
push edx
call eax
mov ecx, dword [ebx + 0x3c]
shr ecx, 4
test cl, 1
je 0x41b727
mov edx, dword [ebx + 0xc]
add dword [ebx + 0x20], edx
mov dword [ebx + 0xc], edi
mov eax, dword [ebx + 0x3c]
and eax, 0x90
cmp al, 0x90
jne 0x41b73f
push ebx
call fcn.0041bba0
mov dword [ebx + 0x10], eax
mov ecx, dword [ebx + 0x3c]
and ecx, 0x90
cmp cl, 0x90
sete cl
mov byte [esp + 0x17], cl
cmp dword [ebx + 0x20], edi
je 0x41b788
inc word [ebx + 0x24]
movzx eax, word [ebx + 0x24]
movzx edx, cl
neg edx
sbb edx, edx
and edx, 0xffff03e8
add edx, 0xffff
movzx ecx, dx
mov dword [ebx + 0x20], edi
cmp ax, cx
jb 0x41b788
push 0xd1
push ebx
call fcn.0041aed0
call fcn.00567d0d
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x41b7a2
push 0x80004005
call fcn.00402400
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
cmp byte [esp + 0x17], 0
mov dword [esp + 0x38], edi
je 0x41b7cc
lea ecx, [ebx + 0x44]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00402340
jmp 0x41b80d
xor cl, cl
lea edx, [esp + 0x1c]
mov eax, ebx
call fcn.0041a540
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x3c], 1
call fcn.00402340
mov byte [esp + 0x38], 0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41b80d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x34]
call eax
test al, al
jne 0x41b87f
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebx + 0x3c]
and ecx, 0x70
cmp cl, 0x70
jne 0x41b875
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov esi, dword [ebx + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 8]
cmp eax, edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], eax
jge 0x41b855
call fcn.00566b22
lea edi, [eax + 1]
call fcn.0041c7c0
mov esi, dword [esi + 4]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esi + eax*8], ecx
mov dword [esi + eax*8 + 4], edx
xor edi, edi
mov ecx, dword [ebx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
cmp dword [ebx + 0x40], edi
je 0x41ba69
mov edi, dword [esp + 0x18]
mov dword [esp + 0x1c], 1
push ecx
mov ecx, dword [edi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
lea esi, [edi - 0x10]
mov dword [esp + 0x24], esp
mov dword [esp + 0x24], esp
call edx
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x41b8c4
cmp eax, dword [esi]
jne 0x41b8c4
mov edi, esi
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x41b8f8
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 1
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x41ba4a
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
inc eax
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.0059beab
add esp, 0x10
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x24]
push eax
add edi, 0x10
push ecx
mov esi, ebx
mov dword [edx], edi
call fcn.0041bae0
mov eax, dword [ebx + 0x40]
add eax, 4
push eax
lea ecx, [esp + 0x1c]
call fcn.00402340
mov edi, dword [esp + 0x18]
mov eax, edi
lea esi, [esp + 0x24]
call fcn.00418ad0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, dword [esp + 0x24]
add edx, 0xfffffff0
mov dword [esp + 0x20], eax
lea ecx, [edx + 0xc]
or esi, 0xffffffff
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x41b961
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
mov edx, dword [eax + 4]
call edx
mov eax, dword [esp + 0x20]
cmp eax, 0xffffffff
je 0x41b985
test al, 0x10
mov eax, 0
sete al
lea eax, [eax + eax - 1]
test eax, eax
je 0x41b985
mov dword [esp + 0x1c], 2
jmp 0x41b894
cmp byte [esp + 0x17], 0
je 0x41ba28
call fcn.00567d0d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x41b798
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x38], 2
movzx ecx, word [ebx + 0x24]
inc ecx
push ecx
lea edx, [esp + 0x20]
push str.pkback__.3d
push edx
call fcn.00401b30
mov esi, dword [esp + 0x28]
add esp, 0xc
push esi
push edi
call fcn.00419860
add esp, 8
or edx, 0xffffffff
test al, al
lea eax, [esi - 0x10]
mov byte [esp + 0x38], 0
lea ecx, [eax + 0xc]
jne 0x41ba15
mov dword [esp + 0x1c], 3
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b894
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41b894
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41ba28
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
mov eax, dword [edx]
push 0
push 0x1022
push edi
call eax
test al, al
jne 0x41ba4f
mov dword [esp + 0x1c], 4
jmp 0x41b894
call fcn.004022b0
cmp byte [esp + 0x17], 0
je 0x41ba61
push ebx
call fcn.0041bba0
mov dword [ebx + 0x10], eax
jmp 0x41ba98
mov eax, dword [ebx + 8]
mov dword [ebx + 0x10], eax
jmp 0x41ba98
cmp byte [esp + 0x17], 0
je 0x41ba7b
push 0xd7
push ebx
call fcn.0041aed0
mov ecx, dword [ebx + 8]
mov edi, dword [esp + 0x18]
mov dword [ebx + 0x10], ecx
mov ebx, dword [ebx + 4]
mov edx, dword [ebx]
mov eax, dword [edx]
push 1
push 0x1022
push edi
mov ecx, ebx
call eax
lea eax, [edi - 0x10]
mov dword [esp + 0x38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41babc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4