Function at 0x41ba10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6449
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4fc040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov ebx, dword [ebp + 8]
xor eax, eax
mov byte [ebp - 4], 4
mov dword [edi + 0x28], eax
mov word [edi + 0x2c], ax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov word [edi + 0x40], ax
mov byte [edi + 0x42], al
cmp byte [ebx + 1], 0x15
jb 0x41bcdf
mov eax, dword [ebx + 4]
mov ecx, 0xffff
movzx eax, word [eax + 8]
cmp ax, cx
je 0x41bacc
test ax, ax
jne 0x41bace
xor eax, eax
mov word [edi + 0x28], ax
mov eax, dword [ebx + 4]
movzx eax, word [eax + 0xa]
cmp ax, cx
je 0x41bae3
test ax, ax
jne 0x41bae5
xor eax, eax
mov word [edi + 0x2c], ax
cmp byte [ebx + 1], 0x20
mov ecx, dword [ebx + 4]
movzx eax, word [ecx + 0xc]
mov edx, eax
jb 0x41bb1a
mov esi, 0x7fff
cmp ax, si
jne 0x41bb1a
mov eax, dword [ecx + 0x1c]
mov ecx, 0x400
and eax, 0x7fffffff
mul ecx
shld edx, eax, 0xa
shl eax, 0xa
jmp 0x41bb3e
test ax, ax
je 0x41bb44
mov ecx, 0x400
test dx, dx
js 0x41bb2e
mov ecx, 0x100000
push 0
and eax, 0x7fff
cdq
push ecx
push edx
push eax
call fcn.004e4360
mov dword [edi + 0x34], edx
mov dword [edi + 0x30], eax
mov edx, 0x11
mov ecx, ebx
call fcn.00422dc0
mov edx, 0x10
mov ecx, ebx
mov esi, eax
call fcn.00422dc0
push esi
push eax
mov ecx, edi
call fcn.0041bd00
mov eax, dword [ebx + 4]
movzx eax, byte [eax + 0xe]
mov byte [edi + 0x40], al
mov eax, dword [ebx + 4]
movzx eax, byte [eax + 0x12]
mov byte [edi + 0x42], al
mov eax, dword [edi + 0x30]
or eax, dword [edi + 0x34]
je 0x41bcdf
mov al, byte [ebx + 1]
cmp al, 0x17
jb 0x41bcdf
cmp al, 0x5c
jb 0x41bb9e
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x54]
jmp 0x41bba0
xor eax, eax
mov ecx, dword [ebx + 4]
mov esi, 0xffff
movzx edx, word [ecx + 0x15]
cmp dx, si
mov ecx, edx
cmovne eax, ecx
mov ecx, 0xf4240
mul ecx
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], edx
cmp byte [ebx + 1], 0x1b
jb 0x41bcdf
mov edx, 0x17
mov ecx, ebx
call fcn.00422dc0
push dword [edi + 0x20]
mov esi, eax
call fcn.004e3288
add esp, 4
test esi, esi
jne 0x41bbf0
mov dword [edi + 0x24], esi
mov dword [edi + 0x20], esi
jmp 0x41bc1f
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bbf5
sub ecx, edx
mov dword [edi + 0x24], ecx
lea eax, [ecx + 1]
push eax
call fcn.004e328d
mov ecx, dword [edi + 0x24]
add esp, 4
inc ecx
mov dword [edi + 0x20], eax
push ecx
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov edx, 0x1a
mov ecx, ebx
call fcn.00422dc0
push dword [edi + 0x10]
mov esi, eax
call fcn.004e3288
add esp, 4
test esi, esi
jne 0x41bc44
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], esi
jmp 0x41bc7a
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41bc50
sub ecx, edx
mov dword [edi + 0x14], ecx
lea eax, [ecx + 1]
push eax
call fcn.004e328d
mov ecx, dword [edi + 0x14]
add esp, 4
inc ecx
mov dword [edi + 0x10], eax
push ecx
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp byte [ebx + 1], 0x1c
jb 0x41bcdf
mov eax, dword [ebx + 4]
movzx eax, byte [eax + 0x1b]
and al, 0xf
mov byte [edi + 0x41], al
mov al, byte [ebx + 1]
cmp al, 0x22
jb 0x41bcdf
cmp al, 0x5c
jb 0x41bc9f
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x58]
jmp 0x41bca1
xor eax, eax
mov ecx, dword [ebx + 4]
mov esi, 0xffff
movzx edx, word [ecx + 0x20]
cmp dx, si
mov ecx, edx
cmovne eax, ecx
mov ecx, 0xf4240
mul ecx
mov ecx, eax
or ecx, edx
jne 0x41bcc8
mov eax, dword [edi + 0x38]
mov edx, dword [edi + 0x3c]
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], edx
cmp byte [ebx + 1], 0x28
jb 0x41bcdf
mov eax, dword [ebx + 4]
mov ax, word [eax + 0x26]
mov word [edi + 0x2a], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4