Function at 0x401250
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x409a98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x34]
push edi
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
mov byte [esi + 0x1c], 1
mov dword [esp + 0x1c], ebp
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x28], ebp
mov eax, dword [ebx]
mov dword [esp + 0x10], eax
lea edx, [eax*4]
push edx
call fcn.00402129
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
add esp, 4
xor edi, edi
cmp eax, ebp
jle 0x4012fe
push 8
call fcn.00402129
mov ecx, dword [esp + 0x20]
add esp, 4
mov dword [ecx + edi*4], eax
mov edx, dword [ebx + 0xc]
mov ecx, dword [esp + 0x1c]
mov eax, dword [edx + edi*4]
mov edx, dword [ecx + edi*4]
inc edi
mov eax, dword [eax]
mov dword [edx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [esp + 0x1c]
mov edx, dword [ecx + edi*4 - 4]
mov ecx, dword [eax + edi*4 - 4]
mov edx, dword [edx + 4]
mov dword [ecx + 4], edx
mov eax, dword [esp + 0x10]
cmp edi, eax
jl 0x4012be
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.004014a0
test al, al
jne 0x401355
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], 0xffffffff
cmp eax, ebp
je 0x40134e
mov eax, dword [esp + 0x10]
xor esi, esi
cmp eax, ebp
jle 0x401341
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + esi*4]
push edx
call fcn.00401f80
mov eax, dword [esp + 0x14]
add esp, 4
inc esi
cmp esi, eax
jl 0x401328
mov eax, dword [esp + 0x1c]
push eax
call fcn.00401f80
add esp, 4
xor eax, eax
jmp 0x401482
push 0x10
call fcn.00402129
add esp, 4
cmp eax, ebp
je 0x40136a
mov dword [eax + 0xc], ebp
mov ebx, eax
jmp 0x40136c
xor ebx, ebx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x34]
lea eax, [ecx + edx + 5]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x38]
mov dword [esi + 4], eax
lea ecx, [ecx + edx + 5]
mov dword [esi + 8], ecx
mov ecx, eax
and ecx, 0x80000007
jns 0x401399
dec ecx
or ecx, 0xfffffff8
inc ecx
je 0x4013a3
sub eax, ecx
add eax, 8
mov dword [esi + 4], eax
mov edx, dword [esi + 4]
mov dword [ebx + 4], edx
mov eax, dword [esi + 8]
mov dword [ebx + 8], eax
mov ebp, dword [esi + 4]
sar ebp, 3
imul ebp, dword [esi + 8]
push ebp
mov dword [ebx], ebp
call fcn.00402129
mov ecx, ebp
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0xc], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [esp + 0x10]
xor ecx, ecx
test edx, edx
mov dword [esp + 0x34], ecx
jle 0x401444
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + ecx*4]
mov ebp, dword [eax + 4]
mov edi, dword [eax]
mov eax, ebp
or eax, edi
je 0x401401
add edi, 3
add ebp, 3
mov eax, ebp
or eax, edi
jne 0x40140d
mov byte [esi + 0x1c], 1
jmp 0x40143b
mov al, byte [esi + 0x1c]
push ebp
test al, al
push edi
push ebx
mov ecx, esi
je 0x40142a
call fcn.004015e0
push ebp
push edi
push ebx
mov ecx, esi
call fcn.00401780
jmp 0x40142f
call fcn.00401610
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
mov byte [esi + 0x1c], 0
inc ecx
cmp ecx, edx
mov dword [esp + 0x34], ecx
jl 0x4013e9
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], 0xffffffff
test eax, eax
je 0x401480
xor esi, esi
test edx, edx
jle 0x401473
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + esi*4]
push edx
call fcn.00401f80
mov eax, dword [esp + 0x14]
add esp, 4
inc esi
cmp esi, eax
jl 0x40145a
mov eax, dword [esp + 0x1c]
push eax
call fcn.00401f80
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc