Function at 0x403d00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebx
push esi
push edi
shr bx, 0x24
mov eax, 0x17e
or edx, 0x3d7
sub esi, eax
shr dx, 0xb8
dec ax
or di, 0xde
or ax, 0x184
imul di
sub eax, 0x25f
rcr di, 0x85
imul ebx
sub ax, 0x1d2
rcl si, 0x56
dec dx
add edi, 0x1a9
rcr ebx, 0xe5
shl edi, 0xf0
imul di
imul ecx
mov ebx, 0x3e7
and dx, 0x70
mov si, 0x224
inc si
imul esi
rcl di, 0x51
add ecx, 0x94
shr ax, 0xbc
xor ax, dx
dec edi
imul dx
mov edi, 0x34a
rcr ecx, 0xc8
rcl ecx, 0xbd
rcl cx, 0x62
movsx esi, cl
rcr edi, 0x2a
mul esi
or bx, 0x3d4
add bx, 0x264
je 0x403da3
mul ecx
rol ax, 5
rcl si, 0x8e
dec si
jmp 0x403e1a
rcr edx, 0x4b
imul esi
ror si, 0xcd
sub ecx, 0x310
sub ebx, 0x254
rol si, 0xad
mul ax
xor cx, 0x192
shl ebx, 0x4d
inc dx
rol bx, 0x84
sub di, di
ror ebx, 0x78
and eax, 0x2ed
rol si, 0xa5
movsx edx, dl
sub ecx, 0x246
or dx, 0x2ff
dec ax
imul edx
sub edx, esi
add esi, edi
inc dx
shr eax, 0x7a
sub cx, dx
sub eax, 0xec
rol edi, 0x6c
and dx, 0x380
rcr edi, 0x55
dec bx
dec di
mul eax
mul ebx
mul edx
movsx esi, di
inc edx
imul edi
mul cx
ror di, 0x7e
or eax, esi
dec si
rcr eax, 0xe5
mul edx
ror edx, 0x25
movzx esi, cl
rcl dx, 0x66
shl cx, 0xcc
shr edi, 0x4b
mov cx, 0x2a2
shr ebx, 0x18
shr bx, 0xea
or bx, dx
xor cx, ax
or dx, si
xor edi, 0x1b9
and si, 0x3e2
imul si
xor ecx, esi
or ax, bx
or cx, bx
or edx, ecx
shl si, 0xaf
shl di, 0x2c
imul ecx
movsx eax, cl
rcl edi, 0xbb
mul edi
or ebx, 0xda
or edi, 0x2a9
xor esi, edx
mul dx
imul bx
imul ax
add eax, 0x28e
rcl si, 0xfe
rol esi, 0x97
xor esi, 0x11a
mul edi
mul bx
or ax, 0x17e
je 0x403ed9
cmp edi, 0x3a
je 0x403ff8
movzx edx, cl
rcl ecx, 0x1c
mov si, 0xf
xor di, ax
movzx edx, cl
inc bx
mul bx
rcl edi, 0xc
and ebx, 0x2be
rcl edx, 0xa0
jmp 0x403f55
and ebx, 0xbc
ror dx, 0x47
shl dx, 0x1e
inc eax
or di, cx
rcr ecx, 0x83
and ecx, 0xda
dec esi
xor ecx, 0x26d
xor edx, 0x2aa
imul ecx
or ecx, 0x22e
imul eax
mov eax, 0x56
mov bx, 0x11a
dec esi
inc cx
imul bx
mul ecx
shl eax, 0xc7
rcr ecx, 0x2f
rol cx, 0x4c
mov edx, 0x219
imul ax
inc edx
movsx ebx, di
imul eax
rcl dx, 0x23
imul dx
rol ax, 0xd0
mul edi
sub dx, 0x30a
imul cx
imul cx
inc esi
imul si
inc cx
or ax, si
mul ax
movzx esi, cx
shl eax, 0xc4
mul cx
and ax, 0x44
ror di, 0xd1
ror ax, 0x6f
xor ecx, 0x2f0
ror esi, 0xba
imul cx
ror bx, 0xac
imul di
or si, si
dec cx
and ax, 0x1c3
inc dx
xor eax, ebx
sub bx, 0x1f
ror ax, 0xa3
mov eax, 0x2b9
shr bx, 0x1b
shr bx, 6
or dx, 0x18c
rcr ecx, 0xdf
rol bx, 0x1d
rcl dx, 0x44
mul eax
and esi, 0x2bb
dec esi
rol cx, 0x2a
add di, si
rcl eax, 7
sub ecx, 0x2ed
or edi, ebx
rcl si, 0xaa
sub esi, 0x38c
shr esi, 0x37
rcr ecx, 0xa0
imul esi
mul esi
rcl ebx, 0xf7
or dx, dx
inc ax
je 0x403ff8
xor eax, ebx
rol eax, 0xfd
xor bx, 0x22c
dec esi
jmp 0x40402d
xor edi, 0x179
rcl si, 0xa2
rcr ebx, 0x76
mul eax
shr ecx, 0x93
dec dx
imul ax
mul cx
rcl esi, 0x92
movzx ecx, al
rol edi, 0xf2
sub si, 0x256
imul bx
add dx, 0x42
dec ax
inc ecx
sub di, di
shr edx, 0xc2
shl bx, 0xe8
inc ebx
shr eax, 0xd5
dec ax
imul edx
rcr ax, 0x4b
rcl di, 0x65
add esi, 0x57
ror dx, 0x56
shl ax, 0xab
inc esi
dec edx
xor ecx, esi
dec ecx
rcl dx, 0x7e
rol cx, 0xd8
xor cx, 0x2c7
ror ebx, 0xe9
mov ecx, ecx
imul eax
or eax, 0x13
rcr bx, 0x30
rcl edx, 0x43
movsx edx, bl
shl bx, 0xf4
xor cx, 0x209
movsx ebx, di
sub edx, 0x41
dec bx
imul eax
rol ebx, 0x46
mov cx, 0x30
mov ecx, eax
rcl ax, 0x68
mul eax
shl cx, 0x36
add cx, 0x4d
xor ebx, 0x23f
rol eax, 0x5e
dec ecx
rcl si, 0x60
sub edx, ebx
rol eax, 0x2e
sub dx, ax
mul eax
je 0x4040d0
test edx, 0x1e
je 0x404159
sub dx, dx
inc edx
inc bx
rol ecx, 0xc9
jmp 0x404103
rcl si, 0xc
and si, 0x55
imul dx
inc cx
ror si, 0x1e
add esi, 0x390
rcl ecx, 0x8f
dec eax
xor ax, di
dec esi
and esi, eax
and esi, esi
rcl bx, 0xb6
and di, si
shl di, 0x4a
rol si, 0x1a
inc ecx
rcr si, 0x44
mul cx
ror si, 0x52
xor esi, esi
add esi, 0xa4
rcl edi, 0xf
and ecx, ebx
movsx ecx, dx
ror dx, 0xb0
rcr edi, 0x9b
ror edx, 0x73
inc esi
rol esi, 0xab
shl bx, 0xed
sub ax, 0x1d8
add esi, esi
rol ebx, 0xac
inc esi
rcr eax, 0x62
shr bx, 0xf2
ror dx, 6
or edx, edx
xor eax, esi
xor edx, 0x316
rcl eax, 0x6a
je 0x404159
shr edi, 0x30
jmp 0x4041c5
mov bx, 0x1ce
sub cx, ax
mov bx, 0x3a9
rcr dx, 0x7e
rol si, 0x3a
shl si, 0x65
inc edx
shl si, 0xf9
imul dx
inc di
imul eax
shr ax, 0xb5
dec si
imul bx
dec ax
mul edi
shl esi, 0x8e
dec ecx
mul bx
rcl cx, 0xd0
rol ebx, 0xb5
movzx edi, dl
inc edi
sub ecx, ecx
imul esi
ror si, 0x31
ror cx, 0xa3
shr ax, 0xae
dec ebx
shl si, 0xf1
mul ecx
shl edi, 0xba
mul eax
or esi, 0x150
rcr esi, 0x59
dec edi
rol bx, 0xf1
mov ax, 0x3aa
mul ecx
inc cx
add ecx, ebx
inc esi
inc esi
inc bx
shr ax, 0x5a
ror edx, 0x5a
shl ebx, 7
rcl ebx, 0x44
or edx, 0x37f
mul ecx
imul ax
movsx ebx, di
imul bx
movsx esi, si
or ax, 0x3ba
rcl di, 5
shr ax, 0xe8
mov dx, 0x86
add dx, si
movsx ebx, cl
imul cx
xor cx, 0x95
mul edi
movsx esi, bx
mul bx
rcl edx, 0x2e
xor cx, di
inc bx
shr di, 0x69
dec eax
rcl edi, 0x86
rcr ecx, 0x83
and dx, bx
inc si
sub ebx, edi
xor ebx, 0x8b
je 0x40424b
dec ecx
dec si
shl si, 0xa
sub bx, si
or ax, di
jmp 0x404287
sub ebx, esi
rol si, 0xae
or dx, ax
shl bx, 0xdc
shr edi, 0xbd
rcr ecx, 8
rcr si, 0xc9
rcl si, 0x84
add dx, di
rcr di, 0xdc
mul si
dec ecx
ror eax, 0x10
ror si, 0x69
dec edx
mul dx
shr dx, 0xca
movsx edi, bl
dec cx
inc ax
add edx, 0x2f8
or cx, dx
sub eax, 0x1f1
sub ecx, 0x156
inc ecx
dec eax
rcr cx, 0xc0
xor bx, 0x31e
mul esi
dec esi
add ebx, 0x343
rcr eax, 0xc
rcl edx, 0x3a
imul bx
shr bx, 0x75
inc ecx
ror eax, 0xef
rcl ax, 0xb2
or cx, 0x17f
rcl esi, 0x85
rol ecx, 0x12
inc si
movsx eax, si
rcl si, 0x8a
rcl esi, 0x56
mul ebx
rcr ax, 0x9e
mov ebx, edi
or bx, 0xd8
rol bx, 0x66
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x441864], eax
pop edi
pop esi
pop ebx
ret