Function at 0x34002853
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x3413a7eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.3400b090
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.3400b070
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.3400b090
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.3400b070
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.3400b090
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.3400b090
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.3400b090
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.3400b090
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x10]
add ecx, 0x78
call fcn.340b4c70
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
call fcn.340b4c70
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x10]
add ecx, 0x178
call fcn.340b4c70
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x10]
add ecx, 0x198
call fcn.340acc50
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x10]
add ecx, 0x1a8
call fcn.340acc50
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x1b8
call fcn.340acc50
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c8
call fcn.340acc50
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x10]
add ecx, 0x1d8
call fcn.340acc50
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x10]
add ecx, 0x1e8
call fcn.340acc50
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x10]
add ecx, 0x1f8
call fcn.340b4c70
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x10]
add ecx, 0x218
call fcn.340acc50
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x10]
add ecx, 0x228
call fcn.340acc50
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x10]
add ecx, 0x238
call fcn.340acc50
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x10]
add ecx, 0x248
call fcn.340acc50
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x10]
add ecx, 0x258
call fcn.340acc50
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x10]
add ecx, 0x268
call fcn.340acc50
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x10]
add ecx, 0x278
call fcn.340b4c70
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x10]
add ecx, 0x298
call fcn.340acc50
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x10]
add ecx, 0x2a8
call fcn.340acc50
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x10]
add ecx, 0x2b8
call fcn.340acc50
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c8
call fcn.340acc50
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x10]
add ecx, 0x2d8
call fcn.340acc50
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x10]
add ecx, 0x2e8
call fcn.340acc50
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x10]
add ecx, 0x2f8
call fcn.340b4c70
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x10]
add ecx, 0x318
call fcn.340acc50
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x10]
add ecx, 0x328
call fcn.340acc50
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x10]
add ecx, 0x338
call fcn.340acc50
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x10]
add ecx, 0x348
call fcn.340acc50
mov byte [ebp - 4], 0x23
mov ecx, dword [ebp - 0x10]
add ecx, 0x358
call fcn.340acc50
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x10]
add ecx, 0x368
call fcn.340acc50
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x10]
add ecx, 0x378
call fcn.340b4c70
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x10]
add ecx, 0x398
call fcn.340acc50
mov byte [ebp - 4], 0x27
mov ecx, dword [ebp - 0x10]
add ecx, 0x3a8
call fcn.340acc50
mov byte [ebp - 4], 0x28
mov ecx, dword [ebp - 0x10]
add ecx, 0x3b8
call fcn.340acc50
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c8
call fcn.340acc50
mov byte [ebp - 4], 0x2a
mov ecx, dword [ebp - 0x10]
add ecx, 0x3d8
call fcn.340acc50
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0x10]
add ecx, 0x3e8
call fcn.340acc50
mov byte [ebp - 4], 0x2c
mov ecx, dword [ebp - 0x10]
add ecx, 0x3f8
call fcn.340b4c70
mov byte [ebp - 4], 0x2d
mov ecx, dword [ebp - 0x10]
add ecx, 0x418
call fcn.340acc50
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x10]
add ecx, 0x428
call fcn.340acc50
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x10]
add ecx, 0x438
call fcn.340acc50
mov byte [ebp - 4], 0x30
mov ecx, dword [ebp - 0x10]
add ecx, 0x448
call fcn.340acc50
mov byte [ebp - 4], 0x31
mov ecx, dword [ebp - 0x10]
add ecx, 0x458
call fcn.340acc50
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x10]
add ecx, 0x468
call fcn.340acc50
mov byte [ebp - 4], 0x33
mov ecx, dword [ebp - 0x10]
add ecx, 0x478
call fcn.340b4c70
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp - 0x10]
add ecx, 0x498
call fcn.340acc50
mov byte [ebp - 4], 0x35
mov ecx, dword [ebp - 0x10]
add ecx, 0x4a8
call fcn.340acc50
mov byte [ebp - 4], 0x36
mov ecx, dword [ebp - 0x10]
add ecx, 0x4b8
call fcn.340acc50
mov byte [ebp - 4], 0x37
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c8
call fcn.340acc50
mov byte [ebp - 4], 0x38
mov ecx, dword [ebp - 0x10]
add ecx, 0x4d8
call fcn.340acc50
mov byte [ebp - 4], 0x39
mov ecx, dword [ebp - 0x10]
add ecx, 0x4e8
call fcn.340acc50
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x10]
add ecx, 0x4f8
call fcn.340b4c70
mov byte [ebp - 4], 0x3b
mov ecx, dword [ebp - 0x10]
add ecx, 0x518
call fcn.340acc50
mov byte [ebp - 4], 0x3c
mov ecx, dword [ebp - 0x10]
add ecx, 0x528
call fcn.340acc50
mov byte [ebp - 4], 0x3d
mov ecx, dword [ebp - 0x10]
add ecx, 0x538
call fcn.340acc50
mov byte [ebp - 4], 0x3e
mov ecx, dword [ebp - 0x10]
add ecx, 0x548
call fcn.340acc50
mov byte [ebp - 4], 0x3f
mov ecx, dword [ebp - 0x10]
add ecx, 0x558
call fcn.340acc50
mov byte [ebp - 4], 0x40
mov ecx, dword [ebp - 0x10]
add ecx, 0x568
call fcn.340acc50
mov byte [ebp - 4], 0x41
mov ecx, dword [ebp - 0x10]
add ecx, 0x578
call fcn.340b4c70
mov byte [ebp - 4], 0x42
mov ecx, dword [ebp - 0x10]
add ecx, 0x598
call fcn.340acc50
mov byte [ebp - 4], 0x43
mov ecx, dword [ebp - 0x10]
add ecx, 0x5a8
call fcn.340acc50
mov byte [ebp - 4], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x5b8
call fcn.340acc50
mov byte [ebp - 4], 0x45
mov ecx, dword [ebp - 0x10]
add ecx, 0x5c8
call fcn.340acc50
mov byte [ebp - 4], 0x46
mov ecx, dword [ebp - 0x10]
add ecx, 0x5d8
call fcn.340acc50
mov byte [ebp - 4], 0x47
mov ecx, dword [ebp - 0x10]
add ecx, 0x5e8
call fcn.340acc50
mov byte [ebp - 4], 0x48
mov ecx, dword [ebp - 0x10]
add ecx, 0x5f8
call fcn.340b4c70
mov byte [ebp - 4], 0x49
mov ecx, dword [ebp - 0x10]
add ecx, 0x618
call fcn.340acc50
mov byte [ebp - 4], 0x4a
mov ecx, dword [ebp - 0x10]
add ecx, 0x628
call fcn.340acc50
mov byte [ebp - 4], 0x4b
mov ecx, dword [ebp - 0x10]
add ecx, 0x638
call fcn.340acc50
mov byte [ebp - 4], 0x4c
mov ecx, dword [ebp - 0x10]
add ecx, 0x648
call fcn.340acc50
mov byte [ebp - 4], 0x4d
mov ecx, dword [ebp - 0x10]
add ecx, 0x658
call fcn.340acc50
mov byte [ebp - 4], 0x4e
mov ecx, dword [ebp - 0x10]
add ecx, 0x668
call fcn.340acc50
mov byte [ebp - 4], 0x4f
mov ecx, dword [ebp - 0x10]
add ecx, 0x678
call fcn.340b4c70
mov byte [ebp - 4], 0x50
mov ecx, dword [ebp - 0x10]
add ecx, 0x698
call fcn.3400b620
mov byte [ebp - 4], 0x51
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x34146648
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x28], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.340a70a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c
call fcn.340a1d30
mov ecx, dword [ebp - 0x10]
add ecx, 0x40
call fcn.340a70a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.340a1d30
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.340a70a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.340a70a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.340a70a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.340a70a0
mov edx, dword [ebp - 0x10]
add edx, 0x58
push edx
call fcn.3405bacb
add esp, 4
mov eax, dword [ebp - 0x10]
add eax, 0x68
push eax
call fcn.3405bacb
add esp, 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x98
push ecx
call fcn.3405bb06
add esp, 4
mov edx, dword [ebp - 0x10]
add edx, 0x118
push edx
call fcn.3405bb06
add esp, 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x198
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x1a8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x1b8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x1d8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x1e8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x218
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x228
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x238
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x248
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x258
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x268
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x298
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2a8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2b8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2d8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2e8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x318
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x328
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x338
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x348
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x358
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x368
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x398
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x3a8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x3b8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x3c8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x3d8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x3e8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x418
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x428
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x438
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x448
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x458
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x468
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x498
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x4a8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x4b8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x4d8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x4e8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x518
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x528
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x538
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x548
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x558
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x568
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x598
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x5a8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x5b8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x5c8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x5d8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x5e8
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x618
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x628
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x638
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x648
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x658
call fcn.3400b0b0
mov ecx, dword [ebp - 0x10]
add ecx, 0x668
call fcn.3400b0b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret