Function at 0x42a190
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4b468c
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4dde40]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov edi, dword [esp + 0x54]
lea eax, [edi + 0xc]
push eax
mov dword [edi], 0x4c79f0
call fcn.0040bc70
lea eax, [edi + 0x8c]
xor ebx, ebx
push eax
mov dword [esp + 0x50], ebx
call fcn.004298b0
mov byte [edi + 0x244], bl
mov dword [edi + 0x248], ebx
mov ebp, 0xf
mov dword [edi + 0x264], ebp
mov dword [edi + 0x260], ebx
mov byte [edi + 0x250], bl
mov dword [edi + 0x268], ebx
mov dword [edi + 0x26c], ebx
mov byte [edi + 0x270], bl
mov byte [edi + 0x271], bl
mov byte [edi + 0x272], bl
mov byte [edi + 0x273], bl
mov dword [edi + 0x28c], ebp
mov dword [edi + 0x288], ebx
mov byte [edi + 0x278], bl
mov dword [edi + 0x2a8], ebp
mov dword [edi + 0x2a4], ebx
mov byte [edi + 0x294], bl
mov dword [edi + 0x2c4], ebp
mov dword [edi + 0x2c0], ebx
mov byte [edi + 0x2b0], bl
mov dword [edi + 0x2e0], ebp
mov dword [edi + 0x2dc], ebx
mov byte [edi + 0x2cc], bl
push 0x42a140
push 0x428c00
push 9
lea eax, [edi + 0x2e4]
push 0x28
push eax
mov byte [esp + 0x60], 6
call fcn.0047dd87
lea eax, [edi + 0x44c]
push eax
mov byte [esp + 0x50], 7
call fcn.00433770
mov esi, dword [0x4b640c]
push ebx
push ebx
push ebx
push ebx
mov byte [edi + 0x46c], bl
mov dword [edi + 0x478], ebx
mov dword [edi + 0x47c], ebx
mov dword [edi + 0x480], ebx
mov byte [edi + 0x484], bl
mov dword [edi + 0x488], ebx
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 0x48c], eax
call esi
mov dword [edi + 0x494], eax
mov dword [edi + 0x4b4], ebp
mov dword [edi + 0x4b0], ebx
mov byte [edi + 0x4a0], bl
lea eax, [edi + 0x4b8]
push eax
mov byte [esp + 0x50], 9
call fcn.0040f3d0
push ebx
push ebx
push ebx
mov byte [esp + 0x58], 0xa
push ebx
mov dword [edi + 0x4d8], ebx
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 0x4dc], eax
call esi
mov dword [edi + 0x4e4], eax
lea eax, [edi + 0x4f0]
push eax
mov byte [edi + 0x4ec], bl
call fcn.00433ab0
push ebx
push ebx
push ebx
push ebx
mov byte [esp + 0x5c], 0xb
call esi
mov dword [edi + 0x510], eax
lea eax, [edi + 0x518]
push eax
call fcn.00433350
push ebx
push ebx
push ebx
push ebx
mov byte [esp + 0x5c], 0xc
call esi
push ebx
push ebx
push ebx
mov dword [edi + 0x538], eax
push ebx
mov dword [edi + 0x540], ebx
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 0x544], eax
call esi
mov dword [edi + 0x54c], eax
lea eax, [edi + 0x554]
push eax
call dword [0x4b6434]
lea eax, [edi + 0x56c]
push eax
call dword [0x4b6434]
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 0x584], ebx
mov dword [edi + 0x6f0], ebx
call esi
push ebx
push ebx
push ebx
push ebx
mov dword [edi + 0x6f4], eax
call esi
mov dword [edi + 0x6fc], eax
push 0x40
mov byte [edi + 0x704], bl
mov dword [edi + 0x708], ebx
mov byte [edi + 0x70c], bl
call fcn.00438168
sub esp, 0x18
mov ecx, esp
mov dword [edi + 0x470], eax
mov dword [esp + 0x30], esp
mov dword [ecx + 0x18], ebp
push ebx
mov dword [ecx + 0x14], ebx
push 0x4c620c
mov byte [ecx + 4], bl
call fcn.00408940
push ebx
push ebx
xor edx, edx
lea esi, [esp + 0x3c]
call fcn.00429820
mov byte [esp + 0x4c], 0xd
mov ecx, dword [eax]
mov dword [edi + 0x2e4], ecx
mov edx, dword [eax + 4]
push 0xffffffffffffffff
mov dword [edi + 0x2e8], edx
mov ecx, dword [eax + 8]
push ebx
add eax, 0xc
mov dword [edi + 0x2ec], ecx
push eax
lea ecx, [edi + 0x2f0]
call fcn.004075d0
mov byte [esp + 0x4c], 0xc
cmp dword [esp + 0x3c], 0x10
jb 0x42a452
mov edx, dword [esp + 0x28]
push edx
call fcn.0043815d
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c6124
mov byte [ecx + 4], bl
call fcn.00408940
push 1
push ebx
mov edx, 1
lea esi, [esp + 0x3c]
call fcn.00429820
mov byte [esp + 0x4c], 0xe
mov ecx, dword [eax]
mov dword [edi + 0x30c], ecx
mov edx, dword [eax + 4]
push 0xffffffffffffffff
mov dword [edi + 0x310], edx
mov ecx, dword [eax + 8]
push ebx
add eax, 0xc
mov dword [edi + 0x314], ecx
push eax
lea ecx, [edi + 0x318]
call fcn.004075d0
mov byte [esp + 0x4c], 0xc
cmp dword [esp + 0x3c], 0x10
jb 0x42a4cb
mov edx, dword [esp + 0x28]
push edx
call fcn.0043815d
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 2
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c74e8
mov byte [ecx + 4], bl
call fcn.00408940
push 2
push 0xffffffffffffffff
mov edx, 1
lea esi, [esp + 0x3c]
call fcn.00429820
mov byte [esp + 0x4c], 0xf
mov ecx, dword [eax]
mov dword [edi + 0x334], ecx
mov edx, dword [eax + 4]
push 0xffffffffffffffff
mov dword [edi + 0x338], edx
mov ecx, dword [eax + 8]
push ebx
add eax, 0xc
mov dword [edi + 0x33c], ecx
push eax
lea ecx, [edi + 0x340]
call fcn.004075d0
mov byte [esp + 0x4c], 0xc
cmp dword [esp + 0x3c], 0x10
jb 0x42a545
mov edx, dword [esp + 0x28]
push edx
call fcn.0043815d
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c74ec
mov byte [ecx + 4], bl
call fcn.00408940
push 3
push 0xffffffffffffffff
xor edx, edx
lea esi, [esp + 0x3c]
call fcn.00429820
mov byte [esp + 0x4c], 0x10
mov ecx, dword [eax]
mov dword [edi + 0x35c], ecx
mov edx, dword [eax + 4]
push 0xffffffffffffffff
mov dword [edi + 0x360], edx
mov ecx, dword [eax + 8]
push ebx
add eax, 0xc
mov dword [edi + 0x364], ecx
push eax
lea ecx, [edi + 0x368]
call fcn.004075d0
mov byte [esp + 0x4c], 0xc
cmp dword [esp + 0x3c], 0x10
jb 0x42a5bc
mov edx, dword [esp + 0x28]
push edx
call fcn.0043815d
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 2
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str.false
mov byte [ecx + 4], bl
call fcn.00408940
push 4
push 0xffffffffffffffff
or edx, 0xffffffff
lea esi, [esp + 0x3c]
call fcn.00429820
mov byte [esp + 0x4c], 0x11
mov ecx, dword [eax]
mov dword [edi + 0x384], ecx
mov edx, dword [eax + 4]
push 0xffffffffffffffff
mov dword [edi + 0x388], edx
mov ecx, dword [eax + 8]
push ebx
add eax, 0xc
mov dword [edi + 0x38c], ecx
push eax
lea ecx, [edi + 0x390]
call fcn.004075d0
mov byte [esp + 0x4c], 0xc
cmp dword [esp + 0x3c], 0x10
jb 0x42a634
mov edx, dword [esp + 0x28]
push edx
call fcn.0043815d
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c74f4
mov byte [ecx + 4], bl
call fcn.00408940
push 5
push ebx
or edx, 0xffffffff
lea esi, [esp + 0x3c]
call fcn.00429820
mov byte [esp + 0x4c], 0x12
mov ecx, dword [eax]
mov dword [edi + 0x3ac], ecx
mov edx, dword [eax + 4]
push 0xffffffffffffffff
mov dword [edi + 0x3b0], edx
mov ecx, dword [eax + 8]
push ebx
add eax, 0xc
mov dword [edi + 0x3b4], ecx
push eax
lea ecx, [edi + 0x3b8]
call fcn.004075d0
mov byte [esp + 0x4c], 0xc
cmp dword [esp + 0x3c], 0x10
jb 0x42a6ab
mov edx, dword [esp + 0x28]
push edx
call fcn.0043815d
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 2
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str.true
mov byte [ecx + 4], bl
call fcn.00408940
push 6
push 1
or edx, 0xffffffff
lea esi, [esp + 0x3c]
call fcn.00429820
mov byte [esp + 0x4c], 0x13
mov ecx, dword [eax]
mov dword [edi + 0x3d4], ecx
mov edx, dword [eax + 4]
push 0xffffffffffffffff
mov dword [edi + 0x3d8], edx
mov ecx, dword [eax + 8]
push ebx
add eax, 0xc
mov dword [edi + 0x3dc], ecx
push eax
lea ecx, [edi + 0x3e0]
call fcn.004075d0
mov byte [esp + 0x4c], 0xc
cmp dword [esp + 0x3c], 0x10
jb 0x42a723
mov edx, dword [esp + 0x28]
push edx
call fcn.0043815d
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c74fc
mov byte [ecx + 4], bl
call fcn.00408940
push 7
push 1
xor edx, edx
lea esi, [esp + 0x3c]
call fcn.00429820
mov byte [esp + 0x4c], 0x14
mov ecx, dword [eax]
mov dword [edi + 0x3fc], ecx
mov edx, dword [eax + 4]
push 0xffffffffffffffff
mov dword [edi + 0x400], edx
mov ecx, dword [eax + 8]
push ebx
add eax, 0xc
mov dword [edi + 0x404], ecx
push eax
lea ecx, [edi + 0x408]
call fcn.004075d0
mov byte [esp + 0x4c], 0xc
cmp dword [esp + 0x3c], 0x10
jb 0x42a79a
mov edx, dword [esp + 0x28]
push edx
call fcn.0043815d
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 2
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str._XEe
mov byte [ecx + 4], bl
call fcn.00408940
push 8
push 1
mov edx, 1
lea esi, [esp + 0x3c]
call fcn.00429820
mov byte [esp + 0x4c], 0x15
mov ecx, dword [eax]
mov dword [edi + 0x424], ecx
mov edx, dword [eax + 4]
push 0xffffffffffffffff
mov dword [edi + 0x428], edx
mov ecx, dword [eax + 8]
push ebx
add eax, 0xc
mov dword [edi + 0x42c], ecx
push eax
lea ecx, [edi + 0x430]
call fcn.004075d0
mov byte [esp + 0x4c], 0xc
cmp dword [esp + 0x3c], 0x10
jb 0x42a814
mov edx, dword [esp + 0x28]
push edx
call fcn.0043815d
add esp, 4
push 0x42a560
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 3
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7504
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42a650
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 2
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7508
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42b2f0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c750c
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42b600
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c5f34
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42bcc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7510
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42bcc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7514
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42bf90
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 4
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
mov byte [ecx + 4], bl
push 0x4c7518
call fcn.00408940
push edi
call fcn.0042be80
push 0x42c1d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7520
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42c1d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7524
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42cb50
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 2
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7528
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42ed50
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str.456789abcdefABCDEF
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42ed50
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7530
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42ed50
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7534
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42ed50
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 1
push 0x4c74ec
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42ed50
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7538
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42d3a0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 2
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c753c
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42f250
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 2
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7540
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42f590
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 2
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7544
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42fda0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 1
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4c7548
mov byte [ecx + 4], bl
call fcn.00408940
push edi
call fcn.0042be80
push 0x42fda0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4c754c
call fcn.00405af0
push edi
call fcn.0042be80
push 0x42fda0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4c7550
call fcn.00405af0
push edi
call fcn.0042be80
push 0x42fd90
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4c7554
call fcn.00405af0
push edi
call fcn.0042be80
push 0x4308f0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4c7568
call fcn.00405af0
push edi
call fcn.0042be80
push 0x431130
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4c756c
call fcn.00405af0
push edi
call fcn.0042be80
push 0x431470
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x4c7570
call fcn.00405af0
push edi
call fcn.0042be80
lea eax, [edi + 0xc]
push eax
call fcn.0040be60
mov eax, edi
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 4