Function at 0x4390ec
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1a
push 0
push 0
dec ecx
jne 0x4390f5
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
test dl, dl
je 0x43910e
add esp, 0xfffffff0
call fcn.00403da8
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
lea eax, [ebp - 8]
call fcn.00405190
xor eax, eax
push ebp
push 0xa14cfa
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00403b30
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
call fcn.00404d0c
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 4]
call fcn.0041a030
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x18]
call fcn.00404d0c
mov eax, dword [ebx + 0x18]
xor edx, edx
call fcn.0040502c
je 0x43918e
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x18]
call fcn.00419f28
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0042fae4
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00419f28
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x18]
call fcn.00404d0c
mov edi, 0xfffe
mov eax, edi
call fcn.00403268
mov esi, eax
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov edx, edi
mov eax, esi
call fcn.00415944
lea eax, [ebp - 0x24]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042fae4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00419f28
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x10]
call fcn.00404d0c
lea edx, [ebp - 0x2c]
mov eax, dword [ebx + 0x10]
call fcn.0041a068
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00419f28
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 0x14]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov edx, esi
mov eax, edi
call fcn.00415750
lea eax, [ebp - 0x38]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0042fae4
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00419f28
mov edx, dword [ebp - 0x30]
lea eax, [ebx + 0x1c]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov edx, edi
mov eax, esi
call fcn.004158ac
lea eax, [ebp - 0x44]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.0042fae4
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00419f28
mov edx, dword [ebp - 0x3c]
lea eax, [ebx + 0xc]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0xa194c8]
cmp byte [eax], 0
je 0x439297
push esi
push 0
push 0
push 5
push 0
call fcn.0041a78c
jmp 0x4392a5
push esi
push 0
push 0
push 5
push 0
call fcn.0041a784
test eax, eax
jne 0x4392d6
lea eax, [ebp - 0x50]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.0042fae4
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00419f28
mov edx, dword [ebp - 0x48]
lea eax, [ebx + 8]
call fcn.00404d0c
jmp 0x4392e1
lea eax, [ebx + 8]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0xa194c8]
cmp byte [eax], 0
je 0x439304
push esi
push 0
push 0
push 0x2e
push 0
call fcn.0041a78c
jmp 0x439312
push esi
push 0
push 0
push 0x2e
push 0
call fcn.0041a784
test eax, eax
jne 0x439343
lea eax, [ebp - 0x5c]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.0042fae4
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.00419f28
mov edx, dword [ebp - 0x54]
lea eax, [ebx + 0x20]
call fcn.00404d0c
jmp 0x43934e
lea eax, [ebx + 0x20]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0xa194c8]
cmp byte [eax], 0
je 0x439371
push esi
push 0
push 0
push 0x26
push 0
call fcn.0041a78c
jmp 0x43937f
push esi
push 0
push 0
push 0x26
push 0
call fcn.0041a784
test eax, eax
jne 0x4393b0
lea eax, [ebp - 0x68]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.0042fae4
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00419f28
mov edx, dword [ebp - 0x60]
lea eax, [ebx + 0x24]
call fcn.00404d0c
jmp 0x4393bb
lea eax, [ebx + 0x24]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0xa194c8]
cmp byte [eax], 0
je 0x4393de
push esi
push 0
push 0
push 0x23
push 0
call fcn.0041a78c
jmp 0x4393ec
push esi
push 0
push 0
push 0x23
push 0
call fcn.0041a784
test eax, eax
jne 0x43941d
lea eax, [ebp - 0x74]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x70]
call fcn.0042fae4
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x6c]
call fcn.00419f28
mov edx, dword [ebp - 0x6c]
lea eax, [ebx + 0x28]
call fcn.00404d0c
jmp 0x439428
lea eax, [ebx + 0x28]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0xa194c8]
cmp byte [eax], 0
je 0x43944b
push esi
push 0
push 0
push 0x2b
push 0
call fcn.0041a78c
jmp 0x439459
push esi
push 0
push 0
push 0x2b
push 0
call fcn.0041a784
test eax, eax
jne 0x43948a
lea eax, [ebp - 0x80]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x7c]
call fcn.0042fae4
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x78]
call fcn.00419f28
mov edx, dword [ebp - 0x78]
lea eax, [ebx + 0x2c]
call fcn.00404d0c
jmp 0x439495
lea eax, [ebx + 0x2c]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0xa194c8]
cmp byte [eax], 0
je 0x4394b8
push esi
push 0
push 0
push 0x27
push 0
call fcn.0041a78c
jmp 0x4394c6
push esi
push 0
push 0
push 0x27
push 0
call fcn.0041a784
test eax, eax
jne 0x439509
lea eax, [ebp - 0x8c]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
call fcn.0042fae4
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.00419f28
mov edx, dword [ebp - 0x84]
lea eax, [ebx + 0x30]
call fcn.00404d0c
jmp 0x439514
lea eax, [ebx + 0x30]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0xa194c8]
cmp byte [eax], 0
je 0x439537
push esi
push 0
push 0
push 0x22
push 0
call fcn.0041a78c
jmp 0x439545
push esi
push 0
push 0
push 0x22
push 0
call fcn.0041a784
test eax, eax
jne 0x439588
lea eax, [ebp - 0x98]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.0042fae4
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x90]
call fcn.00419f28
mov edx, dword [ebp - 0x90]
lea eax, [ebx + 0x34]
call fcn.00404d0c
jmp 0x439593
lea eax, [ebx + 0x34]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0xa194c8]
cmp byte [eax], 0
je 0x4395b6
push esi
push 0
push 0
push 0x21
push 0
call fcn.0041a78c
jmp 0x4395c4
push esi
push 0
push 0
push 0x21
push 0
call fcn.0041a784
test eax, eax
jne 0x439607
lea eax, [ebp - 0xa4]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.0042fae4
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x9c]
call fcn.00419f28
mov edx, dword [ebp - 0x9c]
lea eax, [ebx + 0x38]
call fcn.00404d0c
jmp 0x439612
lea eax, [ebx + 0x38]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0xa194c8]
cmp byte [eax], 0
je 0x439635
push esi
push 0
push 0
push 0x20
push 0
call fcn.0041a78c
jmp 0x439643
push esi
push 0
push 0
push 0x20
push 0
call fcn.0041a784
test eax, eax
jne 0x439686
lea eax, [ebp - 0xb0]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0xac]
call fcn.0042fae4
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa8]
call fcn.00419f28
mov edx, dword [ebp - 0xa8]
lea eax, [ebx + 0x3c]
call fcn.00404d0c
jmp 0x439691
lea eax, [ebx + 0x3c]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0xa194c8]
cmp byte [eax], 0
je 0x4396b4
push esi
push 0
push 0
push 0x1a
push 0
call fcn.0041a78c
jmp 0x4396c2
push esi
push 0
push 0
push 0x1a
push 0
call fcn.0041a784
test eax, eax
jne 0x439705
lea eax, [ebp - 0xbc]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.0042fae4
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.00419f28
mov edx, dword [ebp - 0xb4]
lea eax, [ebx + 0x40]
call fcn.00404d0c
jmp 0x439710
lea eax, [ebx + 0x40]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0xa194c8]
cmp byte [eax], 0
je 0x439733
push esi
push 0
push 0
push 0x1c
push 0
call fcn.0041a78c
jmp 0x439741
push esi
push 0
push 0
push 0x1c
push 0
call fcn.0041a784
test eax, eax
jne 0x439784
lea eax, [ebp - 0xc8]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.0042fae4
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0xc0]
call fcn.00419f28
mov edx, dword [ebp - 0xc0]
lea eax, [ebx + 0x44]
call fcn.00404d0c
jmp 0x43978f
lea eax, [ebx + 0x44]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0xa194c8]
cmp byte [eax], 0
je 0x4397b2
push esi
push 0
push 0
push 0x28
push 0
call fcn.0041a78c
jmp 0x4397c0
push esi
push 0
push 0
push 0x28
push 0
call fcn.0041a784
test eax, eax
jne 0x439803
lea eax, [ebp - 0xd4]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0xd4]
lea edx, [ebp - 0xd0]
call fcn.0042fae4
mov eax, dword [ebp - 0xd0]
lea edx, [ebp - 0xcc]
call fcn.00419f28
mov edx, dword [ebp - 0xcc]
lea eax, [ebx + 0x48]
call fcn.00404d0c
jmp 0x43980e
lea eax, [ebx + 0x48]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov eax, esi
call fcn.00403288
lea eax, [ebx + 0x4c]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
lea eax, [ebx + 0x50]
mov edx, dword [ebx + 0x10]
call fcn.00404d0c
lea eax, [ebx + 0x54]
mov edx, dword [ebx + 0xc]
call fcn.00404d0c
lea eax, [ebx + 0x58]
mov edx, dword [ebx + 8]
call fcn.00404d0c
lea eax, [ebx + 0x5c]
mov edx, dword [ebx + 0x24]
call fcn.00404d0c
lea eax, [ebx + 0x60]
mov edx, dword [ebx + 0x2c]
call fcn.00404d0c
lea eax, [ebx + 0x64]
mov edx, dword [ebx + 0x20]
call fcn.00404d0c
lea eax, [ebx + 0x68]
mov edx, dword [ebx + 0x30]
call fcn.00404d0c
lea eax, [ebx + 0x6c]
mov edx, dword [ebx + 0x34]
call fcn.00404d0c
lea eax, [ebx + 0x70]
mov edx, dword [ebx + 0x38]
call fcn.00404d0c
lea eax, [ebx + 0x74]
mov edx, dword [ebx + 0x3c]
call fcn.00404d0c
lea eax, [ebx + 0x78]
mov edx, dword [ebx + 0x40]
call fcn.00404d0c
lea eax, [ebx + 0x7c]
mov edx, dword [ebx + 0x1c]
call fcn.00404d0c
lea eax, [ebx + 0x80]
mov edx, dword [ebx + 0x28]
call fcn.00404d0c
lea eax, [ebx + 0x84]
mov edx, dword [ebx + 0x44]
call fcn.00404d0c
lea eax, [ebx + 0x88]
mov edx, dword [ebx + 0x14]
call fcn.00404d0c
lea eax, [ebx + 0x8c]
mov edx, dword [ebx + 0x48]
call fcn.00404d0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xa14d01
lea eax, [ebp - 0xd4]
mov edx, 0x34
call fcn.00404ce8
ret