Function at 0x4018a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4320ca
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], edi
lea ecx, [edi + 8]
call fcn.00402f20
lea ecx, [edi + 0x1520]
mov dword [ebp - 4], 0
call fcn.00402a90
lea esi, [edi + 0x18e4]
mov ecx, esi
call fcn.0041c900
mov dword [edi + 0x19dc], 0
mov dword [edi + 0x19d8], 0
mov dword [edi + 0x19e0], 0
mov dword [edi + 0x19e8], 0
mov dword [edi + 0x19e4], 0
mov dword [edi + 0x19ec], 0
mov dword [edi + 0x19f4], 0
mov dword [edi + 0x19f0], 0
mov dword [edi + 0x19f8], 0
mov dword [edi + 0x1a00], 0
mov dword [edi + 0x19fc], 0
mov dword [edi + 0x1a04], 0
mov dword [edi + 0x1a0c], 0
mov dword [edi + 0x1a08], 0
mov dword [edi + 0x1a10], 0
mov dword [edi + 0x1a30], 0
lea eax, [edi + 0x1a98]
mov dword [edi + 0x1a2c], 0
mov dword [edi + 0x1a74], 0
mov dword [edi + 0x1a70], 0
push 0x60
push 0
push eax
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x58], 0
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
add esp, 0xc
movups xmmword [edi + 0x1af8], xmm0
mov dword [edi + 0x1b08], 0
mov dword [edi + 0x1b10], 0
mov dword [edi + 0x1b0c], 0
mov dword [edi + 0x1b14], 0
mov dword [edi + 0x1b1c], 0
mov dword [edi + 0x1b18], 0
mov dword [edi + 0x1b20], 0
mov dword [edi + 0x1b28], 0
mov dword [edi + 0x1b24], 0
mov dword [edi + 0x1b2c], 0
mov dword [edi + 0x1b34], 0
mov dword [edi + 0x1b30], 0
mov dword [edi + 0x1b38], 0
mov dword [edi + 0x1b40], 0
mov dword [edi + 0x1b3c], 0
mov dword [edi + 0x1b44], 0
mov dword [edi + 0x1b7c], 0
mov dword [edi + 0x1b80], 0
mov dword [edi + 0x1b84], 0
mov dword [edi + 0x1b88], 0
mov dword [edi + 0x1ba4], 0
mov dword [edi + 0x1ba8], 0
mov dword [edi + 0x1bac], 0
mov dword [edi + 0x1bb0], 0
mov dword [edi + 0x1bf4], 0
mov dword [edi + 0x1bd0], 0
mov dword [edi + 0x1bd8], 0
mov dword [edi + 0x1bd4], 0
mov dword [edi + 0x1be4], 0x7f7fffff
mov dword [edi + 0x1be0], 0x7f7fffff
mov dword [edi + 0x1bdc], 0x7f7fffff
mov dword [edi + 0x1be8], 0
mov dword [edi + 0x1bec], 0
mov dword [edi + 0x1bf0], 0
mov dword [edi + 0x1bf4], 0
mov dword [edi + 0x1c1c], 0
mov dword [edi + 0x1bf8], 0
mov dword [edi + 0x1c00], 0
mov dword [edi + 0x1bfc], 0
mov dword [edi + 0x1c0c], 0x7f7fffff
mov dword [edi + 0x1c08], 0x7f7fffff
mov dword [edi + 0x1c04], 0x7f7fffff
mov dword [edi + 0x1c10], 0
mov dword [edi + 0x1c14], 0
mov dword [edi + 0x1c18], 0
mov dword [edi + 0x1c1c], 0
mov dword [edi + 0x1c44], 0
mov dword [edi + 0x1c20], 0
mov dword [edi + 0x1c28], 0
mov dword [edi + 0x1c24], 0
mov dword [edi + 0x1c34], 0x7f7fffff
mov dword [edi + 0x1c30], 0x7f7fffff
mov dword [edi + 0x1c2c], 0x7f7fffff
mov dword [edi + 0x1c38], 0
mov dword [edi + 0x1c3c], 0
mov dword [edi + 0x1c40], 0
mov dword [edi + 0x1c44], 0
mov byte [edi + 0x1c84], 0
mov dword [edi + 0x1c88], 0
mov dword [edi + 0x1c90], 0
mov dword [edi + 0x1c94], 0
mov dword [edi + 0x1c8c], 0
mov dword [edi + 0x1ca8], 0
mov dword [edi + 0x1cac], 0
mov dword [edi + 0x1ca0], 0
mov dword [edi + 0x1ca4], 0
mov dword [edi + 0x1c98], 0
mov dword [edi + 0x1c9c], 0
push 0x402660
push 0x414db0
push 2
lea eax, [edi + 0x1cb0]
mov byte [ebp - 4], 0xb
push 0xc
push eax
mov dword [ebp - 0x18], eax
call fcn.00430e92
push esi
lea ecx, [edi + 0x1ccc]
call fcn.004015c0
push esi
lea ecx, [edi + 0x1d68]
call fcn.004015c0
mov dword [edi + 0x1e24], 0
xorps xmm0, xmm0
mov dword [edi + 0x1e20], 0
mov dword [edi + 0x1e18], 0
mov dword [edi + 0x1e1c], 0
movups xmmword [edi + 0x1e2c], xmm0
movups xmmword [edi + 0x1e3c], xmm0
mov word [edi + 0x1e4c], 0
mov dword [edi + 0x1e28], 0xffffffff
mov byte [edi + 0x1e4e], 0
mov dword [edi + 0x1e50], 0
mov dword [edi + 0x1e54], 0
mov dword [edi + 0x1e58], 0
lea eax, [edi + 0x1ed8]
mov dword [edi + 0x1e5c], 0
mov dword [edi + 0x1e80], 0
mov dword [edi + 0x1e7c], 0
mov dword [edi + 0x1e84], 0
mov dword [edi + 0x1ea0], 0
mov dword [edi + 0x1e9c], 0
mov dword [edi + 0x1ea4], 0
mov dword [edi + 0x1eac], 0
mov dword [edi + 0x1ea8], 0
mov dword [edi + 0x1eb0], 0
mov dword [edi + 0x1eb4], 0
mov dword [edi + 0x1ebc], 0
mov dword [edi + 0x1eb8], 0
mov dword [edi + 0x1ec0], 0
mov dword [edi + 0x1ec8], 0
mov dword [edi + 0x1ec4], 0
mov dword [edi + 0x1ecc], 0
mov dword [edi + 0x1ed4], 0
mov dword [edi + 0x1ed0], 0
push 0xe74
push 0
push eax
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x2c], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [edi + 0x2d4c]
call fcn.004220f0
mov dword [edi + 0x2dd0], 0
mov dword [edi + 0x2dcc], 0
mov dword [edi + 0x2dc8], 0
mov dword [edi + 0x2dc4], 0
mov eax, dword [0x4bb8a0]
mov dword [edi + 0x2dec], 0
mov dword [edi + 0x2de8], 0
mov dword [edi + 0x2df0], 0
mov dword [edi + 0x2df8], 0
mov dword [edi + 0x2df4], 0
mov dword [edi + 0x2dfc], 0
mov dword [edi + 0x2e04], 0
mov dword [edi + 0x2e00], 0
mov dword [edi + 0x2e0c], 0
mov dword [edi + 0x2e08], 0
mov dword [edi + 0x2e1c], 0
mov dword [edi + 0x2e18], 0
mov dword [edi + 0x2e20], 0
mov dword [edi + 0x2e28], 0
mov dword [edi + 0x2e24], 0
mov dword [edi + 0x2e2c], 0
mov dword [edi + 0x2e34], 0
mov dword [edi + 0x2e30], 0
mov dword [edi + 0x2e38], 0
mov dword [edi + 0x2e4c], 0
mov dword [edi + 0x2e48], 0
mov dword [edi + 0x2e50], 0
mov word [edi], pe_nt_image_headers32
mov dword [edi + 0x18d8], 0
mov dword [edi + 0x18e0], 0
mov dword [edi + 0x18dc], 0
test eax, eax
je 0x401fd7
inc dword [eax + 0x374]
push 0x460
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4020a9
mov dword [eax + 0x24], 0
lea ecx, [eax + 0x58]
mov dword [eax + 0x2c], 0
mov edx, 0x40
mov dword [eax + 0x38], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x54], 0
mov dword [ecx + 0xc], 0
lea ecx, [ecx + 0x10]
mov dword [ecx - 8], 0
mov dword [ecx - 0xc], 0
mov dword [ecx - 0x10], 0
sub edx, 1
jne 0x402045
mov byte [eax], dl
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 1
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x24], edx
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x30], edx
mov dword [eax + 0x45c], 0xffffffff
mov dword [eax + 0x458], 0xffffffff
jmp 0x4020ab
xor eax, eax
mov dword [edi + 0x98], eax
xorps xmm0, xmm0
movsd qword [edi + 0x19b8], xmm0
mov dword [edi + 0x19c0], 0
mov dword [edi + 0x19c8], 0xffffffff
mov dword [edi + 0x19c4], 0xffffffff
mov word [edi + 0x19cd], 0
mov byte [edi + 0x19cc], 0
mov byte [edi + 0x19cf], 0
mov dword [edi + 0x19d0], 0
mov dword [edi + 0x19d4], 0
mov dword [edi + 0x1a14], 0
mov dword [edi + 0x1a18], 0
mov dword [edi + 0x1a1c], 0
mov dword [edi + 0x1a20], 0
mov dword [edi + 0x1a24], 0
mov dword [edi + 0x1a28], 0
mov dword [edi + 0x1a34], 0
mov dword [edi + 0x1a38], 0
mov byte [edi + 0x1a3c], 0
mov dword [edi + 0x1a40], 0
mov dword [edi + 0x1a48], 0
mov dword [edi + 0x1a44], 0
mov dword [edi + 0x1a4c], 0
mov dword [edi + 0x1a50], 0
mov dword [edi + 0x1a54], 0
mov dword [edi + 0x1a58], 0
mov byte [edi + 0x1a5c], 0
mov dword [edi + 0x1a60], 0
mov dword [edi + 0x1a64], 0
mov dword [edi + 0x1a68], 0
mov dword [edi + 0x1a6c], 0
mov dword [edi + 0x1a70], 0xbf800000
mov dword [edi + 0x1a74], 0xbf800000
mov dword [edi + 0x1a78], 0
mov dword [edi + 0x1a7c], 0
mov dword [edi + 0x1a80], 0
mov dword [edi + 0x1a84], 0
mov word [edi + 0x1a88], 0
mov dword [edi + 0x1a8c], 0
mov dword [edi + 0x1a90], 0
mov dword [edi + 0x1a94], 0
mov dword [edi + 0x1b48], 0
mov dword [edi + 0x1b60], 0
mov dword [edi + 0x1b5c], 0
mov dword [edi + 0x1b58], 0
mov dword [edi + 0x1b54], 0
mov dword [edi + 0x1b50], 0
mov dword [edi + 0x1b4c], 0
mov dword [edi + 0x1b74], 0
mov dword [edi + 0x1b6c], 0
mov dword [edi + 0x1b68], 0
mov dword [edi + 0x1b64], 0
mov dword [edi + 0x1b70], 0
mov dword [edi + 0x1b78], 0
mov dword [edi + 0x1b7c], 0
mov dword [edi + 0x1b80], 0
mov dword [edi + 0x1b84], 0
mov dword [edi + 0x1b88], 0
mov dword [edi + 0x1b8c], 0
mov dword [edi + 0x1b90], 0
mov dword [edi + 0x1b94], 0x7fffffff
mov dword [edi + 0x1b98], 0x10000
mov word [edi + 0x1b9c], 0
mov byte [edi + 0x1b9e], 0
mov dword [edi + 0x1ba0], 0
mov word [edi + 0x1bb4], 0
mov dword [edi + 0x1bb8], 0
mov dword [edi + 0x1bbc], 0
mov dword [edi + 0x1bc0], 0
mov dword [edi + 0x1bcc], 0xffffffff
mov dword [edi + 0x1bc8], 0xffffffff
mov dword [edi + 0x1bc4], 0xffffffff
mov dword [edi + 0x1c48], 0
mov dword [edi + 0x1c4c], 0
mov dword [edi + 0x1c58], 0
mov dword [edi + 0x1c54], 0
mov dword [edi + 0x1c50], 0
mov dword [edi + 0x1c60], 0
mov dword [edi + 0x1c5c], 0
mov byte [edi + 0x1c64], 0
mov dword [edi + 0x1c6c], 0
lea eax, [edi + 0x2e70]
mov dword [edi + 0x1c68], 0
mov dword [edi + 0x1c74], 0x7fffffff
mov dword [edi + 0x1c70], 0x7fffffff
mov dword [edi + 0x1c7c], 0x7fffffff
mov dword [edi + 0x1c78], 0x7fffffff
mov byte [edi + 0x1c80], 0
mov dword [edi + 0x1cc8], 0
mov dword [edi + 0x1cf8], 0x4334bc
mov dword [edi + 0x1d94], 0x4334cc
mov dword [edi + 0x1e04], 0
mov word [edi + 0x1e09], 0
mov byte [edi + 0x1e08], 0
mov dword [edi + 0x1e0c], 0
mov dword [edi + 0x1e10], 0xffffffff
mov dword [edi + 0x1e14], 0xffffffff
mov dword [edi + 0x1e60], 0
mov dword [edi + 0x1e64], 0
mov dword [edi + 0x1e68], 0
mov dword [edi + 0x1e6c], 0
mov dword [edi + 0x1e70], 0
mov dword [edi + 0x1e74], 0xffffffff
mov dword [edi + 0x1e78], 0
movups xmmword [edi + 0x1e88], xmm0
mov dword [edi + 0x1e98], 0
mov dword [edi + 0x1ed0], 0
mov dword [edi + 0x1ed4], 0
mov dword [edi + 0x2da8], 0
mov dword [edi + 0x2dac], 0xa900000
mov dword [edi + 0x2db4], 0
mov dword [edi + 0x2db0], 0
mov dword [edi + 0x2dc0], 0x7f7fffff
mov dword [edi + 0x2dbc], 0x7f7fffff
mov dword [edi + 0x2db8], 0x7f7fffff
mov byte [edi + 0x2dd4], 0
mov dword [edi + 0x2dd8], 0
mov dword [edi + 0x2ddc], 0x3c23d70a
mov dword [edi + 0x2de0], 0
mov dword [edi + 0x2de4], 0
mov dword [edi + 0x2e08], 0x7f7fffff
mov dword [edi + 0x2e0c], 0x7f7fffff
mov dword [edi + 0x2e00], 0x7f7fffff
mov dword [edi + 0x2e04], 0x7f7fffff
mov byte [edi + 0x2e10], 0
mov dword [edi + 0x2e14], 0
mov byte [edi + 0x2e3c], 0
mov dword [edi + 0x2e40], 0
mov dword [edi + 0x2e44], 0
mov dword [edi + 0x2e54], 0x7f7fffff
mov byte [edi + 0x2e58], 0
mov dword [edi + 0x2e5c], 0
mov dword [edi + 0x2e64], 2
push 0x1e0
mov dword [edi + 0x2e60], 2
push 0
mov byte [edi + 0x2e68], 0
push eax
mov dword [edi + 0x2e6c], 0
call sub.VCRUNTIME140.dll_memset
mov dword [edi + 0x3050], 0
lea eax, [edi + 0x3064]
mov dword [edi + 0x3054], 0
push 0xc01
mov dword [edi + 0x3060], 0xffffffff
push 0
mov dword [edi + 0x305c], 0xffffffff
push eax
mov dword [edi + 0x3058], 0xffffffff
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0xc]
add esp, 0x18
mov eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4