Function at 0x44c420
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44ef9f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
push ebx
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
call 0x4577ca
lea ecx, [esp + 0x28]
mov dword [esp + 0xa8], 0
call 0x4577ca
lea ecx, [esp + 0x20]
mov byte [esp + 0xa8], 1
call 0x4577ca
push 0x45f3a0
lea eax, [esp + 0xc]
push 0x462f44
push eax
mov byte [esp + 0xb4], 2
call 0x457824
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xac], 3
call 0x457806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 2
call 0x4577be
lea ecx, [esp + 0x18]
call 0x4577ca
lea ecx, [esp + 0xc]
mov byte [esp + 0xa8], 4
call 0x4577ca
push 0x45f260
lea ecx, [esp + 0x10]
mov byte [esp + 0xac], 5
call 0x45781e
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x10]
call 0x45783c
push 0x45f260
lea ecx, [esp + 0x10]
call 0x457800
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push edx
push 0x45f644
push eax
call 0x457836
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xac], 6
call 0x457806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 5
call 0x4577be
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call 0x4577ee
call 0x456760
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x40]
push eax
call 0x4577ee
push 0x45f504
lea ecx, [esp + 0x44]
mov byte [esp + 0xac], 7
call 0x457800
lea ecx, [esp + 0x30]
call 0x4577ca
mov byte [esp + 0xa8], 8
lea ecx, [esp + 0x1c]
call 0x4577ca
push 0x45f634
lea ecx, [esp + 0x34]
mov byte [esp + 0xac], 9
call 0x45781e
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x20]
call 0x457806
lea edx, [esp + 0x1c]
lea eax, [esp + 8]
push edx
push 0x45f260
push eax
call 0x457836
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xac], 0xa
call 0x457806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 9
call 0x4577be
push 0x45f260
lea ecx, [esp + 0x20]
call 0x457800
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x34]
call 0x45783c
push ecx
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call 0x4577ee
call 0x456760
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
call 0x4577ee
push 0x462d70
lea ecx, [esp + 0x30]
mov byte [esp + 0xac], 0xb
call 0x45783c
lea ecx, [esp + 0x24]
call 0x4577ca
lea ecx, [esp + 0x14]
mov byte [esp + 0xa8], 0xc
call 0x4577ca
mov bl, 0xd
push 0x45f634
lea ecx, [esp + 0x28]
mov byte [esp + 0xac], bl
call 0x45781e
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x18]
call 0x457806
lea edx, [esp + 0x14]
lea eax, [esp + 8]
push edx
push 0x45f260
push eax
call 0x457836
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xac], 0xe
call 0x457806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], bl
call 0x4577be
push 0x45f260
lea ecx, [esp + 0x18]
call 0x457800
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x28]
call 0x45783c
push ecx
lea edx, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call 0x4577ee
call 0x456760
add esp, 4
lea eax, [esp + 0x2c]
lea ecx, [esp + 8]
push 0x45f5d4
push eax
push ecx
call 0x457824
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0xac], 0xf
call 0x457806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], bl
call 0x4577be
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push edx
push 0x45f260
push eax
call 0x457836
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0xac], 0x10
call 0x457806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], bl
call 0x4577be
push 0x45f260
lea ecx, [esp + 0x10]
call 0x457800
push 0x45f634
lea ecx, [esp + 0x1c]
call 0x45781e
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x1c]
call 0x45783c
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call 0x4577ee
call 0x456760
add esp, 4
lea eax, [esp + 0x10]
lea ecx, [esp + 0x3c]
push 0x462d70
push eax
push ecx
call 0x4578d2
push 0x45f5d4
lea ecx, [esp + 0x40]
mov byte [esp + 0xac], 0x11
call 0x457800
push ecx
lea edx, [esp + 0x40]
mov ecx, esp
mov dword [esp + 0xc], esp
push edx
call 0x4577ee
push ecx
mov byte [esp + 0xb0], 0x12
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x462f44
call 0x4577ee
mov ecx, esi
mov byte [esp + 0xb0], 0x11
call fcn.0044d070
lea ecx, [esp + 0x34]
mov esi, eax
call 0x4577ca
lea ecx, [esp + 0x38]
mov byte [esp + 0xa8], 0x13
call 0x4577ca
push 0x45f624
lea eax, [esp + 0xc]
push 0x462f04
push eax
mov byte [esp + 0xb4], 0x14
call 0x457824
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0xac], 0x15
call 0x457806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 0x14
call 0x4577be
push 0x45f5b8
lea ecx, [esp + 0xc]
push 0x462f44
push ecx
call 0x457824
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0xac], 0x16
call 0x457806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 0x14
call 0x4577be
test esi, esi
je 0x44ca74
push 0x45f61c
lea ecx, [esp + 0x24]
call 0x45781e
lea edx, [esp + 0x10]
push 0x45f2b0
lea eax, [esp + 0xc]
push edx
push eax
call 0x457824
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xac], 0x17
call 0x457806
lea ecx, [esp + 8]
mov byte [esp + 0xa8], 0x14
call 0x4577be
mov ecx, dword [0x453568]
mov eax, dword [esp + 0x28]
push 1
mov edx, dword [ecx]
lea ecx, [esp + 0x4c]
push edx
push 2
push eax
call dword [0x453544]
push 0x45f5f4
lea ecx, [esp + 0x24]
mov byte [esp + 0xac], 0x18
call 0x457800
mov esi, dword [0x453530]
push 0x45f5e0
lea ecx, [esp + 0x4c]
call esi
mov ecx, dword [esp + 0x20]
push ecx
lea ecx, [esp + 0x4c]
call esi
lea ecx, [esp + 0x48]
call dword [0x453540]
mov edx, dword [esp + 0x28]
push 1
push edx
call dword [0x4531cc]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push 0
push eax
push ecx
call dword [0x4531a8]
lea ecx, [esp + 0x50]
mov byte [esp + 0xa8], 0x14
call dword [0x45353c]
lea ecx, [esp + 0x50]
call dword [0x453538]
lea ecx, [esp + 0x38]
mov byte [esp + 0xa8], 0x13
call 0x4577be
lea ecx, [esp + 0x34]
mov byte [esp + 0xa8], 0x11
call 0x4577be
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa8], bl
call 0x4577be
lea ecx, [esp + 0x14]
mov byte [esp + 0xa8], 0xc
call 0x4577be
lea ecx, [esp + 0x24]
mov byte [esp + 0xa8], 0xb
call 0x4577be
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], 9
call 0x4577be
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa8], 8
call 0x4577be
lea ecx, [esp + 0x30]
mov byte [esp + 0xa8], 7
call 0x4577be
mov byte [esp + 0xa8], 5
lea ecx, [esp + 0x40]
call 0x4577be
lea ecx, [esp + 0xc]
mov byte [esp + 0xa8], 4
call 0x4577be
lea ecx, [esp + 0x18]
mov byte [esp + 0xa8], 2
call 0x4577be
lea ecx, [esp + 0x20]
mov byte [esp + 0xa8], 1
call 0x4577be
lea ecx, [esp + 0x28]
mov byte [esp + 0xa8], 0
call 0x4577be
lea ecx, [esp + 0x10]
mov dword [esp + 0xa8], 0xffffffff
call 0x4577be
mov eax, 1
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0xa4
ret
lea ecx, [esp + 0x38]
mov byte [esp + 0xa8], 0x13
call 0x4577be
lea ecx, [esp + 0x34]
mov byte [esp + 0xa8], 0x11
call 0x4577be
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa8], bl
call 0x4577be
lea ecx, [esp + 0x14]
mov byte [esp + 0xa8], 0xc
call 0x4577be
lea ecx, [esp + 0x24]
mov byte [esp + 0xa8], 0xb
call 0x4577be
lea ecx, [esp + 0x2c]
mov byte [esp + 0xa8], 9
call 0x4577be
lea ecx, [esp + 0x1c]
mov byte [esp + 0xa8], 8
call 0x4577be
lea ecx, [esp + 0x30]
mov byte [esp + 0xa8], 7
call 0x4577be
lea ecx, [esp + 0x40]
mov byte [esp + 0xa8], 5
call 0x4577be
lea ecx, [esp + 0xc]
mov byte [esp + 0xa8], 4
call 0x4577be
lea ecx, [esp + 0x18]
mov byte [esp + 0xa8], 2
call 0x4577be
lea ecx, [esp + 0x20]
mov byte [esp + 0xa8], 1
call 0x4577be
lea ecx, [esp + 0x28]
mov byte [esp + 0xa8], 0
call 0x4577be
lea ecx, [esp + 0x10]
mov dword [esp + 0xa8], 0xffffffff
call 0x4577be
mov ecx, dword [esp + 0xa0]
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0xa4
ret