Function at 0x404730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [0x42d5e0]
lea ebx, [ebp - 0x1b]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [eax + 7], 0x23bcaa0f
mov dword [eax + 4], 0xf141eff
mov dword [eax], 0x54340127
lea eax, [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x42df08], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push 0x9385646d
push dword [0x42df08]
call fcn.00403680
add esp, 8
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
call edx
push 0x27
push 0x42d547
push 0x547
push section..data
call section..text
add esp, 0x10
push 0xb
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call section..text
add esp, 0x10
mov eax, 0x13ee0d1e
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
mov eax, 0x8126447d
nop word cs:[eax + eax]
cmp eax, 0xe34e3b25
jle 0x404840
cmp eax, 0x2ca5087d
jg 0x4048a0
cmp eax, 0xfb36b74b
jle 0x404a5e
cmp eax, 0xfb36b74c
je 0x404e23
cmp eax, 0x13ee0d1e
je 0x404e88
cmp eax, 0x1e3ac7ea
jne 0x4047f0
mov eax, 0xf68fa4d9
mov dword [ebp - 0x44], 0x4e4
cmp eax, 0xe34e3b25
jg 0x4047f7
nop dword [eax]
cmp eax, 0xa18dc7f6
jle 0x4048e0
cmp eax, 0xbf7ebaed
jle 0x404aa6
cmp eax, 0xbf7ebaee
je 0x404f10
cmp eax, 0xd106027f
je 0x40504a
cmp eax, 0xd4d2b504
jne 0x4047f0
push dword [ebp - 0x24]
push dword [0x42df08]
call fcn.00403680
add esp, 8
mov eax, 0x7742b30e
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
cmp eax, 0x6ce038e2
jg 0x404c7e
cmp eax, 0x3b119f68
je 0x405066
cmp eax, 0x490b8079
je 0x40507b
cmp eax, 0x2ca5087e
jne 0x4047f0
jmp 0x4054f9
cmp eax, 0x88316a6d
jg 0x404df1
cmp eax, 0x810de003
je 0x405090
cmp eax, 0x8126447d
jne 0x4047f0
mov ecx, dword [0x42df58]
lea eax, [ecx - 1]
imul eax, ecx
mov ecx, eax
mov edx, eax
and eax, 0xf32afbcc
or ecx, 0x1dde2ae1
not edx
mov esi, ecx
mov edi, edx
and ecx, 0x6fc2f595
and edx, 0xcd50433
not esi
or edi, 0xe221d51e
or eax, edx
and esi, 0x8021000a
or esi, ecx
mov ecx, edi
and edi, 0x6fc2f595
not ecx
and ecx, 0x101c0a60
or ecx, edi
xor ecx, esi
mov esi, ecx
and ecx, 0x850a36bf
not esi
and esi, 0x7af5c940
or ecx, esi
mov esi, ecx
xor ecx, 0x98d41c5f
xor esi, 0x220ae000
mov edx, ecx
and edx, 0xd5211ff5
and esi, 0x2adee00a
or esi, edx
mov edx, eax
xor eax, 0x4010431
xor edx, 0x220ae008
and eax, 0xd5211ff5
and edx, 0x2adee00a
or edx, eax
xor edx, esi
mov esi, 0x2ca5087e
not edx
or edx, ecx
cmp edx, 0xffffffff
setne ah
sete dl
cmp dword [0x42df5c], 9
mov ch, ah
setg al
xor ch, dl
and ch, ah
xor dl, al
mov cl, ch
mov dh, ch
and dl, al
xor cl, 1
or cl, ch
xor cl, 1
and dh, cl
xor cl, ch
or cl, dh
xor cl, 1
mov ch, cl
xor cl, al
or ch, al
not cl
xor ch, 1
and cl, al
xor al, ah
mov ah, dl
mov dh, ch
xor dl, al
xor ah, 1
xor al, 1
or al, ah
and dh, cl
xor cl, ch
xor al, 1
or cl, dh
or al, dl
mov edx, ecx
xor dl, 1
mov ebx, eax
mov ah, dl
mov ch, dl
and ah, cl
xor ch, ah
xor ah, 1
or ah, cl
mov cl, al
xor cl, 1
xor ah, 1
and cl, al
or ah, ch
mov dh, ah
and bl, cl
xor cl, al
or cl, bl
xor dh, 1
and dh, cl
xor cl, 1
and cl, ah
mov ah, dl
xor dl, al
and ah, al
or cl, dh
or dl, ah
mov eax, edx
xor al, cl
test al, 1
mov eax, 0xa18dc7f7
cmovne esi, eax
test dl, 1
mov eax, 0x2ca5087e
cmovne eax, esi
test cl, 1
jmp 0x4052e2
cmp eax, 0xe34e3b26
je 0x4051fc
cmp eax, 0xf68fa4d9
jne 0x4047f0
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ecx
push 0x40
push dword [ebp - 0x44]
push section..data
call eax
test eax, eax
mov eax, 0xe34e3b26
mov ecx, 0xbf7ebaee
cmove eax, ecx
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
cmp eax, 0xa18dc7f7
je 0x4047e1
cmp eax, 0xb6fa73fa
jne 0x4047f0
mov ecx, dword [0x42df58]
lea eax, [ecx - 1]
imul eax, ecx
mov edx, eax
mov ecx, eax
xor edx, 0x15e132a0
not ecx
and edx, eax
or eax, 0xea1ecd5f
and ecx, 0x810280
mov esi, edx
mov edi, eax
and edx, 0x208f8685
not esi
and edi, 0xdf70797a
or eax, esi
and esi, 0xdf70797a
or ecx, edi
or edx, esi
not eax
xor edx, ecx
or eax, edx
mov ecx, eax
and eax, 0xca92d72e
not ecx
and ecx, 0x356d28d1
or eax, ecx
mov ecx, eax
mov edx, eax
xor eax, 0xf8709070
xor ecx, 0xdf73e58e
xor edx, 0x801230
mov esi, ecx
and edx, 0x17b1f630
and eax, ecx
and esi, 0xe84e09cf
or esi, edx
mov ecx, esi
xor esi, 0x100a600
xor ecx, 0xe84e09cf
and esi, 0x10caf80
mov edx, ecx
and edx, 0x270375fe
mov edi, edx
and edi, eax
xor eax, edx
or eax, edi
mov edi, ecx
and ecx, 1
and edi, 0xfef3507f
mov edx, eax
and eax, 0x6db28522
or edi, esi
not edx
xor edi, 0x10caf81
and edx, 0x924d7add
or ecx, edi
or eax, edx
mov esi, ecx
mov edx, eax
and ecx, 0x6347c703
xor eax, 0xb54e0f22
not esi
xor edx, 0x40216090
and esi, 0x9cb838fc
and edx, 0xd1276592
or ecx, esi
mov esi, eax
and esi, 0x2ed89a6d
or edx, esi
mov esi, ecx
xor ecx, 0x9cb838fc
xor esi, 0x41074502
or eax, ecx
and ecx, 0x2ed89a6d
and esi, 0xd1276592
not eax
or esi, ecx
mov ecx, dword [0x42df5c]
xor esi, edx
or eax, esi
mov esi, 0x6ce038e3
mov edx, eax
and eax, 0xd2b1139f
not edx
and edx, 0x2d4eec60
or edx, eax
xor edx, 0x2d4eec60
cmp edx, 0xffffffff
setne dl
sete al
cmp ecx, 9
setg ah
cmp ecx, 0xa
mov dh, dl
setl ch
mov cl, ah
or dh, ch
or cl, al
and ch, dl
and al, ah
or al, ch
mov ch, ah
or ah, dl
mov bl, dh
xor ch, dl
xor ah, 1
xor bl, cl
or cl, dh
or ah, ch
xor cl, 1
mov dl, ah
or cl, bl
xor dl, al
xor al, 1
xor cl, 1
or al, ah
xor dl, 1
mov dh, cl
xor al, 1
or al, dl
or dh, al
xor cl, al
mov al, dh
xor al, cl
test al, 1
mov eax, 0x3b119f68
cmovne esi, eax
test cl, 1
mov ecx, 0x6ce038e3
mov eax, esi
cmovne eax, ecx
test dh, 1
cmovne eax, esi
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
cmp eax, 0x6ce038e3
je 0x4052f5
cmp eax, 0x7742b30e
jne 0x4047f0
push dword [ebp - 0x24]
push dword [0x42df08]
call fcn.00403680
add esp, 8
mov dword [ebp - 0x28], eax
mov eax, dword [0x42df58]
mov edi, 0xd106027f
lea ecx, [eax - 1]
imul ecx, eax
mov eax, ecx
and ecx, 0xfaf315af
not eax
and eax, 0x50cea50
or eax, ecx
mov edx, eax
mov ecx, eax
xor eax, 0x10cc010
xor edx, 0xfaf315af
xor ecx, 0xfaf315ae
and eax, 0xab7cd59a
and ecx, edx
and edx, 0x54832a65
or edx, eax
mov eax, ecx
and ecx, 0x21512b6b
not eax
mov esi, eax
and esi, 0xdeaed494
or ecx, esi
mov esi, edx
xor edx, 0xab7cd59b
xor esi, 0x12a60
or eax, edx
and edx, 0xdeaed494
and esi, 0x21512b6b
not eax
or esi, edx
xor esi, ecx
or eax, esi
mov esi, 0xd4d2b504
mov ecx, eax
and eax, 0x7862d5cf
not ecx
and ecx, 0x879d2a30
or eax, ecx
mov ecx, eax
and eax, 0x3a084652
not ecx
and ecx, 0xc5f7b9ad
or eax, ecx
mov ecx, eax
xor eax, 0x426a939d
xor ecx, 0x30156842
mov edx, eax
and edx, 0x8dca0534
and ecx, 0x7235facb
or ecx, edx
mov edx, dword [0x42df5c]
xor ecx, 0x8dca0534
xor eax, ecx
test eax, ecx
sete cl
setne al
cmp edx, 9
setg ah
cmp edx, 0xa
setl dl
or cl, ah
mov ch, dl
xor ch, al
or al, dl
mov edx, eax
mov dh, ch
xor dl, cl
or cl, al
xor dh, ah
xor cl, 1
and dh, ch
or cl, dl
xor dh, 1
mov eax, ecx
mov ah, dh
xor al, 1
and cl, al
and ah, al
xor cl, 1
mov dl, cl
or cl, al
xor dl, al
xor cl, 1
xor al, dh
or cl, dl
or al, ah
xor cl, dh
mov ch, cl
xor ch, al
not ch
test ch, 1
cmovne edi, esi
test al, 1
mov eax, 0xd106027f
cmovne eax, edi
test cl, 1
cmovne eax, edi
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
cmp eax, 0x88316a6e
je 0x4053d6
cmp eax, 0x8847f73e
jne 0x4047f0
mov eax, 0x88316a6e
mov dword [ebp - 0x40], 0x8aafdc01
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_FindAtomW]
mov edi, section..data
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push esi
mov edx, edi
mov ecx, 0x27
xor ecx, 0x1af
add edx, ecx
mov ecx, 3
sub esp, 4
loop 0x404e4c
mov dword [esp + 4], 1
xor dword [esp + 4], 0xbb8
mov dword [esp], edx
mov dword [esp + 8], 0
lea eax, [ebx]
push eax
ret
mov ecx, 0xbc682bb5
mov dword [ebp - 0x20], 1
nop word cs:[eax + eax]
nop
cmp ecx, 0xeebb87f8
jg 0x404ed0
cmp ecx, 0xbc682bb5
je 0x404ef5
cmp ecx, 0xe6ce0b8f
jne 0x404ea0
mov ecx, 0xeebb87f9
mov al, 1
cmp ecx, 0xeebb87f8
jle 0x404ea8
nop word [eax + eax]
cmp ecx, 0xeebb87f9
je 0x4054d3
cmp ecx, 0x5d376a7
jne 0x404ea0
mov ecx, 0xeebb87f9
xor eax, eax
cmp ecx, 0xeebb87f8
jle 0x404ea8
jmp 0x404ed0
cmp dword [ebp - 0x20], 0
mov ecx, 0x5d376a7
mov edx, 0xe6ce0b8f
cmove ecx, edx
cmp ecx, 0xeebb87f8
jle 0x404ea8
jmp 0x404ed0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov ecx, dword [0x42df58]
lea eax, [ecx - 1]
imul eax, ecx
mov ecx, eax
mov esi, eax
not ecx
and esi, 0x39bd4c2e
mov edx, ecx
mov edi, ecx
and edx, 0xc642b3d1
or edi, 0x4d730467
or esi, edx
mov edx, esi
xor esi, 0x4020041
xor edx, 0x8110402
or esi, 0x2284f188
and esi, 0x27a6f1ed
and edx, 0x48510402
or edx, esi
mov esi, edi
and edi, 0x27a6f1ed
not esi
and esi, 0x90080a10
or esi, edi
xor esi, edx
mov edx, esi
and esi, 0x26d417ea
not edx
and edx, 0xd92be815
or esi, edx
mov edx, esi
xor esi, 0x9458ec73
xor edx, 0x6ba7138c
and ecx, esi
and edx, eax
mov eax, dword [0x42df5c]
or edx, ecx
xor esi, edx
test esi, edx
mov esi, 0x8126447d
sete cl
setne dl
cmp eax, 0xa
setl ch
cmp eax, 9
setg ah
xor cl, ch
mov dh, ah
xor dh, ch
and dh, ah
or ah, dl
mov al, dh
mov bl, dh
xor ah, 1
xor al, 1
or ah, cl
xor cl, 1
or al, dh
xor al, 1
and bl, al
xor al, dh
or al, bl
xor al, dl
mov edx, ecx
or cl, ah
xor dl, ah
xor cl, 1
or cl, dl
mov edx, ecx
xor dl, 1
and cl, dl
mov ah, dl
and ah, cl
xor cl, dl
or cl, ah
mov edx, ecx
mov ah, cl
xor dl, 1
and ah, dl
mov ch, ah
xor ah, cl
xor ch, 1
or ch, dl
xor ch, 1
or ch, ah
mov cl, ch
xor ch, 1
and ch, al
xor al, 1
mov ah, al
and cl, al
and ah, dl
xor dl, al
or ch, cl
or dl, ah
mov eax, edx
xor al, ch
test al, 1
mov eax, 0xa18dc7f7
cmovne esi, eax
test dl, 1
mov eax, 0x8126447d
cmovne eax, esi
test ch, 1
jmp 0x4052e2
mov eax, 0x1e3ac7ea
mov dword [ebp - 0x44], 0
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
mov eax, 0xb6fa73fa
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
mov eax, 0xbf7ebaee
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_FindAtomW]
mov edi, section..data
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push esi
mov edx, edi
mov ecx, 0x27
xor ecx, 0x1af
add edx, ecx
mov ecx, 3
sub esp, 4
loop 0x4050b9
mov dword [esp + 4], 1
xor dword [esp + 4], 0xbb8
mov dword [esp], edx
mov dword [esp + 8], 0
lea eax, [ebx]
push eax
ret
mov ecx, dword [0x42df58]
lea eax, [ecx - 1]
imul eax, ecx
mov ecx, eax
mov esi, eax
not ecx
and esi, 0x32447d04
mov edx, ecx
and ecx, 0x63a402f4
and edx, 0xcdbb82fa
or esi, edx
mov edx, eax
xor edx, 0xfffffffe
xor esi, 0x32447d04
and edx, eax
mov edi, esi
and eax, 0x9c5bfd0b
and edi, edx
xor edx, esi
or eax, ecx
or edx, edi
xor eax, 0x9c5bfd0b
mov edi, 0x3b119f68
mov esi, edx
and edx, 0x217a99e8
not esi
and esi, 0xde856617
or edx, esi
mov esi, 0xb6fa73fa
xor edx, 0x217a99e8
mov ecx, edx
and ecx, eax
xor eax, edx
mov edx, dword [0x42df5c]
or eax, ecx
mov ecx, eax
and eax, 0x5087b9bf
not ecx
and ecx, 0xaf784640
or eax, ecx
xor eax, 0x5087b9bf
setne al
cmp edx, 9
setg cl
cmp edx, 0xa
setl dl
mov ah, cl
or cl, al
xor ah, al
xor cl, 1
xor dl, al
or cl, ah
mov al, ah
xor cl, 1
and al, cl
xor cl, ah
or cl, al
mov eax, ecx
xor al, 1
and cl, al
mov ah, al
and ah, cl
xor cl, al
mov al, dl
or cl, ah
xor al, cl
xor cl, 1
xor al, 1
or cl, dl
mov edx, eax
xor dl, cl
test al, 1
mov eax, 0x3b119f68
cmovne eax, esi
test cl, 1
cmovne eax, edi
test dl, 1
cmove eax, esi
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
mov eax, dword [0x42df58]
lea ecx, [eax - 1]
imul ecx, eax
mov eax, ecx
mov esi, ecx
or eax, 0x673eac22
xor esi, 0x98c153dd
mov edx, eax
mov edi, eax
and esi, ecx
not edx
and edi, 0x4ada069d
and edx, 0x90015140
or edx, edi
mov edi, esi
and esi, 0xb525f962
not edi
or eax, edi
and edi, 0x4ada069d
or esi, edi
not eax
mov edi, 0x810de003
xor esi, edx
or eax, esi
mov esi, 0xfb36b74c
mov edx, eax
and eax, 0xf9f9293e
not edx
and edx, 0x606d6c1
or eax, edx
mov edx, eax
xor eax, 0x9ec7851d
xor edx, 0x61387ae2
and edx, ecx
not ecx
and ecx, eax
or edx, ecx
not edx
or edx, eax
cmp edx, 0xffffffff
sete al
setne cl
cmp dword [0x42df5c], 0xa
setl dl
mov ah, dl
xor cl, dl
or ah, al
xor cl, 1
xor al, dl
xor ah, 1
or ah, cl
mov cl, ah
mov dl, ah
and dl, al
xor cl, 1
xor al, 1
and cl, al
or cl, dl
mov dl, ah
and dl, al
xor al, ah
or al, dl
mov edx, eax
xor dl, cl
test dl, 1
cmovne edi, esi
test al, al
mov eax, 0x810de003
cmovne eax, edi
test cl, cl
cmove eax, edi
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
mov eax, dword [0x42df58]
lea edi, [eax - 1]
imul edi, eax
mov eax, edi
mov esi, edi
mov ecx, edi
and edi, 0xb382d428
not eax
and esi, 0x46a6cdab
or ecx, 0x551a967c
mov edx, eax
and ecx, 0x551a967d
and eax, 0x4c7d2bd7
and edx, 0xb9593254
or eax, edi
or esi, edx
mov edx, esi
xor esi, 0x11181254
xor edx, 0x2a44982
and esi, 0x551a967c
and edx, 0xaae56982
or edx, esi
xor ecx, edx
mov edx, ecx
and ecx, 0x4c7d2bd7
not edx
mov esi, edx
and esi, 0xb382d428
or ecx, esi
mov esi, 0xd4d2b504
xor eax, ecx
mov ecx, dword [0x42df5c]
not eax
or eax, edx
cmp eax, 0xffffffff
sete al
cmp ecx, 0xa
setl dl
cmp ecx, 9
mov ecx, eax
mov ch, al
setg ah
xor ch, dl
and dl, al
or al, ah
xor cl, ah
or dl, ch
xor ch, 1
not cl
xor al, 1
and cl, ah
mov ah, al
and ah, cl
xor cl, al
mov al, ch
xor al, dl
or dl, ch
or cl, ah
xor dl, 1
or dl, al
mov eax, edx
xor al, cl
xor cl, 1
or cl, dl
xor al, 1
mov edx, ecx
xor dl, al
test dl, 1
mov edx, 0x7742b30e
cmovne edx, esi
test al, 1
mov esi, 0x7742b30e
mov eax, edx
cmovne eax, esi
test cl, 1
cmovne eax, edx
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x24], edx
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
test al, 1
mov eax, 0x8847f73e
mov ecx, 0x88316a6e
mov dword [ebp - 0x40], 0
cmovne eax, ecx
cmp eax, 0xe34e3b25
jg 0x4047f7
jmp 0x404840
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410653
xor eax, eax
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret