Function at 0x4391c0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1a
push 0
push 0
dec ecx
jne 0x4391c9
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
test dl, dl
je 0x4391e2
add esp, 0xfffffff0
call fcn.00403da8
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
lea eax, [ebp - 8]
call fcn.00405190
xor eax, eax
push ebp
push 0x2f8bdce
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00403b30
lea eax, [ebx + 4]
mov edx, dword [ebp - 8]
call fcn.00404d0c
lea edx, [ebp - 0xc]
mov eax, dword [ebx + 4]
call fcn.0041a030
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x18]
call fcn.00404d0c
mov eax, dword [ebx + 0x18]
xor edx, edx
call fcn.0040502c
je 0x439262
lea edx, [ebp - 0x18]
mov eax, dword [ebx + 0x18]
call fcn.00419f28
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.0042fbb8
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00419f28
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x18]
call fcn.00404d0c
mov edi, 0xfffe
mov eax, edi
call fcn.00403268
mov esi, eax
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov edx, edi
mov eax, esi
call fcn.00415944
lea eax, [ebp - 0x24]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042fbb8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.00419f28
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x10]
call fcn.00404d0c
lea edx, [ebp - 0x2c]
mov eax, dword [ebx + 0x10]
call fcn.0041a068
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00419f28
mov edx, dword [ebp - 0x28]
lea eax, [ebx + 0x14]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov edx, esi
mov eax, edi
call fcn.00415750
lea eax, [ebp - 0x38]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.0042fbb8
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00419f28
mov edx, dword [ebp - 0x30]
lea eax, [ebx + 0x1c]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov edx, edi
mov eax, esi
call fcn.004158ac
lea eax, [ebp - 0x44]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.0042fbb8
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00419f28
mov edx, dword [ebp - 0x3c]
lea eax, [ebx + 0xc]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0x2f904c8]
cmp byte [eax], 0
je 0x43936b
push esi
push 0
push 0
push 5
push 0
call fcn.0041a78c
jmp 0x439379
push esi
push 0
push 0
push 5
push 0
call fcn.0041a784
test eax, eax
jne 0x4393aa
lea eax, [ebp - 0x50]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.0042fbb8
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.00419f28
mov edx, dword [ebp - 0x48]
lea eax, [ebx + 8]
call fcn.00404d0c
jmp 0x4393b5
lea eax, [ebx + 8]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0x2f904c8]
cmp byte [eax], 0
je 0x4393d8
push esi
push 0
push 0
push 0x2e
push 0
call fcn.0041a78c
jmp 0x4393e6
push esi
push 0
push 0
push 0x2e
push 0
call fcn.0041a784
test eax, eax
jne 0x439417
lea eax, [ebp - 0x5c]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.0042fbb8
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.00419f28
mov edx, dword [ebp - 0x54]
lea eax, [ebx + 0x20]
call fcn.00404d0c
jmp 0x439422
lea eax, [ebx + 0x20]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0x2f904c8]
cmp byte [eax], 0
je 0x439445
push esi
push 0
push 0
push 0x26
push 0
call fcn.0041a78c
jmp 0x439453
push esi
push 0
push 0
push 0x26
push 0
call fcn.0041a784
test eax, eax
jne 0x439484
lea eax, [ebp - 0x68]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.0042fbb8
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00419f28
mov edx, dword [ebp - 0x60]
lea eax, [ebx + 0x24]
call fcn.00404d0c
jmp 0x43948f
lea eax, [ebx + 0x24]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0x2f904c8]
cmp byte [eax], 0
je 0x4394b2
push esi
push 0
push 0
push 0x23
push 0
call fcn.0041a78c
jmp 0x4394c0
push esi
push 0
push 0
push 0x23
push 0
call fcn.0041a784
test eax, eax
jne 0x4394f1
lea eax, [ebp - 0x74]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x70]
call fcn.0042fbb8
mov eax, dword [ebp - 0x70]
lea edx, [ebp - 0x6c]
call fcn.00419f28
mov edx, dword [ebp - 0x6c]
lea eax, [ebx + 0x28]
call fcn.00404d0c
jmp 0x4394fc
lea eax, [ebx + 0x28]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0x2f904c8]
cmp byte [eax], 0
je 0x43951f
push esi
push 0
push 0
push 0x2b
push 0
call fcn.0041a78c
jmp 0x43952d
push esi
push 0
push 0
push 0x2b
push 0
call fcn.0041a784
test eax, eax
jne 0x43955e
lea eax, [ebp - 0x80]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x7c]
call fcn.0042fbb8
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x78]
call fcn.00419f28
mov edx, dword [ebp - 0x78]
lea eax, [ebx + 0x2c]
call fcn.00404d0c
jmp 0x439569
lea eax, [ebx + 0x2c]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0x2f904c8]
cmp byte [eax], 0
je 0x43958c
push esi
push 0
push 0
push 0x27
push 0
call fcn.0041a78c
jmp 0x43959a
push esi
push 0
push 0
push 0x27
push 0
call fcn.0041a784
test eax, eax
jne 0x4395dd
lea eax, [ebp - 0x8c]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
call fcn.0042fbb8
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.00419f28
mov edx, dword [ebp - 0x84]
lea eax, [ebx + 0x30]
call fcn.00404d0c
jmp 0x4395e8
lea eax, [ebx + 0x30]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0x2f904c8]
cmp byte [eax], 0
je 0x43960b
push esi
push 0
push 0
push 0x22
push 0
call fcn.0041a78c
jmp 0x439619
push esi
push 0
push 0
push 0x22
push 0
call fcn.0041a784
test eax, eax
jne 0x43965c
lea eax, [ebp - 0x98]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.0042fbb8
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x90]
call fcn.00419f28
mov edx, dword [ebp - 0x90]
lea eax, [ebx + 0x34]
call fcn.00404d0c
jmp 0x439667
lea eax, [ebx + 0x34]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0x2f904c8]
cmp byte [eax], 0
je 0x43968a
push esi
push 0
push 0
push 0x21
push 0
call fcn.0041a78c
jmp 0x439698
push esi
push 0
push 0
push 0x21
push 0
call fcn.0041a784
test eax, eax
jne 0x4396db
lea eax, [ebp - 0xa4]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa0]
call fcn.0042fbb8
mov eax, dword [ebp - 0xa0]
lea edx, [ebp - 0x9c]
call fcn.00419f28
mov edx, dword [ebp - 0x9c]
lea eax, [ebx + 0x38]
call fcn.00404d0c
jmp 0x4396e6
lea eax, [ebx + 0x38]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0x2f904c8]
cmp byte [eax], 0
je 0x439709
push esi
push 0
push 0
push 0x20
push 0
call fcn.0041a78c
jmp 0x439717
push esi
push 0
push 0
push 0x20
push 0
call fcn.0041a784
test eax, eax
jne 0x43975a
lea eax, [ebp - 0xb0]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0xac]
call fcn.0042fbb8
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa8]
call fcn.00419f28
mov edx, dword [ebp - 0xa8]
lea eax, [ebx + 0x3c]
call fcn.00404d0c
jmp 0x439765
lea eax, [ebx + 0x3c]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0x2f904c8]
cmp byte [eax], 0
je 0x439788
push esi
push 0
push 0
push 0x1a
push 0
call fcn.0041a78c
jmp 0x439796
push esi
push 0
push 0
push 0x1a
push 0
call fcn.0041a784
test eax, eax
jne 0x4397d9
lea eax, [ebp - 0xbc]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.0042fbb8
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.00419f28
mov edx, dword [ebp - 0xb4]
lea eax, [ebx + 0x40]
call fcn.00404d0c
jmp 0x4397e4
lea eax, [ebx + 0x40]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0x2f904c8]
cmp byte [eax], 0
je 0x439807
push esi
push 0
push 0
push 0x1c
push 0
call fcn.0041a78c
jmp 0x439815
push esi
push 0
push 0
push 0x1c
push 0
call fcn.0041a784
test eax, eax
jne 0x439858
lea eax, [ebp - 0xc8]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.0042fbb8
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0xc0]
call fcn.00419f28
mov edx, dword [ebp - 0xc0]
lea eax, [ebx + 0x44]
call fcn.00404d0c
jmp 0x439863
lea eax, [ebx + 0x44]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov edx, edi
mov eax, esi
call fcn.00406ed0
mov eax, dword [0x2f904c8]
cmp byte [eax], 0
je 0x439886
push esi
push 0
push 0
push 0x28
push 0
call fcn.0041a78c
jmp 0x439894
push esi
push 0
push 0
push 0x28
push 0
call fcn.0041a784
test eax, eax
jne 0x4398d7
lea eax, [ebp - 0xd4]
mov edx, esi
call fcn.00404e18
mov eax, dword [ebp - 0xd4]
lea edx, [ebp - 0xd0]
call fcn.0042fbb8
mov eax, dword [ebp - 0xd0]
lea edx, [ebp - 0xcc]
call fcn.00419f28
mov edx, dword [ebp - 0xcc]
lea eax, [ebx + 0x48]
call fcn.00404d0c
jmp 0x4398e2
lea eax, [ebx + 0x48]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
mov eax, esi
call fcn.00403288
lea eax, [ebx + 0x4c]
mov edx, dword [ebx + 0x18]
call fcn.00404d0c
lea eax, [ebx + 0x50]
mov edx, dword [ebx + 0x10]
call fcn.00404d0c
lea eax, [ebx + 0x54]
mov edx, dword [ebx + 0xc]
call fcn.00404d0c
lea eax, [ebx + 0x58]
mov edx, dword [ebx + 8]
call fcn.00404d0c
lea eax, [ebx + 0x5c]
mov edx, dword [ebx + 0x24]
call fcn.00404d0c
lea eax, [ebx + 0x60]
mov edx, dword [ebx + 0x2c]
call fcn.00404d0c
lea eax, [ebx + 0x64]
mov edx, dword [ebx + 0x20]
call fcn.00404d0c
lea eax, [ebx + 0x68]
mov edx, dword [ebx + 0x30]
call fcn.00404d0c
lea eax, [ebx + 0x6c]
mov edx, dword [ebx + 0x34]
call fcn.00404d0c
lea eax, [ebx + 0x70]
mov edx, dword [ebx + 0x38]
call fcn.00404d0c
lea eax, [ebx + 0x74]
mov edx, dword [ebx + 0x3c]
call fcn.00404d0c
lea eax, [ebx + 0x78]
mov edx, dword [ebx + 0x40]
call fcn.00404d0c
lea eax, [ebx + 0x7c]
mov edx, dword [ebx + 0x1c]
call fcn.00404d0c
lea eax, [ebx + 0x80]
mov edx, dword [ebx + 0x28]
call fcn.00404d0c
lea eax, [ebx + 0x84]
mov edx, dword [ebx + 0x44]
call fcn.00404d0c
lea eax, [ebx + 0x88]
mov edx, dword [ebx + 0x14]
call fcn.00404d0c
lea eax, [ebx + 0x8c]
mov edx, dword [ebx + 0x48]
call fcn.00404d0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2f8bdd5
lea eax, [ebp - 0xd4]
mov edx, 0x34
call fcn.00404ce8
ret