Function at 0x4118e0
Capabilities:
Access peb ldr_data
Enumerate pe sections
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x3b0
mov esi, esp
mov dword [esi + 0x398], ebp
mov dword [esi + 0x39c], esp
mov dword [esi + 0x3a8], 0xffffffff
mov dword [esi + 0x3a4], 0x7023e0
mov ebx, ecx
lea eax, [esi + 0x3a0]
mov edi, edx
mov ecx, dword fs:[0]
mov dword [esi + 0x3a0], ecx
mov dword fs:[0], eax
movzx eax, byte [edx + 4]
test eax, eax
mov dword [esi + 0x14], eax
je 0x411942
cmp eax, 1
jne 0x411951
xor eax, eax
jmp 0x411953
mov byte [esi + 0x71], 2
mov eax, dword [0x919820]
test eax, eax
jne 0x4119a8
jmp 0x411995
mov al, 1
movaps xmm0, xmmword [0x725660]
mov byte [esi + 0x6c], al
mov dword [esi + 0x6d], 0x2020201
mov byte [esi + 0x71], 0
mov dword [esi + 0x48], 4
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 4
movups xmmword [esi + 0x58], xmm0
mov byte [esi + 0x68], 0
mov eax, dword [0x919820]
test eax, eax
jne 0x4119a8
call dword [sym.imp.kernel32.dll_GetProcessHeap]
test eax, eax
je 0x411d55
mov dword [0x919820], eax
push pe_nt_image_headers32
push 8
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
mov dword [esi + 0x10], eax
je 0x411d55
movsd xmm2, qword [esi + 0x60]
movsd xmm1, qword [esi + 0x58]
mov eax, dword [esi + 0x70]
movsd xmm0, qword [esi + 0x68]
movsd qword [esi + 0x30], xmm2
movsd qword [esi + 0x28], xmm1
movsd xmm2, qword [esi + 0x48]
movsd xmm1, qword [esi + 0x50]
mov dword [esi + 0x40], eax
movsd qword [esi + 0x38], xmm0
lea eax, [esi + 0x178]
movsd qword [esi + 0x20], xmm1
movsd qword [esi + 0x18], xmm2
push 0x120
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
movzx eax, byte [edi + 6]
mov dword [esi + 0xc], edi
lea edi, [esi + 0x170]
mov byte [esi + 0xb], al
lea eax, [esi + 0x48]
push 0x128
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movaps xmm0, xmmword [0x725670]
movaps xmm1, xmmword [0x725680]
movaps xmm2, xmmword [str._________._0123456789:_____ABCDEFGHIJKLMNOPQRSTUVWXYZ____abcdefghijklmnopqrstuvwxyz]
lea eax, [esi + 0x298]
movaps xmmword [esi + 0x170], xmm0
movaps xmmword [esi + 0x180], xmm1
movaps xmm1, xmmword [0x7256a0]
movaps xmmword [esi + 0x190], xmm2
movaps xmm2, xmmword [0x7256b0]
movaps xmmword [esi + 0x1a0], xmm1
movaps xmm1, xmmword [0x7256c0]
movaps xmmword [esi + 0x1b0], xmm2
movaps xmm2, xmmword [0x7256d0]
movaps xmmword [esi + 0x1c0], xmm1
movaps xmm1, xmmword [0x7256e0]
movaps xmmword [esi + 0x1d0], xmm2
movaps xmm2, xmmword [0x7256f0]
movaps xmmword [esi + 0x1e0], xmm1
movaps xmm1, xmmword [0x725700]
movaps xmmword [esi + 0x1f0], xmm2
movaps xmm2, xmmword [0x725710]
movaps xmmword [esi + 0x200], xmm1
movaps xmm1, xmmword [0x725720]
movaps xmmword [esi + 0x210], xmm2
movaps xmm2, xmmword [0x725730]
movaps xmmword [esi + 0x220], xmm1
movaps xmm1, xmmword [0x725740]
movaps xmmword [esi + 0x230], xmm2
movaps xmm2, xmmword [0x725750]
movaps xmmword [esi + 0x240], xmm1
movaps xmm1, xmmword [0x725760]
movaps xmmword [esi + 0x250], xmm2
movaps xmmword [esi + 0x260], xmm1
push pe_nt_image_headers32
push edi
push eax
mov edi, eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [ebx + 4], 0
mov dword [ebx], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x18], 0
lea eax, [ebx + 0x28]
push 0x128
lea ecx, [esi + 0x48]
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
movsd xmm1, qword [esi + 0x20]
movsd xmm0, qword [esi + 0x18]
movsd xmm2, qword [esi + 0x30]
mov eax, dword [esi + 0x40]
movsd qword [ebx + 0x164], xmm1
movsd xmm1, qword [esi + 0x28]
mov dword [ebx + 0x184], eax
movsd qword [ebx + 0x15c], xmm0
movsd qword [ebx + 0x174], xmm2
lea eax, [ebx + 0x1ec]
movsd qword [ebx + 0x16c], xmm1
movsd xmm1, qword [esi + 0x38]
movsd qword [ebx + 0x17c], xmm1
mov dword [ebx + 0x1a4], 4
mov dword [ebx + 0x1a8], 0
mov dword [ebx + 0x1ac], 0
mov dword [ebx + 0x1b0], 1
mov dword [ebx + 0x1b4], 0
mov dword [ebx + 0x1b8], 0
mov dword [ebx + 0x1bc], 4
mov dword [ebx + 0x1c0], 0
mov dword [ebx + 0x1c4], 0
mov dword [ebx + 0x1c8], 4
mov dword [ebx + 0x1cc], 0
mov dword [ebx + 0x1d0], 0
mov dword [ebx + 0x1d4], 4
mov dword [ebx + 0x1d8], 0
mov dword [ebx + 0x1dc], 0
mov dword [ebx + 0x1e0], 0
push pe_nt_image_headers32
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 0x14]
movzx ecx, byte [esi + 0xb]
mov edi, dword [esi + 0x10]
mov dword [ebx + 0x2ec], 0xffffffff
mov dword [ebx + 0x2f4], 0
mov dword [ebx + 0x2f0], 0
mov dword [ebx + 0x2fc], 0
mov dword [ebx + 0x2f8], 0
mov dword [ebx + 0x300], 0
mov edx, dword [esi + 0xc]
mov byte [ebx + 0x304], al
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x150], 0
mov word [ebx + 0x154], 0
mov byte [ebx + 0x156], cl
mov byte [ebx + 0x157], 1
mov dword [ebx + 0x158], 0
mov dword [ebx + 0x188], edi
mov dword [ebx + 0x18c], pe_nt_image_headers32
mov dword [ebx + 0x190], pe_nt_image_headers32
mov dword [ebx + 0x194], 0
mov word [ebx + 0x198], 0
mov byte [ebx + 0x19a], cl
mov byte [ebx + 0x19c], cl
mov ecx, dword [esi + 0x3a0]
mov byte [ebx + 0x19d], 1
mov dword [ebx + 0x1a0], edx
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, 1
mov edx, pe_nt_image_headers32
mov dword [esi + 0x3a8], 0
call fcn.00709d20
ud2