Function at 0x402260
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444a48
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x450
mov eax, dword [0x455170]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movaps xmm0, xmmword [0x451bf0]
mov dword [ebp - 0x444], eax
mov eax, dword fs:[0x2c]
mov dword [ebp - 0x430], 0x9d9c8070
mov dword [ebp - 0x42c], 0x7987cabe
mov esi, dword [eax]
mov dword [ebp - 0x450], esi
mov eax, dword [esi + 0xa0]
test al, 1
jne 0x402327
or eax, 1
mov dword [esi + 0xa0], eax
mov dword [ebp - 4], 0
mov byte [esi + 0x2f4], 1
movups xmmword [esi + 0x2dc], xmm0
push 0x445160
movq xmm0, qword [ebp - 0x430]
movq qword [esi + 0x2ec], xmm0
call fcn.0041e22d
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x2f4], 0
lea eax, [eax + 0x2dc]
mov dword [ebp - 0x44c], eax
je 0x40239c
mov esi, dword [ebp - 0x44c]
xorps xmm0, xmm0
movlpd qword [ebp - 0x460], xmm0
mov eax, dword [ebp - 0x45c]
mov edi, dword [ebp - 0x460]
mov dword [ebp - 0x448], eax
mov ecx, edi
mov eax, 0xe9ffe523
and ecx, 7
mov edx, 0x79e9a5d7
shl ecx, 3
call fcn.004446d0
xor byte [edi + esi], al
add edi, 1
adc dword [ebp - 0x448], 0
jne 0x40238c
cmp edi, 0x18
jb 0x402361
mov eax, dword [ebp - 0x44c]
mov byte [esi + 0x18], 0
mov esi, dword [ebp - 0x450]
push eax
push dword [ebp - 0x444]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x45c], eax
test eax, eax
je 0x4026bb
mov eax, dword [esi + 0x174]
movaps xmm0, xmmword [0x451c30]
mov dword [ebp - 0x430], 0xef3c941a
mov dword [ebp - 0x42c], 0x9d79e2e8
test al, 1
jne 0x40241e
or eax, 1
mov dword [esi + 0x174], eax
mov dword [ebp - 4], 1
mov byte [esi + 0x12c], 1
movups xmmword [esi + 0x114], xmm0
push 0x445140
movq xmm0, qword [ebp - 0x430]
movq qword [esi + 0x124], xmm0
call fcn.0041e22d
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
cmp byte [eax + 0x12c], 0
lea eax, [eax + 0x114]
mov dword [ebp - 0x448], eax
je 0x40249b
mov esi, dword [ebp - 0x448]
xorps xmm0, xmm0
movlpd qword [ebp - 0x458], xmm0
mov eax, dword [ebp - 0x454]
mov edi, dword [ebp - 0x458]
mov dword [ebp - 0x44c], eax
nop dword [eax + eax]
mov ecx, edi
mov eax, 0x9b5ff149
and ecx, 7
mov edx, 0x9d178d81
shl ecx, 3
call fcn.004446d0
xor byte [edi + esi], al
add edi, 1
adc dword [ebp - 0x44c], 0
jne 0x40248b
cmp edi, 0x18
jb 0x402460
mov eax, dword [ebp - 0x448]
mov byte [esi + 0x18], 0
mov esi, dword [ebp - 0x450]
push eax
push dword [ebp - 0x444]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x448], eax
test eax, eax
je 0x4026bb
mov eax, dword [esi + 0x2a8]
movaps xmm0, xmmword [0x451c10]
mov dword [ebp - 0x430], 0xba9bfeb5
test al, 1
jne 0x402511
or eax, 1
mov dword [esi + 0x2a8], eax
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x430]
mov word [esi + 0x158], 0x14b
movups xmmword [esi + 0x144], xmm0
push 0x445120
mov dword [esi + 0x154], eax
call fcn.0041e22d
add esp, 4
mov dword [ebp - 4], 0xffffffff
cmp byte [esi + 0x159], 0
lea edi, [esi + 0x144]
je 0x40256f
xorps xmm0, xmm0
movlpd qword [ebp - 0x458], xmm0
mov eax, dword [ebp - 0x454]
mov esi, dword [ebp - 0x458]
mov dword [ebp - 0x450], eax
nop dword [eax]
mov ecx, esi
mov eax, 0xddf597c7
and ecx, 7
mov edx, 0xd1d9554b
shl ecx, 3
call fcn.004446d0
xor byte [esi + edi], al
add esi, 1
adc dword [ebp - 0x450], 0
jne 0x40256b
cmp esi, 0x15
jb 0x402540
mov byte [edi + 0x15], 0
push edi
push dword [ebp - 0x444]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x450], esi
test esi, esi
je 0x4026bb
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.0041fcf0
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.explorer.exe
lea eax, [ebp - 0x220]
push 0x104
push eax
call fcn.00421879
add esp, 0xc
push 0x104
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x444], eax
push ecx
push 0x104
push eax
call fcn.00421815
mov edi, dword fs:[0x30]
add esp, 0xc
mov dword [ebp - 0x44c], edi
push dword [edi + 0x1c]
call dword [ebp - 0x45c]
lea eax, [ebp - 0x220]
push eax
mov eax, dword [edi + 0x10]
add eax, 0x38
push eax
call esi
lea eax, [ebp - 0x220]
push eax
mov eax, dword [edi + 0x10]
add eax, 0x40
push eax
call esi
mov eax, dword [edi + 0xc]
push 0x208
push 0
mov edi, dword [eax + 0xc]
lea eax, [ebp - 0x428]
push eax
mov esi, edi
call fcn.0041fcf0
add esp, 0xc
lea eax, [ebp - 0x428]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
nop dword [eax]
push dword [esi + 0x28]
lea eax, [ebp - 0x428]
push eax
call fcn.00421709
add esp, 8
test eax, eax
je 0x40267e
mov esi, dword [esi]
cmp esi, edi
jne 0x402660
jmp 0x40269c
push dword [ebp - 0x444]
mov edi, dword [ebp - 0x450]
lea eax, [esi + 0x24]
push eax
call edi
push dword [ebp - 0x444]
lea eax, [esi + 0x2c]
push eax
call edi
mov eax, dword [ebp - 0x44c]
push dword [eax + 0x1c]
call dword [ebp - 0x448]
push dword [ebp - 0x444]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x4026c0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041dea9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret