Function at 0x413dd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [0x643d98], eax
test eax, eax
je 0x414012
mov ecx, dword [0x632f30]
push ecx
push eax
call fcn.00413d30
mov edx, dword [0x632d5c]
mov ecx, dword [0x643d98]
add esp, 8
push edx
push ecx
mov dword [0x643ccc], eax
call eax
mov edx, dword [0x6330e8]
mov dword [0x643bf4], eax
mov eax, dword [0x643d98]
push edx
push eax
call dword [0x643ccc]
mov ecx, dword [0x633150]
mov edx, dword [0x643d98]
push ecx
push edx
mov dword [0x643d58], eax
call dword [0x643ccc]
mov ecx, dword [0x643d98]
mov dword [0x643be4], eax
mov eax, dword [0x632db8]
push eax
push ecx
call dword [0x643ccc]
mov edx, dword [0x632da4]
mov dword [0x643d48], eax
mov eax, dword [0x643d98]
push edx
push eax
call dword [0x643ccc]
mov ecx, dword [0x632e44]
mov edx, dword [0x643d98]
push ecx
push edx
mov dword [0x643c10], eax
call dword [0x643ccc]
mov ecx, dword [0x643d98]
mov dword [0x643bf0], eax
mov eax, dword [0x633008]
push eax
push ecx
call dword [0x643ccc]
mov edx, dword [0x632e80]
mov dword [0x643d9c], eax
mov eax, dword [0x643d98]
push edx
push eax
call dword [0x643ccc]
mov ecx, dword [0x6330c8]
mov edx, dword [0x643d98]
push ecx
push edx
mov dword [0x643d88], eax
call dword [0x643ccc]
mov ecx, dword [0x643d98]
mov dword [0x643c50], eax
mov eax, dword [0x633078]
push eax
push ecx
call dword [0x643ccc]
mov edx, dword [0x632efc]
mov dword [0x643c60], eax
mov eax, dword [0x643d98]
push edx
push eax
call dword [0x643ccc]
mov ecx, dword [0x632e38]
mov edx, dword [0x643d98]
push ecx
push edx
mov dword [0x643d10], eax
call dword [0x643ccc]
mov ecx, dword [0x643d98]
mov dword [0x643d44], eax
mov eax, dword [0x633118]
push eax
push ecx
call dword [0x643ccc]
mov edx, dword [0x632c10]
mov dword [0x643d38], eax
mov eax, dword [0x643d98]
push edx
push eax
call dword [0x643ccc]
mov ecx, dword [0x6330c0]
mov edx, dword [0x643d98]
push ecx
push edx
mov dword [0x643dec], eax
call dword [0x643ccc]
mov ecx, dword [0x643d98]
mov dword [0x643dac], eax
mov eax, dword [0x632d7c]
push eax
push ecx
call dword [0x643ccc]
mov edx, dword [0x632f58]
mov dword [0x643dc4], eax
mov eax, dword [0x643d98]
push edx
push eax
call dword [0x643ccc]
mov ecx, dword [0x633140]
mov edx, dword [0x643d98]
push ecx
push edx
mov dword [0x643c6c], eax
call dword [0x643ccc]
mov ecx, dword [0x643d98]
mov dword [0x643cd8], eax
mov eax, dword [0x632c1c]
push eax
push ecx
call dword [0x643ccc]
mov edx, dword [0x632c88]
mov dword [0x643df4], eax
mov eax, dword [0x643d98]
push edx
push eax
call dword [0x643ccc]
mov ecx, dword [0x632e04]
mov edx, dword [0x643d98]
push ecx
push edx
mov dword [0x643d00], eax
call dword [0x643ccc]
mov dword [0x643d08], eax
mov eax, dword [0x633080]
push eax
call dword [0x643bf4]
mov ecx, dword [0x632cd8]
push ecx
mov dword [0x643bbc], eax
call dword [0x643bf4]
mov edx, dword [0x632c60]
push edx
mov dword [0x643cdc], eax
call dword [0x643bf4]
mov dword [0x643dcc], eax
mov eax, dword [0x632d38]
push eax
call dword [0x643bf4]
mov ecx, dword [0x632e70]
push ecx
mov dword [0x643c90], eax
call dword [0x643bf4]
mov dword [0x643cc0], eax
mov eax, dword [0x643bbc]
test eax, eax
je 0x414086
mov edx, dword [0x632fe4]
push edx
push eax
call dword [0x643ccc]
mov dword [0x643c9c], eax
mov eax, dword [0x643cdc]
test eax, eax
je 0x4140ba
mov ecx, dword [0x632f64]
push ecx
push eax
call dword [0x643ccc]
mov edx, dword [0x632d28]
mov dword [0x643d18], eax
mov eax, dword [0x643cdc]
push edx
push eax
call dword [0x643ccc]
mov dword [0x643cbc], eax
mov eax, dword [0x643dcc]
test eax, eax
je 0x4140d6
mov ecx, dword [0x632ed8]
push ecx
push eax
call dword [0x643ccc]
mov dword [0x643d5c], eax
mov eax, dword [0x643c90]
test eax, eax
je 0x4140f2
mov edx, dword [0x632c84]
push edx
push eax
call dword [0x643ccc]
mov dword [0x643d24], eax
mov eax, dword [0x643cc0]
test eax, eax
je 0x414125
mov ecx, dword [0x632f54]
push ecx
push eax
call dword [0x643ccc]
mov edx, dword [0x643cc0]
push str.NtQueryInformationProcess
push edx
mov dword [0x643d8c], eax
call dword [0x643ccc]
mov dword [0x643be8], eax
mov esp, ebp
pop ebp
ret