Function at 0x4402ee
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x24]
mov dword [ebp - 0x4c], 0xffffffff
cmp dword [0x5299a0], 0
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x68], eax
mov esi, dword [ebp + 0x1c]
mov dword [ebp - 0x64], edx
jne 0x440347
mov eax, 0x4a9425
mov ebx, 0xc000007a
call fcn.0043f793
mov dword [esp + 4], str.NtCreateFile
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push ecx
push ecx
mov dword [0x5299a0], eax
test eax, eax
je 0x440349
xor ebx, ebx
cmp dword [0x52999c], 0
jne 0x44037e
mov eax, 0x4a9425
call fcn.0043f793
mov dword [esp + 4], str.RtlDosPathNameToNtPathNameW
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
push edx
push edx
mov dword [0x52999c], eax
mov eax, 0xc000007a
cmove ebx, eax
cmp dword [0x529998], 0
jne 0x4403b3
mov eax, 0x4a9425
call fcn.0043f793
mov dword [esp + 4], str.RtlFreeHeap
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
push ecx
push ecx
mov dword [0x529998], eax
mov eax, 0xc000007a
cmove ebx, eax
cmp dword [0x529994], 0
jne 0x4403de
mov eax, 0x4a9425
call fcn.0043f793
mov dword [esp + 4], str.RtlSetLastWin32ErrorAndNtStatusFromNtStatus
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push edx
push edx
mov dword [0x529994], eax
cmp dword [0x529994], 0
mov eax, dword [ebp + 8]
je 0x4403ee
test ebx, ebx
je 0x44044f
call fcn.0043ee8a
xor ecx, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ecx
mov edx, eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [ebp - 0x5c], edx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
sub esp, 0x1c
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, dword [ebp - 0x5c]
mov esi, eax
test edx, edx
je 0x440440
mov dword [esp], edx
call sub.msvcrt.dll_free
mov dword [esp], esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push eax
jmp 0x44062e
call fcn.0043ee8a
mov edx, eax
mov eax, dword [ebp + 0x18]
dec eax
cmp eax, 4
ja 0x440482
mov eax, dword [ebp + 0x18]
mov ebx, esi
shr ebx, 0x1e
mov al, byte [eax + 0x4a967f]
xor ebx, 1
and ebx, 1
mov byte [ebp - 0x5c], al
shl ebx, 5
test esi, esi
jns 0x44048e
or ebx, 2
jmp 0x44048e
mov dword [esp], 0x57
jmp 0x440533
bt esi, 0x1d
jae 0x440497
or ebx, 8
bt esi, 0x1c
jae 0x4404a0
or bh, 8
bt esi, 0x1b
jae 0x4404a9
or ebx, 4
bt esi, 0x1a
jae 0x4404b8
or bh, 0x10
or edi, 0x10000
bt esi, 0x19
jae 0x4404db
bt edi, 0x1c
jae 0x4404c9
or bh, 0x44
jmp 0x4404de
test edi, edi
jns 0x4404d0
or bh, 0x40
bt edi, 0x1e
jae 0x4404de
or bh, 4
jmp 0x4404de
or ebx, 0x40
bt esi, 0x15
jae 0x4404ea
or ebx, 0x200000
bt esi, 0x14
jae 0x4404f6
or ebx, 0x400000
xor eax, eax
lea ecx, [ebp - 0x38]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [ebp - 0x60], edx
call dword [0x52999c]
mov edx, dword [ebp - 0x60]
lea ecx, [ebp - 0x38]
sub esp, 0x10
test al, al
jne 0x440542
test edx, edx
je 0x44052c
mov dword [esp], edx
call sub.msvcrt.dll_free
mov dword [esp], 2
call dword [sym.imp.KERNEL32.DLL_SetLastError]
or ebx, 0xffffffff
push eax
jmp 0x44062e
xor eax, eax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], eax
xor eax, eax
cmp dword [ebp + 0x14], 0
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
je 0x44057d
mov eax, dword [ebp + 0x14]
cmp dword [eax + 8], 0
setne al
movzx eax, al
add eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 4]
mov dword [ebp - 0x20], eax
bt esi, 0x18
jb 0x440587
or dword [ebp - 0x24], 0x40
mov dword [ebp - 0x60], edx
mov edx, dword [ebp - 0x64]
and esi, 0x7fa7
or edi, 0x100080
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x44], edx
xor edx, edx
mov dword [ebp - 0x48], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ebx
movzx eax, byte [ebp - 0x5c]
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x48]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x40]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x30]
mov dword [esp + 8], eax
lea eax, [ebp - 0x4c]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [0x5299a0]
mov ecx, dword [ebp - 0x34]
sub esp, 0x2c
mov ebx, eax
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
xor ecx, ecx
mov dword [esp + 4], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [0x529998]
mov edx, dword [ebp - 0x60]
sub esp, 0xc
test edx, edx
je 0x440621
mov dword [esp], edx
call sub.msvcrt.dll_free
mov dword [esp], ebx
call dword [0x529994]
push eax
mov ebx, dword [ebp - 0x4c]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret