Function at 0x422b80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
mov dword [0x630068], esi
test esi, esi
je 0x422db3
call fcn.00422ae0
mov ecx, dword [0x62f9f8]
push ecx
push esi
mov dword [0x62ff9c], eax
call eax
mov edx, dword [0x62fd9c]
mov dword [0x62fec4], eax
mov eax, dword [0x630068]
push edx
push eax
call dword [0x62ff9c]
mov ecx, dword [0x62fe08]
mov edx, dword [0x630068]
push ecx
push edx
mov dword [0x630028], eax
call dword [0x62ff9c]
mov ecx, dword [0x630068]
mov dword [0x62feb4], eax
mov eax, dword [0x62fa58]
push eax
push ecx
call dword [0x62ff9c]
mov edx, dword [0x62fa44]
mov dword [0x630018], eax
mov eax, dword [0x630068]
push edx
push eax
call dword [0x62ff9c]
mov ecx, dword [0x62fae4]
mov edx, dword [0x630068]
push ecx
push edx
mov dword [0x62fee0], eax
call dword [0x62ff9c]
mov ecx, dword [0x630068]
mov dword [0x62fec0], eax
mov eax, dword [0x62fcb0]
push eax
push ecx
call dword [0x62ff9c]
mov edx, dword [0x62fb28]
mov dword [0x63006c], eax
mov eax, dword [0x630068]
push edx
push eax
call dword [0x62ff9c]
mov ecx, dword [0x62fd7c]
mov edx, dword [0x630068]
push ecx
push edx
mov dword [0x630058], eax
call dword [0x62ff9c]
mov ecx, dword [0x630068]
mov dword [0x62ff20], eax
mov eax, dword [0x62fd20]
push eax
push ecx
call dword [0x62ff9c]
mov edx, dword [0x62fba4]
mov dword [0x62ff30], eax
mov eax, dword [0x630068]
push edx
push eax
call dword [0x62ff9c]
mov ecx, dword [0x62fad8]
mov edx, dword [0x630068]
push ecx
push edx
mov dword [0x62ffe0], eax
call dword [0x62ff9c]
mov ecx, dword [0x630068]
mov dword [0x630014], eax
mov eax, dword [0x62fdd0]
push eax
push ecx
call dword [0x62ff9c]
mov edx, dword [0x62f8a8]
mov dword [0x630008], eax
push edx
mov eax, dword [0x630068]
push eax
call dword [0x62ff9c]
mov ecx, dword [0x62fd74]
mov edx, dword [0x630068]
push ecx
push edx
mov dword [0x6300bc], eax
call dword [0x62ff9c]
mov ecx, dword [0x630068]
mov dword [0x63007c], eax
mov eax, dword [0x62fa18]
push eax
push ecx
call dword [0x62ff9c]
mov edx, dword [0x62fc00]
mov dword [0x630094], eax
mov eax, dword [0x630068]
push edx
push eax
call dword [0x62ff9c]
mov ecx, dword [0x62fdf8]
mov edx, dword [0x630068]
push ecx
push edx
mov dword [0x62ff3c], eax
call dword [0x62ff9c]
mov ecx, dword [0x630068]
mov dword [0x62ffa8], eax
mov eax, dword [0x62f8b4]
push eax
push ecx
call dword [0x62ff9c]
mov edx, dword [0x62f920]
mov dword [0x6300c0], eax
mov eax, dword [0x630068]
push edx
push eax
call dword [0x62ff9c]
mov ecx, dword [0x62faa4]
mov edx, dword [0x630068]
push ecx
push edx
mov dword [0x62ffd0], eax
call dword [0x62ff9c]
mov dword [0x62ffd8], eax
mov eax, dword [0x62fd28]
push eax
call dword [0x62fec4]
mov ecx, dword [0x62f970]
push ecx
mov dword [0x62fe8c], eax
call dword [0x62fec4]
mov edx, dword [0x62f8f8]
push edx
mov dword [0x62ffac], eax
call dword [0x62fec4]
mov dword [0x63009c], eax
mov eax, dword [0x62f9d0]
push eax
call dword [0x62fec4]
mov ecx, dword [0x62fb14]
push ecx
mov dword [0x62ff60], eax
call dword [0x62fec4]
mov dword [0x62ff90], eax
mov eax, dword [0x62fe8c]
pop esi
test eax, eax
je 0x422e28
mov edx, dword [0x62fc8c]
push edx
push eax
call dword [0x62ff9c]
mov dword [0x62ff6c], eax
mov eax, dword [0x62ffac]
test eax, eax
je 0x422e5c
mov ecx, dword [0x62fc0c]
push ecx
push eax
call dword [0x62ff9c]
mov edx, dword [0x62f9c0]
mov dword [0x62ffe8], eax
mov eax, dword [0x62ffac]
push edx
push eax
call dword [0x62ff9c]
mov dword [0x62ff8c], eax
mov eax, dword [0x63009c]
test eax, eax
je 0x422e78
mov ecx, dword [0x62fb80]
push ecx
push eax
call dword [0x62ff9c]
mov dword [0x63002c], eax
mov eax, dword [0x62ff60]
test eax, eax
je 0x422e94
mov edx, dword [0x62f91c]
push edx
push eax
call dword [0x62ff9c]
mov dword [0x62fff4], eax
mov eax, dword [0x62ff90]
test eax, eax
je 0x422ec7
mov ecx, dword [0x62fbfc]
push ecx
push eax
call dword [0x62ff9c]
mov edx, dword [0x62ff90]
push str.NtQueryInformationProcess
push edx
mov dword [0x63005c], eax
call dword [0x62ff9c]
mov dword [0x62feb8], eax
mov esp, ebp
pop ebp
ret