Function at 0x406ea8
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0xbf8b8b
call fcn.00be12c8
push ecx
push ebx
push esi
mov esi, ecx
lea eax, [esi + 4]
mov ecx, eax
neg ecx
lea edx, [eax - 4]
sbb ecx, ecx
and ecx, edx
push edi
mov dword [ebp - 0x10], esi
mov dword [0xd7c41c], ecx
xor edi, edi
mov dword [ebp - 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc83664
push 0x1f
lea ecx, [esi + 0x18]
pop ebx
push 0x64
mov byte [ebp - 4], 1
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc83660
call fcn.0041a4b9
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0xc8365c
lea ecx, [esi + 0x44]
push 0x64
mov byte [ebp - 4], 3
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc83658
call fcn.0041a716
lea ecx, [esi + 0x5c]
push 0x64
mov byte [ebp - 4], 4
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc83654
call fcn.004199a3
lea eax, [esi + 0x74]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc83650
lea ecx, [esi + 0x88]
push 0x64
mov byte [ebp - 4], 6
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc8364c
call fcn.0041a941
lea eax, [esi + 0xa0]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc83648
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 8
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc83644
push 0x64
call fcn.0041ab6c
lea eax, [esi + 0xcc]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc83640
lea ecx, [esi + 0xe0]
push 0x64
mov byte [ebp - 4], 0xa
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc8363c
call fcn.0041af17
lea eax, [esi + 0xf8]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc83638
lea ecx, [esi + 0x10c]
push 0x64
mov byte [ebp - 4], 0xc
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc83634
call fcn.0041b2c2
lea eax, [esi + 0x124]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc83630
lea ecx, [esi + 0x138]
push 0x64
mov byte [ebp - 4], 0xe
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc8362c
call fcn.0041b4ed
lea eax, [esi + 0x150]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc83628
lea ecx, [esi + 0x164]
push 0x64
mov byte [ebp - 4], 0x10
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc83624
call fcn.0041b718
lea ecx, [esi + 0x17c]
push 0x64
mov byte [ebp - 4], 0x11
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc83620
call fcn.0041ba28
lea eax, [esi + 0x194]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc8361c
lea ecx, [esi + 0x1a8]
mov byte [ebp - 4], 0x13
mov dword [ecx + 4], edi
push 0x64
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc83618
call fcn.0041bdd3
lea eax, [esi + 0x1c0]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc83614
lea ecx, [esi + 0x1d4]
push 0x64
mov byte [ebp - 4], 0x15
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc83610
call fcn.0041c1b6
lea eax, [esi + 0x1ec]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc8360c
lea ecx, [esi + 0x200]
push 0x64
mov byte [ebp - 4], 0x17
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc83608
call fcn.0041c561
lea eax, [esi + 0x218]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc83604
lea ecx, [esi + 0x22c]
push 0x64
mov byte [ebp - 4], 0x19
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc83600
call fcn.0041c90c
lea eax, [esi + 0x244]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc835fc
lea ecx, [esi + 0x258]
push 0x64
mov byte [ebp - 4], 0x1b
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc835f8
call fcn.0041ccb7
lea eax, [esi + 0x270]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc835f4
lea ecx, [esi + 0x284]
push 0x64
mov byte [ebp - 4], 0x1d
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc835f0
call fcn.0041d062
lea eax, [esi + 0x29c]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc835ec
lea ecx, [esi + 0x2b0]
push 0x64
mov byte [ebp - 4], bl
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc835e8
call fcn.0041d45a
lea eax, [esi + 0x2c8]
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax], 0xc835e4
lea ecx, [esi + 0x2dc]
push 0x64
mov byte [ebp - 4], 0x21
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc835e0
call fcn.0041d805
lea ecx, [esi + 0x2f4]
push 0x64
mov byte [ebp - 4], 0x22
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edi
mov dword [ecx], 0xc835dc
call fcn.0041dbb0
mov byte [ebp - 4], 0x23
call dword [0xd8648c]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30c], eax
pop edi
mov dword [esi], 0xc835d8
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret