Function at 0x4090b9
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc0
mov esi, esp
mov dword [esi + 0xa8], ebp
lea eax, [esi + 0xb0]
mov dword [esi + 0x44], ecx
mov edi, dword [ebp + 0x10]
mov dword [esi + 0x38], edx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x4398d0
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
and dword [eax + 8], 0
and dword [esi + 0x2c], 0
mov dword [esi + 0x30], 1
mov eax, dword [ebp + 0xc]
and dword [esi + 0x34], 0
lea ecx, [esi + 0x68]
push edi
push eax
push dword [ebp + 8]
call fcn.00412450
add esp, 0xc
mov eax, dword [esi + 0x74]
mov edx, dword [esi + 0xa4]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x48], eax
mov byte [esi + 3], al
mov eax, dword [esi + 0x68]
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x20], edx
and edi, 0xffffff00
mov dword [esi + 0x54], edi
mov edi, edx
sub edi, ecx
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x40], edi
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x70]
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x78]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x84]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x8c]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x98]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x9c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0xa0]
mov dword [esi + 0x3c], eax
mov eax, edx
lea eax, [edx - 1]
mov dword [esi + 0x60], eax
xor eax, eax
cmp dword [esi + 0x58], 0
mov dword [esi + 0x24], eax
je 0x40934d
movzx eax, byte [esi + 3]
mov edx, dword [esi + 0xc]
mov ebx, dword [esi + 8]
or eax, dword [esi + 0x54]
mov edi, edx
mov dword [esi + 0x10], edx
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x14]
cmp dword [esi + 0x18], edi
mov ecx, edi
mov dword [esi + 0x50], edi
cmova ecx, dword [esi + 0x18]
cmp edx, 0xffffffff
mov edx, edi
cmove ecx, dword [esi + 0x18]
mov dword [esi + 0x14], ecx
mov ecx, 0
cmove edx, ecx
mov dword [esi + 0x1c], edx
mov ecx, dword [esi + 0x60]
add ecx, eax
cmp ecx, dword [esi + 4]
jae 0x409458
mov cl, byte [ebx + ecx]
mov edx, eax
xor edi, edi
xor eax, eax
inc eax
shld edi, eax, cl
mov eax, ebx
xor ebx, ebx
inc ebx
shl ebx, cl
test cl, 0x20
mov ecx, 0
cmovne edi, ebx
cmovne ebx, ecx
and edi, dword [esi + 0x64]
and ebx, dword [esi + 0x5c]
or ebx, edi
je 0x4092ba
mov ebx, dword [esi + 0x14]
lea edi, [eax + edx]
mov eax, edx
mov ecx, edx
cmp ebx, dword [esi + 0x20]
jae 0x409267
mov ecx, ebx
add ebx, eax
cmp ebx, dword [esi + 4]
jae 0x40949d
mov eax, dword [esi + 0x3c]
lea ebx, [ecx + 1]
mov al, byte [eax + ecx]
cmp al, byte [edi + ecx]
mov eax, edx
je 0x40922e
sub eax, dword [esi + 0x18]
mov edx, dword [esi + 0xc]
mov ebx, dword [esi + 8]
cmp edx, 0xffffffff
lea eax, [eax + ecx + 1]
je 0x4091e6
jmp 0x4092e7
mov ecx, dword [esi + 0x18]
cmp dword [esi + 0x1c], ecx
jae 0x4092f5
dec ecx
cmp ecx, dword [esi + 0x20]
jae 0x4094be
lea edi, [ecx + edx]
mov eax, edx
cmp edi, dword [esi + 4]
jae 0x4094d5
mov eax, dword [esi + 0x3c]
mov bl, byte [eax + ecx]
mov eax, dword [esi + 8]
cmp bl, byte [eax + edi]
mov ebx, dword [esi + 8]
je 0x40926a
mov eax, edx
mov edx, dword [esi + 0xc]
add eax, dword [esi + 0x4c]
cmp edx, 0xffffffff
je 0x4091e6
mov edi, dword [esi + 0x40]
mov ecx, eax
mov dword [esi + 0x10], edi
jmp 0x4091c3
mov ecx, dword [esi + 0xc]
mov ebx, dword [esi + 0x10]
add edx, dword [esi + 0x20]
mov edi, 0
cmp ecx, 0xffffffff
cmovne ebx, edi
mov edi, dword [esi + 0x50]
mov dword [esi + 0x10], ebx
mov ebx, 0
cmovne edi, ebx
mov ebx, eax
mov eax, edx
mov edx, ecx
jmp 0x4091c3
mov dword [esi + 0x10], 0
xor edi, edi
jmp 0x4091c3
mov eax, dword [esi + 0x20]
cmp dword [esi + 0xc], 0xffffffff
mov ebx, dword [esi + 0x10]
mov ecx, edx
lea edi, [edx + eax]
mov eax, 0
cmovne ebx, eax
and dword [esi + 0xb8], 0
mov eax, ecx
mov dword [esi + 0x1c], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0xc], ebx
mov edi, dword [esi + 0x38]
mov edx, dword [esi + 0x24]
lea ecx, [esi + 0x2c]
add eax, edi
add edx, edi
push eax
call fcn.0040eb59
pop eax
lea ecx, [esi + 0x2c]
mov edx, 0x455fc8
push 0x455fc8
call fcn.0040eb59
pop eax
mov eax, dword [esi + 0x1c]
jmp 0x40919e
test dword [esi + 0x48], 0xff0000
mov ecx, dword [esi + 8]
jne 0x409458
mov ebx, dword [esi + 0x28]
mov dh, byte [esi + 3]
mov eax, dword [esi + 4]
test ebx, ebx
je 0x409382
mov eax, dword [esi + 4]
sub eax, ebx
jbe 0x40937c
cmp byte [ecx + ebx], 0xbf
jg 0x409382
jmp 0x4094ee
jne 0x4094ee
test eax, eax
mov dword [esi + 0x28], ebx
je 0x409424
mov dl, byte [ecx + ebx]
movzx eax, dl
test dl, dl
jns 0x4093ea
movzx edi, byte [ecx + ebx + 1]
and eax, 0x1f
and edi, 0x3f
cmp dl, 0xdf
jbe 0x4093db
movzx ecx, byte [ecx + ebx + 2]
shl edi, 6
and ecx, 0x3f
or ecx, edi
cmp dl, 0xf0
jb 0x4093e2
mov edi, dword [esi + 8]
mov byte [esi + 3], dh
and eax, 7
shl ecx, 6
shl eax, 0x12
movzx edx, byte [edi + ebx + 3]
and edx, 0x3f
or edx, ecx
mov ecx, edi
or eax, edx
mov dh, byte [esi + 3]
jmp 0x4093ea
shl eax, 6
or eax, edi
jmp 0x4093ea
shl eax, 0xc
or eax, ecx
mov ecx, dword [esi + 8]
test dh, dh
jne 0x409441
cmp eax, 0x110000
je 0x409458
cmp eax, 0x80
mov edx, 1
jb 0x409416
cmp eax, 0x800
push 2
pop edx
jb 0x409416
cmp eax, 0x10000
push 4
pop edx
sbb edx, 0
mov eax, dword [esi + 0x28]
add eax, edx
mov dh, 1
mov ebx, eax
jmp 0x409363
and dword [esi + 0xb8], 0
test dh, dh
mov byte [esi + 3], dh
je 0x409458
mov eax, dword [esi + 0x28]
xor byte [esi + 3], 1
mov dword [esi + 0x1c], eax
jmp 0x40931e
and dword [esi + 0xb8], 0
xor dh, 1
mov eax, ebx
mov dword [esi + 0x1c], ebx
mov byte [esi + 3], dh
jmp 0x40931e
mov eax, dword [esi + 0x38]
mov edi, dword [ebp + 8]
mov edx, dword [esi + 0x24]
and dword [esi + 0xb8], 0
lea ecx, [esi + 0x2c]
add edi, eax
add edx, eax
push edi
call fcn.0040eb59
pop eax
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x44]
movsd xmm0, qword [esi + 0x2c]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
mov ecx, dword [esi + 0xb0]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 4]
add ecx, eax
cmp edx, ecx
cmova ecx, edx
and dword [esi + 0xb8], 0
push 0x4531f4
call fcn.00448770
pop eax
jmp 0x409507
and dword [esi + 0xb8], 0
mov edx, dword [esi + 0x20]
push 0x4531d4
call fcn.00448770
pop eax
jmp 0x409507
and dword [esi + 0xb8], 0
mov edx, dword [esi + 4]
mov ecx, edi
push 0x4531e4
call fcn.00448770
pop eax
jmp 0x409507
and dword [esi + 0xb8], 0
mov edx, dword [esi + 4]
push 0x453bb4
push edx
push ebx
call fcn.00448c30
add esp, 0xc
ud2