Function at 0x4431c0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5e0ddf
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x65fde0]
xor eax, esp
mov dword [esp + 0x220], eax
push ebp
push esi
mov eax, dword [0x65fde0]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov eax, edi
mov dword [esp + 0x20], edi
call fcn.00411f00
push 0x626b3c
lea ecx, [esp + 0x14]
mov dword [esp + 0x23c], 0
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 1
call fcn.0040a620
push edi
lea ecx, [edi + 0x20]
push ecx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 3
call fcn.0040a610
push 0x626b50
lea ecx, [esp + 0x10]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 4
call fcn.0040a620
push edi
lea edx, [edi + 0x48]
push edx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 6
call fcn.0040a610
push 0x626b64
lea ecx, [esp + 0x14]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 7
call fcn.0040a620
push edi
lea ecx, [edi + 0x70]
push ecx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 9
call fcn.0040a610
push 0x626b7c
lea ecx, [esp + 0x10]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0xa
call fcn.0040a620
push edi
lea edx, [edi + 0x98]
push edx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 0xc
call fcn.0040a610
push 0x626a6c
lea ecx, [esp + 0x14]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0xd
call fcn.0040a620
push edi
lea ecx, [edi + 0xc0]
push ecx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 0xf
call fcn.0040a610
push 0x626b94
lea ecx, [esp + 0x10]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x10
call fcn.0040a620
push edi
lea edx, [edi + 0xe8]
push edx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 0x12
call fcn.0040a610
push 0x626bb8
lea ecx, [esp + 0x14]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x13
call fcn.0040a620
push edi
lea ecx, [edi + 0x110]
push ecx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 0x15
call fcn.0040a610
push 0x626bc8
lea ecx, [esp + 0x10]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x16
call fcn.0040a620
push edi
lea edx, [edi + 0x138]
push edx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 0x18
call fcn.0040a610
push 0x626bdc
lea ecx, [esp + 0x14]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x19
call fcn.0040a620
push edi
lea ecx, [edi + 0x160]
push ecx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 0x1b
call fcn.0040a610
push 0x626bf4
lea ecx, [esp + 0x10]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x1c
call fcn.0040a620
push edi
lea edx, [edi + 0x188]
push edx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 0x1e
call fcn.0040a610
push 0x626c10
lea ecx, [esp + 0x14]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x1f
call fcn.0040a620
push edi
lea ecx, [edi + 0x1b0]
push ecx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 0x21
call fcn.0040a610
push 0x626c28
lea ecx, [esp + 0x10]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x22
call fcn.0040a620
push edi
lea edx, [edi + 0x1d8]
push edx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 0x24
call fcn.0040a610
push 0x626c40
lea ecx, [esp + 0x14]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x25
call fcn.0040a620
push edi
lea ecx, [edi + 0x200]
push ecx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 0x27
call fcn.0040a610
push 0x626c54
lea ecx, [esp + 0x10]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x28
call fcn.0040a620
push edi
lea edx, [edi + 0x228]
push edx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 0x2a
call fcn.0040a610
push 0x626c68
lea ecx, [esp + 0x14]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x2b
call fcn.0040a620
push edi
lea ecx, [edi + 0x250]
push ecx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 0x2d
call fcn.0040a610
push 0x626c84
lea ecx, [esp + 0x10]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x2e
call fcn.0040a620
push edi
lea edx, [edi + 0x278]
push edx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 0x30
call fcn.0040a610
push 0x626c98
lea ecx, [esp + 0x14]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x31
call fcn.0040a620
push edi
lea ecx, [edi + 0x2a0]
push ecx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 0x33
call fcn.0040a610
push 0x626cac
lea ecx, [esp + 0x10]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x34
call fcn.0040a620
push edi
lea edx, [edi + 0x2c8]
push edx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 0x36
call fcn.0040a610
push 0x626cc4
lea ecx, [esp + 0x14]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x37
call fcn.0040a620
push edi
lea ecx, [edi + 0x2f0]
push ecx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 0x39
call fcn.0040a610
push 0x626ce8
lea ecx, [esp + 0x10]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x3a
call fcn.0040a620
push edi
lea edx, [edi + 0x318]
push edx
mov esi, eax
call fcn.00442f70
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 0x3c
call fcn.0040a610
push 0x626d04
lea ecx, [esp + 0x14]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x3d
call fcn.0040a620
push edi
lea ecx, [edi + 0x358]
push ecx
mov esi, eax
call fcn.00442f70
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 0x3f
call fcn.0040a610
push 0x626d20
lea ecx, [esp + 0x10]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x40
call fcn.0040a620
push edi
lea edx, [edi + 0x398]
push edx
mov esi, eax
call fcn.00442f70
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 0x42
call fcn.0040a610
push 0x626d40
lea ecx, [esp + 0x14]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x43
call fcn.0040a620
push edi
lea ecx, [edi + 0x3d8]
push ecx
mov esi, eax
call fcn.00442f70
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 0x45
call fcn.0040a610
push 0x626d50
lea ecx, [esp + 0x10]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x46
call fcn.0040a620
push edi
lea edx, [edi + 0x418]
push edx
mov esi, eax
call fcn.00442f70
lea ecx, [esp + 0xc]
mov byte [esp + 0x238], 0x48
call fcn.0040a610
push 0x626d60
lea ecx, [esp + 0x14]
call fcn.00419700
add esp, 4
mov ecx, eax
mov byte [esp + 0x238], 0x49
call fcn.0040a620
push edi
lea ecx, [edi + 0x458]
push ecx
mov esi, eax
call fcn.00442da0
lea ecx, [esp + 0x10]
mov byte [esp + 0x238], 0x4b
call fcn.0040a610
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x2e]
push eax
mov word [esp + 0x30], dx
call fcn.005baaa0
lea ecx, [esp + 0x30]
push ecx
call fcn.0042ff40
lea esi, [esp + 0x24]
call fcn.0049d100
push eax
lea edx, [esp + 0x20]
push 0x61abd0
push edx
mov byte [esp + 0x254], 0x4c
call fcn.0041b080
add esp, 0x1c
mov ecx, eax
mov byte [esp + 0x238], 0x4d
call fcn.0040a620
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00434200
add esp, 8
lea ecx, [esp + 0xc]
call fcn.0040a610
mov ecx, esi
mov byte [esp + 0x238], 0x4b
call fcn.0040a610
lea ecx, [esp + 0x24]
push ecx
call fcn.0042fc10
push 0x626b0c
lea ecx, [esp + 0x24]
call fcn.00419700
mov ebp, eax
lea esi, [esp + 0x20]
mov byte [esp + 0x240], 0x4e
call fcn.0049d100
push eax
lea edx, [esp + 0x18]
push 0x61abd0
push edx
mov byte [esp + 0x24c], 0x4f
call fcn.0041b080
push ebp
push eax
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x258], 0x50
call fcn.00406170
add esp, 0x20
mov ecx, eax
mov byte [esp + 0x238], 0x51
call fcn.0040a620
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00434200
add esp, 8
lea ecx, [esp + 0x14]
call fcn.0040a610
lea ecx, [esp + 0xc]
call fcn.0040a610
mov ecx, esi
call fcn.0040a610
lea ecx, [esp + 0x1c]
mov byte [esp + 0x238], 0x4b
call fcn.0040a610
lea esi, [esp + 0x24]
mov eax, edi
call fcn.004114c0
mov edx, esi
push edx
call fcn.0042c690
add esp, 4
cmp eax, 1
sete al
mov byte [edi + 0x1c], al
mov eax, edi
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.005b6c8b
add esp, 0x230
ret