Function at 0x417d70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [0x4595e0]
lea ebx, [ebp - 0x1f]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov dword [eax + 0xb], 0x26553301
mov dword [eax + 8], 0x1390358
mov dword [eax + 4], 0x1711ff87
mov dword [eax], 0x7f156599
lea eax, [ebp - 0x38]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x459fc8], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push 0x9385646d
push dword [0x459fc8]
call fcn.00414ee0
add esp, 8
mov dword [ebp - 0x3c], eax
mov edx, dword [ebp - 0x3c]
call edx
push 0x27
push section..data
push 0x547
push 0x459027
call section..text
add esp, 0x10
push 0xf
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call section..text
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
mov eax, 0xfad44368
mov edi, 0x459027
nop word [eax + eax]
cmp eax, 0x2e8a05ad
jle 0x417e60
cmp eax, 0x6c5bf264
jg 0x417eb0
cmp eax, 0x2e8a05ae
je 0x417edd
cmp eax, 0x5baa40b0
jne 0x417e30
jmp 0x41802e
cmp eax, 0xc99f18d6
je 0x417ef9
cmp eax, 0xfad44368
je 0x417f59
cmp eax, 0x13b127f0
jne 0x417e30
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x38]
push ecx
push 0x40
push esi
push 0x459027
call eax
test eax, eax
mov eax, 0xc99f18d6
mov ecx, 0x5baa40b0
cmove eax, ecx
cmp eax, 0x2e8a05ad
jg 0x417e37
jmp 0x417e60
cmp eax, 0x6c5bf265
je 0x417fdd
cmp eax, 0x6ea3baca
jne 0x417e30
mov eax, 0x13b127f0
mov esi, 0x4e4
cmp eax, 0x2e8a05ad
jg 0x417e37
jmp 0x417e60
mov eax, 0x6c5bf265
mov dword [ebp - 0x40], 0x8aafdc01
cmp eax, 0x2e8a05ad
jg 0x417e37
jmp 0x417e60
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
push esi
mov edx, edi
mov ecx, 0x27
xor ecx, 0x1af
add edx, ecx
mov ecx, 3
sub esp, 4
loop 0x417f1a
mov dword [esp + 4], 1
xor dword [esp + 4], 0xbb8
mov dword [esp], edx
mov dword [esp + 8], 0
lea eax, [ebx]
push eax
ret
mov ecx, 0x84738550
mov dword [ebp - 0x24], 1
nop word cs:[eax + eax]
nop
cmp ecx, 0xf030b60c
jg 0x417f90
cmp ecx, 0x84738550
je 0x417fb1
cmp ecx, 0xa32f897d
jne 0x417f70
jmp 0x418008
cmp ecx, 0xf030b60d
je 0x417fcc
cmp ecx, 0x1f2a4a8
jne 0x417f70
mov ecx, 0xa32f897d
mov al, 1
cmp ecx, 0xf030b60c
jle 0x417f78
jmp 0x417f90
cmp dword [ebp - 0x24], 0
mov ecx, 0xf030b60d
mov edx, 0x1f2a4a8
cmove ecx, edx
cmp ecx, 0xf030b60c
jle 0x417f78
jmp 0x417f90
mov ecx, 0xa32f897d
xor eax, eax
cmp ecx, 0xf030b60c
jle 0x417f78
jmp 0x417f90
push dword [ebp - 0x40]
push dword [0x459fc8]
call fcn.00414ee0
add esp, 8
mov dword [ebp - 0x28], eax
mov eax, 0x6ea3baca
xor esi, esi
cmp eax, 0x2e8a05ad
jg 0x417e37
jmp 0x417e60
test al, 1
mov eax, 0x2e8a05ae
mov ecx, 0x6c5bf265
mov dword [ebp - 0x40], 0
cmovne eax, ecx
cmp eax, 0x2e8a05ad
jg 0x417e37
jmp 0x417e60
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a3d3
xor eax, eax
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret