Function at 0x404b10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57a4e8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x60db70]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea esi, [ebx + 0x188]
push esi
call fcn.0040ced0
lea eax, [ebx + 0x1c4]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.00411d00
mov dword [ebx + 0x200], edi
mov dword [ebx + 0x204], edi
mov dword [ebx + 0x208], edi
mov dword [ebx + 0x210], edi
mov dword [ebx + 0x214], edi
mov dword [ebx + 0x218], edi
mov dword [ebx + 0x220], edi
mov dword [ebx + 0x224], edi
mov dword [ebx + 0x228], edi
mov dword [ebx + 0x230], edi
mov dword [ebx + 0x234], edi
mov dword [ebx + 0x238], edi
mov dword [ebx + 0x240], edi
mov dword [ebx + 0x244], edi
mov dword [ebx + 0x248], edi
mov byte [ebp - 4], 6
push edi
mov dword [ebx + 0x180], edi
mov dword [ebx], edi
mov byte [ebx + 0x120], 0
mov word [ebx + 0xa9], 1
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov word [ebx + 0x14], di
call fcn.00552678
push edi
mov dword [ebx + 0xc8], eax
mov dword [ebx + 0xcc], edx
call fcn.00552678
push edi
mov dword [ebx + 0xd0], eax
mov dword [ebx + 0xd4], edx
call fcn.00552678
push edi
mov dword [ebx + 0xe0], eax
mov dword [ebx + 0xe4], edx
call fcn.00552678
push edi
mov dword [ebx + 0xe8], eax
mov dword [ebx + 0xec], edx
call fcn.00552678
push edi
mov dword [ebx + 0xf8], eax
mov dword [ebx + 0xfc], edx
call fcn.00552678
push edi
mov dword [ebx + 0x100], eax
mov dword [ebx + 0x104], edx
call fcn.00552678
push edi
mov dword [ebx + 0x110], eax
mov dword [ebx + 0x114], edx
call fcn.00552678
push edi
mov dword [ebx + 0x118], eax
mov dword [ebx + 0x11c], edx
call fcn.00552678
push edi
mov dword [ebx + 0x128], eax
mov dword [ebx + 0x12c], edx
call fcn.00552678
add esp, 0x28
mov dword [ebx + 0x130], eax
mov dword [ebx + 0x134], edx
lea ecx, [ebp - 0x48]
push ecx
mov byte [ebx + 0xd8], 0
mov byte [ebx + 0xf0], 0
mov byte [ebx + 0x108], 0
mov byte [ebx + 0x120], 0
mov byte [ebx + 0x138], 0
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x2c], edi
mov dword [ebx + 0x30], edi
mov dword [ebx + 0xa4], edi
mov dword [ebx + 0xa0], edi
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x3c], edi
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x44], edi
mov dword [ebx + 0x48], edi
mov dword [ebx + 0x4c], edi
mov dword [ebx + 0x50], edi
mov dword [ebx + 0x54], edi
mov dword [ebx + 0x58], edi
mov dword [ebx + 0x5c], edi
mov dword [ebx + 0x60], edi
mov dword [ebx + 0x64], edi
mov dword [ebx + 0x68], edi
mov dword [ebx + 0x6c], edi
mov dword [ebx + 0x70], edi
mov dword [ebx + 0x74], edi
mov dword [ebx + 0x78], edi
mov dword [ebx + 0x7c], edi
mov dword [ebx + 0x80], edi
mov dword [ebx + 0x84], edi
mov dword [ebx + 0x88], edi
mov dword [ebx + 0x8c], edi
mov dword [ebx + 0x90], edi
mov dword [ebx + 0x94], edi
mov dword [ebx + 0x98], edi
mov dword [ebx + 0x9c], edi
mov byte [ebx + 0xa8], 0
mov dword [ebx + 0xac], edi
mov dword [ebx + 0xb0], edi
mov byte [ebx + 0xc0], 0
mov dword [ebx + 0xb4], edi
mov dword [ebx + 0xb8], edi
mov dword [ebx + 0xbc], edi
mov dword [ebx + 0x140], edi
mov dword [ebx + 0x144], edi
mov dword [ebx + 0x148], edi
mov dword [ebx + 0x13c], edi
mov dword [ebx + 0x150], edi
mov dword [ebx + 0x154], edi
mov dword [ebx + 0x158], edi
mov dword [ebx + 0x15c], edi
mov dword [ebx + 0x160], edi
mov dword [ebx + 0x164], edi
mov dword [ebx + 0x168], edi
mov dword [ebx + 0x16c], edi
mov dword [ebx + 0x170], edi
mov dword [ebx + 0x174], edi
mov dword [ebx + 0x178], edi
mov dword [ebx + 0x17c], edi
mov word [ebx + 0x184], 0x100
call fcn.0040ced0
mov edi, eax
mov byte [ebp - 4], 7
call fcn.00404e60
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404e0e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebx + 0x186], 0
mov byte [ebx + 0x1fc], 0
mov dword [ebx + 0x250], 0x1000000
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4