Function at 0x406500
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x632a40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push str.kernel32.dll
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x20
push str.be3968f21acf789f51434846125dbf19
lea ecx, [ebp - 0x1c]
mov dword [esi], eax
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00408580
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x40657c
cmp eax, 0x10
jb 0x406564
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00408a70
pop ecx
pop esp
push eax
push esp
push ebx
push ecx
push esp
push ebx
pop esi
pop edi
pop ebp
pop edi
pop edi
pop ebx
push edi
pop edx
pop ebx
pop eax
pop esi
pop esi
push ecx
push ebx
jmp 0x40658e
cmp eax, 0x10
jb 0x40658e
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00408a70
push 0x20
push str.fa4d02d7ccd654f812d9b62ba632350d
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00408580
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x4065e5
cmp eax, 0x10
jb 0x4065cd
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00408a70
pop esi
push ebp
pop ecx
pop eax
pop esi
push edx
pop edi
push ecx
push edx
pop esp
push esp
pop esi
pop esp
push edi
push eax
pop ecx
push ebx
pop ebx
pop esi
push edi
pop ebx
pop esi
jmp 0x4065f7
cmp eax, 0x10
jb 0x4065f7
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00408a70
push 0x20
push str.63cfa3a725ff457b4a4fe8d101344adc
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00408580
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x406652
cmp eax, 0x10
jb 0x406636
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00408a70
push ebp
push eax
push esp
pop edx
pop edx
pop eax
pop esi
pop edi
pop edi
push ebx
push edx
pop ebp
pop ecx
push esi
push eax
push esp
pop ecx
pop ebx
pop ebp
pop ebx
pop edx
pop esi
pop esi
pop esp
push esi
pop ebx
jmp 0x406664
cmp eax, 0x10
jb 0x406664
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00408a70
push 0x20
push str.57d0fe31bdd0193168aeb025444b8d6f
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00408580
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x4066ba
cmp eax, 0x10
jb 0x4066a3
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00408a70
pop ebx
pop ebp
pop edi
pop eax
pop ebp
pop edx
pop ebp
push eax
push esp
push eax
push ebx
push esp
pop esp
pop edi
pop ebp
pop edx
push esp
push ebx
push eax
pop esi
pop esi
jmp 0x4066cc
cmp eax, 0x10
jb 0x4066cc
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00408a70
call fcn.0043ba50
test al, al
je 0x4066f4
pop edx
pop ebp
pop edx
pop edx
pop esp
pop ebx
push esi
push ebx
push edx
pop esi
push eax
pop edx
pop esp
push edi
pop ebx
pop esi
pop esp
pop edx
pop ecx
push esp
pop ebp
push edx
push edx
push ecx
pop edi
push ebp
push edx
push ecx
pop eax
push esi
pop ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
test eax, eax
jne 0x406710
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00579ec9
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6238fc
push eax
call esi
push str.IsWow64Process
push dword [ebx]
mov dword [ebx + 8], eax
call esi
push str.Wow64DisableWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0xc], eax
call esi
push str.Wow64RevertWow64FsRedirection
push dword [ebx]
mov dword [ebx + 0x18], eax
call esi
push str.GetSystemWow64DirectoryW
push dword [ebx]
mov dword [ebx + 0x14], eax
call esi
push str.advapi32.dll
mov dword [ebx + 0x10], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx + 4], eax
call fcn.0043b7b0
test al, al
je 0x40677d
pop esi
pop ecx
pop edi
push ebx
pop ecx
push edi
push eax
pop edi
push ebp
push edi
push eax
pop eax
push esp
push edx
push ebx
pop eax
pop edi
push ebp
pop ebp
push ecx
pop edx
call fcn.0043b350
test al, al
je 0x406799
push esp
pop esp
push edi
pop ecx
pop ebp
push esp
push esp
pop eax
push esi
push esi
push ebp
pop esp
pop ebx
pop ebx
push edi
pop esp
push esp
pop edi
push edx
call fcn.0043b9e0
test al, al
je 0x4067c0
push edx
push edi
pop eax
pop esp
push edi
pop ebx
pop esi
pop ebp
push esi
pop edi
push esp
push ecx
pop eax
push eax
push ecx
push ebp
push ecx
push ebp
pop esp
push esp
pop edx
pop esp
pop ebp
pop eax
pop esp
pop ebx
pop esi
push edi
push edi
pop ebp
mov esi, dword [ebp - 0x20]
mov eax, dword [esi + 4]
test eax, eax
je 0x4066fd
push str.Wow64RevertWow64FsRedirection
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Wow64RevertWow64FsRedirection
push dword [esi + 4]
mov dword [esi + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 0x1c], eax
xor ecx, ebp
pop esi
mov eax, 1
pop ebx
call fcn.00579ec9
mov esp, ebp
pop ebp
ret