Function at 0x412110
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4518db
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x49e040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 8]
call fcn.00413650
lea eax, [esi + 0x1520]
mov dword [ebp - 4], 0
push 0x78
push 0
push eax
mov dword [eax + 0x64], 0
mov dword [eax + 0x60], 0
mov dword [eax + 0x68], 0
mov dword [eax + 0x70], 0
mov dword [eax + 0x6c], 0
mov dword [eax + 0x74], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [esi + 0x1598]
mov byte [ebp - 4], 1
call fcn.004134b0
lea ecx, [esi + 0x19e0]
call fcn.00439b10
mov dword [esi + 0x1c04], 0
mov dword [esi + 0x1c00], 0
mov dword [esi + 0x1c08], 0
mov dword [esi + 0x1c10], 0
mov dword [esi + 0x1c0c], 0
mov dword [esi + 0x1c14], 0
mov dword [esi + 0x1c1c], 0
mov dword [esi + 0x1c18], 0
mov dword [esi + 0x1c20], 0
mov dword [esi + 0x1c28], 0
mov dword [esi + 0x1c24], 0
mov dword [esi + 0x1c2c], 0
mov dword [esi + 0x1c34], 0
mov dword [esi + 0x1c30], 0
mov dword [esi + 0x1c38], 0
mov dword [esi + 0x1c44], 0
lea eax, [esi + 0x1cd0]
mov dword [esi + 0x1c40], 0
xorps xmm0, xmm0
mov dword [esi + 0x1c64], 0
mov dword [esi + 0x1c60], 0
mov dword [esi + 0x1cac], 0
mov dword [esi + 0x1ca8], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
movups xmmword [eax + 0x64], xmm0
push 0x8c
movups xmmword [eax + 0x74], xmm0
mov byte [eax + 0x81], 1
push 0
push eax
mov dword [eax + 0x88], 0
mov dword [eax + 0x84], 0
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [esi + 0x1d5c], xmm0
mov dword [esi + 0x1d6c], 0
mov dword [esi + 0x1d74], 0
mov dword [esi + 0x1d70], 0
mov dword [esi + 0x1d78], 0
mov dword [esi + 0x1d80], 0
mov dword [esi + 0x1d7c], 0
mov dword [esi + 0x1d84], 0
mov dword [esi + 0x1d8c], 0
mov dword [esi + 0x1d88], 0
mov dword [esi + 0x1d90], 0
mov dword [esi + 0x1d98], 0
mov dword [esi + 0x1d94], 0
mov dword [esi + 0x1d9c], 0
mov dword [esi + 0x1da4], 0
mov dword [esi + 0x1da0], 0
mov dword [esi + 0x1da8], 0
mov dword [esi + 0x1db0], 0
mov dword [esi + 0x1dac], 0
mov dword [esi + 0x1db4], 0
mov dword [esi + 0x1dbc], 0
mov dword [esi + 0x1db8], 0
mov dword [esi + 0x1dc0], 0
mov dword [esi + 0x1dc8], 0
mov dword [esi + 0x1dc4], 0
mov dword [esi + 0x1dcc], 0
mov dword [esi + 0x1dd4], 0
mov dword [esi + 0x1dd0], 0
mov dword [esi + 0x1dd8], 0
mov dword [esi + 0x1df4], 0
mov dword [esi + 0x1df0], 0
mov dword [esi + 0x1df8], 0
mov eax, dword [esi + 0x1df8]
mov dword [esi + 0x1dfc], 0
mov ecx, dword [esi + 0x1dfc]
mov dword [esi + 0x1e08], 0
mov dword [esi + 0x1e0c], 0
mov dword [esi + 0x1e00], 0
mov dword [esi + 0x1e04], 0
mov dword [esi + 0x1df0], eax
mov dword [esi + 0x1df4], ecx
mov dword [esi + 0x1e10], 0x3f800000
mov dword [esi + 0x1e4c], 0
mov dword [esi + 0x1e50], 0
mov dword [esi + 0x1e54], 0
mov dword [esi + 0x1e58], 0
mov dword [esi + 0x1e74], 0
mov dword [esi + 0x1e78], 0
mov dword [esi + 0x1e7c], 0
mov dword [esi + 0x1e80], 0
mov dword [esi + 0x1eb8], 0
mov dword [esi + 0x1ea0], 0
mov dword [esi + 0x1ea8], 0
mov dword [esi + 0x1ea4], 0
mov dword [esi + 0x1eac], 0
mov dword [esi + 0x1eb0], 0
mov dword [esi + 0x1eb4], 0
mov dword [esi + 0x1eb8], 0
mov dword [esi + 0x1ec4], 0x7f7fffff
mov dword [esi + 0x1ec0], 0x7f7fffff
mov dword [esi + 0x1ebc], 0x7f7fffff
mov dword [esi + 0x1ee0], 0
mov dword [esi + 0x1ec8], 0
mov dword [esi + 0x1ed0], 0
mov dword [esi + 0x1ecc], 0
mov dword [esi + 0x1ed4], 0
mov dword [esi + 0x1ed8], 0
mov dword [esi + 0x1edc], 0
mov dword [esi + 0x1ee0], 0
mov dword [esi + 0x1eec], 0x7f7fffff
mov dword [esi + 0x1ee8], 0x7f7fffff
mov dword [esi + 0x1ee4], 0x7f7fffff
mov dword [esi + 0x1f08], 0
mov dword [esi + 0x1ef0], 0
mov dword [esi + 0x1ef8], 0
mov dword [esi + 0x1ef4], 0
mov dword [esi + 0x1efc], 0
mov dword [esi + 0x1f00], 0
mov dword [esi + 0x1f04], 0
mov dword [esi + 0x1f08], 0
mov dword [esi + 0x1f14], 0x7f7fffff
mov dword [esi + 0x1f10], 0x7f7fffff
mov dword [esi + 0x1f0c], 0x7f7fffff
mov dword [esi + 0x1f78], 0
mov dword [esi + 0x1f74], 0
mov dword [esi + 0x1f6c], 0
mov dword [esi + 0x1f70], 0
movups xmmword [esi + 0x1f80], xmm0
movups xmmword [esi + 0x1f90], xmm0
mov word [esi + 0x1fa0], 0
mov dword [esi + 0x1f7c], 0xffffffff
mov byte [esi + 0x1fa2], 0
mov dword [esi + 0x1fa4], 0
mov dword [esi + 0x1fa8], 0
mov dword [esi + 0x1fac], 0
mov dword [esi + 0x1fb0], 0
mov dword [esi + 0x1fd4], 0
mov dword [esi + 0x1fd0], 0
mov dword [esi + 0x1fd8], 0
mov dword [esi + 0x1ff4], 0
mov dword [esi + 0x1ff0], 0
mov dword [esi + 0x1ff8], 0
mov dword [esi + 0x2000], 0
mov dword [esi + 0x1ffc], 0
mov dword [esi + 0x2004], 0
mov dword [esi + 0x2008], 0
mov dword [esi + 0x2010], 0
mov dword [esi + 0x200c], 0
mov dword [esi + 0x2014], 0
mov dword [esi + 0x201c], 0
mov dword [esi + 0x2018], 0
mov dword [esi + 0x2020], 0
mov dword [esi + 0x2028], 0
mov dword [esi + 0x2024], 0
mov dword [esi + 0x202c], 0
mov dword [esi + 0x2038], 0
mov dword [esi + 0x2034], 0
mov dword [esi + 0x203c], 0
mov dword [esi + 0x2044], 0
mov dword [esi + 0x2040], 0
mov dword [esi + 0x2048], 0
mov dword [esi + 0x204c], 0
mov dword [esi + 0x2054], 0
mov dword [esi + 0x2050], 0
mov dword [esi + 0x2058], 0
mov dword [esi + 0x2060], 0
mov dword [esi + 0x205c], 0
mov dword [esi + 0x2064], 0
lea eax, [esi + 0x2070]
mov dword [esi + 0x206c], 0
mov dword [esi + 0x2068], 0
push 0xe7c
push 0
push eax
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x2c], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea ecx, [esi + 0x2eec]
call fcn.0043faa0
mov dword [esi + 0x2f68], 0
mov dword [esi + 0x2f64], 0
mov dword [esi + 0x2f60], 0
mov dword [esi + 0x2f5c], 0
mov dword [esi + 0x2f8c], 0
mov dword [esi + 0x2f88], 0
mov dword [esi + 0x2f90], 0
mov dword [esi + 0x2f98], 0
mov dword [esi + 0x2f94], 0
mov dword [esi + 0x2f9c], 0
mov dword [esi + 0x2fa4], 0
xorps xmm0, xmm0
mov dword [esi + 0x2fa0], 0
mov dword [esi + 0x2fac], 0
mov dword [esi + 0x2fa8], 0
mov dword [esi + 0x2fbc], 0
mov dword [esi + 0x2fb8], 0
mov dword [esi + 0x2fc0], 0
mov dword [esi + 0x2fc8], 0
mov dword [esi + 0x2fc4], 0
mov dword [esi + 0x2fcc], 0
mov dword [esi + 0x2fd4], 0
mov dword [esi + 0x2fd0], 0
mov dword [esi + 0x2fd8], 0
movups xmmword [esi + 0x2fb8], xmm0
movups xmmword [esi + 0x2fc8], xmm0
movq qword [esi + 0x2fd8], xmm0
mov dword [esi + 0x2fec], 0
mov dword [esi + 0x2fe8], 0
mov dword [esi + 0x2ff0], 0
mov dword [esi + 0x2ff8], 0
mov dword [esi + 0x2ff4], 0
mov dword [esi + 0x2ffc], 0
mov dword [esi + 0x3004], 0
mov dword [esi + 0x3000], 0
mov dword [esi + 0x3008], 0
mov dword [esi + 0x3010], 0
mov dword [esi + 0x300c], 0
mov dword [esi + 0x3014], 0
mov dword [esi + 0x301c], 0
mov dword [esi + 0x3018], 0
mov dword [esi + 0x3020], 0
mov dword [esi + 0x3038], 0
mov dword [esi + 0x3034], 0
mov dword [esi + 0x303c], 0
mov eax, dword [0x5b5d98]
mov dword [esi + 0x3064], 0x1000000
mov word [esi + 0x3068], 1
mov dword [esi + 0x306c], 0xffffffff
mov dword [esi + 0x3070], 0xffffffff
mov word [esi], 0x100
mov dword [esi + 0x19d0], 0
mov dword [esi + 0x19cc], 0
mov dword [esi + 0x19d4], 0
mov dword [esi + 0x19dc], 0
mov dword [esi + 0x19d8], 0
test eax, eax
je 0x412a89
inc dword [eax + 0x374]
push 0x468
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
lea eax, [ebp - 0xd]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x412b60
mov dword [edi + 0x28], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x54], 0
lea eax, [edi + 0x58]
mov ecx, 0x40
mov dword [eax + 0xc], 0
lea eax, [eax + 0x10]
mov dword [eax - 8], 0
mov dword [eax - 0xc], 0
mov dword [eax - 0x10], 0
sub ecx, 1
jne 0x412b10
push 0x468
push ecx
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [edi + 0xc], 1
mov dword [edi + 0x464], 0xffffffff
mov dword [edi + 0x460], 0xffffffff
jmp 0x412b62
xor edi, edi
mov dword [esi + 0x98], edi
xorps xmm0, xmm0
movsd qword [esi + 0x1bd8], xmm0
mov dword [esi + 0x1be0], 0
mov dword [esi + 0x1bec], 0xffffffff
mov dword [esi + 0x1be8], 0xffffffff
mov dword [esi + 0x1be4], 0xffffffff
mov dword [esi + 0x1bf1], 0
mov byte [esi + 0x1bf0], 0
mov dword [esi + 0x1bf8], 0
mov dword [esi + 0x1bfc], 0
mov dword [esi + 0x1c3c], 0
mov dword [esi + 0x1c48], 0
mov dword [esi + 0x1c4c], 0
mov dword [esi + 0x1c50], 0
mov dword [esi + 0x1c54], 0
mov dword [esi + 0x1c58], 0
mov dword [esi + 0x1c5c], 0
mov dword [esi + 0x1c68], 0
mov dword [esi + 0x1c6c], 0
mov dword [esi + 0x1c74], 0
mov dword [esi + 0x1c70], 0
mov dword [esi + 0x1c78], 0
mov dword [esi + 0x1c80], 0
mov dword [esi + 0x1c7c], 0
mov dword [esi + 0x1c84], 0
mov dword [esi + 0x1c88], 0
mov dword [esi + 0x1c8c], 0
mov dword [esi + 0x1c90], 0
mov word [esi + 0x1c94], 0
mov byte [esi + 0x1c96], 0
mov dword [esi + 0x1c98], 0
mov dword [esi + 0x1c9c], 0
mov dword [esi + 0x1ca0], 0
mov dword [esi + 0x1ca4], 0
mov dword [esi + 0x1ca8], 0xbf800000
mov dword [esi + 0x1cac], 0xbf800000
mov dword [esi + 0x1cb0], 0
mov dword [esi + 0x1cb4], 0
mov dword [esi + 0x1cb8], 0xffffffff
mov dword [esi + 0x1cbc], 0
mov word [esi + 0x1cc0], 0
mov dword [esi + 0x1cc4], 0
mov dword [esi + 0x1cc8], 0
mov dword [esi + 0x1ccc], 0
mov dword [esi + 0x1ddc], 0
mov dword [esi + 0x1de0], 0
mov dword [esi + 0x1de8], 0
mov dword [esi + 0x1de4], 0
mov dword [esi + 0x1dec], 0
mov dword [esi + 0x1e14], 0
mov dword [esi + 0x1e18], 0
mov dword [esi + 0x1e30], 0
mov dword [esi + 0x1e2c], 0
mov dword [esi + 0x1e28], 0
mov dword [esi + 0x1e24], 0
mov dword [esi + 0x1e20], 0
mov dword [esi + 0x1e1c], 0
mov dword [esi + 0x1e44], 0
mov dword [esi + 0x1e3c], 0
mov dword [esi + 0x1e38], 0
mov dword [esi + 0x1e34], 0
mov dword [esi + 0x1e40], 0
mov dword [esi + 0x1e48], 0
mov dword [esi + 0x1e4c], 0
mov dword [esi + 0x1e50], 0
mov dword [esi + 0x1e54], 0
mov dword [esi + 0x1e58], 0
mov dword [esi + 0x1e5c], 0
mov dword [esi + 0x1e60], 0
mov dword [esi + 0x1e64], 0x7fffffff
mov dword [esi + 0x1e68], 0x10000
mov word [esi + 0x1e6c], 0
mov byte [esi + 0x1e6e], 0
mov dword [esi + 0x1e70], 0
mov byte [esi + 0x1e84], 0
mov dword [esi + 0x1e88], 0
mov dword [esi + 0x1e8c], 0
mov dword [esi + 0x1e90], 0
mov dword [esi + 0x1e9c], 0xffffffff
mov dword [esi + 0x1e98], 0xffffffff
mov dword [esi + 0x1e94], 0xffffffff
lea eax, [esi + 0x3074]
mov dword [esi + 0x1f18], 0
mov dword [esi + 0x1f1c], 0
mov dword [esi + 0x1f28], 0
mov dword [esi + 0x1f24], 0
mov dword [esi + 0x1f20], 0
mov dword [esi + 0x1f30], 0
mov dword [esi + 0x1f2c], 0
mov byte [esi + 0x1f34], 0
mov dword [esi + 0x1f3c], 0
mov dword [esi + 0x1f38], 0
mov dword [esi + 0x1f44], 0x7fffffff
mov dword [esi + 0x1f40], 0x7fffffff
mov dword [esi + 0x1f4c], 0x7fffffff
mov dword [esi + 0x1f48], 0x7fffffff
mov byte [esi + 0x1f50], 0
mov dword [esi + 0x1f54], 0
mov dword [esi + 0x1f58], 0
mov word [esi + 0x1f5d], 0
mov byte [esi + 0x1f5c], 0
mov dword [esi + 0x1f60], 0
mov dword [esi + 0x1f64], 0xffffffff
mov dword [esi + 0x1f68], 0xffffffff
mov dword [esi + 0x1fb4], 0
mov dword [esi + 0x1fb8], 0
mov dword [esi + 0x1fbc], 0
mov dword [esi + 0x1fc0], 0
mov dword [esi + 0x1fc4], 0
mov dword [esi + 0x1fc8], 0xffffffff
mov dword [esi + 0x1fcc], 0
movups xmmword [esi + 0x1fdc], xmm0
mov dword [esi + 0x1fec], 0
mov dword [esi + 0x2030], 0
mov dword [esi + 0x2068], 0
mov dword [esi + 0x206c], 0
mov dword [esi + 0x2f40], 0
mov dword [esi + 0x2f44], 0xa900000
mov dword [esi + 0x2f4c], 0
mov dword [esi + 0x2f48], 0
mov dword [esi + 0x2f58], 0x7f7fffff
mov dword [esi + 0x2f54], 0x7f7fffff
mov dword [esi + 0x2f50], 0x7f7fffff
mov dword [esi + 0x2f6c], 0
mov word [esi + 0x2f70], 0
mov dword [esi + 0x2f74], 0
mov dword [esi + 0x2f78], 0x3c23d70a
mov dword [esi + 0x2f7c], 0
mov dword [esi + 0x2f80], 0
mov dword [esi + 0x2f84], 0x3f000000
mov dword [esi + 0x2fa8], 0x7f7fffff
mov dword [esi + 0x2fac], 0x7f7fffff
mov dword [esi + 0x2fa0], 0x7f7fffff
mov dword [esi + 0x2fa4], 0x7f7fffff
mov dword [esi + 0x2fb0], 0
mov byte [esi + 0x2fb4], 0x2e
mov byte [esi + 0x2fe0], 0
mov dword [esi + 0x2fe4], 0
mov dword [esi + 0x3024], 0
mov byte [esi + 0x3028], 0
mov dword [esi + 0x302c], 0
mov dword [esi + 0x3044], 0
mov dword [esi + 0x3040], 0
mov dword [esi + 0x3030], 0
mov dword [esi + 0x3048], 0x7f7fffff
mov byte [esi + 0x304c], 0
mov dword [esi + 0x3050], 0
mov dword [esi + 0x3058], 2
push 0x1e0
mov dword [esi + 0x3054], 2
push 0
mov byte [esi + 0x305c], 0
push eax
mov dword [esi + 0x3060], 0
call sub.VCRUNTIME140.dll_memset
mov dword [esi + 0x3254], 0
mov dword [esi + 0x3258], 0
mov dword [esi + 0x3264], 0xffffffff
mov dword [esi + 0x3260], 0xffffffff
mov dword [esi + 0x325c], 0xffffffff
push 0xc01
lea eax, [esi + 0x3268]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4