Function at 0x4020ad
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
movsx ebx, dl
sub dx, si
rcl ax, 0x1a
movsx esi, dx
or bx, ax
sub eax, 0x369
imul ax
add ecx, 0x20b
ror dx, 0x65
mov bx, bx
mul bx
shl ebx, 0x89
imul ax
rcr di, 0x3e
shl edi, 0xfa
imul edx
rcr ebx, 0xeb
mul si
imul dx
rol si, 0x3d
jae 0x40210d
cmp esi, 0x35
jl 0x402145
imul esi
mul ebx
mul esi
imul di
imul edi
jmp 0x402114
mul ebx
inc si
inc edx
or edx, ebx
dec bx
shr bx, 0xc
jb 0x402145
test edx, 0x42
jae 0x40217d
inc esi
and bx, dx
imul si
inc edx
dec ax
imul esi
add di, cx
and ebx, 0x2a0
rcr ax, 0x10
sub esi, 0x20c
jmp 0x40215e
rol di, 0x66
mul si
rcr eax, 8
imul edx
mul cx
sub edi, 0x3e0
inc esi
or edx, ebx
dec eax
xor bx, 0x295
shl edi, 0x54
ror si, 0x91
mul ecx
inc edx
je 0x40217d
cmp esi, 0x1b
jg 0x4021bb
shl si, 0x8f
shl ebx, 0xb6
jmp 0x402187
imul ax
xor ax, dx
rol di, 0x73
shr ecx, 0x42
ror ax, 0x3b
mul eax
inc edx
shr cx, 0xe8
sub bx, cx
inc ax
and ecx, 0x1df
jg 0x4021bb
test ecx, 0x5d
ja 0x4021e3
mul di
xor ebx, 0x3ab
imul di
sub ecx, 0x74
jmp 0x4021c8
dec esi
add ecx, edx
imul cx
rcr ebx, 0x68
imul ecx
and eax, edx
dec ax
je 0x4021e3
mul ecx
and di, ax
add di, ax
movzx edi, dh
and esi, 0x346
rcl ax, 0x9b
jmp 0x4021e9
or edi, 0x2b2
ror di, 0xee
shl edx, 0x65
mul bx
mov si, 0x157
shr ebx, 0x43
jg 0x402203
mul bx
inc cx
jmp 0x40220f
dec bx
imul ax
rol cx, 0xe
dec esi
imul esi
rol eax, 0xe1
and si, 0x327
rcr dx, 0x50
rol di, 0xd5
je 0x40222b
cmp ecx, 0x25
jb 0x40226a
rcl ecx, 0x58
jmp 0x402233
ror ebx, 0x8b
shl eax, 0xf9
xor edi, edi
add ax, 0x181
mul di
rcl ecx, 0xbc
inc edi
imul edx
mul dx
ja 0x40226a
cmp esi, 0x44
jl 0x4022b1
dec eax
mov ax, di
or ebx, 0x3c1
imul ax
rcr si, 0xda
imul cx
imul si
rcl si, 0x4d
dec eax
mul ecx
jmp 0x402278
sub ax, 0x5b
dec edx
shl di, 0xf2
dec bx
rcl eax, 0x82
xor edx, 0x29e
dec ax
rcl dx, 0x20
rol dx, 0x90
inc dx
mul cx
and ebx, ecx
xor edx, 0x34
mul edi
je 0x4022b1
inc ecx
inc edx
imul ebx
inc ax
mov edx, esi
mul edx
imul edi
ror edx, 0xb7
and ecx, 0x1c7
rcl ax, 0xaf
jmp 0x4022d4
sub ax, bx
xor ebx, 0x53
rcl ax, 0x59
ror ebx, 0xde
movzx esi, bx
imul edi
imul si
sub edi, 0x279
inc bx
sub edi, 0x378
imul eax
mul ebx
xor ecx, 0x14
je 0x4022fb
cmp edi, 0x55
jl 0x40232e
add ax, ax
imul ax
ror cx, 0x31
rol esi, 0x77
xor si, 0x358
dec esi
mul edi
imul ebx
jmp 0x402309
and di, dx
inc edi
and edi, 0x1d7
shl cx, 0x83
movsx eax, bh
sub di, di
and dx, 0x23b
shl esi, 0xd5
shr ebx, 0x3b
rol ecx, 0x4f
sub edx, 0x1fb
mul bx
dec edi
je 0x40232e
or cx, ax
jmp 0x402334
and edx, 0x114
mul ecx
movsx eax, cl
or bx, 0x1ac
rcr ax, 0x9d
xor eax, 0x1fe
shl ebx, 0xc8
mul ebx
push 0x17
push 0x428ac0
mov edx, 0x4e4
mov ecx, 0x4756e0
call fcn.00401ca2
pop ecx
pop ecx
dec ebx
rcl dx, 0xfb
dec ax
rol ebx, 0x19
mul ebx
ror edi, 0xdd
ror dx, 0xa3
add dx, 0x50
sub esi, ecx
shr edx, 0xdb
mov ecx, edx
dec eax
imul cx
dec ebx
rcr dx, 0xc9
ror cx, 0x93
mov ax, 0x1f1
or di, cx
rcl bx, 0xcb
imul si
inc edx
imul dx
movzx ebx, dl
rcl edx, 0xeb
mul edi
ja 0x4023c9
sub cx, 0x2c5
inc bx
rcr edi, 0xf4
sub ebx, 0xfb
add ecx, 0x1d5
movsx edx, dh
add bx, ax
jmp 0x4023db
imul ax
dec edi
rol si, 0xb7
and ecx, eax
shl eax, 0x50
ror eax, 0x2d
mul esi
movsx edi, ax
inc bx
inc dx
shr edi, 0x28
shr ecx, 1
shr bx, 5
rol cx, 0x16
movzx edi, dx
je 0x402400
mul si
inc edi
mov edx, 0xdf
inc esi
jmp 0x402412
movsx edi, bl
add bx, 0x7b
sub bx, 0x1db
mul di
mul bx
rcl eax, 0xae
or edi, 0xff
movzx edi, cl
ror bx, 0xba
xor bx, 0x14b
mul si
shl edi, 0x36
ror eax, 0x69
dec ecx
jb 0x402452
test eax, 0x40
jae 0x40248b
shr di, 0xa8
mul cx
ror bx, 0xdc
xor ebx, 0x14f
xor dx, 0x113
jmp 0x40246d
rcr esi, 0xc7
movzx edx, cx
or si, ax
rcr ebx, 0x93
inc dx
shl cx, 0x16
dec eax
imul dx
shl cx, 0xf3
dec edi
rol si, 0xfb
jb 0x40248b
cmp edx, 0x63
jne 0x4024d8
mov ebx, ecx
and esi, 0x3ac
mov ecx, 0x56
shl si, 0x2b
jmp 0x40249f
shr ax, 0xba
or edx, eax
shl cx, 0x60
rol dx, 0x47
sub esi, 0xc6
dec di
sub ax, 0xaa
shr ax, 0xfb
sub eax, 0xa
inc ecx
inc eax
mul cx
or dx, 0x3b5
inc si
shl ecx, 0x1f
ja 0x4024d8
xor bx, 0x19b
shr dx, 0x67
movzx edx, si
imul dx
mov bx, di
ror ax, 0x76
or edx, 0x19
jmp 0x4024e7
mov ax, cx
rcl edx, 0x96
add di, 0x279
dec ax
sub ebx, edx
imul esi
add edi, 0x2d0
or di, dx
or eax, ecx
xor esi, 0x382
mul edi
mov si, 0xb1
inc esi
je 0x40250b
movsx edx, bl
mul cx
jmp 0x402511
imul eax
shl dx, 0xa8
and ebx, edi
jb 0x40252b
shl di, 0x72
mov ax, 0xf4
mul dx
and ecx, edi
inc esi
dec di
imul edx
mov esi, esi
jmp 0x402530
mul ax
mul esi
movzx esi, di
inc eax
mul di
add esi, 0x255
and di, 0x8c
and eax, 0x1a1
rol ecx, 0xc7
sub di, dx
sub ax, 0x39e
or dx, 0x294
je 0x402560
rcl esi, 0xa8
shr edi, 0x2d
jmp 0x402569
ror di, 0xbf
shl ecx, 0x40
mul ecx
rcr dx, 0x27
inc cx
mul edx
add esi, esi
shr ecx, 0x3a
rol ecx, 0xab
jne 0x402589
sub di, 0x2f7
rcl bx, 0x7a
imul bx
jmp 0x4025a2
mul bx
rcl ebx, 0xd2
mul bx
add esi, esi
add ax, 0x21
mov ecx, 0x35f
dec edx
inc cx
or esi, eax
sub ebx, 0x3e7
imul edi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x4770b0], eax
ror di, 0xb7
rcl bx, 0x7d
sub di, 0x3ca
imul edx
shr eax, 0x31
shr ebx, 0x1a
sub si, ax
mul ebx
ror dx, 0xb
dec ax
mul ax
rol eax, 5
ror esi, 0x10
mul cx
ror ebx, 0x3f
inc di
mov esi, 0x319
mul di
inc edx
ror di, 0xf3
add ecx, ecx
imul esi
mov si, di
imul dx
mov esi, 0xcb
jb 0x40262f
add ebx, 0x305
imul esi
shr si, 0xb1
inc edx
shr di, 0x2e
ror edi, 0x85
movzx esi, dx
shr eax, 0xf5
inc esi
jmp 0x40263f
ror si, 0x5f
mul eax
inc eax
shl esi, 0x2b
movzx eax, si
add di, cx
inc ecx
inc di
mul ax
mul ax
shr edx, 0x52
add ecx, 0x302
inc bx
inc dx
rol edi, 0x7e
jb 0x402680
test edx, 0x38
jae 0x4026cb
imul edi
rcl edi, 0xff
sub cx, dx
imul eax
mul cx
shl di, 0x26
shr ax, 0x65
sub ecx, esi
and edi, ebx
ror esi, 0xf
jmp 0x4026a0
imul ebx
add dx, dx
imul dx
and bx, 0x12
imul eax
add bx, cx
shl ebx, 0x32
mul edi
sub ecx, 0x9a
shl ax, 0xfe
inc edi
rol bx, 0x4f
sub dx, 0x3c9
mul edx
shr bx, 9
rcl eax, 0x42
add edx, edx
je 0x4026cb
mov dx, 0x2a8
imul di
shr di, 0x53
mov cx, 0x51
mul ax
jmp 0x4026d0
rol bx, 0xe9
inc edx
shl di, 0xb6
imul ecx
or cx, 0x13e
mul di
imul bx
mul bx
jae 0x402701
test eax, 0x63
je 0x402735
inc bx
shl ecx, 0x5d
rcl dx, 0x3b
inc eax
shl ax, 0xfa
ror di, 0xa
jmp 0x402708
add dx, 0x1f7
mul edx
rcr ax, 0x63
sub bx, si
inc ecx
inc edi
add edi, ebx
rcl dx, 0x1d
and ax, bx
jb 0x402735
cmp ecx, 4
ja 0x402766
sub ebx, 0x3d5
imul si
inc bx
rol edx, 0xe0
mul esi
xor edx, edx
jmp 0x40274a
rcl bx, 0x9b
dec di
mov ecx, 0x375
ror di, 0x85
dec eax
inc di
sub si, dx
mul ecx
shr dx, 0xb1
rcl ax, 0x8f
shr edx, 0xb7
inc ax
rcr edx, 0x3f
jb 0x402766
add edi, 0x194
jmp 0x40278d
mul si
shr dx, 0xe9
movzx edi, dx
rol ebx, 0xb8
rol di, 0xa6
rol ax, 0x81
sub esi, 0x189
ror ebx, 0x71
and edx, 0x1c8
shl ecx, 0xba
imul si
xor si, dx
sub si, 0x2fb
dec ecx
shr dx, 0xc1
shr dx, 0x9c
mul di
rcl edi, 0x98
or eax, ecx
sub esi, 0x2dd
jae 0x4027c5
sub si, 0x368
add edx, edi
and eax, 0x172
and esi, 0x187
jmp 0x4027e0
shl cx, 0x9b
movsx edi, bl
or edi, 0x322
rcr si, 0x65
shr ax, 0x9b
inc si
xor ax, di
dec ebx
dec di
rcl esi, 0x57
dec edi
mul eax
xor dx, 0x2b5
jb 0x402801
test edi, 0x56
jb 0x402837
ror ax, 0xd7
rcl ax, 0xe2
jmp 0x40281c
inc eax
mul dx
sub si, 0xbe
inc eax
rol edi, 0x2d
imul dx
mul eax
and bx, bx
add ecx, 0x154
xor edi, ebx
inc cx
mov ax, 0x11a
jae 0x402837
dec eax
imul dx
dec edx
movsx esi, si
or si, 0x11
shr ebx, 0x89
jmp 0x402840
shr bx, 0x48
rcl cx, 0x89
dec ebx
mul ecx
imul bx
mul esi
inc eax
rcr si, 0x77
shl bx, 0xe6
sub ecx, 0x1aa
or bx, ax
or esi, 0x3bc
jb 0x402883
test ebx, 0x2f
jb 0x4028bc
inc ax
rcl cx, 0x23
ror ax, 0x7a
inc ecx
imul ecx
ror dx, 0x38
rol di, 0x25
mul bx
jmp 0x40289c
ror edi, 0x5f
sub di, 0x2d3
inc esi
imul bx
mul edi
dec esi
mov si, 0x332
and ax, 0x2ae
or edi, ebx
shl ecx, 0xab
add esi, 0xf
mul dx
rol si, 0xbf
imul ecx
or bx, 0x2ed
je 0x4028bc
cmp ebx, 0x4e
ja 0x4028fc
mul di
jmp 0x4028dd
rol esi, 0x78
ror ebx, 0xc0
or cx, dx
rcr eax, 0xd2
mov eax, ecx
rol ax, 0xe7
or cx, ax
and edx, 0x110
imul bx
shr ecx, 0xfa
sub esi, 0x105
shl dx, 0x76
jb 0x4028fc
and di, 0x2ea
inc edx
and bx, 0x26b
dec cx
ror bx, 0x3b
jmp 0x402909
and eax, 0x32a
imul esi
imul edx
shr ax, 0xa5
ror bx, 0x96
and edx, ecx
and di, cx
rcl di, 0xe2
imul ecx
dec dx
shr si, 0x8c
or dx, ax
call fcn.00401fee
lea ecx, [ebp - 8]
mov dword [ebp - 4], 0x188
push ecx
push 0x40
push 0x4e4
push 0x4756e0
call eax
test eax, eax
je 0x402986
push 0x13
push 0x475bd0
mov edx, 0x4cc00
mov ecx, 0x428ae0
call fcn.00401ca2
pop ecx
pop ecx
mov esi, 0x428ae0
push esi
mov edx, 0x4756e0
mov ecx, dword [ebp - 4]
add edx, ecx
sub esp, 8
mov dword [esp + 4], 1
mov dword [esp], edx
lea edi, sym.imp.KERNEL32.dll_GetConsoleWindow
mov edi, dword [edi]
push edi
ret
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10