Function at 0x4536b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529e2c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi + 4], 0x53c204
mov dword [edi + 0x2c], 0x53c20c
mov dword [edi + 0xdf0], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x14], ebx
mov byte [edi + 0x1c], bl
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov byte [edi + 0x38], bl
mov dword [ebp - 4], ebx
mov dword [edi], vtable.CImgFileList.0
mov dword [edi + 0x1e4], ebx
mov dword [edi + 0x1e8], ebx
mov dword [edi + 0x1ec], ebx
mov dword [edi + 0x1f0], ebx
mov dword [edi + 0x1f4], ebx
mov dword [edi + 0x1f8], ebx
mov dword [edi + 0x1fc], ebx
mov dword [edi + 0x200], ebx
mov dword [edi + 0x208], ebx
mov eax, vtable.CMemDc.0
mov dword [edi + 0x204], eax
mov dword [edi + 0x20c], ebx
mov dword [edi + 0x210], ebx
mov byte [edi + 0x214], bl
mov dword [edi + 0x218], ebx
mov dword [edi + 0x21c], ebx
mov byte [edi + 0x220], bl
mov dword [edi + 0x228], ebx
mov dword [edi + 0x224], eax
mov dword [edi + 0x22c], ebx
mov dword [edi + 0x230], ebx
mov byte [edi + 0x234], bl
mov dword [edi + 0x238], ebx
mov dword [edi + 0x23c], ebx
mov byte [edi + 0x240], bl
mov dword [edi + 0x248], ebx
mov dword [edi + 0x244], eax
mov dword [edi + 0x24c], ebx
mov dword [edi + 0x250], ebx
mov byte [edi + 0x254], bl
mov dword [edi + 0x258], ebx
mov dword [edi + 0x25c], ebx
mov byte [edi + 0x260], bl
mov dword [edi + 0x268], ebx
mov dword [edi + 0x264], eax
mov dword [edi + 0x26c], ebx
mov dword [edi + 0x270], ebx
mov byte [edi + 0x274], bl
mov dword [edi + 0x278], ebx
mov dword [edi + 0x27c], ebx
mov byte [edi + 0x280], bl
mov dword [edi + 0x288], ebx
mov dword [edi + 0x284], eax
mov dword [edi + 0x28c], ebx
mov dword [edi + 0x290], ebx
mov byte [edi + 0x294], bl
mov dword [edi + 0x298], ebx
mov dword [edi + 0x29c], ebx
mov byte [edi + 0x2a0], bl
mov dword [edi + 0x2b4], 0x544264
mov dword [edi + 0x2c4], ebx
mov dword [edi + 0x2b8], ebx
mov dword [edi + 0x2bc], ebx
mov byte [edi + 0x2c0], bl
mov dword [edi + 0x2a4], ebx
mov dword [edi + 0x2a8], ebx
mov dword [edi + 0x2ac], ebx
mov dword [edi + 0x2b0], ebx
mov byte [edi + 0x2c8], bl
lea eax, [edi + 0x2cc]
call fcn.0045a050
lea eax, [edi + 0x3b4]
call fcn.004b54b0
lea esi, [edi + 0x438]
call fcn.0045b2f0
mov dword [edi + 0xd38], ebx
mov dword [edi + 0xd3c], ebx
mov dword [edi + 0xd40], ebx
mov dword [edi + 0xd64], ebx
mov dword [edi + 0xd68], ebx
mov dword [edi + 0xd6c], ebx
lea eax, [edi + 0xd74]
mov dword [eax + 4], ebx
mov dword [eax], vtable.CUseDll.0
mov dword [eax + 8], ebx
mov byte [eax + 0xc], bl
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], 1
mov dword [edi + 0xd8c], ebx
mov dword [edi + 0xd90], ebx
mov dword [edi + 0xd94], ebx
mov dword [edi + 0xda0], ebx
mov dword [edi + 0xd9c], 0x543cb8
mov dword [edi + 0xda4], ebx
mov byte [edi + 0xda8], bl
mov dword [edi + 0xdac], ebx
mov dword [edi + 0xdb4], ebx
mov dword [edi + 0xdb0], 0x53c92c
mov dword [edi + 0xdb8], ebx
mov dword [edi + 0xdbc], ebx
mov byte [edi + 0xdc0], bl
mov dword [edi + 0xdc4], ebx
mov dword [edi + 0xdc8], ebx
mov byte [edi + 0xdcc], bl
mov byte [ebp - 4], 0x10
or ecx, 0xffffffff
mov dword [edi + 0xd30], ebx
mov dword [edi + 0xd48], ebx
mov dword [edi + 0xd4c], ebx
mov dword [edi + 0xd50], ebx
mov dword [edi + 0xd54], ebx
mov dword [edi + 0xd58], ebx
mov dword [edi + 0xd5c], ebx
mov dword [edi + 0xd34], ecx
mov dword [edi + 0xd60], ebx
mov dword [edi + 0x1e0], ecx
mov byte [edi + 0x1dc], bl
mov word [edi + 0xd70], 1
call fcn.00453490
mov dword [edi + 0xd20], ebx
mov dword [edi + 0xd24], ebx
mov dword [edi + 0xd28], ebx
mov dword [edi + 0xd2c], ebx
mov ecx, 0x68
lea eax, [edi + 0x3c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x4539c7
mov dword [edi + 0xdd0], ebx
mov dword [edi + 0xdd8], ebx
mov dword [edi + 0xddc], ebx
mov dword [edi + 0xde4], ebx
mov dword [edi + 0xde8], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4