Function at 0x40602a
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48147a
mov eax, dword fs:[0]
push eax
mov eax, 0x2a30
call fcn.0046bdf0
mov eax, dword [0x49b390]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea eax, [ebx + 0x58]
push 7
mov dword [ebx], 0x488e14
xor edx, edx
pop ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], edx
mov dword [ebp - 0x29f0], ebx
mov dword [ebp - 0x29ec], eax
mov word [eax + 4], dx
lea eax, [ebx + 0x7c]
mov dword [ebp - 4], edx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], edx
mov dword [ebp - 0x29e8], eax
mov word [eax + 4], dx
lea eax, [ebx + 0xcc]
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x2a10], eax
call fcn.0045934a
lea eax, [ebx + 0x144]
push eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x2a18], eax
call fcn.0045934a
lea eax, [ebx + 0x1bc]
push eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x2a20], eax
call fcn.0045934a
lea eax, [ebx + 0x234]
push eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x2a28], eax
call fcn.0045934a
lea eax, [ebx + 0x2ac]
push eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x2a30], eax
call fcn.004595c6
lea eax, [ebx + 0x31c]
push eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x2a38], eax
call fcn.004595c6
lea eax, [ebx + 0x38c]
push eax
mov byte [ebp - 4], 7
mov dword [ebp - 0x29f4], eax
call fcn.004595c6
lea eax, [ebx + 0x3fc]
push eax
mov byte [ebp - 4], 8
mov dword [ebp - 0x2a1c], eax
call fcn.004595c6
lea eax, [ebx + 0x46c]
push eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x2a04], eax
call fcn.004595c6
lea esi, [ebx + 0x4dc]
mov byte [ebp - 4], 0xa
mov eax, 0x486cbc
mov ecx, esi
mov dword [ebp - 0x29fc], esi
mov dword [ebp - 0x29d8], esi
call fcn.00404680
add esi, 0x3c
mov byte [ebp - 4], 0xb
call fcn.0045993b
push 0x190
push 0xfffffffffffffff2
mov edi, esi
call fcn.004599a0
mov eax, dword [ebp - 0x29d8]
xor edi, edi
mov dword [eax + 0x5c], 0x464646
mov dword [eax + 0x2c], edi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], edi
mov dword [eax + 0x28], edi
mov byte [eax + 0x30], 1
mov dword [eax + 0x34], edi
mov byte [eax + 0x31], 0
mov dword [eax + 0x38], edi
lea esi, [ebx + 0x554]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x2a2c], esi
call fcn.0045993b
lea esi, [ebx + 0x590]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x2a0c], esi
call fcn.0045993b
lea esi, [ebx + 0x5cc]
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x2a24], esi
call fcn.0045993b
lea esi, [ebx + 0x608]
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x2a14], esi
call fcn.0045993b
lea esi, [ebx + 0x644]
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x2a00], esi
call fcn.0045993b
lea esi, [ebx + 0x680]
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x2a34], esi
call fcn.0045993b
lea esi, [ebx + 0x6bc]
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x29f8], esi
call fcn.0045993b
lea eax, [ebx + 0x6f8]
push eax
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x2a08], eax
call fcn.0045934a
mov byte [ebp - 4], 0x14
mov dword [ebx + 0x7b0], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], edi
mov dword [ebx + 0x24], edi
mov dword [ebx + 0x28], edi
mov dword [ebx + 0x2c], edi
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x3c], edi
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x44], edi
mov dword [ebx + 0x48], edi
push 0x7fe
lea eax, [ebp - 0x9b2]
push edi
push eax
mov dword [ebx + 0x4c], edi
mov dword [ebx + 0x50], edi
mov dword [ebx + 0x54], edi
mov dword [ebx + 0x74], edi
mov dword [ebx + 0x78], edi
mov dword [ebx + 0x770], edi
mov dword [ebx + 0x774], edi
mov byte [ebx + 0x7a0], 0
mov dword [ebx + 0x7a4], edi
mov dword [ebx + 0x7a8], edi
mov dword [ebx + 0x7ac], edi
mov byte [ebx + 0x784], 1
mov byte [ebx + 0x77a], 0
mov word [ebp - 0x9b4], di
call fcn.0045d4e0
add esp, 0xc
lea eax, [ebp - 0x29e0]
push eax
push 0x20019
push edi
push 0x4884e8
push 0x80000002
call dword [0x482038]
cmp eax, edi
mov dword [ebp - 0x29d8], eax
jne 0x4064e5
mov esi, dword [0x482020]
lea eax, [ebp - 0x29d4]
push eax
push edi
lea eax, [ebp - 0x29dc]
push eax
push edi
push str.stallExe
push dword [ebp - 0x29e0]
mov dword [ebp - 0x29dc], edi
mov dword [ebp - 0x29d4], edi
call esi
cmp eax, edi
mov dword [ebp - 0x29d8], eax
jne 0x4064d9
cmp dword [ebp - 0x29dc], 1
jne 0x4064d9
cmp dword [ebp - 0x29d4], 2
jb 0x4064d9
lea eax, [ebp - 0x29d4]
push eax
lea eax, [ebp - 0x9b4]
push eax
lea eax, [ebp - 0x29dc]
push eax
push edi
push str.stallExe
push dword [ebp - 0x29e0]
mov dword [ebp - 0x29d4], 0x400
call esi
mov dword [ebp - 0x29d8], eax
lea eax, [ebp - 0x9b4]
push 0x488530
push eax
call fcn.0045fefd
test eax, eax
pop ecx
pop ecx
je 0x4064d9
lea eax, [ebp - 0x29d4]
push eax
push edi
lea eax, [ebp - 0x29dc]
push eax
push edi
push str.installDir
push dword [ebp - 0x29e0]
call esi
cmp eax, edi
mov dword [ebp - 0x29d8], eax
jne 0x4064d9
cmp dword [ebp - 0x29dc], 1
jne 0x4064d9
cmp dword [ebp - 0x29d4], 2
jb 0x4064d9
lea eax, [ebp - 0x29d4]
push eax
lea eax, [ebp - 0x9b4]
push eax
lea eax, [ebp - 0x29dc]
push eax
push edi
push str.installDir
push dword [ebp - 0x29e0]
mov dword [ebp - 0x29d4], 0x400
call esi
mov dword [ebp - 0x29d8], eax
lea eax, [ebp - 0x9b4]
push eax
call dword [0x482408]
test eax, eax
je 0x4064d9
lea eax, [ebp - 0x29d4]
push eax
push edi
lea eax, [ebp - 0x29dc]
push eax
push edi
push str._baiduBaiduPlayerBrowser
push dword [ebp - 0x29e0]
mov byte [ebx + 0x77a], 1
call esi
cmp eax, edi
mov dword [ebp - 0x29d8], eax
jne 0x4064d9
cmp dword [ebp - 0x29dc], 1
jne 0x4064d9
cmp dword [ebp - 0x29d4], 2
jb 0x4064d9
lea eax, [ebp - 0x29d4]
push eax
lea eax, [ebp - 0x9b4]
push eax
lea eax, [ebp - 0x29dc]
push eax
push edi
push str._baiduBaiduPlayerBrowser
push dword [ebp - 0x29e0]
mov dword [ebp - 0x29d4], 0x400
call esi
mov dword [ebp - 0x29d8], eax
push dword [ebp - 0x29e0]
call dword [0x482028]
cmp byte [ebx + 0x77a], 0
je 0x406509
cmp dword [ebp - 0x29d8], edi
jne 0x406509
mov esi, dword [ebp - 0x29ec]
lea eax, [ebp - 0x9b4]
call fcn.004049bc
jmp 0x406537
push 1
push 0x1a
lea eax, [ebp - 0x29b4]
push eax
push edi
call dword [0x4823ec]
mov esi, dword [ebp - 0x29ec]
lea eax, [ebp - 0x29b4]
call fcn.004049bc
push 0x488564
push esi
call fcn.004050a7
mov eax, dword [ebp - 0x29ec]
push 0xffffffffffffffff
push dword [ebp - 0x29e8]
xor ebx, ebx
call fcn.00404c5e
push 0x488598
mov ebx, dword [ebp - 0x29f0]
xor edi, edi
push edi
mov eax, dword [ebp + 8]
push edi
push edi
push edi
push 1
push edi
push edi
push edi
push 0x190
push edi
push edi
push edi
push 0xfffffffffffffff4
mov byte [ebx + 0x779], 0
mov dword [ebx + 0x798], edi
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], edi
mov dword [ebx + 0x77c], 0x128
mov dword [ebx + 0x780], 0x210
call dword [0x4820a0]
push 0xb99d7f
push 1
push edi
mov dword [ebx + 0xa4], eax
mov dword [ebx + 0xac], edi
mov dword [ebx + 0xc0], edi
mov byte [ebx + 0x778], 0
mov dword [ebx + 0x788], edi
mov dword [ebx + 0x78c], edi
mov dword [ebx + 0x790], edi
mov dword [ebx + 0x794], edi
call dword [0x4820b0]
mov dword [ebx + 0xa8], eax
cmp dword [0x4a6e58], 8
mov eax, dword [0x4a6e44]
jae 0x4065fa
mov eax, 0x4a6e44
push eax
push 0x4885a0
push 0x5a
push 0x49d9fc
call fcn.00405200
add esp, 0x10
mov eax, ebx
call fcn.00408ccc
push 0x74
call fcn.00405fb4
pop ecx
push 0x30
mov dword [ebx + 4], eax
call fcn.0045e1d5
cmp eax, edi
pop ecx
je 0x406636
mov esi, eax
call fcn.004053c7
jmp 0x406638
xor eax, eax
push dword [ebx + 4]
mov dword [ebx + 0xac], eax
push eax
call fcn.004056db
mov esi, dword [ebx + 0xac]
mov eax, dword [esi + 0x18]
cmp eax, 0x20
jne 0x40665a
call fcn.00407179
push 0x83
call fcn.00405fb4
pop ecx
push 0x30
mov dword [ebx + 8], eax
call fcn.0045e1d5
cmp eax, edi
pop ecx
je 0x40667d
mov esi, eax
call fcn.004053c7
jmp 0x40667f
xor eax, eax
push dword [ebx + 8]
mov dword [ebx + 0xb0], eax
push eax
call fcn.004056db
mov esi, dword [ebx + 0xb0]
cmp dword [esi + 0x18], 0x20
jne 0x40669f
call fcn.00407179
push 0x84
call fcn.00405fb4
pop ecx
push 0x30
mov dword [ebx + 0xc], eax
call fcn.0045e1d5
cmp eax, edi
pop ecx
je 0x4066c2
mov esi, eax
call fcn.004053c7
jmp 0x4066c4
xor eax, eax
push dword [ebx + 0xc]
lea esi, [ebx + 0xb4]
push eax
mov dword [esi], eax
call fcn.004056db
mov esi, dword [esi]
cmp dword [esi + 0x18], 0x20
jne 0x4066e2
call fcn.00407179
push 0x85
call fcn.00405fb4
pop ecx
push 0x30
mov dword [ebx + 0x10], eax
call fcn.0045e1d5
cmp eax, edi
pop ecx
je 0x406705
mov esi, eax
call fcn.004053c7
jmp 0x406707
xor eax, eax
push dword [ebx + 0x10]
lea esi, [ebx + 0xb8]
push eax
mov dword [esi], eax
call fcn.004056db
mov esi, dword [esi]
cmp dword [esi + 0x18], 0x20
jne 0x406725
call fcn.00407179
mov eax, dword [ebx + 0xac]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebx + 0xb0]
mov edx, dword [edx + 0x10]
lea ecx, [edx + ecx + 1]
mov dword [ebx + 0x77c], ecx
mov eax, dword [eax + 0xc]
inc eax
push 0x7f
mov dword [ebx + 0x780], eax
call fcn.00405fb4
pop ecx
push 0x30
mov dword [ebx + 0x78], eax
call fcn.0045e1d5
cmp eax, edi
pop ecx
je 0x40676b
mov esi, eax
call fcn.004053c7
jmp 0x40676d
xor eax, eax
push dword [ebx + 0x78]
lea esi, [ebx + 0xbc]
push eax
mov dword [esi], eax
call fcn.004056db
mov esi, dword [esi]
cmp dword [esi + 0x18], 0x20
jne 0x40678b
call fcn.00407179
push 0x75
call fcn.00405fb4
pop ecx
push 0x30
mov dword [ebp - 0x29e8], eax
mov dword [ebx + 0x34], eax
call fcn.0045e1d5
cmp eax, edi
pop ecx
je 0x4067b1
mov esi, eax
call fcn.004053c7
jmp 0x4067b3
xor eax, eax
push dword [ebp - 0x29e8]
mov edi, dword [ebp - 0x29fc]
push eax
mov dword [edi + 0x2c], eax
call fcn.004056db
test eax, eax
je 0x4067dd
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x4067d9
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [edi + 0x2c], 0
mov esi, dword [edi + 0x2c]
call fcn.00459cc6
mov eax, dword [edi + 0x2c]
mov ecx, dword [eax + 0xc]
mov dword [edi + 0x24], ecx
mov eax, dword [eax + 0x10]
mov dword [edi + 0x28], eax
and dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0x10e
mov eax, dword [ebx + 0x780]
push 0x78
mov dword [ebx + 0x514], eax
mov byte [ebx + 0x50c], 0
call fcn.00405fb4
mov esi, dword [ebp - 0x2a10]
pop ecx
push 4
mov dword [ebx + 0x38], eax
push eax
mov eax, esi
call fcn.0045941f
mov eax, dword [ebx + 0x780]
push 0xa
pop edi
sub eax, 0x1f
push 0x79
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
call fcn.00405fb4
mov esi, dword [ebp - 0x2a18]
pop ecx
push 4
mov dword [ebx + 0x3c], eax
push eax
mov eax, esi
call fcn.0045941f
mov eax, dword [ebx + 0x780]
sub eax, 0x3e
push 0x94
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edi
call fcn.00405fb4
pop ecx
push 0x93
mov dword [ebx + 0x1c], eax
call fcn.00405fb4
pop ecx
push 0x95
mov dword [ebx + 0x20], eax
call fcn.00405fb4
pop ecx
push 0x96
mov dword [ebx + 0x24], eax
call fcn.00405fb4
pop ecx
push 0x97
mov dword [ebx + 0x28], eax
call fcn.00405fb4
cmp byte [ebx + 0x77a], 0
pop ecx
mov dword [ebx + 0x2c], eax
je 0x4068bd
mov eax, dword [ebx + 0x28]
jmp 0x4068c0
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp - 0x2a20]
push 4
mov dword [ebx + 0x30], eax
push eax
mov eax, esi
call fcn.0045941f
push 0x9a
mov dword [esi + 0x2c], 0x17f
mov dword [esi + 0x30], 0xc1
call fcn.00405fb4
pop ecx
push 0x98
mov dword [ebx + 0x40], eax
call fcn.00405fb4
pop ecx
push 0x99
mov dword [ebx + 0x44], eax
call fcn.00405fb4
pop ecx
push 0x80
mov dword [ebx + 0x48], eax
call fcn.00405fb4
mov esi, dword [ebp - 0x2a28]
pop ecx
push 4
mov dword [ebx + 0x74], eax
push eax
mov eax, esi
call fcn.0045941f
push 0x7e
mov dword [esi + 0x2c], 0x16c
mov dword [esi + 0x30], 0x11b
call fcn.00405fb4
pop ecx
push 0x7d
mov dword [ebx + 0x50], eax
call fcn.00405fb4
pop ecx
push 0x7b
mov dword [ebx + 0x54], eax
call fcn.00405fb4
mov edi, dword [ebp - 0x2a30]
pop ecx
push eax
mov dword [ebx + 0x4c], eax
call fcn.0045977b
mov eax, dword [edi + 0x68]
mov ecx, 0x158
mov dword [edi + 0x64], ecx
add eax, 0x26
mov dword [edi + 0x60], 0x1c
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov eax, 0x4885a8
lea ecx, [ebp - 0x30]
call fcn.00404680
lea eax, [ebx + 0x2b0]
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x15
call fcn.0045998e
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
mov eax, edi
call fcn.004597dd
mov dword [ebx + 0x2d0], 0x464646
mov byte [edi + 0x3c], 0
mov byte [edi + 0x5c], 0
push dword [ebx + 0x4c]
mov edi, dword [ebp - 0x2a38]
call fcn.0045977b
mov eax, dword [edi + 0x68]
mov ecx, 0x13e
add eax, 0x26
mov dword [edi + 0x60], 0x1c
mov dword [edi + 0x64], ecx
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov eax, 0x4885bc
lea ecx, [ebp - 0x30]
call fcn.00404680
lea eax, [ebx + 0x320]
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x16
call fcn.0045998e
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
mov eax, edi
call fcn.004597dd
push dword [ebx + 0x4c]
mov edi, dword [ebp - 0x29f4]
mov dword [ebx + 0x340], 0x464646
call fcn.0045977b
mov eax, dword [edi + 0x68]
mov ecx, 0x158
mov dword [edi + 0x64], ecx
add eax, 0x10b
mov dword [edi + 0x60], 0x101
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov eax, 0x4885cc
lea ecx, [ebp - 0x30]
call fcn.00404680
lea eax, [ebx + 0x390]
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x17
call fcn.0045998e
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
mov eax, edi
call fcn.004597dd
mov dword [ebx + 0x3b0], 0x464646
mov byte [edi + 0x3c], 0
mov byte [edi + 0x5c], 0
push dword [ebx + 0x4c]
mov edi, dword [ebp - 0x2a1c]
call fcn.0045977b
mov eax, dword [edi + 0x68]
mov ecx, 0x171
mov dword [edi + 0x64], ecx
add eax, 0x26
mov dword [edi + 0x60], 0x1c
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov eax, str.hao123
lea ecx, [ebp - 0x30]
call fcn.00404680
lea eax, [ebx + 0x400]
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x18
call fcn.0045998e
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
mov eax, edi
call fcn.004597dd
mov dword [ebx + 0x420], 0x464646
mov byte [edi + 0x3c], 0
mov byte [edi + 0x5c], 0
push dword [ebx + 0x4c]
mov edi, dword [ebp - 0x2a04]
call fcn.0045977b
mov dword [edi + 0x60], 0x1ce
mov ecx, 0x158
mov eax, dword [edi + 0x68]
mov dword [edi + 0x64], ecx
add eax, 0x1d8
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov eax, 0x4885f0
lea ecx, [ebp - 0x30]
call fcn.00404680
lea eax, [ebx + 0x470]
push eax
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x19
call fcn.0045998e
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
mov eax, edi
call fcn.004597dd
mov dword [ebx + 0x490], 0x464646
mov byte [edi + 0x3c], 0
mov byte [edi + 0x5c], 0
mov eax, 0x48860c
lea ecx, [ebp - 0x30]
mov byte [ebx + 0x4c9], 1
mov byte [ebx + 0x309], 1
mov byte [ebx + 0x379], 1
mov byte [ebx + 0x3e9], 1
mov byte [ebx + 0x459], 1
call fcn.00404680
mov edi, dword [ebp - 0x2a2c]
push edi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x1a
call fcn.0045998e
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
push 0x190
push 0xfffffffffffffff4
call fcn.004599a0
mov dword [ebx + 0x574], 0xc36602
mov dword [edi + 0x24], 0x98
mov dword [edi + 0x28], 0x18c
mov eax, 0x488618
lea ecx, [ebp - 0x30]
mov byte [ebx + 0x58c], 0
call fcn.00404680
mov edi, dword [ebp - 0x2a0c]
push edi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x1b
call fcn.0045998e
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
push 0x190
push 0xfffffffffffffff4
call fcn.004599a0
mov dword [ebx + 0x5b0], 0xc36602
mov dword [edi + 0x24], 0x1c
mov dword [edi + 0x28], 0x18c
mov eax, 0x488620
lea ecx, [ebp - 0x30]
mov byte [ebx + 0x5c8], 0
call fcn.00404680
mov edi, dword [ebp - 0x2a24]
push edi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x1c
call fcn.0045998e
mov byte [ebp - 4], 0x14
push 0
push 1
lea esi, [ebp - 0x30]
call fcn.00404a28
push 0x190
push 0xfffffffffffffff4
call fcn.004599a0
mov dword [ebx + 0x5ec], 0x464646
mov dword [edi + 0x24], 0x1c
mov dword [edi + 0x28], 0x18c
mov eax, str._vz_N_f
lea ecx, [ebp - 0x30]
mov byte [ebx + 0x604], 0
call fcn.00404680
mov edi, dword [ebp - 0x2a14]
push edi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x1d
call fcn.0045998e
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
push 0x190
push 0xfffffffffffffff4
call fcn.004599a0
mov dword [ebx + 0x628], 0x464646
mov eax, 0x488648
lea ecx, [ebp - 0x30]
mov dword [edi + 0x24], 0x1c
mov dword [edi + 0x28], 0x121
call fcn.00404680
mov edi, dword [ebp - 0x2a34]
push edi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x1e
call fcn.0045998e
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
push 0x190
push 0xfffffffffffffff4
call fcn.004599a0
mov dword [ebx + 0x6a0], 0x464646
mov dword [edi + 0x24], 0x1c
mov dword [edi + 0x28], 0x11a
mov eax, 0x488668
lea ecx, [ebp - 0x30]
mov byte [ebx + 0x6b8], 0
call fcn.00404680
mov edi, dword [ebp - 0x29f8]
push edi
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x1f
call fcn.0045998e
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
push 0x190
push 0xfffffffffffffff4
call fcn.004599a0
mov dword [ebx + 0x6dc], 0x9f
mov dword [edi + 0x24], 0x193
mov dword [edi + 0x28], pe_nt_image_headers32
mov eax, 0x488680
lea ecx, [ebp - 0x30]
mov byte [ebx + 0x6f4], 0
call fcn.00404680
mov edi, dword [ebp - 0x2a00]
mov byte [ebp - 4], 0x20
push edi
lea eax, [ebp - 0x30]
call fcn.0045998e
push 0
push 1
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 0x14
call fcn.00404a28
push 0x190
push 0xfffffffffffffff4
call fcn.004599a0
mov dword [ebx + 0x664], 0x9f
mov dword [edi + 0x24], 0x1b4
mov dword [edi + 0x28], 0x120
push 0x91
mov byte [ebx + 0x67c], 0
call fcn.00405fb4
pop ecx
push 0x92
mov dword [ebx + 0x14], eax
call fcn.00405fb4
mov esi, dword [ebp - 0x2a08]
pop ecx
push 4
push dword [ebx + 0x14]
mov dword [ebx + 0x18], eax
mov eax, esi
call fcn.0045941f
push 0xff
lea eax, [ebp - 0x1b3]
push 0
push eax
mov dword [esi + 0x2c], 0x25f
mov dword [esi + 0x30], 0x13f
mov byte [ebp - 0x1b4], 0
call fcn.0045d4e0
xor eax, eax
mov byte [ebp - 0x28], 0
lea edi, [ebp - 0x27]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1b4]
add esp, 0xc
push eax
lea ecx, [ebp - 0x28]
call fcn.00440c65
pop ecx
lea ebx, [ebp - 0x28]
lea ecx, [ebp - 0x29d0]
call fcn.0041a1fd
push 0x100
xor ebx, ebx
lea eax, [ebp - 0x1b4]
push ebx
push eax
mov byte [ebp - 4], 0x21
call fcn.0045d4e0
add esp, 0xc
push 0x7e
lea eax, [ebp - 0xb2]
push ebx
push eax
mov word [ebp - 0xb4], bx
call fcn.0045d4e0
add esp, 0xc
push 0xfde9
lea eax, [ebp - 0xb4]
push 0x40
push eax
lea edi, [ebp - 0x29d0]
call fcn.0044b883
add esp, 0xc
push 0x4886b8
lea eax, [ebp - 0x29e4]
push eax
call fcn.00404607
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 0x22
push eax
lea eax, [ebp - 0x29e4]
push eax
call fcn.0040bafa
push 0x4886c8
lea eax, [ebp - 0x29e4]
push eax
call fcn.0040bafa
push dword [ebp - 0x29e4]
push ebx
push 0x488750
call dword [0x482520]
mov esi, dword [ebp - 0x29f0]
mov ecx, esi
call fcn.004078d3
mov ecx, esi
call fcn.00407207
call dword [0x48220c]
mov dword [esi + 0x79c], eax
mov eax, dword [ebp - 0x29e4]
add eax, 0xfffffff0
call fcn.00401144
push ebx
push 1
mov ecx, edi
call fcn.0040489d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045ce5b
leave
ret 4