Function at 0x402b70
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4262c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
call fcn.0041afba
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
xor ebx, ebx
mov dword [esp + 0x30], ebx
call fcn.0041afba
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebp, [eax + 0x10]
mov dword [esp + 0x14], ebp
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x44
push 0x40
mov byte [esp + 0x38], 1
call edi
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0x2c
push 0x40
mov esi, eax
call edi
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push str.unz32dll.dll
mov dword [edi + 0xc], 0x402820
mov dword [edi], 0x402830
mov dword [edi + 4], ebx
mov dword [edi + 8], 0x402840
mov dword [edi + 0x10], 0x402850
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [esp + 0x20], eax
je 0x402d35
push str.Wiz_SingleEntryUnzip
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esp + 0x38]
cmp edx, ebx
mov dword [esp + 0x24], eax
jne 0x402c3a
xor eax, eax
jmp 0x402c49
mov eax, edx
lea ebp, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402c40
sub eax, ebp
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.004016b0
mov edx, dword [esp + 0x3c]
cmp edx, ebx
jne 0x402c60
xor eax, eax
jmp 0x402c6e
mov eax, edx
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402c65
sub eax, ebp
push eax
push edx
lea ecx, [esp + 0x1c]
call fcn.004016b0
mov ebp, dword [esp + 0x14]
push edi
push esi
push ebx
mov eax, 1
push ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov eax, dword [esp + 0x20]
push ebx
push ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebp
call dword [esp + 0x3c]
cmp eax, ebx
jne 0x402d35
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push edi
push ecx
push esi
push edx
call fcn.00402860
mov eax, dword [esp + 0x30]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x10]
mov byte [esp + 0x30], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402cf7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402d1d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
mov edi, dword [esp + 0x18]
cmp edi, ebx
je 0x402d4f
cmp esi, ebx
je 0x402d48
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esi, dword [esp + 0x1c]
cmp esi, ebx
je 0x402d65
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add ebp, 0xfffffff0
mov byte [esp + 0x30], bl
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402d8f
mov ecx, dword [ebp]
mov eax, dword [ecx]
push ebp
call dword [eax + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402db5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret