Function at 0x563e60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x62514e
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x682d00]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x682d00]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xbc]
xor edi, edi
mov esi, ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x18], edi
xor ebx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x4c], edi
call fcn.0051fdc0
lea ecx, [esp + 0x84]
mov dword [esp + 0xb4], ebx
call fcn.0051a860
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 1
mov dword [esp + 0x44], ebx
call fcn.005eec00
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
mov edx, dword [eax + 0x68]
push ecx
mov ecx, esi
mov byte [esp + 0xb8], 2
call edx
xor ecx, ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 4], ecx
mov eax, dword [ebp]
cmp eax, ecx
jle 0x5646a9
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x5c]
call eax
add eax, 0xffffffef
cmp eax, 0x21
ja case.0x563f44.18
movzx ecx, byte [eax + 0x564728]
jmp dword [ecx*4 + 0x564714]
cmp dword [esp + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
mov ebp, dword [edx + eax*4]
mov dword [esp + 0x48], ebp
je 0x563f7c
mov eax, dword [esi + 0xc]
test byte [eax + 2], 8
mov ecx, dword [ebp + 0x24]
je 0x563f71
mov dword [eax + 4], ecx
jmp 0x563f74
mov dword [eax + 0xc], ecx
mov dword [esp + 0x44], 0
mov ecx, esi
call fcn.00562690
mov ebx, eax
push ebx
push ebp
mov ecx, esi
call fcn.0055f320
test eax, eax
je 0x564625
test ebx, ebx
jl 0x564625
jmp 0x5645a2
cmp dword [esp + 0x44], 0
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov edi, dword [ecx + edx*4]
je 0x563fd0
mov eax, dword [esi + 0xc]
test byte [eax + 2], 8
mov ecx, dword [edi + 0x14]
je 0x563fc5
mov dword [eax + 4], ecx
jmp 0x563fc8
mov dword [eax + 0xc], ecx
mov dword [esp + 0x44], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x56400a
cmp eax, 0x16
je 0x56400a
cmp eax, 0x20
jne 0x56404c
mov ecx, dword [esi + 0xc]
mov eax, ebx
shl eax, 4
test dword [eax + ecx], 0xffff
je 0x56400a
mov edx, dword [esp + 0x4c]
add edx, 4
push edx
mov ecx, edi
call fcn.00520820
test eax, eax
jne 0x5645a2
mov ecx, esi
call fcn.00562690
mov ebp, eax
push ebp
lea eax, [edi + 4]
push eax
mov ecx, esi
call fcn.0055f150
test eax, eax
je 0x564625
mov ebx, ebp
test ebp, ebp
jl 0x564625
mov eax, dword [edi + 0x14]
shl ebp, 4
add ebp, dword [esi + 0xc]
test byte [ebp + 2], 8
je 0x564212
mov dword [ebp + 4], eax
jmp 0x5645a2
cmp eax, 0x31
je 0x56405a
cmp eax, 0x32
jne 0x564196
cmp dword [esp + 0x1c], 0
je 0x564196
push edi
lea ecx, [esp + 0x70]
call fcn.0052a1e0
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov ecx, ebp
mov dword [esp + 0x58], 0
call fcn.005c93b0
cmp dword [esp + 0x6c], 0
jne 0x564095
cmp dword [esp + 0x70], 0
je 0x5640d3
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x74]
call fcn.0052a3e0
test eax, eax
jne 0x5640d3
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.00563710
mov ebx, eax
test ebx, ebx
jl 0x564625
mov eax, dword [edi + 0x14]
mov ecx, ebx
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.0040b320
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.00523bf0
add esp, 8
test eax, eax
jne 0x5640f1
lea eax, [edi + 4]
push eax
jmp 0x5641d4
mov edx, dword [edi + 0xc]
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [edi + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x1c], esp
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov edx, dword [esp + 0x50]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 4]
mov dword [esp + 0x24], esp
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x2c], esp
mov dword [eax + 4], ecx
call fcn.005625e0
add esp, 0x18
test eax, eax
je 0x564144
lea eax, [edi + 4]
push eax
jmp 0x5641d4
mov edx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 0x10]
sub ecx, dword [edi + 4]
sub eax, dword [edi + 8]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x3c]
sub edx, ebp
mov ebp, dword [esp + 0x40]
sub ebp, dword [esp + 0x14]
test ecx, ecx
jle 0x564172
test edx, edx
jl 0x564190
test ecx, ecx
jge 0x564178
test edx, edx
jg 0x564190
test eax, eax
jle 0x564182
test ebp, ebp
jl 0x564190
test eax, eax
jge 0x5645a2
test ebp, ebp
jle 0x5645a2
lea eax, [edi + 4]
push eax
jmp 0x5641d4
cmp eax, 0x11
jne 0x5645a2
mov eax, dword [esp + 0x48]
mov eax, dword [eax + 0x28]
cmp eax, dword [edi + 0x14]
je 0x5645a2
mov ecx, dword [esp + 0x48]
lea ebp, [edi + 4]
add ecx, 0xc
push ebp
push ecx
call fcn.00523bf0
add esp, 8
test eax, eax
je 0x5641d3
mov eax, dword [esp + 0x48]
mov edx, dword [eax + 0x24]
cmp edx, dword [eax + 0x28]
je 0x5641fb
push ebp
mov ecx, esi
call fcn.00563710
mov ebx, eax
test ebx, ebx
jl 0x564625
mov eax, dword [edi + 0x14]
mov ecx, ebx
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.0040b320
jmp 0x5645a2
mov eax, dword [edi + 0x14]
lea ecx, [ebx + 2]
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.0040b320
jmp 0x5645a2
mov dword [ebp + 0xc], eax
jmp 0x5645a2
cmp dword [esp + 0x14], 0x16
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov eax, dword [ecx + edx*4]
mov dword [esp + 0x1c], eax
jne 0x56437a
test edi, edi
je 0x56437a
push edi
lea ecx, [esp + 0x60]
call fcn.0052a1e0
mov ebp, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
mov dword [esp + 0x5c], 0
call fcn.005c93b0
cmp dword [esp + 0x5c], 0
jne 0x56426b
cmp dword [esp + 0x60], 0
je 0x5642a6
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x64]
call fcn.0052a3e0
test eax, eax
jne 0x5642a6
lea ecx, [edi + 0xc]
push ecx
mov ecx, esi
call fcn.00563710
test eax, eax
jl 0x564625
mov ecx, dword [edi + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.0040b320
lea ebx, [edi + 0xc]
lea edx, [esp + 0x34]
push ebx
push edx
call fcn.00523bf0
add esp, 8
test eax, eax
jne 0x5642c5
lea eax, [esp + 0x34]
push eax
jmp 0x56435a
mov ecx, dword [ebp + 4]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x1c], esp
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], ecx
mov edx, dword [edi + 4]
mov dword [esp + 0x24], esp
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [edi + 8]
mov dword [esp + 0x2c], esp
mov dword [eax + 4], ecx
call fcn.005625e0
add esp, 0x18
test eax, eax
je 0x564316
lea eax, [esp + 0x34]
push eax
jmp 0x56435a
mov eax, dword [ebx + 4]
mov edx, dword [edi + 8]
mov ecx, dword [ebx]
mov ebx, dword [esp + 0x1c]
sub ecx, dword [edi + 4]
mov ebp, dword [ebx + 4]
sub ebp, dword [esp + 0x34]
sub eax, edx
mov edx, dword [ebx + 8]
sub edx, dword [esp + 0x38]
test ecx, ecx
jle 0x56433f
test ebp, ebp
jl 0x564355
test ecx, ecx
jge 0x564345
test ebp, ebp
jg 0x564355
test eax, eax
jle 0x56434f
test edx, edx
jl 0x564355
test eax, eax
jge 0x56437a
test edx, edx
jle 0x56437a
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.00563710
test eax, eax
jl 0x564625
mov ecx, dword [edi + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.0040b320
cmp dword [esp + 0x18], 0
mov ebx, dword [esp + 0x1c]
jne 0x5643ea
lea edx, [esp + 0x84]
push edx
mov ecx, ebx
mov dword [esp + 0x48], 1
call fcn.005c93d0
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x24]
call fcn.005823c0
test dword [esp + 0x20], 0x80000
mov eax, dword [ebx + 0x20]
je 0x5643c0
mov dword [esp + 0x24], eax
jmp 0x5643c4
mov dword [esp + 0x2c], eax
mov ecx, esi
call fcn.00562690
mov ebp, eax
push ebp
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.0055f000
test eax, eax
je 0x564625
test ebp, ebp
jl 0x564625
mov ecx, esi
call fcn.00562690
mov ebp, eax
push ebp
add ebx, 4
push ebx
mov ecx, esi
call fcn.0055f150
test eax, eax
je 0x564625
mov ebx, ebp
test ebp, ebp
jl 0x564625
mov ecx, dword [esi + 0xc]
shl ebp, 4
push 1
add ecx, ebp
call fcn.00582760
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0xc]
mov edx, dword [ecx + 0x1c]
add eax, ebp
mov dword [eax + 0xc], edx
mov edx, dword [ecx]
mov eax, dword [edx + 0x5c]
call eax
cmp eax, 0x32
jne 0x564447
mov ecx, dword [esi + 0xc]
push 1
add ecx, ebp
call fcn.005827a0
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
dec eax
cmp dword [esp + 0x18], eax
jne 0x5645a2
mov ebx, dword [esp + 0x1c]
lea edx, [esp + 0x84]
push edx
mov ecx, ebx
call fcn.005c93d0
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x24]
call fcn.005823c0
test dword [esp + 0x20], 0x80000
mov eax, dword [ebx + 0x20]
je 0x56448f
mov dword [esp + 0x24], eax
jmp 0x564493
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.005636e0
mov ebx, eax
test ebx, ebx
jl 0x564625
jmp 0x5645a2
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ebp, dword [edx + eax*4]
lea eax, [edx + eax*4]
mov dword [esp + 0x4c], ebp
cmp ecx, 0x16
jne 0x564527
cmp dword [ebp + 0x14], 1
jne 0x5644e6
lea ecx, [edi + 0xc]
push ecx
mov ecx, esi
call fcn.00563710
test eax, eax
jl 0x564625
mov ecx, dword [edi + 0x14]
jmp 0x564540
lea edx, [esp + 0x7c]
push edx
mov ecx, ebp
call fcn.0057fe60
mov ecx, dword [eax]
cmp ecx, dword [ebp + 0xc]
jne 0x564554
mov edx, dword [eax + 4]
cmp edx, dword [ebp + 0x10]
jne 0x564554
lea eax, [edi + 0xc]
push eax
mov ecx, esi
call fcn.00563710
test eax, eax
jl 0x564625
mov ecx, dword [edi + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.0040b320
jmp 0x564554
cmp ecx, 0x20
jne 0x564554
mov ebx, dword [eax - 4]
lea ecx, [ebx + 4]
push ecx
mov ecx, esi
call fcn.00563710
mov ebx, dword [ebx + 0x1c]
lea ecx, [ebx + ebx]
shl eax, 4
add eax, dword [esi + 0xc]
test byte [eax + 2], 8
je 0x564551
mov dword [eax + 4], ecx
jmp 0x564554
mov dword [eax + 0xc], ecx
cmp dword [esp + 0x18], 0
jne 0x564589
cmp dword [ebp + 0x14], 1
mov ecx, esi
jne 0x564569
lea edx, [ebp + 4]
push edx
jmp 0x56456d
lea eax, [ebp + 0xc]
push eax
call fcn.00563710
mov ecx, dword [ebp + 0x24]
shl eax, 4
add eax, dword [esi + 0xc]
test byte [eax + 2], 8
je 0x564586
mov dword [eax + 4], ecx
jmp 0x564589
mov dword [eax + 0xc], ecx
mov ecx, esi
call fcn.00562690
mov ebx, eax
push ebx
push ebp
mov ecx, esi
call fcn.0055f470
test eax, eax
jne 0x5645a2
or ebx, 0xffffffff
mov ebp, dword [esp + 0x50]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov ecx, dword [ecx + edx*4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x5c]
call edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
inc eax
cmp eax, dword [ebp]
mov dword [esp + 0x18], eax
jl 0x563f20
mov eax, dword [esp + 0x14]
cmp eax, 0x20
jne 0x564670
mov ebx, dword [esp + 0x4c]
mov ecx, esi
call fcn.00562690
cmp dword [ebx + 0x14], 0
mov edi, eax
push edi
jne 0x564665
lea eax, [ebx + 4]
push eax
mov ecx, esi
call fcn.0055f150
test eax, eax
je 0x564625
test edi, edi
jl 0x564625
mov ebx, dword [ebx + 0x24]
shl edi, 4
add edi, dword [esi + 0xc]
test byte [edi + 2], 8
je 0x56466b
mov dword [edi + 4], ebx
jmp 0x5646a9
push 0x302
call fcn.005f2690
add esp, 4
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 1
call fcn.0051a4a0
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0
call fcn.0051b350
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], 0xffffffff
call fcn.0051fe50
xor eax, eax
jmp 0x5646e7
lea ecx, [ebx + 0xc]
push ecx
jmp 0x5645f2
mov dword [edi + 0xc], ebx
jmp 0x5646a9
cmp eax, 0x16
jne 0x5646a9
mov ecx, esi
call fcn.00562690
mov ebx, eax
push ebx
lea edx, [edi + 0xc]
push edx
mov ecx, esi
call fcn.0055f150
test eax, eax
je 0x564625
test ebx, ebx
jl 0x564625
mov edi, dword [edi + 0x14]
shl ebx, 4
add ebx, dword [esi + 0xc]
test byte [ebx + 2], 8
je 0x5646a6
mov dword [ebx + 4], edi
jmp 0x5646a9
mov dword [ebx + 0xc], edi
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 1
call fcn.0051a4a0
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0
call fcn.0051b350
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], 0xffffffff
call fcn.0051fe50
mov eax, 1
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005f9aee
add esp, 0xa4
ret 4