Function at 0x6511c7c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6514e07b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6516c6d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.651165d0
xor eax, eax
xor ebx, ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [ebp - 4], ebx
mov byte [esi + 0x44], bl
mov dword [esi], 0x65157878
mov dword [esi + 4], 0x65156fe4
mov dword [esi + 0xc], 0x65157844
mov dword [esi + 0x10], 0x65157820
mov dword [esi + 0x14], 0x651577e0
mov dword [esi + 0x18], 0x651577c4
mov dword [esi + 0x1c], 0x65157794
mov dword [esi + 0x20], 0x65157774
mov dword [esi + 0x24], 0x65157764
mov dword [esi + 0x48], ebx
push esi
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 2
call fcn.6511ac80
push esi
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 3
call fcn.65118da0
mov dword [esi + 0x8c], 0x6515d174
push esi
lea ecx, [esi + 0x94]
mov byte [ebp - 4], 4
call fcn.6511a8c0
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd8], ebx
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebx
mov edi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_void_]
lea ecx, [esi + 0xe4]
mov byte [ebp - 4], 0xd
call edi
lea ecx, [esi + 0xe8]
mov byte [ebp - 4], 0xe
call edi
push esi
lea ecx, [esi + 0xf0]
mov byte [ebp - 4], 0xf
call fcn.6510fef0
mov dword [esi + 0x198], ebx
mov dword [esi + 0x19c], ebx
mov dword [esi + 0x1a0], ebx
mov dword [esi + 0x1a8], ebx
mov dword [esi + 0x1ac], ebx
mov dword [esi + 0x1b0], ebx
mov dword [esi + 0x1b8], ebx
mov dword [esi + 0x1bc], ebx
mov dword [esi + 0x1c0], ebx
mov dword [esi + 0x1c8], ebx
mov dword [esi + 0x1cc], ebx
mov dword [esi + 0x1d0], ebx
mov dword [esi + 0x1d8], ebx
mov dword [esi + 0x1dc], ebx
mov dword [esi + 0x1e0], ebx
mov dword [esi + 0x1e4], ebx
mov dword [esi + 0x1e8], ebx
mov dword [esi + 0x1ec], ebx
mov dword [esi + 0x1f0], ebx
mov dword [esi + 0x1f4], ebx
mov dword [esi + 0x1f8], ebx
mov dword [esi + 0x1fc], ebx
mov dword [esi + 0x200], ebx
mov dword [esi + 0x204], ebx
mov dword [esi + 0x208], ebx
mov dword [esi + 0x20c], ebx
mov dword [esi + 0x210], ebx
mov dword [esi + 0x214], ebx
mov dword [esi + 0x218], ebx
mov dword [esi + 0x21c], ebx
mov dword [esi + 0x220], ebx
mov dword [esi + 0x224], ebx
mov dword [esi + 0x228], ebx
mov dword [esi + 0x22c], ebx
mov dword [esi + 0x230], ebx
mov dword [esi + 0x234], ebx
mov dword [esi + 0x238], ebx
mov dword [esi + 0x23c], ebx
mov dword [esi + 0x240], ebx
mov dword [esi + 0x244], ebx
lea ecx, [esi + 0x248]
mov byte [ebp - 4], 0x2e
call dword [sym.imp.AFBase.DLL_public:_void___thiscall_CScanVirus::constructor_void_]
push esi
lea ecx, [esi + 0x58c]
mov byte [ebp - 4], 0x2f
call fcn.65118e50
mov dword [esi + 0x588], 0x6515d174
push esi
lea ecx, [esi + 0x594]
mov byte [ebp - 4], 0x30
call fcn.65118ef0
mov dword [esi + 0x590], 0x6515d174
lea ecx, [esi + 0x5a0]
mov byte [ebp - 4], 0x31
call fcn.65137d20
lea ecx, [esi + 0x600]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXBSTR::constructor_void_]
push esi
lea ecx, [esi + 0x608]
mov byte [ebp - 4], 0x33
call fcn.65121be0
mov dword [esi + 0x604], 0x6515d174
lea ecx, [esi + 0x610]
mov byte [ebp - 4], 0x34
call fcn.65139630
mov eax, dword [esi + 0x594]
mov dword [esi + 0x598], ebx
mov dword [esi + 0x59c], ebx
mov ecx, 0x6511c2f0
mov dword [eax + 0x28], ecx
xor edx, edx
mov dword [eax + 0x2c], edx
mov eax, dword [esi + 0x58c]
mov dword [eax + 0x2c], edx
mov ecx, 0x65119fc0
mov dword [eax + 0x28], ecx
mov eax, dword [esi + 0x608]
mov ecx, 0x65115ae0
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ebx
mov dword [esi + 0x60c], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret