Function at 0x8907c0
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov dword [esi + 0x138], ebp
nop
mov edi, dword [ebp + 8]
mov dword [esi + 0x13c], esp
mov dword [esi + 0x148], 0xffffffff
lea eax, [esi + 0x140]
mov dword [esi + 0x144], 0x891a80
mov ecx, dword fs:[0]
mov dword [esi + 0x140], ecx
mov dword fs:[0], eax
call fcn.00891a60
mov edx, dword [0xa41acc]
mov ecx, dword [0xa41aac]
mov ebx, 0xfffff065
sub ebx, eax
mov dword [esi + 0x18], ebx
sub ecx, ebx
add ecx, edx
call dword [0xa0535c]
call ecx
mov byte [edi], 0
mov dword [edi + 0x14], 0
mov ecx, eax
xor ecx, 0xd688d893
mov dword [edi + 0x18], ecx
mov byte [edi + 4], 0
mov dword [edi + 0x2c], 0
mov dword [esi + 8], ecx
mov dword [edi + 0x30], ecx
mov byte [edi + 0x1c], 0
mov byte [edi + 0x34], 0
mov dword [edi + 0x38], 0
xorps xmm0, xmm0
movaps xmmword [esi + 0x20], xmm0
mov dword [esi + 0xc], eax
mov ecx, eax
xor ecx, 0xd688d895
mov dword [esi + 0x88], 0x9b9474
lea eax, [esi + 0x20]
mov dword [esi + 0x8c], eax
lea eax, [esi + 0x88]
mov dword [esi + 0x10], ecx
mov dword [esi + ecx*4 + 0x88], eax
mov dword [esi + 0x148], 0x14
push eax
call fcn.008b6780
add esp, 4
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi + eax*4 + 0x88]
test edi, edi
nop
mov ecx, dword [esi + 0xc]
lea edx, [esi + 0x88]
je 0x890902
xor ebx, ebx
cmp edi, edx
setne bl
mov eax, dword [edi]
mov ecx, dword [esi + 0xc]
xor ecx, 0x1688d898
mov ecx, dword [eax + ecx*4]
mov dword [esi + 0x14], ecx
mov dword [esi + 0x148], 0xffffffff
call dword [0xa0535c]
mov ecx, edi
push ebx
call dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
lea edx, [esi + 0x88]
nop
mov eax, dword [esi + 0x28]
xor cl, 0x83
shr eax, cl
mov ecx, dword [ebp + 8]
mov byte [ecx], al
xorps xmm0, xmm0
movaps xmmword [esi + 0x60], xmm0
mov dword [esi + 0x88], 0x9b9504
lea eax, [esi + 0x60]
mov dword [esi + 0x8c], eax
mov eax, dword [esi + 0x10]
mov dword [esi + eax*4 + 0x88], edx
mov dword [esi + 0x148], 0x13
push edx
call fcn.008b6780
add esp, 4
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi + eax*4 + 0x88]
test edi, edi
je 0x89098a
xor ebx, ebx
lea eax, [esi + 0x88]
cmp edi, eax
setne bl
mov eax, dword [edi]
mov ecx, dword [esi + 0xc]
xor ecx, 0x1688d898
mov ecx, dword [eax + ecx*4]
mov dword [esi + 0x14], ecx
mov dword [esi + 0x148], 0xffffffff
call dword [0xa0535c]
mov ecx, edi
push ebx
call dword [esi + 0x14]
nop
mov dword [esi + 0x148], 9
lea ecx, [esi + 0x88]
push 1
call fcn.006863c0
nop
mov eax, dword [esi + 0xc]
mov ecx, eax
xor ecx, 0xd688d88c
mov edx, eax
xor edx, 0xd688d898
mov eax, dword [esi + 8]
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edx
mov eax, dword [esi + edx + 0x60]
mov dword [esi + 0x20], eax
mov dword [esi + 0x54], ecx
lea ecx, [esi + ecx + 0x88]
mov byte [esi + edx + 0x20], 0
mov dword [esi + 0x148], 0x12
mov dword [esi + 0x1c], edx
push edx
lea eax, [esi + 0x20]
push eax
mov dword [esi + 0x4c], ecx
push ecx
call fcn.0078d5f0
add esp, 0xc
nop
mov eax, dword [esi + 0x34]
cmp eax, dword [esi + 8]
jbe 0x890a68
nop
mov ebx, dword [esi + 0xc]
mov ecx, ebx
xor ecx, 0x79bd27bf
mov edx, eax
xor edx, ecx
mov edi, eax
and edi, ecx
sub edx, ecx
lea edi, [edx + edi*2]
inc edi
mov ecx, ebx
xor ecx, 0xd688d763
cmp edi, ecx
mov edx, dword [esi + 0x20]
jbe 0x890a5d
nop
mov ecx, dword [edx - 4]
mov edi, ebx
xor edi, 0x29772760
add edi, edx
sub edi, ecx
mov edx, ebx
xor edx, 0xd688d8bc
cmp edi, edx
jae 0x891206
mov edx, ebx
xor edx, 0xd688d8b8
mov dword [0xa41af8], 0x3eefb953
add eax, edx
mov edi, eax
mov edx, ecx
nop
push edi
push edx
call fcn.008ea1ad
add esp, 8
nop
mov eax, dword [esi + 0xc]
xor eax, 0xd688d890
mov ecx, dword [esi + 8]
mov dword [esi + 0x34], ecx
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x70], eax
mov eax, dword [esi + eax + 0x60]
mov dword [esi + 0x20], eax
mov byte [esi + ecx + 0x20], 0
mov dword [esi + 0x148], 0x11
push ecx
lea eax, [esi + 0x20]
push eax
push dword [esi + 0x4c]
call fcn.0078d5f0
add esp, 0xc
nop
mov eax, dword [esi + 0x34]
cmp eax, dword [esi + 8]
jbe 0x890b17
lea edi, [eax + 1]
mov ebx, dword [esi + 0xc]
mov ecx, ebx
xor ecx, 0xd688d763
cmp edi, ecx
mov ecx, dword [esi + 0x20]
jbe 0x890b0c
nop
mov edx, dword [ecx - 4]
mov dword [esi + 0x14], edx
mov edi, ebx
xor edi, 0x77fd5276
mov edx, edi
xor edx, ecx
mov dword [esi + 0x50], edx
and ecx, edi
mov edx, ebx
xor edx, 0x29772760
sub edx, edi
add edx, dword [esi + 0x50]
lea ecx, [edx + ecx*2]
sub ecx, dword [esi + 0x14]
mov edx, ebx
xor edx, 0xd688d8bc
cmp ecx, edx
jae 0x891216
xor ebx, 0xd688d8b8
add eax, ebx
mov edi, eax
mov ecx, dword [esi + 0x14]
nop
push edi
push ecx
call fcn.008ea1ad
add esp, 8
nop
mov eax, dword [esi + 0xc]
xor eax, 0xd688d894
mov ecx, dword [esi + 8]
mov dword [esi + 0x34], ecx
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x5c], eax
mov eax, dword [esi + eax + 0x60]
mov dword [esi + 0x20], eax
mov byte [esi + ecx + 0x20], 0
mov dword [esi + 0x148], 0x10
push ecx
lea eax, [esi + 0x20]
push eax
push dword [esi + 0x4c]
call fcn.0078d5f0
add esp, 0xc
nop
mov eax, dword [esi + 0x34]
cmp eax, dword [esi + 8]
jbe 0x890bac
lea edi, [eax + 1]
mov ebx, dword [esi + 0xc]
mov ecx, ebx
xor ecx, 0xd688d763
cmp edi, ecx
mov ecx, dword [esi + 0x20]
jbe 0x890ba1
nop
mov edx, dword [ecx - 4]
mov edi, ebx
xor edi, 0x29772760
add edi, ecx
sub edi, edx
mov ecx, ebx
xor ecx, 0xd688d8bc
cmp edi, ecx
jae 0x891226
mov ecx, ebx
xor ecx, 0xd688d8b8
add eax, ecx
mov edi, eax
mov ecx, edx
nop
push edi
push ecx
call fcn.008ea1ad
add esp, 8
lea ecx, [esi + 0xa0]
mov dword [esi + 0x148], 0xf
lea eax, [esi + 0x20]
push eax
call fcn.0069bd10
nop
mov eax, dword [0xa41ad0]
mov edi, dword [0xa41aa0]
sub edi, dword [esi + 0x18]
add edi, eax
mov eax, dword [ebp + 8]
lea ebx, [eax + 4]
mov dword [esi + 0x148], 0xffffffff
mov ecx, edi
call dword [0xa0535c]
lea ecx, [esi + 0x88]
call edi
lea eax, [esi + 0x20]
cmp ebx, eax
nop
mov ecx, dword [esi + 8]
je 0x890ca7
nop
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x18]
cmp eax, ecx
jbe 0x890c6b
lea edx, [eax + 1]
mov ecx, dword [esi + 0xc]
xor ecx, 0xd688d763
cmp edx, ecx
mov ecx, dword [ebx]
ja 0x890c2c
nop
test byte [0xa57020], 1
je 0x890c60
nop
mov edx, dword [ecx - 4]
mov dword [esi + 0x14], edx
mov edi, dword [esi + 0xc]
mov edx, edi
xor edx, 0x29772760
add edx, ecx
sub edx, dword [esi + 0x14]
mov ecx, edi
xor ecx, 0xd688d8bc
cmp edx, ecx
jae 0x891256
xor edi, 0xd688d8b8
add eax, edi
mov edx, eax
mov ecx, dword [esi + 0x14]
nop
push edx
push ecx
call fcn.008ea1ad
add esp, 8
nop
mov eax, dword [0xa41ac0]
mov ecx, dword [0xa41aa8]
sub ecx, dword [esi + 0x18]
add ecx, eax
mov edi, dword [esi + 0xc]
xor edi, 0xd688d884
call dword [0xa0535c]
push edi
lea eax, [esi + 0x20]
push eax
push ebx
call ecx
add esp, 0xc
mov dword [esi + 0x30], 0
mov ecx, dword [esi + 8]
mov dword [esi + 0x34], ecx
mov byte [esi + 0x20], 0
nop
mov eax, dword [esi + 0x34]
cmp eax, ecx
jbe 0x890d07
lea edx, [eax + 1]
mov ebx, dword [esi + 0xc]
mov ecx, ebx
xor ecx, 0xd688d763
cmp edx, ecx
mov edi, dword [esi + 0x20]
jbe 0x890cfc
nop
mov ecx, dword [edi - 4]
mov edx, ebx
xor edx, 0x29772760
add edx, edi
sub edx, ecx
mov edi, ebx
xor edi, 0xd688d8bc
cmp edx, edi
jae 0x891236
neg eax
mov edx, ebx
xor edx, 0x29772747
inc edx
mov edi, edx
xor edi, eax
and edx, eax
lea edx, [edi + edx*2]
neg edx
mov edi, ecx
nop
push edx
push edi
call fcn.008ea1ad
add esp, 8
xorps xmm0, xmm0
movaps xmmword [esi + 0x60], xmm0
mov dword [esi + 0x88], 0x9b9574
lea eax, [esi + 0x60]
mov dword [esi + 0x8c], eax
lea eax, [esi + 0x88]
mov ecx, dword [esi + 0x10]
mov dword [esi + ecx*4 + 0x88], eax
mov dword [esi + 0x148], 0xe
push eax
call fcn.008b6780
add esp, 4
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi + eax*4 + 0x88]
test edi, edi
je 0x890d81
xor ebx, ebx
lea eax, [esi + 0x88]
cmp edi, eax
setne bl
mov eax, dword [edi]
mov ecx, dword [esi + 0x1c]
mov ecx, dword [eax + ecx*4]
mov dword [esi + 0x14], ecx
mov dword [esi + 0x148], 0xffffffff
call dword [0xa0535c]
mov ecx, edi
push ebx
call dword [esi + 0x14]
nop
mov eax, dword [esi + 0xc]
xor eax, 0x5688d898
cmp dword [esi + 0x60], eax
jae 0x890da6
nop
mov dword [esi + 0x30], 0
mov eax, dword [esi + 8]
mov dword [esi + 0x34], eax
mov byte [esi + 0x20], 0
jmp 0x890f7e
nop
mov dword [esi + 0x148], 9
lea ecx, [esi + 0x88]
push 1
call fcn.006863c0
mov eax, dword [esi + 0xc]
mov ecx, eax
xor ecx, 0xd688d89f
mov dword [esi + 0x84], ecx
mov ecx, eax
xor ecx, 0xd688d763
mov dword [esi + 0x80], ecx
mov ecx, eax
xor ecx, 0x29772760
mov dword [esi + 0x7c], ecx
mov ecx, eax
xor ecx, 0xd688d8bc
mov dword [esi + 0x78], ecx
xor eax, 0xd688d8b8
mov dword [esi + 0x74], eax
xor ebx, ebx
jmp 0x890e13
add eax, dword [esi + 0x74]
mov edx, eax
mov ecx, edi
nop
push edx
push ecx
call fcn.008ea1ad
add esp, 8
inc ebx
cmp ebx, dword [esi + 0x84]
jae 0x890f3a
nop
mov dword [esi + 0x20], 0x9b95e4
lea eax, [esi + 0x60]
mov dword [esi + 0x24], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x28], ebx
lea eax, [esi + 0x20]
mov ecx, dword [esi + 0x10]
mov dword [esi + ecx*4 + 0x20], eax
mov dword [esi + 0x148], 0xd
push eax
call fcn.008b6780
add esp, 4
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi + eax*4 + 0x20]
test edi, edi
lea ecx, [esi + 0x20]
je 0x890e8a
xor ebx, ebx
cmp edi, ecx
setne bl
mov eax, dword [edi]
mov ecx, dword [esi + 0x1c]
mov ecx, dword [eax + ecx*4]
mov dword [esi + 0x50], ecx
mov dword [esi + 0x148], 0xffffffff
call dword [0xa0535c]
mov ecx, edi
push ebx
call dword [esi + 0x50]
lea ecx, [esi + 0x20]
nop
mov dword [esi + 0x30], 0
mov eax, dword [esi + 8]
mov dword [esi + 0x34], eax
mov byte [esi + 0x20], 0
mov dword [esi + 0x148], 0xb
sub esp, 0xc
movzx eax, byte [esi + 0x58]
mov byte [esp + 4], al
lea eax, [esi + 0x60]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x54]
mov dword [esp], eax
call fcn.0066cb40
lea eax, [esi + 0x20]
mov ecx, dword [esi + 8]
cmp dword [esi + 0x34], ecx
jbe 0x890ed1
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x30]
mov dword [esi + 0x148], 0xc
push ecx
push eax
push dword [esi + 0x4c]
call fcn.0078d5f0
add esp, 0xc
nop
mov eax, dword [esi + 0x34]
cmp eax, dword [esi + 8]
nop
mov ebx, dword [esi + 0x14]
jbe 0x890e12
mov ecx, eax
xor ecx, 1
mov edx, eax
and edx, 1
lea edx, [ecx + edx*2]
mov ecx, dword [esi + 0x20]
cmp edx, dword [esi + 0x80]
jbe 0x890e07
nop
mov edi, dword [ecx - 4]
add ecx, dword [esi + 0x7c]
sub ecx, edi
cmp ecx, dword [esi + 0x78]
jb 0x890e00
nop
mov dword [esi + 0x148], 5
call fcn.008cd651
lea ecx, [esi + 0xa0]
mov dword [esi + 0x148], 0xb
lea eax, [esi + 0x20]
push eax
call fcn.0069bd10
nop
mov eax, dword [0xa41ad0]
mov edi, dword [0xa41aa0]
sub edi, dword [esi + 0x18]
add edi, eax
mov dword [esi + 0x148], 0xffffffff
mov ecx, edi
call dword [0xa0535c]
lea ecx, [esi + 0x88]
call edi
nop
mov eax, dword [ebp + 8]
lea ebx, [eax + 0x1c]
lea eax, [esi + 0x20]
cmp ebx, eax
nop
mov ecx, dword [esi + 8]
je 0x89103f
nop
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30]
cmp eax, ecx
jbe 0x890ff9
lea edi, [eax + 1]
mov edx, dword [esi + 0xc]
mov ecx, edx
xor ecx, 0xd688d763
cmp edi, ecx
mov ecx, dword [ebx]
jbe 0x890fe4
nop
mov edi, dword [ecx - 4]
mov dword [esi + 0x14], edi
mov edi, edx
xor edi, 0x29772760
add edi, ecx
sub edi, dword [esi + 0x14]
mov ecx, edx
xor ecx, 0xd688d8bc
cmp edi, ecx
jae 0x891266
xor edx, 0xd688d8b8
add eax, edx
mov edi, eax
mov ecx, dword [esi + 0x14]
nop
push edi
push ecx
call fcn.008ea1ad
add esp, 8
mov dword [esi + 0x148], 0xffffffff
nop
mov eax, dword [0xa41ac0]
mov ecx, dword [0xa41aa8]
sub ecx, dword [esi + 0x18]
add ecx, eax
mov edi, dword [esi + 0xc]
xor edi, 0xd688d884
mov dword [esi + 0x148], 0xffffffff
call dword [0xa0535c]
push edi
lea eax, [esi + 0x20]
push eax
push ebx
call ecx
add esp, 0xc
mov dword [esi + 0x30], 0
mov ecx, dword [esi + 8]
mov dword [esi + 0x34], ecx
mov byte [esi + 0x20], 0
nop
mov eax, dword [esi + 0x34]
cmp eax, ecx
jbe 0x891095
lea edi, [eax + 1]
mov ebx, dword [esi + 0xc]
mov ecx, ebx
xor ecx, 0xd688d763
cmp edi, ecx
mov ecx, dword [esi + 0x20]
jbe 0x89108a
nop
mov edx, dword [ecx - 4]
mov edi, ebx
xor edi, 0x29772760
add edi, ecx
sub edi, edx
mov ecx, ebx
xor ecx, 0xd688d8bc
cmp edi, ecx
jae 0x891246
mov ecx, ebx
xor ecx, 0xd688d8b8
add eax, ecx
mov edi, eax
mov ecx, edx
nop
push edi
push ecx
call fcn.008ea1ad
add esp, 8
nop
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x8911f0
xorps xmm0, xmm0
movaps xmmword [esi + 0x20], xmm0
mov dword [esi + 0x88], 0x9b9654
lea eax, [esi + 0x20]
mov dword [esi + 0x8c], eax
lea eax, [esi + 0x88]
mov ecx, dword [esi + 0x10]
mov dword [esi + ecx*4 + 0x88], eax
mov dword [esi + 0x148], 0xa
push eax
call fcn.008b6780
add esp, 4
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi + eax*4 + 0x88]
test edi, edi
nop
mov edx, dword [esi + 0x1c]
je 0x891120
xor ebx, ebx
lea eax, [esi + 0x88]
cmp edi, eax
setne bl
mov eax, dword [edi]
mov ecx, dword [eax + edx*4]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x148], 0xffffffff
call dword [0xa0535c]
mov ecx, edi
push ebx
call dword [esi + 0x10]
mov edx, dword [esi + 0x1c]
nop
mov eax, dword [esi + edx + 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x5c]
mov ecx, dword [esi + eax + 0x20]
mov dword [esi + 0x14], ecx
mov eax, dword [esi + eax + 0x24]
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 8]
cmp byte [eax + 0x34], 0
je 0x8911c0
nop
mov ecx, dword [esi + 0x54]
mov ebx, dword [eax + ecx + 0x3c]
cmp ebx, dword [esi + 8]
jbe 0x8911c0
lea ecx, [ebx + ebx]
and ecx, 2
mov edx, ebx
xor edx, ecx
xor edx, 1
and ecx, ebx
lea ecx, [edx + ecx*2]
mov edi, dword [esi + 0xc]
mov edx, edi
xor edx, 0xd688d763
cmp ecx, edx
mov edx, dword [eax + 0x38]
jbe 0x8911b1
nop
mov eax, dword [0xa570d4]
add eax, dword [edx - 4]
mov dword [esi + 0x4c], eax
mov ecx, edi
xor ecx, 0x29772760
mov eax, ecx
xor eax, edx
and ecx, edx
lea ecx, [eax + ecx*2]
mov eax, dword [esi + 0x4c]
sub ecx, eax
mov edx, edi
xor edx, 0xd688d8bc
cmp ecx, edx
jae 0x891276
xor edi, 0xd688d8b8
add ebx, edi
mov ecx, ebx
mov edx, eax
nop
push ecx
push edx
call fcn.008ea1ad
add esp, 8
nop
mov eax, dword [ebp + 8]
nop
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x38], ecx
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x3c], ecx
mov ecx, dword [esi + 0x50]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x5c]
mov byte [eax + ecx + 0x3c], 0
mov ecx, dword [esi + 0x70]
mov dword [eax + ecx + 0x3c], ecx
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0x54]
mov dword [eax + edx + 0x3c], ecx
mov byte [eax + 0x34], 1
nop
mov ecx, dword [esi + 0x140]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
nop
mov dword [esi + 0x148], 0
call fcn.008cd651
nop
mov dword [esi + 0x148], 1
call fcn.008cd651
nop
mov dword [esi + 0x148], 2
call fcn.008cd651
nop
mov dword [esi + 0x148], 4
call fcn.008cd651
nop
mov dword [esi + 0x148], 7
call fcn.008cd651
nop
mov dword [esi + 0x148], 3
call fcn.008cd651
nop
mov dword [esi + 0x148], 6
call fcn.008cd651
nop
mov dword [esi + 0x148], 8
call fcn.008cd651
nop word cs:[eax + eax]
push ebp
sub esp, 0xc
lea esi, [ebp - 0x14c]
mov ebp, dword [esi + 0x138]
nop
mov eax, dword [esi + 0x10]
mov edi, dword [esi + eax*4 + 0x88]
test edi, edi
je 0x8912e3
xor ebx, ebx
lea eax, [esi + 0x88]
cmp edi, eax
setne bl
mov eax, dword [edi]
mov ecx, dword [esi + 0xc]
xor ecx, 0x1688d898
mov ecx, dword [eax + ecx*4]
mov dword [esi + 8], ecx
call dword [0xa0535c]
mov ecx, edi
push ebx
call dword [esi + 8]
mov dword [0xa41af4], 0x4999882f
add esp, 0xc
pop ebp
ret