Function at 0x576650
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x72f438
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov al, byte [esp + 0x34]
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push ebx
mov dword [esp + 0x14], esi
mov byte [esi], al
call fcn.0053a5e0
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov ecx, dword [0x7de6cc]
mov edi, dword [esp + 0x38]
mov dword [esi + 0x28], ecx
mov edx, dword [0x7de6d0]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x2c], edx
mov eax, dword [0x7de6d4]
mov dl, byte [esp + 0x40]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x10], ecx
push eax
mov dword [esi + 0xc], edi
mov byte [esi + 0x14], bl
mov byte [esi + 0x15], bl
mov byte [esi + 0x16], bl
mov byte [esi + 0x17], bl
mov byte [esi + 0x18], dl
mov ecx, dword [eax]
push ecx
lea eax, [esp + 0x48]
push eax
mov ecx, esi
mov dword [esp + 0x3c], ebx
call fcn.00539610
cmp byte [esi + 0x18], bl
mov ecx, dword [esp + 0x44]
mov dword [esi + 0x34], ecx
je 0x576700
mov ecx, edi
call fcn.00521630
mov ecx, eax
call fcn.004e2850
cmp eax, ebx
je 0x576700
cmp word [eax + 0x1e], bx
je 0x576700
mov byte [esi + 0x17], 1
mov ecx, dword [esi + 0x10]
call fcn.0055fe60
mov edx, dword [eax]
mov dword [esp + 0x10], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 8]
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x18], edx
call fcn.0055fe60
mov ecx, dword [eax]
mov dword [esp + 0x1c], ecx
mov edx, dword [eax + 4]
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x20], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x24], eax
call fcn.005264b0
mov ecx, eax
call fcn.0053e020
mov ecx, dword [esi + 0xc]
mov dword [ecx + 0xc4], ebx
mov edx, dword [esi + 0x10]
mov eax, dword [esi + 0xc]
push 1
push edx
push eax
call fcn.0053add0
fcomp dword [esi + 0x34]
mov ecx, dword [esi + 0xc]
add esp, 0xc
fnstsw ax
test ah, 1
je 0x57679b
mov edx, dword [ecx + 0x2c]
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x50], edx
call fcn.0053b200
add esp, 0x10
test al, al
je 0x57685d
jmp 0x576859
fld dword [ecx + 0xb4]
fcomp dword [0x7de6cc]
fnstsw ax
test ah, 0x40
je 0x5767d4
fld dword [ecx + 0xb8]
fcomp dword [0x7de6d0]
fnstsw ax
test ah, 0x40
je 0x5767d4
fld dword [ecx + 0xbc]
fcomp dword [0x7de6d4]
fnstsw ax
test ah, 0x40
jne 0x576838
mov edx, dword [ecx + 0xb4]
mov dword [esp + 0x10], edx
mov eax, dword [ecx + 0xb8]
mov dword [esp + 0x14], eax
mov ecx, dword [ecx + 0xbc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x20], ecx
call fcn.0053ad70
fcomp dword [esi + 0x34]
add esp, 8
fnstsw ax
test ah, 1
je 0x576838
mov ecx, dword [esi + 0xc]
mov edx, dword [ecx + 0x2c]
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x50], edx
call fcn.0053b200
add esp, 0x10
test al, al
je 0x576838
mov byte [esi + 0x14], 1
cmp byte [esi + 0x17], bl
jne 0x57685d
mov ecx, dword [esi + 0x10]
call fcn.0055fe60
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x18], eax
mov byte [esi + 0x14], 1
cmp byte [esi + 0x14], bl
je 0x5768e6
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esi + 0x20], edx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0xc]
mov dword [eax + 0xb4], ecx
mov edx, dword [esp + 0x14]
mov dword [eax + 0xb8], edx
mov ecx, dword [esp + 0x18]
add eax, 0xb4
mov dword [eax + 8], ecx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esi + 0x28], edx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ecx
mov ecx, dword [esi + 0xc]
xor edx, edx
mov dx, word [ecx + 8]
shr edx, 0xd
test dl, 1
je 0x5768cb
call fcn.0055fe60
mov eax, dword [eax + 8]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x28]
add eax, 0x12c
mov dword [eax], ecx
mov edx, dword [esi + 0x2c]
mov dword [eax + 4], edx
mov ecx, dword [esi + 0x30]
mov dword [eax + 8], ecx
jmp 0x5768f5
cmp byte [esi + 0x17], bl
je 0x5768f1
mov byte [esi + 0x16], 1
jmp 0x5768f5
mov byte [esi + 0x15], 1
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0x10