Function at 0x63e860
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x78
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x706280
lea eax, [ebp - 0x18]
mov esi, dword fs:[0]
mov dword [ebp - 0x18], esi
mov dword fs:[0], eax
movzx eax, byte [edx + 0x36]
mov bh, byte [edx + 0x30]
mov ah, byte [edx + 0x37]
mov bl, byte [edx + 0x38]
mov byte [ebp - 0x1d], al
mov al, byte [ecx + 0x36]
cmp bh, 3
mov byte [ebp - 0x48], al
mov al, byte [ecx + 0x37]
mov byte [ebp - 0x40], al
mov al, byte [ecx + 0x38]
mov byte [ebp - 0x44], al
jne 0x63e8c4
mov bh, byte [ecx + 0x30]
cmp bh, 3
jne 0x63eb03
mov bh, 3
jmp 0x63e8e8
mov esi, dword [edx + 0x28]
mov byte [ebp - 0x3c], ah
mov al, bh
mov bh, byte [edx + 0x33]
movzx edi, word [edx + 0x31]
mov ah, byte [ebp - 0x3c]
mov dword [ebp - 0x50], esi
mov esi, dword [edx + 0x2c]
mov byte [ebp - 0x2a], bh
mov bh, al
mov word [ebp - 0x2c], di
mov dword [ebp - 0x4c], esi
movzx esi, byte [ebp - 0x44]
cmp bl, 2
movzx edi, bl
cmove edi, esi
movzx esi, byte [ebp - 0x40]
cmp ah, 2
movzx eax, ah
mov dword [ebp - 0x44], edi
mov edi, edx
cmove eax, esi
movzx esi, byte [ebp - 0x48]
mov dword [ebp - 0x40], eax
movzx eax, byte [ebp - 0x1d]
cmp al, 2
movzx eax, al
cmove eax, esi
movzx esi, byte [ecx + 0x3e]
mov dword [ebp - 0x3c], eax
movzx eax, byte [edx + 0x3e]
cmp al, 3
cmovne esi, eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x48], esi
mov esi, dword [edx + 8]
cmp esi, 2
jne 0x63e93d
mov esi, dword [ecx + 8]
mov edi, ecx
mov dword [ebp - 0x70], esi
cmp eax, 2
mov esi, edx
mov dword [ebp - 0x38], edi
jne 0x63e94f
mov eax, dword [ecx + 0x10]
mov esi, ecx
cmp dword [edx], 0
mov edi, dword [ecx]
mov byte [ebp - 0x1d], bh
mov ebx, dword [edx + 0x18]
mov dword [ebp - 0x84], esi
mov esi, edx
mov dword [ebp - 0x24], ecx
cmove esi, ecx
mov ecx, 1
cmovne edi, ecx
cmp ebx, 2
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x68], edi
mov edi, edx
jne 0x63e983
mov edi, dword [ebp - 0x24]
mov ebx, dword [edi + 0x18]
mov dword [ebp - 0x74], eax
mov eax, dword [edx + 0x20]
mov esi, edx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x6c], ebx
cmp eax, 2
jne 0x63e99c
mov esi, dword [ebp - 0x24]
mov eax, dword [esi + 0x20]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x64], eax
movzx eax, byte [edx + 0x3d]
movd xmm0, dword [edx + 0x39]
movdqa xmm2, xmmword [0x7272d0]
movzx ebx, byte [edi + 0x3d]
cmp al, 2
movd xmm1, dword [edi + 0x39]
pcmpeqb xmm2, xmm0
cmovne ebx, eax
cmp byte [edx + 0x34], 0
movzx eax, word [ebp - 0x2c]
pand xmm1, xmm2
pandn xmm2, xmm0
por xmm2, xmm1
mov dword [ebp - 0x60], ebx
cmove edx, edi
mov word [ebp - 0x28], ax
cmove ecx, dword [edi + 0x34]
movzx eax, byte [edx + 0x35]
mov byte [ebp - 0x1e], al
movzx eax, byte [ebp - 0x2a]
mov byte [ebp - 0x26], al
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x84]
movdqu xmmword [ebp - 0x84], xmm2
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x34], eax
movzx eax, byte [edi + 0x30]
cmp al, 3
je 0x63ea59
cmp al, 2
je 0x63ea59
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x28]
lock dec dword [eax]
jne 0x63ea59
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0
mov ecx, dword [eax + 0x28]
mov edx, dword [eax + 0x2c]
call fcn.004240a0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x24]
movups xmm0, xmmword [ebp - 0x84]
mov dword [ecx], eax
mov eax, dword [ebp - 0x54]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x70]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x58]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x74]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x5c]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x6c]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0x64]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp - 0x50]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x4c]
mov dword [ecx + 0x2c], eax
movzx eax, byte [ebp - 0x1d]
mov byte [ecx + 0x30], al
movzx eax, byte [ebp - 0x26]
mov byte [ecx + 0x33], al
movzx eax, word [ebp - 0x28]
mov word [ecx + 0x31], ax
mov eax, dword [ebp - 0x38]
mov byte [ecx + 0x34], al
movzx eax, byte [ebp - 0x1e]
mov byte [ecx + 0x35], al
mov eax, dword [ebp - 0x3c]
mov byte [ecx + 0x36], al
mov eax, dword [ebp - 0x40]
mov byte [ecx + 0x37], al
mov eax, dword [ebp - 0x44]
mov byte [ecx + 0x38], al
mov eax, dword [ebp - 0x60]
movss dword [ecx + 0x39], xmm0
mov byte [ecx + 0x3d], al
mov eax, dword [ebp - 0x48]
mov byte [ecx + 0x3e], al
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x78
pop esi
pop edi
pop ebx
pop ebp
ret
cmp bh, 2
jne 0x63eb0f
mov bh, 2
jmp 0x63e8e8
mov esi, dword [ecx + 0x28]
mov dword [ebp - 0x50], esi
lock inc dword [esi]
jle 0x63eb22
mov esi, dword [ecx + 0x2c]
jmp 0x63e8e5
ud2