Function at 0x5e6d20
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Check for peb ntglobalflag flag
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x724a1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0xb0
mov dword [esi], 0x58
call fcn.006fa7e6
mov edi, dword [esi]
mov dword [esi + 4], eax
lea eax, [edi*8 + 4]
push eax
call fcn.006fa7e6
add esp, 8
mov dword [esp + 0xc], eax
test eax, eax
mov dword [esp + 0x18], 0
je 0x5e6d8a
push fcn.005e5c20
push fcn.005b3190
push edi
lea ebx, [eax + 4]
push 8
push ebx
mov dword [eax], edi
call fcn.006fb55f
jmp 0x5e6d8c
xor ebx, ebx
mov ecx, dword [esi + 4]
mov dword [esi + 8], ebx
mov word [ecx], 0
mov ecx, dword [esi + 8]
push 0x74ddac
mov dword [esp + 0x1c], 0xffffffff
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 2], 1
mov ecx, dword [esi + 8]
push 0x74dda8
add ecx, 8
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 4], 2
mov ecx, dword [esi + 8]
push 0x74dda4
add ecx, 0x10
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 6], 3
mov ecx, dword [esi + 8]
push 0x74dda0
add ecx, 0x18
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 8], 4
mov ecx, dword [esi + 8]
push 0x74d32c
add ecx, 0x20
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0xa], 7
mov ecx, dword [esi + 8]
push 0x74dd9c
add ecx, 0x28
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0xc], 0xa
mov ecx, dword [esi + 8]
push 0x74dd98
add ecx, 0x30
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0xe], 0x7e6
mov ecx, dword [esi + 8]
push 0x74dd94
add ecx, 0x38
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x10], 0x270f
mov ecx, dword [esi + 8]
push 0x74dd90
add ecx, 0x40
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x12], 0x270e
mov ecx, dword [esi + 8]
push 0x74dd8c
add ecx, 0x48
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x14], 0x270d
mov ecx, dword [esi + 8]
push 0x74dd88
add ecx, 0x50
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x16], 0x7d0
mov ecx, dword [esi + 8]
push 0x74dd84
add ecx, 0x58
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x18], 0x7d1
mov ecx, dword [esi + 8]
push 0x74dd80
add ecx, 0x60
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x1a], 0x7d2
mov ecx, dword [esi + 8]
push 0x74dd7c
add ecx, 0x68
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x1c], 0x7d7
mov ecx, dword [esi + 8]
push 0x74dd78
add ecx, 0x70
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x1e], 0x7d3
mov ecx, dword [esi + 8]
push 0x74dd74
add ecx, 0x78
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x20], 0x7d8
mov ecx, dword [esi + 8]
push 0x74dd70
add ecx, 0x80
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x22], 0x7d9
mov ecx, dword [esi + 8]
push 0x74dd6c
add ecx, 0x88
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x24], 0x7da
mov ecx, dword [esi + 8]
push 0x74dd68
add ecx, 0x90
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x26], 0x7db
mov ecx, dword [esi + 8]
push 0x74dd64
add ecx, 0x98
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x28], 0x7dc
mov ecx, dword [esi + 8]
push 0x74dd60
add ecx, 0xa0
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x2a], 0x7dd
mov ecx, dword [esi + 8]
push 0x74dd5c
add ecx, 0xa8
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x2c], 0x7de
mov ecx, dword [esi + 8]
push 0x74dd58
add ecx, 0xb0
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x2e], 0x7df
mov ecx, dword [esi + 8]
push 0x74dd54
add ecx, 0xb8
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x30], 0x7e0
mov ecx, dword [esi + 8]
push 0x74dd50
add ecx, 0xc0
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x32], 6
mov ecx, dword [esi + 8]
push 0x74dd4c
add ecx, 0xc8
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x34], 0x7d5
mov ecx, dword [esi + 8]
push 0x74dd48
add ecx, 0xd0
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x36], 0x7e1
mov ecx, dword [esi + 8]
push 0x74dd44
add ecx, 0xd8
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x38], 0x7e2
mov ecx, dword [esi + 8]
push 0x74dd40
add ecx, 0xe0
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x3a], 8
mov ecx, dword [esi + 8]
push 0x74dd3c
add ecx, 0xe8
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x3c], 9
mov ecx, dword [esi + 8]
push 0x74dd38
add ecx, 0xf0
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x3e], 0x7e8
mov ecx, dword [esi + 8]
push 0x74dd34
add ecx, 0xf8
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x40], 0x7e9
mov ecx, dword [esi + 8]
push 0x74dd30
add ecx, 0x100
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x42], 0x7ea
mov ecx, dword [esi + 8]
push 0x74dd2c
add ecx, 0x108
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x44], 0x7eb
mov ecx, dword [esi + 8]
push 0x74dd28
add ecx, 0x110
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x46], 0x7ef
mov ecx, dword [esi + 8]
push 0x74dd24
add ecx, 0x118
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x48], 0x7f0
mov ecx, dword [esi + 8]
push 0x74dd20
add ecx, 0x120
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x4a], 0x7e7
mov ecx, dword [esi + 8]
push 0x74dd1c
add ecx, 0x128
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x4c], 0x7ed
mov ecx, dword [esi + 8]
push 0x74dd18
add ecx, 0x130
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x4e], 0x7ee
mov ecx, dword [esi + 8]
push 0x74dd14
add ecx, 0x138
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x50], 0x7f1
mov ecx, dword [esi + 8]
push 0x74dd10
add ecx, 0x140
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x52], 0x7f2
mov ecx, dword [esi + 8]
push 0x74dd0c
add ecx, 0x148
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x54], 0x7f3
mov ecx, dword [esi + 8]
push 0x74dd08
add ecx, 0x150
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x56], 0x7f4
mov ecx, dword [esi + 8]
push 0x74dd04
add ecx, 0x158
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x58], 0x7f5
mov ecx, dword [esi + 8]
push 0x74dd00
add ecx, 0x160
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x5a], 0x7f6
mov ecx, dword [esi + 8]
push 0x74dcfc
add ecx, 0x168
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x5c], 0x7f7
mov ecx, dword [esi + 8]
push 0x74dcf8
add ecx, 0x170
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x5e], 0x7f8
mov ecx, dword [esi + 8]
push 0x74dcf4
add ecx, 0x178
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x60], 0x7f9
mov ecx, dword [esi + 8]
push 0x74dcf0
add ecx, 0x180
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x62], 0x7fa
mov ecx, dword [esi + 8]
push 0x74dcec
add ecx, 0x188
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x64], 0x7fb
mov ecx, dword [esi + 8]
push 0x74dce8
add ecx, 0x190
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x66], 0x7fc
mov ecx, dword [esi + 8]
push 0x74dce4
add ecx, 0x198
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x68], 0x7fd
mov ecx, dword [esi + 8]
push 0x74dce0
add ecx, 0x1a0
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x6a], 0x7fe
mov ecx, dword [esi + 8]
push 0x74dcdc
add ecx, 0x1a8
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x6c], 0x7ff
mov ecx, dword [esi + 8]
push 0x74dcd8
add ecx, 0x1b0
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x6e], 0x800
mov ecx, dword [esi + 8]
push 0x74dcd4
add ecx, 0x1b8
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x70], 0x801
mov ecx, dword [esi + 8]
push 0x74dcd0
add ecx, 0x1c0
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x72], 0x802
mov ecx, dword [esi + 8]
push 0x74dccc
add ecx, 0x1c8
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x74], 0x803
mov ecx, dword [esi + 8]
push 0x74dcc8
add ecx, 0x1d0
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x76], 0x804
mov ecx, dword [esi + 8]
push 0x74dcc4
add ecx, 0x1d8
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x78], 0x805
mov ecx, dword [esi + 8]
push 0x74dcc0
add ecx, 0x1e0
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x7a], 0x806
mov ecx, dword [esi + 8]
push 0x74dcbc
add ecx, 0x1e8
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x7c], 0x807
mov ecx, dword [esi + 8]
push 0x74dcb8
add ecx, 0x1f0
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x7e], 0x808
mov ecx, dword [esi + 8]
push 0x74dcb4
add ecx, 0x1f8
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x80], 0x809
mov ecx, dword [esi + 8]
push 0x74dcb0
add ecx, 0x200
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x82], 0x80a
mov ecx, dword [esi + 8]
push 0x74dcac
add ecx, 0x208
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x84], 0x80b
mov ecx, dword [esi + 8]
push 0x74dca8
add ecx, 0x210
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x86], 0x80c
mov ecx, dword [esi + 8]
push 0x74dca4
add ecx, 0x218
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x88], 0x80d
mov ecx, dword [esi + 8]
push 0x74dca0
add ecx, 0x220
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x8a], 0xbb8
mov ecx, dword [esi + 8]
push 0x74dc9c
add ecx, 0x228
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x8c], 0xbb9
mov ecx, dword [esi + 8]
push 0x74dc98
add ecx, 0x230
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x8e], 0xbba
mov ecx, dword [esi + 8]
push 0x74dc94
add ecx, 0x238
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x90], 0xb
mov ecx, dword [esi + 8]
push 0x74dc90
add ecx, 0x240
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x92], 0xbbb
mov ecx, dword [esi + 8]
push 0x74dc8c
add ecx, 0x248
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x94], 0xbbd
mov ecx, dword [esi + 8]
push 0x74dc88
add ecx, 0x250
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x96], 0xc
mov ecx, dword [esi + 8]
push 0x74dc84
add ecx, 0x258
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x98], 0xbbc
mov ecx, dword [esi + 8]
push 0x74dc80
add ecx, 0x260
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0x9a], 0x80e
mov ecx, dword [esi + 8]
push 0x74dc7c
add ecx, 0x268
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0x9c], 0x80f
mov ecx, dword [esi + 8]
push 0x74dc78
add ecx, 0x270
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0x9e], 0xbbe
mov ecx, dword [esi + 8]
push 0x74dc74
add ecx, 0x278
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0xa0], 0xbbf
mov ecx, dword [esi + 8]
push 0x74dc70
add ecx, 0x280
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0xa2], 0xbc0
mov ecx, dword [esi + 8]
push 0x74dc6c
add ecx, 0x288
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0xa4], 0xbc1
mov ecx, dword [esi + 8]
push 0x74dc68
add ecx, 0x290
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0xa6], 0xbc2
mov ecx, dword [esi + 8]
push 0x74dc64
add ecx, 0x298
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0xa8], 0xd
mov ecx, dword [esi + 8]
push 0x74dc60
add ecx, 0x2a0
call fcn.005e5140
mov edx, dword [esi + 4]
mov word [edx + 0xaa], 0xbc3
mov ecx, dword [esi + 8]
push 0x74dc5c
add ecx, 0x2a8
call fcn.005e5140
mov eax, dword [esi + 4]
mov word [eax + 0xac], 0xe
mov ecx, dword [esi + 8]
push 0x74dc58
add ecx, 0x2b0
call fcn.005e5140
mov ecx, dword [esi + 4]
mov word [ecx + 0xae], 0xffff
mov ecx, dword [esi + 8]
push 0x73d71c
add ecx, 0x2b8
call fcn.005e5140
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret