Function at 0x565510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6270ce
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x685e38]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x685e38]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xbc]
xor edi, edi
mov esi, ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x18], edi
xor ebx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x4c], edi
call fcn.00520ea0
lea ecx, [esp + 0x84]
mov dword [esp + 0xb4], ebx
call fcn.0051b930
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 1
mov dword [esp + 0x44], ebx
call fcn.005f06c0
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
mov edx, dword [eax + 0x68]
push ecx
mov ecx, esi
mov byte [esp + 0xb8], 2
call edx
xor ecx, ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 4], ecx
mov eax, dword [ebp]
cmp eax, ecx
jle 0x565d59
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x5c]
call eax
add eax, 0xffffffef
cmp eax, 0x21
ja case.0x5655f4.18
movzx ecx, byte [eax + 0x565dd8]
jmp dword [ecx*4 + 0x565dc4]
cmp dword [esp + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
mov ebp, dword [edx + eax*4]
mov dword [esp + 0x48], ebp
je 0x56562c
mov eax, dword [esi + 0xc]
test byte [eax + 2], 8
mov ecx, dword [ebp + 0x24]
je 0x565621
mov dword [eax + 4], ecx
jmp 0x565624
mov dword [eax + 0xc], ecx
mov dword [esp + 0x44], 0
mov ecx, esi
call fcn.00563d40
mov ebx, eax
push ebx
push ebp
mov ecx, esi
call fcn.005609d0
test eax, eax
je 0x565cd5
test ebx, ebx
jl 0x565cd5
jmp 0x565c52
cmp dword [esp + 0x44], 0
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov edi, dword [ecx + edx*4]
je 0x565680
mov eax, dword [esi + 0xc]
test byte [eax + 2], 8
mov ecx, dword [edi + 0x14]
je 0x565675
mov dword [eax + 4], ecx
jmp 0x565678
mov dword [eax + 0xc], ecx
mov dword [esp + 0x44], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5656ba
cmp eax, 0x16
je 0x5656ba
cmp eax, 0x20
jne 0x5656fc
mov ecx, dword [esi + 0xc]
mov eax, ebx
shl eax, 4
test dword [eax + ecx], 0xffff
je 0x5656ba
mov edx, dword [esp + 0x4c]
add edx, 4
push edx
mov ecx, edi
call fcn.00521940
test eax, eax
jne 0x565c52
mov ecx, esi
call fcn.00563d40
mov ebp, eax
push ebp
lea eax, [edi + 4]
push eax
mov ecx, esi
call fcn.00560800
test eax, eax
je 0x565cd5
mov ebx, ebp
test ebp, ebp
jl 0x565cd5
mov eax, dword [edi + 0x14]
shl ebp, 4
add ebp, dword [esi + 0xc]
test byte [ebp + 2], 8
je 0x5658c2
mov dword [ebp + 4], eax
jmp 0x565c52
cmp eax, 0x31
je 0x56570a
cmp eax, 0x32
jne 0x565846
cmp dword [esp + 0x1c], 0
je 0x565846
push edi
lea ecx, [esp + 0x70]
call fcn.0052b360
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov ecx, ebp
mov dword [esp + 0x58], 0
call fcn.005caa60
cmp dword [esp + 0x6c], 0
jne 0x565745
cmp dword [esp + 0x70], 0
je 0x565783
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x74]
call fcn.0052b560
test eax, eax
jne 0x565783
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.00564dc0
mov ebx, eax
test ebx, ebx
jl 0x565cd5
mov eax, dword [edi + 0x14]
mov ecx, ebx
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.0040b310
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.00524de0
add esp, 8
test eax, eax
jne 0x5657a1
lea eax, [edi + 4]
push eax
jmp 0x565884
mov edx, dword [edi + 0xc]
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [edi + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x1c], esp
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov edx, dword [esp + 0x50]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 4]
mov dword [esp + 0x24], esp
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x2c], esp
mov dword [eax + 4], ecx
call fcn.00563c90
add esp, 0x18
test eax, eax
je 0x5657f4
lea eax, [edi + 4]
push eax
jmp 0x565884
mov edx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 0x10]
sub ecx, dword [edi + 4]
sub eax, dword [edi + 8]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x3c]
sub edx, ebp
mov ebp, dword [esp + 0x40]
sub ebp, dword [esp + 0x14]
test ecx, ecx
jle 0x565822
test edx, edx
jl 0x565840
test ecx, ecx
jge 0x565828
test edx, edx
jg 0x565840
test eax, eax
jle 0x565832
test ebp, ebp
jl 0x565840
test eax, eax
jge 0x565c52
test ebp, ebp
jle 0x565c52
lea eax, [edi + 4]
push eax
jmp 0x565884
cmp eax, 0x11
jne 0x565c52
mov eax, dword [esp + 0x48]
mov eax, dword [eax + 0x28]
cmp eax, dword [edi + 0x14]
je 0x565c52
mov ecx, dword [esp + 0x48]
lea ebp, [edi + 4]
add ecx, 0xc
push ebp
push ecx
call fcn.00524de0
add esp, 8
test eax, eax
je 0x565883
mov eax, dword [esp + 0x48]
mov edx, dword [eax + 0x24]
cmp edx, dword [eax + 0x28]
je 0x5658ab
push ebp
mov ecx, esi
call fcn.00564dc0
mov ebx, eax
test ebx, ebx
jl 0x565cd5
mov eax, dword [edi + 0x14]
mov ecx, ebx
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.0040b310
jmp 0x565c52
mov eax, dword [edi + 0x14]
lea ecx, [ebx + 2]
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.0040b310
jmp 0x565c52
mov dword [ebp + 0xc], eax
jmp 0x565c52
cmp dword [esp + 0x14], 0x16
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov eax, dword [ecx + edx*4]
mov dword [esp + 0x1c], eax
jne 0x565a2a
test edi, edi
je 0x565a2a
push edi
lea ecx, [esp + 0x60]
call fcn.0052b360
mov ebp, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
mov dword [esp + 0x5c], 0
call fcn.005caa60
cmp dword [esp + 0x5c], 0
jne 0x56591b
cmp dword [esp + 0x60], 0
je 0x565956
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x64]
call fcn.0052b560
test eax, eax
jne 0x565956
lea ecx, [edi + 0xc]
push ecx
mov ecx, esi
call fcn.00564dc0
test eax, eax
jl 0x565cd5
mov ecx, dword [edi + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.0040b310
lea ebx, [edi + 0xc]
lea edx, [esp + 0x34]
push ebx
push edx
call fcn.00524de0
add esp, 8
test eax, eax
jne 0x565975
lea eax, [esp + 0x34]
push eax
jmp 0x565a0a
mov ecx, dword [ebp + 4]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x1c], esp
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], ecx
mov edx, dword [edi + 4]
mov dword [esp + 0x24], esp
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [edi + 8]
mov dword [esp + 0x2c], esp
mov dword [eax + 4], ecx
call fcn.00563c90
add esp, 0x18
test eax, eax
je 0x5659c6
lea eax, [esp + 0x34]
push eax
jmp 0x565a0a
mov eax, dword [ebx + 4]
mov edx, dword [edi + 8]
mov ecx, dword [ebx]
mov ebx, dword [esp + 0x1c]
sub ecx, dword [edi + 4]
mov ebp, dword [ebx + 4]
sub ebp, dword [esp + 0x34]
sub eax, edx
mov edx, dword [ebx + 8]
sub edx, dword [esp + 0x38]
test ecx, ecx
jle 0x5659ef
test ebp, ebp
jl 0x565a05
test ecx, ecx
jge 0x5659f5
test ebp, ebp
jg 0x565a05
test eax, eax
jle 0x5659ff
test edx, edx
jl 0x565a05
test eax, eax
jge 0x565a2a
test edx, edx
jle 0x565a2a
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.00564dc0
test eax, eax
jl 0x565cd5
mov ecx, dword [edi + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.0040b310
cmp dword [esp + 0x18], 0
mov ebx, dword [esp + 0x1c]
jne 0x565a9a
lea edx, [esp + 0x84]
push edx
mov ecx, ebx
mov dword [esp + 0x48], 1
call fcn.005caa80
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x24]
call fcn.00583a80
test dword [esp + 0x20], 0x80000
mov eax, dword [ebx + 0x20]
je 0x565a70
mov dword [esp + 0x24], eax
jmp 0x565a74
mov dword [esp + 0x2c], eax
mov ecx, esi
call fcn.00563d40
mov ebp, eax
push ebp
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.005606b0
test eax, eax
je 0x565cd5
test ebp, ebp
jl 0x565cd5
mov ecx, esi
call fcn.00563d40
mov ebp, eax
push ebp
add ebx, 4
push ebx
mov ecx, esi
call fcn.00560800
test eax, eax
je 0x565cd5
mov ebx, ebp
test ebp, ebp
jl 0x565cd5
mov ecx, dword [esi + 0xc]
shl ebp, 4
push 1
add ecx, ebp
call fcn.00583de0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0xc]
mov edx, dword [ecx + 0x1c]
add eax, ebp
mov dword [eax + 0xc], edx
mov edx, dword [ecx]
mov eax, dword [edx + 0x5c]
call eax
cmp eax, 0x32
jne 0x565af7
mov ecx, dword [esi + 0xc]
push 1
add ecx, ebp
call fcn.00583e20
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
dec eax
cmp dword [esp + 0x18], eax
jne 0x565c52
mov ebx, dword [esp + 0x1c]
lea edx, [esp + 0x84]
push edx
mov ecx, ebx
call fcn.005caa80
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x24]
call fcn.00583a80
test dword [esp + 0x20], 0x80000
mov eax, dword [ebx + 0x20]
je 0x565b3f
mov dword [esp + 0x24], eax
jmp 0x565b43
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00564d90
mov ebx, eax
test ebx, ebx
jl 0x565cd5
jmp 0x565c52
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ebp, dword [edx + eax*4]
lea eax, [edx + eax*4]
mov dword [esp + 0x4c], ebp
cmp ecx, 0x16
jne 0x565bd7
cmp dword [ebp + 0x14], 1
jne 0x565b96
lea ecx, [edi + 0xc]
push ecx
mov ecx, esi
call fcn.00564dc0
test eax, eax
jl 0x565cd5
mov ecx, dword [edi + 0x14]
jmp 0x565bf0
lea edx, [esp + 0x7c]
push edx
mov ecx, ebp
call fcn.00581480
mov ecx, dword [eax]
cmp ecx, dword [ebp + 0xc]
jne 0x565c04
mov edx, dword [eax + 4]
cmp edx, dword [ebp + 0x10]
jne 0x565c04
lea eax, [edi + 0xc]
push eax
mov ecx, esi
call fcn.00564dc0
test eax, eax
jl 0x565cd5
mov ecx, dword [edi + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.0040b310
jmp 0x565c04
cmp ecx, 0x20
jne 0x565c04
mov ebx, dword [eax - 4]
lea ecx, [ebx + 4]
push ecx
mov ecx, esi
call fcn.00564dc0
mov ebx, dword [ebx + 0x1c]
lea ecx, [ebx + ebx]
shl eax, 4
add eax, dword [esi + 0xc]
test byte [eax + 2], 8
je 0x565c01
mov dword [eax + 4], ecx
jmp 0x565c04
mov dword [eax + 0xc], ecx
cmp dword [esp + 0x18], 0
jne 0x565c39
cmp dword [ebp + 0x14], 1
mov ecx, esi
jne 0x565c19
lea edx, [ebp + 4]
push edx
jmp 0x565c1d
lea eax, [ebp + 0xc]
push eax
call fcn.00564dc0
mov ecx, dword [ebp + 0x24]
shl eax, 4
add eax, dword [esi + 0xc]
test byte [eax + 2], 8
je 0x565c36
mov dword [eax + 4], ecx
jmp 0x565c39
mov dword [eax + 0xc], ecx
mov ecx, esi
call fcn.00563d40
mov ebx, eax
push ebx
push ebp
mov ecx, esi
call fcn.00560b20
test eax, eax
jne 0x565c52
or ebx, 0xffffffff
mov ebp, dword [esp + 0x50]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov ecx, dword [ecx + edx*4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x5c]
call edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
inc eax
cmp eax, dword [ebp]
mov dword [esp + 0x18], eax
jl 0x5655d0
mov eax, dword [esp + 0x14]
cmp eax, 0x20
jne 0x565d20
mov ebx, dword [esp + 0x4c]
mov ecx, esi
call fcn.00563d40
cmp dword [ebx + 0x14], 0
mov edi, eax
push edi
jne 0x565d15
lea eax, [ebx + 4]
push eax
mov ecx, esi
call fcn.00560800
test eax, eax
je 0x565cd5
test edi, edi
jl 0x565cd5
mov ebx, dword [ebx + 0x24]
shl edi, 4
add edi, dword [esi + 0xc]
test byte [edi + 2], 8
je 0x565d1b
mov dword [edi + 4], ebx
jmp 0x565d59
push 0x302
call fcn.005f4440
add esp, 4
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 1
call fcn.004f2200
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0
call fcn.0051c420
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], 0xffffffff
call fcn.00520f30
xor eax, eax
jmp 0x565d97
lea ecx, [ebx + 0xc]
push ecx
jmp 0x565ca2
mov dword [edi + 0xc], ebx
jmp 0x565d59
cmp eax, 0x16
jne 0x565d59
mov ecx, esi
call fcn.00563d40
mov ebx, eax
push ebx
lea edx, [edi + 0xc]
push edx
mov ecx, esi
call fcn.00560800
test eax, eax
je 0x565cd5
test ebx, ebx
jl 0x565cd5
mov edi, dword [edi + 0x14]
shl ebx, 4
add ebx, dword [esi + 0xc]
test byte [ebx + 2], 8
je 0x565d56
mov dword [ebx + 4], edi
jmp 0x565d59
mov dword [ebx + 0xc], edi
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 1
call fcn.004f2200
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0
call fcn.0051c420
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], 0xffffffff
call fcn.00520f30
mov eax, 1
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005fb9ce
add esp, 0xa4
ret 4