Function at 0x667627a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x66789d18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x208]
mov esi, ecx
lea ecx, [esp + 0x10]
xor ebx, ebx
mov eax, dword [edi]
push ecx
mov ecx, edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ebx
call dword [eax + 0x10]
mov edx, dword [edi]
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov dword [esp + 0x1c], ebx
call dword [edx + 0xc]
mov ecx, dword [esp + 0x10]
shr ecx, 0xc
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x110]
call fcn.66763e30
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x110]
push edx
mov dword [esp + 0x204], ebx
mov dword [esp + 0x114], 0x66796d50
call fcn.66763f00
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add ecx, eax
mov dword [esp + 0x200], 1
shr ecx, 0xc
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x58]
call fcn.6672b3e7
lea edx, [esp + 0x30]
lea ecx, [esp + 0x58]
push edx
mov byte [esp + 0x204], 2
mov dword [esp + 0x5c], 0x66795ff8
call fcn.66722c8a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add ecx, eax
mov byte [esp + 0x200], 3
test ecx, 0xfff
jne 0x667628ee
lea ecx, [esp + 0x80]
call fcn.667074c0
lea ecx, [esp + 0x58]
mov byte [esp + 0x200], 4
call fcn.6672b33a
lea edx, [esp + 0x20]
lea ecx, [esp + 0x80]
push edx
mov dword [esp + 0x24], eax
call fcn.66707500
lea eax, [esp + 0x58]
push 1
push eax
lea ecx, [esp + 0x80]
call fcn.66763900
lea ecx, [esp + 0x80]
call fcn.66707530
lea ecx, [esp + 0x80]
mov byte [esp + 0x200], 3
call fcn.667074e0
lea ecx, [esp + 0x110]
call fcn.66763f40
lea ecx, [esp + 0xe8]
mov dword [esp + 0x20], eax
call fcn.66756530
lea ecx, [esp + 0x20]
mov byte [esp + 0x200], 5
push ecx
lea ecx, [esp + 0xec]
mov dword [esp + 0xec], 0x667957fc
call fcn.66706a50
mov ebp, dword [esi + 0x30]
lea ecx, [esp + 0x110]
mov byte [esp + 0x200], 6
call fcn.66763f40
mov edi, dword [esi + 0x30]
lea ecx, [esp + 0x58]
lea ebp, [ebp + eax*4]
call fcn.6672b33a
lea edx, [edi + eax*4 + 4]
cmp ebp, edx
je 0x66762e66
jmp 0x66762967
mov esi, dword [esp + 0x28]
mov eax, dword [ebp]
lea ecx, [eax + 0x2c]
call fcn.66706890
lea ecx, [esp + 0x98]
mov dword [esp + 0x38], eax
call fcn.6672d3da
lea eax, [esp + 0x38]
lea ecx, [esp + 0x98]
push eax
mov byte [esp + 0x204], 7
mov dword [esp + 0x9c], 0x6679607c
call fcn.6672d41d
push 0x1000
mov byte [esp + 0x204], 8
call fcn.66766ab2
mov ebx, eax
mov ecx, 0x400
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp]
add esp, 4
lea ecx, [eax + 0x54]
call fcn.667569b0
mov ecx, dword [ebp]
push eax
push ebx
call fcn.66764bd0
mov edi, eax
cmp edi, 0x410a02bc
jne 0x66762ec2
mov eax, dword [ebp]
lea ecx, [eax + 0x54]
call fcn.667569b0
lea ecx, [esp + 0x98]
mov edi, eax
call fcn.667274e8
push eax
push edi
push ebx
mov ecx, esi
call fcn.66762730
mov edi, eax
cmp edi, 0x410a02bc
jne 0x66762ec2
lea ecx, [esp + 0x80]
call fcn.66764030
lea ecx, [esp + 0xe8]
mov byte [esp + 0x200], 9
call fcn.66756650
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], eax
push ecx
lea ecx, [esp + 0x84]
call fcn.66793756
lea ecx, [esp + 0x80]
call fcn.66764040
mov esi, eax
lea ecx, [esp + 0x80]
shl esi, 0xc
mov byte [esp + 0x200], 8
call fcn.66793748
lea ecx, [esp + 0x138]
mov dword [esp + 0x48], esi
call fcn.6672d4b2
lea edx, [esp + 0x48]
lea ecx, [esp + 0x138]
push edx
mov byte [esp + 0x204], 0xa
mov dword [esp + 0x13c], 0x66796080
call fcn.6672d523
lea ecx, [esp + 0x160]
mov byte [esp + 0x200], 0xb
mov dword [esp + 0x40], 0
call fcn.66756350
lea eax, [esp + 0x40]
lea ecx, [esp + 0x160]
push eax
mov byte [esp + 0x204], 0xc
mov dword [esp + 0x164], 0x66796ad8
call fcn.66756470
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x1e0]
mov byte [esp + 0x200], 0xd
call fcn.667641b0
lea ecx, [esp + 0x138]
mov byte [esp + 0x200], 0xe
call fcn.66722c5d
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], eax
push ecx
lea ecx, [esp + 0x1e4]
call fcn.6672307e
lea ecx, [esp + 0x1e0]
call fcn.6672309d
cmp eax, esi
lea ecx, [esp + 0x1e0]
setb byte [esp + 0x17]
mov byte [esp + 0x200], 0xd
call fcn.66723070
mov al, byte [esp + 0x17]
test al, al
je 0x66762bca
lea ecx, [esp + 0x138]
call fcn.66722c5d
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c8]
sub edx, eax
mov dword [esp + 0x24], edx
call fcn.66764010
lea eax, [esp + 0x24]
lea ecx, [esp + 0x1c8]
push eax
mov byte [esp + 0x204], 0xf
call fcn.667230d0
lea ecx, [esp + 0x1c8]
call fcn.667230ef
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], eax
push ecx
lea ecx, [esp + 0x164]
call fcn.66756470
lea ecx, [esp + 0x1c8]
mov byte [esp + 0x200], 0xd
call fcn.667230c2
lea ecx, [esp + 0x98]
call fcn.667274e8
lea edx, [esp + 0x138]
push eax
push edx
lea ecx, [esp + 0x160]
call fcn.66763fc0
lea ecx, [esp + 0x188]
mov dword [esp + 0x24], eax
call fcn.66756530
lea eax, [esp + 0x24]
lea ecx, [esp + 0x188]
push eax
mov byte [esp + 0x204], 0x10
mov dword [esp + 0x18c], 0x667957fc
call fcn.66706a50
lea ecx, [esp + 0x98]
mov byte [esp + 0x200], 0x11
call fcn.667274e8
lea ecx, [esp + 0xc0]
mov dword [esp + 0x44], eax
call fcn.6672d599
lea ecx, [esp + 0x44]
mov byte [esp + 0x200], 0x12
push ecx
lea ecx, [esp + 0xc4]
mov dword [esp + 0xc4], 0x66796068
call fcn.6672d60a
lea ecx, [esp + 0x160]
mov byte [esp + 0x200], 0x13
call fcn.667564f0
test eax, eax
jbe 0x66762cf6
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x188]
push edx
push eax
lea ecx, [esp + 0x1b0]
call fcn.66763a40
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x4c], eax
call fcn.66764020
lea ecx, [esp + 0x4c]
mov byte [esp + 0x200], 0x14
push ecx
lea ecx, [esp + 0x1b4]
call fcn.66723122
lea ecx, [esp + 0x1b0]
call fcn.66723141
lea edx, [esp + 0x54]
lea ecx, [esp + 0xc0]
push edx
mov dword [esp + 0x58], eax
call fcn.6672d60a
lea ecx, [esp + 0x1b0]
mov byte [esp + 0x200], 0x13
call fcn.66723114
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add ecx, eax
push ecx
lea ecx, [esp + 0x18c]
call fcn.667636a0
test al, al
je 0x66762d36
lea ecx, [esp + 0x138]
call fcn.66722c5d
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
sub edx, eax
add edx, ecx
lea ecx, [esp + 0xc0]
push edx
call fcn.6672c22d
lea ecx, [esp + 0x160]
call fcn.667564f0
test eax, eax
jbe 0x66762d72
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
add ecx, eax
push ecx
lea ecx, [esp + 0x18c]
call fcn.667636a0
test al, al
je 0x66762d72
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xc0]
push edx
call fcn.6672c22d
lea ecx, [esp + 0x160]
call fcn.667564f0
mov esi, eax
mov eax, dword [esp + 0x208]
lea ecx, [esp + 0xc0]
mov edi, dword [eax]
call fcn.6672d629
mov ecx, dword [esp + 0x1c]
add esi, ebx
push eax
push esi
push ecx
mov ecx, dword [esp + 0x214]
call dword [edi + 0x18]
mov esi, eax
cmp esi, 0x410a02bc
jne 0x66762f42
push ebx
call fcn.667661a3
add esp, 4
lea ecx, [esp + 0xc0]
call fcn.6672d629
mov edi, dword [esp + 0x1c]
push 0
add edi, eax
lea ecx, [esp + 0xec]
mov dword [esp + 0x20], edi
call fcn.66763530
lea ecx, [esp + 0xc0]
mov byte [esp + 0x200], 0x11
call fcn.6672c172
lea ecx, [esp + 0x188]
mov byte [esp + 0x200], 0xd
call fcn.66705c80
lea ecx, [esp + 0x160]
mov byte [esp + 0x200], 0xb
call fcn.66755630
lea ecx, [esp + 0x138]
mov byte [esp + 0x200], 8
call fcn.6672c091
lea ecx, [esp + 0x98]
mov byte [esp + 0x200], 6
call fcn.6672bf63
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x58]
add ebp, 4
mov esi, dword [edx + 0x30]
call fcn.6672b33a
lea eax, [esi + eax*4 + 4]
cmp ebp, eax
jne 0x66762963
lea ecx, [esp + 0xe8]
mov byte [esp + 0x200], 3
call fcn.66705c80
lea ecx, [esp + 0x58]
mov byte [esp + 0x200], 1
call fcn.6672b3c0
lea ecx, [esp + 0x110]
mov dword [esp + 0x200], 0xffffffff
call fcn.667638a0
mov eax, 0x410a02bc
mov ecx, dword [esp + 0x1f8]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1f4
ret 4
lea ecx, [esp + 0x98]
mov byte [esp + 0x200], 6
mov dword [esp + 0x98], 0x6679607c
call fcn.6672c031
lea ecx, [esp + 0xe8]
mov byte [esp + 0x200], 3
mov dword [esp + 0xe8], 0x667957fc
call fcn.66705d50
lea ecx, [esp + 0x58]
mov byte [esp + 0x200], 1
mov dword [esp + 0x58], 0x66795ff8
call fcn.6672b2f3
lea ecx, [esp + 0x110]
mov dword [esp + 0x200], 0xffffffff
mov dword [esp + 0x110], 0x66796d50
call fcn.667638a0
mov eax, edi
jmp 0x66762ea7
lea ecx, [esp + 0xc0]
mov byte [esp + 0x200], 0x11
mov dword [esp + 0xc0], 0x66796068
call fcn.6672c282
lea ecx, [esp + 0x188]
mov byte [esp + 0x200], 0xd
call fcn.66705c80
lea ecx, [esp + 0x160]
mov byte [esp + 0x200], 0xb
call fcn.66755630
lea ecx, [esp + 0x138]
mov byte [esp + 0x200], 8
call fcn.6672c091
lea ecx, [esp + 0x98]
mov byte [esp + 0x200], 6
call fcn.6672bf63
lea ecx, [esp + 0xe8]
mov byte [esp + 0x200], 3
call fcn.66705c80
lea ecx, [esp + 0x58]
mov byte [esp + 0x200], 1
call fcn.6672b3c0
lea ecx, [esp + 0x110]
mov dword [esp + 0x200], 0xffffffff
call fcn.667638a0
mov eax, esi
jmp 0x66762ea7