Function at 0x6450cbe0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov dword [ebp - 0x1c], edx
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x6450ceb0
mov eax, dword [ebp - 0x1c]
shr eax, 0x10
cmp eax, 0x6364
je 0x6450ce50
ja 0x6450cd20
cmp eax, 0x6264
je 0x6450cc22
cmp eax, 0x6277
jne 0x6450ce68
mov eax, dword [ebx + 8]
test byte [eax + 0x19], 8
je 0x6450cc2e
or esi, 0x10
mov edx, dword [ebx + 0x100]
mov eax, esi
or eax, 0x10
cmp edx, 0xffffffff
cmove esi, eax
cmp dword [ebx + 0x38], ecx
jb 0x6450cdf0
mov eax, dword [ebx + 0x104]
mov edi, dword [ebx + 0x108]
test eax, eax
je 0x6450ce07
add edx, 1
cmp edx, edi
jb 0x6450ccba
mov edx, edi
mov dword [esp + 8], eax
add edx, 0x200
mov dword [esp + 4], 8
mov dword [ebx + 0x108], edx
shl edx, 4
mov dword [esp + 0xc], edx
mov edi, dword fs:[0x18]
mov eax, dword [edi + 0x30]
mov dword [ebp - 0x20], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov ecx, dword [ebp - 0x20]
mov dword [ebx + 0x104], eax
sub esp, 0x10
test eax, eax
je 0x6450cf5a
mov edi, dword [ebx + 0x100]
lea edx, [edi + 1]
mov edi, dword [ebp - 0x1c]
mov dword [ebx + 0x100], edx
shl edx, 4
mov dword [eax + edx], edi
mov eax, dword [ebx + 0x100]
mov edi, dword [ebp + 8]
shl eax, 4
add eax, dword [ebx + 0x104]
mov dword [eax + 4], esi
mov eax, dword [ebx + 0x100]
xor esi, esi
shl eax, 4
add eax, dword [ebx + 0x104]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x100]
shl eax, 4
add eax, dword [ebx + 0x104]
mov dword [eax + 0xc], ecx
mov eax, dword [ebx + 0x100]
cmp dword [ebx + 0x30], eax
ja 0x6450cd15
add eax, 1
mov dword [ebx + 0x30], eax
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x6370
jne 0x6450ce68
cmp dword [ebx + 0x10], 0x73646976
jne 0x6450ced8
mov edx, dword [ebx + 0x10c]
mov esi, dword [ebx + 0x110]
test edx, edx
je 0x6450cf18
mov eax, dword [ebx + 0x58]
cmp eax, esi
jb 0x6450cda2
add esi, 0x10
mov dword [esp + 8], edx
mov edi, esi
mov dword [esp + 4], 8
shl edi, 4
mov dword [ebp - 0x1c], ecx
mov dword [esp + 0xc], edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov ecx, dword [ebp - 0x1c]
sub esp, 0x10
test eax, eax
mov edx, eax
je 0x6450cf5a
mov dword [ebx + 0x10c], edx
mov dword [ebx + 0x110], esi
mov eax, dword [ebx + 0x58]
mov esi, dword [ebx + 0x100]
add eax, 1
or dword [ebx + 0x18], 0x10000
mov dword [ebx + 0x58], eax
shl eax, 4
mov dword [edx + eax], esi
mov edx, dword [ebx + 0x10c]
mov esi, dword [ebp + 8]
mov dword [edx + eax + 4], 0
mov edx, dword [ebx + 0x10c]
mov dword [edx + eax + 8], esi
mov edx, dword [ebx + 0x10c]
xor esi, esi
mov dword [edx + eax + 0xc], ecx
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x104]
mov edi, dword [ebx + 0x108]
mov dword [ebx + 0x38], ecx
test eax, eax
jne 0x6450cc5c
mov edx, edi
mov dword [esp + 4], 8
add edx, 0x200
mov dword [ebp - 0x20], ecx
mov dword [ebx + 0x108], edx
shl edx, 4
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x20]
mov dword [ebx + 0x104], eax
sub esp, 0xc
jmp 0x6450cca9
mov edx, dword [ebx + 8]
mov eax, esi
and eax, 0xffffffef
test byte [edx + 0x19], 8
cmovne esi, eax
jmp 0x6450cc2e
test byte [0x64524038], 4
je 0x6450cc2e
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.:_unknown_TWOCC_0x_04X_found_n
mov dword [esp + 8], str.AVIFILE_AddFrame
mov dword [esp + 4], 0x64524038
mov dword [esp], 2
mov dword [ebp - 0x20], ecx
call fcn.6450b070
mov ecx, dword [ebp - 0x20]
jmp 0x6450cc2e
mov dword [ebp - 0x20], ecx
mov dword [esp + 8], 0x53b
mov dword [esp + 4], str..._dlls_avifil32_avifile.c
mov dword [esp], 0x64526cdb
call dword [sym.imp.ucrtbase.dll__assert]
mov ecx, dword [ebp - 0x20]
jmp 0x6450cbf9
mov esi, 0x80044066
test byte [0x64524038], 2
je 0x6450cd15
mov dword [esp + 0xc], str.:_found_palette_change_in_non_video_stream__n
mov dword [esp + 8], str.AVIFILE_AddFrame
mov dword [esp + 4], 0x64524038
mov dword [esp], 1
call fcn.6450b070
jmp 0x6450cd15
add esi, 0x10
mov dword [esp + 4], 8
mov edx, esi
mov dword [ebp - 0x1c], ecx
shl edx, 4
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov dword [ebx + 0x10c], eax
mov edx, eax
jne 0x6450cd99
mov esi, 0x80044067
jmp 0x6450cd15