Function at 0x64f860
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x68e552
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
mov dword [esi], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x20], ebp
mov dword [esi + 0x1c], ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x2c], ebp
mov dword [esi + 0x28], ebp
mov dword [esi + 0x24], ebp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x34], ebp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x44], ebp
mov dword [esi + 0x40], ebp
mov dword [esi + 0x3c], ebp
mov dword [esi + 0x50], ebp
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x48], ebp
mov dword [esi + 0x5c], ebp
mov dword [esi + 0x58], ebp
mov dword [esi + 0x54], ebp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x64], ebp
mov dword [esi + 0x60], ebp
mov dword [esi + 0x74], ebp
mov dword [esi + 0x70], ebp
mov dword [esi + 0x6c], ebp
mov dword [esi + 0x80], ebp
mov dword [esi + 0x7c], ebp
mov dword [esi + 0x78], ebp
mov dword [esp + 0x14], esi
mov dword [esi + 0x8c], ebp
mov dword [esi + 0x88], ebp
mov dword [esi + 0x84], ebp
lea eax, [esi + 0x90]
mov ecx, 0x14
mov dword [eax + 8], ebp
mov dword [eax + 4], ebp
mov dword [eax], ebp
add eax, 0xc
dec ecx
jne 0x64f90c
push fcn.0065e798
push fcn.0065e79e
lea eax, [esi + 0x1fc]
push 5
push 4
push eax
call fcn.0065f456
push fcn.0065e798
push fcn.0065e79e
push 0x32
lea eax, [esi + 0x2f4]
push 4
push eax
mov dword [esp + 0x34], ebp
call fcn.0065f456
push fcn.0065e798
push fcn.0065e79e
push 0x32
lea ecx, [esi + 0x3bc]
push 4
push ecx
mov byte [esp + 0x34], 1
call fcn.0065f456
push fcn.0065e798
push fcn.0065e79e
push 0x32
lea edx, [esi + 0x484]
push 4
push edx
mov byte [esp + 0x34], 2
call fcn.0065f456
push fcn.0065e798
push fcn.0065e79e
push 0x32
lea eax, [esi + 0x54c]
push 4
push eax
mov byte [esp + 0x34], 3
call fcn.0065f456
push fcn.0065e798
push fcn.0065e79e
push 0x32
lea ecx, [esi + 0x614]
push 4
push ecx
mov byte [esp + 0x34], 4
call fcn.0065f456
lea ecx, [esi + 0x870]
mov byte [esp + 0x20], 5
call fcn.0064a6e0
mov byte [esp + 0x20], 6
lea eax, [esi + 0x8810]
mov ecx, 0x32
mov dword [eax + 8], ebp
mov dword [eax + 4], ebp
mov dword [eax], ebp
add eax, 0xc
dec ecx
jne 0x64f9ee
lea eax, [esi + 0x8a68]
mov ecx, 0x14
mov dword [eax + 8], ebp
mov dword [eax + 4], ebp
mov dword [eax], ebp
add eax, 0xc
dec ecx
jne 0x64fa07
push fcn.0065e798
push fcn.0065e79e
lea eax, [esi + 0x8b58]
push 6
push 4
push eax
call fcn.0065f456
lea ecx, [esi + 0x8bd0]
mov byte [esp + 0x20], 7
call fcn.0065e79e
lea ecx, [esi + 0x8bd4]
mov byte [esp + 0x20], 8
call fcn.0065e79e
mov ebx, 0x3f800000
mov eax, 0x3f008312
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], eax
mov ecx, 0x3e4ccccd
mov dword [esi + 0x68], ebp
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebp
mov edx, 0x3dc8b439
mov dword [esi + 0x2c], ebp
mov edi, 0x3f4ccccd
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edx
mov dword [esi + 0x3c], 0x3f7ced91
mov dword [esi + 0x40], 0x3f44dd2f
mov dword [esi + 0x44], 0x3c343958
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], edi
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], 0x3ecccccd
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebp
mov dword [esi + 0x7c], 0x3f000000
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], 0x3f50a3d7
lea ecx, [esi + 0x94]
mov dword [esi + 0x88], 0x3f126e98
mov byte [esp + 0x20], 9
mov dword [esi + 0x8c], 0x3ee66666
mov edx, ecx
mov edi, 0x14
mov dword [edx - 4], ebx
mov dword [edx], ebx
mov dword [edx + 4], ebx
add edx, 0xc
dec edi
jne 0x64fb11
mov dword [esi + 0x90], ebp
mov dword [ecx], ebx
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebp
mov dword [esi + 0xa4], ebp
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], ebx
mov dword [esi + 0x180], 0x40c00000
mov dword [esi + 0x190], 0xd2f1a9fc
mov dword [esi + 0x194], 0x3f50624d
mov dword [esi + 0x198], 0xeb851eb8
mov ecx, 0x9999999a
mov dword [esi + 0x19c], 0x3fbeb851
mov eax, 0x3fb99999
mov dword [esi + 0x1a0], ecx
mov dword [esi + 0x1a4], eax
mov dword [esi + 0x1a8], ecx
mov dword [esi + 0x1ac], eax
mov eax, 0x3ff00000
mov dword [esi + 0x1b0], ebp
mov dword [esi + 0x1b4], eax
mov dword [esi + 0x184], 0xc
mov dword [esi + 0x188], ebp
mov edi, 1
mov dword [esi + 0x18c], eax
mov dword [esi + 0x1b8], edi
mov dword [esi + 0x1bc], 7
mov dword [esi + 0x1d8], ebp
mov dword [esi + 0x1dc], ebp
mov dword [esi + 0x1d0], ebp
mov dword [esi + 0x1d4], ebp
mov dword [esi + 0x1c8], ebp
mov dword [esi + 0x1cc], ebp
mov dword [esi + 0x1c0], ebp
mov dword [esi + 0x1c4], ebp
mov dword [esi + 0x1e0], ebp
mov dword [esi + 0x1e4], 0x40340000
mov dword [esi + 0x1e8], ebp
mov dword [esi + 0x1ec], ebp
mov dword [esi + 0x1f0], ebp
mov dword [esi + 0x1f4], ebp
push 0x6d7c78
lea ecx, [esi + 0x1fc]
mov dword [esi + 0x1f8], ebp
call fcn.0065e7a4
push 0x6d7c70
lea ecx, [esi + 0x200]
call fcn.0065e7a4
push 0x6d7c68
lea ecx, [esi + 0x204]
call fcn.0065e7a4
push 0x6fc144
lea ecx, [esi + 0x208]
call fcn.0065e7a4
push 0x6fc144
lea ecx, [esi + 0x20c]
call fcn.0065e7a4
xor edx, edx
mov dword [esi + 0x210], edx
mov dword [esi + 0x214], edx
mov dword [esi + 0x218], edx
mov dword [esi + 0x21c], edx
mov dword [esi + 0x220], edx
mov dword [esi + 0x238], ebp
mov dword [esi + 0x23c], ebp
mov dword [esi + 0x230], ebp
mov dword [esi + 0x234], ebp
mov dword [esi + 0x228], ebp
mov dword [esi + 0x22c], ebp
mov dword [esi + 0x244], ebp
mov dword [esi + 0x240], ebp
mov dword [esi + 0x248], edi
mov dword [esi + 0x254], ebp
mov dword [esi + 0x250], ebp
mov dword [esi + 0x24c], ebp
mov dword [esi + 0x260], ebp
mov dword [esi + 0x25c], ebp
mov dword [esi + 0x258], ebp
mov dword [esi + 0x264], ebp
mov dword [esi + 0x26c], ebp
mov dword [esi + 0x268], ebp
mov dword [esi + 0x270], ebx
mov dword [esi + 0x274], ebx
mov dword [esi + 0x278], ebx
mov eax, 0x40140000
mov dword [esi + 0x280], ebp
mov dword [esi + 0x284], eax
mov dword [esi + 0x288], ebp
mov dword [esi + 0x28c], eax
mov dword [esi + 0x290], 0x47ae147b
mov dword [esi + 0x294], 0x3f947ae1
mov dword [esi + 0x298], ebp
mov dword [esi + 0x2a0], ebp
mov eax, 0x9999999a
mov dword [esi + 0x2a4], 0x3ff80000
mov dword [esi + 0x2a8], eax
mov dword [esi + 0x2ac], 0x3fc99999
mov dword [esi + 0x2b0], eax
mov dword [esi + 0x2b4], 0x3fe99999
mov eax, 9
mov dword [esi + 0x2b8], 0x3e8
push 0x6da988
lea ecx, [esi + 0x310]
mov dword [esi + 0x2bc], ebp
mov dword [esi + 0x2c0], 0xffffffff
mov dword [esi + 0x2c4], ebp
mov dword [esi + 0x2c8], 0x42480000
mov dword [esi + 0x2cc], ebp
mov dword [esi + 0x2d0], edi
mov dword [esi + 0x2d4], edi
mov dword [esi + 0x2d8], ebp
mov dword [esi + 0x2dc], ebp
mov dword [esi + 0x2e0], ebp
mov dword [esi + 0x2e4], edi
mov dword [esi + 0x2ec], eax
mov dword [esi + 0x2e8], eax
mov dword [esi + 0x2f0], eax
call fcn.0065e7a4
push 0x6da984
lea ecx, [esi + 0x314]
call fcn.0065e7a4
push 0x6d6e38
lea ecx, [esi + 0x318]
call fcn.0065e7a4
push 0x6d9df8
lea ecx, [esi + 0x31c]
call fcn.0065e7a4
push 0x6da980
lea ecx, [esi + 0x320]
call fcn.0065e7a4
push 0x6da97c
lea ecx, [esi + 0x324]
call fcn.0065e7a4
push 0x6da978
lea ecx, [esi + 0x3d8]
call fcn.0065e7a4
push 0x6da974
lea ecx, [esi + 0x3dc]
call fcn.0065e7a4
push 0x6da970
lea ecx, [esi + 0x3e0]
call fcn.0065e7a4
push 0x6da96c
lea ecx, [esi + 0x3e4]
call fcn.0065e7a4
push 0x6da968
lea ecx, [esi + 0x3e8]
call fcn.0065e7a4
push 0x6da964
lea ecx, [esi + 0x3ec]
call fcn.0065e7a4
lea eax, [esi + 0x7a4]
mov ecx, 0x32
mov dword [eax - 0xc8], ebp
mov dword [eax], ebp
add eax, 4
dec ecx
jne 0x64fee1
lea edx, [esi + 0x6f8]
mov eax, edi
mov ecx, 6
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x2e8]
mov ecx, 0xa
mov edx, 0x3e800000
mov dword [esi + eax*4 + 0x7a4], 1
lea eax, [esi + 0x8814]
mov dword [eax - 4], 0x3f1eb852
mov dword [eax], ebp
mov dword [eax + 4], edx
mov edi, 0x3f4ccccd
mov dword [eax + 8], 0x3f666666
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], 0x3ecccccd
mov dword [eax + 0x14], 0x3e99999a
mov dword [eax + 0x18], 0x3ecccccd
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], 0x3e8f5c29
mov dword [eax + 0x24], 0x3f0ccccd
mov dword [eax + 0x28], 0x3e6b851f
mov dword [eax + 0x2c], 0x3f47ae14
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], ebp
add eax, 0x3c
dec ecx
jne 0x64ff21
mov edx, dword [esi + 0x3c]
mov eax, dword [esi + 0x40]
lea ecx, [esi + 0x887c]
mov dword [esi + 0x8a68], ebx
push 0x6da3c8
mov dword [ecx], edx
mov edx, dword [esi + 0x44]
mov dword [ecx + 4], eax
mov eax, edi
mov edi, 0x3f19999a
mov dword [ecx + 8], edx
mov dword [esi + 0x8a6c], ebp
mov dword [esi + 0x8a70], ebp
mov ecx, 0x3f000000
mov dword [esi + 0x8a74], ebx
mov dword [esi + 0x8a78], ecx
mov dword [esi + 0x8a7c], ebp
mov dword [esi + 0x8a80], ebx
mov dword [esi + 0x8a84], ebx
mov dword [esi + 0x8a88], ebp
mov dword [esi + 0x8a8c], ecx
mov dword [esi + 0x8a90], ebx
mov dword [esi + 0x8a94], ebp
mov dword [esi + 0x8a98], ecx
mov dword [esi + 0x8a9c], ebx
mov dword [esi + 0x8aa0], ebx
mov dword [esi + 0x8aa4], ecx
mov dword [esi + 0x8aa8], ebp
mov dword [esi + 0x8aac], ebx
mov dword [esi + 0x8ab0], ebx
mov dword [esi + 0x8ab4], ebp
mov dword [esi + 0x8ab8], ebx
mov dword [esi + 0x8abc], 0x3ecccccd
mov dword [esi + 0x8ac0], eax
mov dword [esi + 0x8ac4], edi
mov edx, 0x3e4ccccd
mov dword [esi + 0x8ac8], ebx
mov dword [esi + 0x8acc], edx
mov dword [esi + 0x8ad0], edi
mov dword [esi + 0x8ad4], edx
mov dword [esi + 0x8ad8], eax
mov dword [esi + 0x8adc], eax
mov dword [esi + 0x8ae0], 0x3ecccccd
mov dword [esi + 0x8ae4], 0x3ecccccd
mov dword [esi + 0x8ae8], eax
mov dword [esi + 0x8aec], 0x3e99999a
mov dword [esi + 0x8af0], 0x3ecccccd
mov dword [esi + 0x8af4], ebx
mov dword [esi + 0x8af8], ecx
mov dword [esi + 0x8afc], ecx
mov dword [esi + 0x8b00], ebx
mov dword [esi + 0x8b04], 0x3dcccccd
mov dword [esi + 0x8b08], ecx
mov dword [esi + 0x8b0c], eax
mov dword [esi + 0x8b10], edx
mov dword [esi + 0x8b14], eax
mov dword [esi + 0x8b18], eax
mov dword [esi + 0x8b1c], ebx
mov dword [esi + 0x8b20], ebx
mov dword [esi + 0x8b24], ebp
mov dword [esi + 0x8b28], ebx
mov dword [esi + 0x8b2c], edx
mov dword [esi + 0x8b30], edi
mov dword [esi + 0x8b34], edi
mov dword [esi + 0x8b38], 0x3e99999a
lea ecx, [esi + 0x8b58]
mov dword [esi + 0x8b3c], edx
call fcn.0065e7a4
push 0x6da3bc
lea ecx, [esi + 0x8b5c]
call fcn.0065e7a4
push 0x6da3b0
lea ecx, [esi + 0x8b60]
call fcn.0065e7a4
push 0x6da0a0
lea ecx, [esi + 0x8b64]
call fcn.0065e7a4
push 0x6da3a0
lea ecx, [esi + 0x8b68]
call fcn.0065e7a4
push 0x6da3b0
lea ecx, [esi + 0x8b6c]
call fcn.0065e7a4
mov edi, 1
mov dword [esi + 0x8b70], ebp
mov dword [esi + 0x8b74], edi
mov dword [esi + 0x8b78], 4
mov dword [esi + 0x8b7c], 3
mov eax, 2
mov dword [esi + 0x8b80], 5
mov dword [esi + 0x8b84], eax
mov dword [esi + 0x8b88], ebp
mov dword [esi + 0x8b8c], 0x3fd00000
mov dword [esi + 0x8b90], edi
mov dword [esi + 0x8b94], ebp
mov dword [esi + 0x8b98], ebp
mov dword [esi + 0x8b9c], ebp
mov dword [esi + 0x8ba0], 0x5c28f5c3
mov dword [esi + 0x8ba4], 0x3fc5c28f
mov ebx, 0x40000000
mov dword [esi + 0x8ba8], ebp
mov dword [esi + 0x8bac], ebx
mov dword [esi + 0x8bb0], 0x9999999a
mov dword [esi + 0x8bb4], 0x3fc99999
mov dword [esi + 0x8bb8], 0x33333333
mov dword [esi + 0x8bbc], 0x3fd33333
mov dword [esi + 0x8bc0], ebp
mov dword [esi + 0x8bc4], eax
mov dword [esi + 0x8bc8], ebp
push 0x6fc144
lea ecx, [esi + 0x8bd0]
mov dword [esi + 0x8bcc], ebp
call fcn.0065e7a4
push 0x6fc144
lea ecx, [esi + 0x8bd4]
call fcn.0065e7a4
mov dword [esi + 0x8bd8], ebp
mov dword [esi + 0x8bdc], 0x404d0000
mov dword [esi + 0x8be0], ebp
mov dword [esi + 0x8be4], 0x40370000
mov dword [esi + 0x8be8], ebp
mov dword [esi + 0x8bec], 0x40290000
mov dword [esi + 0x8bf0], 0x66666666
mov dword [esi + 0x8bf4], 0x400e6666
mov dword [esi + 0x8bf8], ebp
mov dword [esi + 0x8bfc], 0x40040000
mov eax, 0x40080000
mov dword [esi + 0x8c00], ebp
mov dword [esi + 0x8c04], eax
mov dword [esi + 0x8c08], ebp
mov dword [esi + 0x8c0c], eax
mov dword [esi + 0x8c10], ebp
mov dword [esi + 0x8c14], ebx
mov eax, 0x3ff00000
mov dword [esi + 0x8c18], ebp
mov dword [esi + 0x8c1c], eax
mov dword [esi + 0x8c20], 0x9999999a
mov dword [esi + 0x8c24], 0x3fe99999
mov dword [esi + 0x8c28], ebp
mov dword [esi + 0x8c2c], eax
lea ebx, [esi + 0x8c40]
mov dword [esi + 0x8c30], edi
mov dword [esi + 0x8c34], ebp
mov ecx, 0x64
xor eax, eax
mov edi, ebx
mov dword [esi + 0x8c38], ebp
mov edx, 1
rep stosd dword es:[edi], eax
mov dword [ebx], edx
mov dword [esi + 0x8c44], edx
mov dword [esi + 0x8c4c], edx
mov dword [esi + 0x8c68], edx
mov dword [esi + 0x8c74], 3
mov dword [esi + 0x8c78], edx
mov dword [esi + 0x8c7c], edx
mov dword [esi + 0x8c8c], edx
mov dword [esi + 0x8c94], 4
mov dword [esi + 0x8ca0], edx
mov dword [esi + 0x8ca4], 5
mov dword [esi + 0x8cb0], edx
mov dword [esi + 0x8cb4], edx
lea ebx, [esi + 0x8dd8]
mov ecx, 0x256
mov edi, ebx
mov dword [esi + 0x8cd8], edx
rep stosd dword es:[edi], eax
mov dword [esi + 0x8dd0], 0x851eb852
mov dword [esi + 0x8dd4], 0x400451eb
mov dword [ebx], 0xbc6a7efa
mov dword [ebx + 4], 0x3f889374
mov dword [esi + 0x8df0], 0x9999999a
mov dword [esi + 0x8df4], 0x3fc99999
mov eax, 0x3ff00000
mov dword [esi + 0x8df8], ebp
mov dword [esi + 0x8dfc], eax
mov dword [esi + 0x8e00], ebp
mov dword [esi + 0x8e04], eax
mov dword [esi + 0x8e08], ebp
mov dword [esi + 0x8e0c], 0x40100000
mov eax, 0x3fe00000
mov dword [esi + 0x8e10], ebp
mov dword [esi + 0x8e14], eax
mov dword [esi + 0x8e18], 0x5e353f7d
mov dword [esi + 0x8e1c], 0x3fd449ba
mov dword [esi + 0x8e28], ebp
mov dword [esi + 0x8e2c], eax
mov dword [esi + 0x8c3c], edx
lea edx, [esi + 0x9730]
mov ecx, 0x96
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [edx], 0x81b6
mov dword [esi + 0x97f8], 0x800a
mov dword [esi + 0x98c0], 0x81bb
mov dword [esi + 0x9734], 0x8020
mov dword [esi + 0x97fc], 0x800b
mov dword [esi + 0x98c4], 0x81db
mov dword [esi + 0x9738], 0x8011
mov dword [esi + 0x9800], 0x801b
mov dword [esi + 0x98c8], 0x81c2
mov dword [esi + 0x973c], 0x81ac
mov dword [esi + 0x9804], 0x8041
mov dword [esi + 0x98cc], 0x81c1
mov dword [esi + 0x9740], 0x8218
mov dword [esi + 0x9808], 0x8013
mov dword [esi + 0x98d0], 0x81c4
mov dword [esi + 0x9744], 0x800c
mov dword [esi + 0x980c], 0x8019
mov dword [esi + 0x98d4], 0x81cd
mov dword [esi + 0x9748], 0x81eb
mov dword [esi + 0x9810], 0x801d
mov dword [esi + 0x98d8], 0x81ea
mov dword [esi + 0x974c], 0x81ec
mov dword [esi + 0x9814], 0x8028
mov dword [esi + 0x98dc], 0x81c3
mov dword [esi + 0x9750], 0x8035
mov dword [esi + 0x9818], 0x8025
mov dword [esi + 0x98e0], 0x81c5
mov dword [esi + 0x9754], 0x8049
mov dword [esi + 0x981c], 0x8225
mov dword [esi + 0x98e4], 0x81e9
mov dword [esi + 0x9758], 0x8033
mov dword [esi + 0x9820], 0x8213
mov dword [esi + 0x98e8], 0x81c6
mov dword [esi + 0x975c], 0x8034
mov dword [esi + 0x9824], 0x8224
mov dword [esi + 0x98ec], 0x81cf
mov dword [esi + 0x9760], 0x8036
mov dword [esi + 0x9828], 0x8030
mov dword [esi + 0x98f0], 0x81e8
mov dword [esi + 0x9764], 0x8039
mov dword [esi + 0x982c], 0x802f
mov dword [esi + 0x98f4], 0x8209
mov dword [esi + 0x9768], 0x8023
mov dword [esi + 0x9830], 0x8032
mov dword [esi + 0x98f8], 0x81d8
mov dword [esi + 0x976c], 0x8024
mov dword [esi + 0x9834], 0x8226
mov dword [esi + 0x98fc], 0x8214
mov dword [esi + 0x9770], 0x801f
mov dword [esi + 0x9838], 0x8038
mov dword [esi + 0x9900], 0x81bf
mov dword [esi + 0x9774], 0x8220
mov dword [esi + 0x983c], 0x803f
mov dword [esi + 0x9904], 0x81c0
mov dword [esi + 0x9778], 0x802c
mov dword [esi + 0x9840], 0x8040
mov dword [esi + 0x9908], 0x81c7
mov dword [esi + 0x977c], 0x802e
mov dword [esi + 0x9844], 0x8037
mov dword [esi + 0x990c], 0x820a
mov dword [esi + 0x9780], 0x8046
mov dword [esi + 0x9848], 0x8043
mov dword [esi + 0x9910], 0x81c8
mov dword [esi + 0x9784], 0x8047
mov dword [esi + 0x984c], 0x81ed
mov dword [esi + 0x9914], 0x820b
mov dword [esi + 0x9788], 0x8048
mov dword [esi + 0x9850], 0x8219
mov dword [esi + 0x9918], 0x81cc
mov dword [esi + 0x978c], 0x81ef
mov dword [esi + 0x9854], 0x821d
mov dword [esi + 0x991c], 0x81ca
mov dword [esi + 0x9790], 0x81e2
mov dword [esi + 0x9858], 0x81b8
mov dword [esi + 0x9920], ebp
mov dword [esi + 0x9794], 0x804e
mov dword [esi + 0x985c], 0x8208
mov dword [esi + 0x9924], ebp
mov dword [esi + 0x9798], 0x8053
mov dword [esi + 0x9860], 0x8201
mov dword [esi + 0x9928], 0x81cb
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x979c], 0x803c
mov dword [esi + 0x9864], 0x81fb
mov dword [esi + 0x992c], 0x81ce
mov dword [esi + 0x97a0], 0x803d
mov dword [esi + 0x9868], 0x8216
mov dword [esi + 0x9930], ebp
mov dword [esi + 0x97a4], 0x81b4
mov dword [esi + 0x986c], 0x81f2
mov dword [esi + 0x9934], ebp
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret