Function at 0x5c3a94
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8d9874
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x14], eax
call fcn.007b4b48
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax + 0x30]
mov dword [eax], 0xb0c020
or ebx, 0x80000000
mov edx, dword [0x9c20c0]
mov dword [eax + 4], edx
mov esi, dword [0x9c20c4]
mov edi, dword [0x9c20c8]
mov ecx, dword [0x9c20cc]
mov edx, dword [0x9c20d0]
mov dword [eax + 0x30], ebx
mov dword [eax + 0xac], esi
mov dword [eax + 0xb0], edi
mov dword [eax + 0xb4], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [eax + 0xb8], edx
mov edx, dword [0x9c20d4]
mov dword [eax + 0xbc], edx
mov edx, dword [0x9c20d8]
mov dword [eax + 0xc0], edx
mov edx, dword [0x9c20dc]
mov dword [eax + 0xc4], edx
mov edx, dword [0x9c20e0]
mov dword [eax + 0xc8], edx
mov edx, dword [0x9c20e4]
mov dword [eax + 0xcc], edx
mov edx, dword [0x9c20e8]
mov dword [eax + 0xd0], edx
mov edx, dword [0x9c20ec]
mov dword [eax + 0xd4], edx
mov dword [ecx + 0x98], 4
lea eax, [ecx + 0xac]
push eax
call fcn.007b9ccc
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x14]
mov edi, 0xffff
push esi
mov word [ecx + 0xe4], di
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xd8], eax
xor edi, edi
mov dword [ecx + 0xdc], edi
mov word [ecx + 0xe6], di
mov dword [ecx + 0xe0], edi
movzx edx, byte [esi]
mov byte [ecx + 0xf2], dl
movzx ebx, byte [esi + 1]
mov byte [ecx + 0xf3], bl
movzx eax, byte [esi + 2]
mov byte [ecx + 0xf4], al
mov dword [ecx + 0xf8], edi
mov dword [ecx + 0xfc], edi
mov word [ecx + 0xe8], di
call fcn.005c3de8
mov ecx, esi
call fcn.005d68b4
mov edx, dword [ebp - 0x2c]
mov ecx, esi
mov byte [edx + 0xf0], al
call fcn.005d6990
test eax, eax
je 0x5c3c1b
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0xf5], 4
jmp 0x5c3c45
mov eax, dword [ebp - 0x2c]
push 4
push 0
movzx edx, byte [eax + 0xf2]
push edx
call fcn.007a8f0c
add esp, 0xc
movzx eax, byte [eax + 0x92bb88]
mov ecx, dword [ebp - 0x2c]
push eax
call fcn.005c3e3c
mov ecx, dword [ebp - 0x2c]
mov eax, dword [0xa8d8c0]
test eax, eax
je 0x5c3d92
push eax
mov edx, dword [ecx]
call dword [edx + 0x14]
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0xf8], 0
mov eax, 0xffff
mov word [edx + 0x1c], ax
call fcn.005c8498
mov ecx, dword [ebp - 0x2c]
mov word [ecx + 0x1c], ax
call fcn.007b4f54
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0xf1], 0
call fcn.005c3e6c
mov ebx, dword [0xa8d820]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0xd8]
mov dword [ebp - 0x14], ebx
lea ebx, [ebx - 1]
mov dword [ebp - 0x18], eax
cmp ecx, 0xffffffff
je 0x5c3d86
test ebx, ebx
jl 0x5c3ce7
mov edx, dword [0xa8d81c]
mov eax, dword [edx + ebx*4]
cmp ecx, dword [eax + 0xd8]
jge 0x5c3ced
xor eax, eax
test ebx, ebx
jle 0x5c3d2f
lea edi, [ebx + eax]
sar edi, 1
mov esi, dword [edx + edi*4]
cmp ecx, dword [esi + 0xd8]
jle 0x5c3cdf
lea eax, [edi + 1]
jmp 0x5c3ce1
mov ebx, edi
cmp eax, ebx
jl 0x5c3cca
jmp 0x5c3d2f
mov edx, dword [0xa8d81c]
mov eax, dword [ebp - 0x14]
lea ecx, [eax + eax]
add ecx, ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ecx + edx], eax
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ebx
add edx, 1
mov dword [0xa8d820], edx
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
lea ebx, [eax + eax]
add ebx, ebx
mov dword [ebp - 0x1c], ebx
add edx, ebx
mov esi, dword [edx]
cmp ecx, dword [esi + 0xd8]
jne 0x5c3d4f
mov dword [0xa8d8d4], 1
jmp 0x5c3d13
mov ecx, dword [ebp - 0x14]
lea ebx, [edx + 4]
add ecx, ecx
add ecx, ecx
neg eax
add eax, eax
add eax, eax
add ecx, eax
push ecx
push edx
push ebx
call fcn.00858c80
add esp, 0xc
mov eax, dword [ebp - 0x2c]
mov edx, dword [0xa8d820]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov edx, dword [0xa8d81c]
jmp 0x5c3cf8
mov dword [0xa8d8d4], 1
jmp 0x5c3d13
mov dword [ecx + 0xf8], 0
call fcn.005c3db0
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0xf1], 3
jmp 0x5c3c89