Function at 0x561de0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x78ebc5
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x867e6c]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x3c]
mov dword [edi], vtable.Sexy::PIEffect.0
xor ebx, ebx
mov ebp, 0xf
mov dword [edi + 0x30], ebp
mov dword [edi + 0x2c], ebx
mov byte [edi + 0x1c], bl
mov dword [esp + 0x34], ebx
mov dword [edi + 0x4c], ebp
mov dword [edi + 0x48], ebx
mov byte [edi + 0x38], bl
lea eax, [edi + 0x50]
mov byte [esp + 0x34], 1
call fcn.00581300
lea esi, [edi + 0xa14]
call fcn.0054a360
mov dword [edi + 0xe5c], ebp
mov dword [edi + 0xe58], ebx
mov byte [edi + 0xe48], bl
lea eax, [edi + 0xe64]
push eax
mov byte [esp + 0x38], 3
call fcn.00428920
lea ecx, [edi + 0xe84]
mov byte [esp + 0x34], 4
call fcn.00434800
lea eax, [edi + 0xea4]
push eax
call fcn.00463cf0
lea ecx, [edi + 0xec8]
push ecx
mov byte [esp + 0x38], 5
call fcn.00448d70
mov dword [edi + 0xef8], ebp
mov dword [edi + 0xef4], ebx
mov byte [edi + 0xee4], bl
mov dword [edi + 0xf0c], ebx
mov dword [edi + 0xf10], ebx
mov dword [edi + 0xf14], ebx
mov dword [edi + 0xf18], ebx
mov dword [edi + 0xf1c], 0x110
mov dword [edi + 0xf20], ebx
mov dword [edi + 0xf24], ebx
mov dword [edi + 0xf28], ebx
mov dword [edi + 0xf2c], ebx
mov dword [edi + 0xf30], 0x138
lea esi, [edi + 0xf48]
mov ecx, esi
mov byte [esp + 0x34], 9
call fcn.00434800
lea ecx, [edi + 0xf5c]
call fcn.00401ff0
lea ebp, [edi + 0xf78]
mov eax, ebp
call fcn.0057e350
lea eax, [edi + 0xf9c]
call fcn.0057e350
mov eax, dword [0x88b148]
add eax, 0x124
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov byte [esp + 0x34], 0xb
mov eax, dword [0x88b148]
lea edx, [esp + 0x18]
push edx
add eax, 0x4cc
mov dword [esp + 0x1c], edi
push eax
lea ebx, [esp + 0x28]
call fcn.00571c20
mov byte [esp + 0x34], 0xa
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
fldz
xor ebx, ebx
fstp dword [edi + 0xf04]
fld1
mov al, 1
mov byte [edi + 0x11], al
fstp dword [edi + 0xf44]
mov byte [edi + 0xf74], al
mov byte [edi + 0xefc], bl
mov dword [edi + 0xe60], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xf00], ebx
mov dword [edi + 0xf38], ebx
mov dword [edi + 0xf3c], ebx
mov dword [edi + 0xf40], ebx
mov dword [edi + 0xe98], ebx
mov dword [edi + 0xe9c], ebx
mov edx, dword [0x88ba50]
mov dword [esi], edx
mov ecx, dword [0x88ba54]
mov dword [esi + 4], ecx
mov edx, dword [0x88ba58]
mov dword [esi + 8], edx
mov ecx, dword [0x88ba5c]
mov byte [edi + 0xf59], al
mov eax, ebp
mov dword [esi + 0xc], ecx
mov byte [edi + 0xf58], bl
mov byte [edi + 0xf5a], bl
call fcn.0057e0f0
lea eax, [edi + 0xf9c]
call fcn.0057e0f0
push 0x6c
call fcn.006442a0
add esp, 4
mov dword [esp + 0x1c], eax
mov byte [esp + 0x34], 0xc
cmp eax, ebx
je 0x562027
push eax
call fcn.005605f0
mov dword [edi + 0xec4], eax
jmp 0x56202d
mov dword [edi + 0xec4], ebx
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4