Function at 0x7489ddd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x748a63e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
push ebx
push esi
push edi
mov eax, dword [0x749481c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0x74861010
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0x74861010
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x74861014
mov byte [ebp - 4], 2
xor ecx, ecx
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 0
mov ebx, dword [ebp + 8]
push 0x748635e4
sub esp, 0x58
mov eax, esp
push ebx
mov dword [eax], 0x748634f8
mov dword [eax + 4], 0x74863590
mov dword [eax + 8], 0x748634ac
mov dword [eax + 0xc], 0x763
mov dword [eax + 0x10], 0xb
mov dword [eax + 0x14], 0xff
mov dword [eax + 0x54], 0x1000000
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
call fcn.748a17a0
add esp, 0x60
push dword [esi + 0x34]
call dword [0x7494a2e4]
mov esi, dword [ebp + 0x10]
mov edi, eax
push esi
call dword [0x7494a2e4]
cmp eax, edi
jb 0x7489df55
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x48]
push dword [eax + 0x34]
push esi
call dword [0x7494a2e0]
cmp dword [ebp - 0x28], 0
jne 0x7489df5c
push 0x74863418
push 0x748633f0
push 0xaa
push 0x748633e0
push ebx
call fcn.7489ef10
mov eax, dword [ebp - 0x14]
add esp, 0x14
mov dword [ebp - 0x18], 0x74861014
test eax, eax
jne 0x748afd14
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
push 0
push esi
call dword [0x7494d0e4]
mov edi, eax
call dword [0x7494a080]
cmp eax, 0x7a
jne 0x748affee
test edi, edi
jne 0x748afff9
mov eax, dword [ebp - 0x2c]
lea eax, [eax*2 + 2]
push eax
push edi
call dword [0x7494a108]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x748afd20
mov eax, dword [ebp - 0x30]
lea eax, [eax*2 + 2]
push eax
push edi
call dword [0x7494a108]
mov edi, eax
mov dword [ebp - 0x34], edi
test edi, edi
je 0x748afd35
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x30]
push eax
push edi
push esi
call dword [0x7494d0e4]
test eax, eax
je 0x748afd4a
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x748afdc3
lea eax, [ebp - 0x58]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
push 0
push edi
push 0
call dword [0x7494d128]
mov esi, eax
cmp esi, 0x8ac
je 0x7489e063
test esi, esi
jne 0x748afddb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x7489e0c6
lea ebx, [ebx]
cmp esi, dword [ebp - 0x44]
jae 0x7489e0f6
push dword [ebp + 0xc]
push dword [eax + esi*4]
call dword [0x7494a330]
test eax, eax
jne 0x748affa5
mov eax, dword [ebp - 0x1c]
inc esi
jmp 0x7489e040
push 0x74863418
push 0x748633f0
push 0xaa
push 0x748633e0
push ebx
call fcn.7489ef10
mov eax, dword [ebp - 0x14]
add esp, 0x14
mov dword [ebp - 0x18], 0x74861014
test eax, eax
jne 0x748afdcf
push edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x74861000
call dword [0x7494a110]
push dword [ebp - 0x20]
call dword [0x7494a110]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x74863418
push 0x748633f0
push 0xaa
push 0x748633e0
push ebx
call fcn.7489ef10
mov eax, dword [ebp - 0x14]
add esp, 0x14
mov dword [ebp - 0x18], 0x74861014
test eax, eax
je 0x7489e092
jmp 0x748afdcf
push 0x74863418
push 0x748633f0
push 0xaa
push 0x748633e0
push ebx
call fcn.7489ef10
mov eax, dword [ebp - 0x14]
add esp, 0x14
mov dword [ebp - 0x18], 0x74861014
test eax, eax
je 0x7489e128
push eax
call dword [0x7494d120]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x74861000
test edi, edi
je 0x7489e141
push edi
call dword [0x7494a110]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x7489df3f
push eax
jmp 0x7489e0aa
push eax
call dword [0x7494d120]
jmp 0x7489df3f
push 0x74936d6c
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x8007000e
push eax
call fcn.748a5f76
push 0x74936d6c
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x8007000e
push eax
call fcn.748a5f76
call dword [0x7494a080]
push eax
push 0x74885d98
sub esp, 0x58
mov ecx, esp
push ecx
push 0xb
push 0x795
push 0x74863590
push 0x748634ac
push 0x748634f8
call fcn.7489a1f0
push ebx
call fcn.748a17a0
add esp, 0x64
mov ecx, ebx
push 0
call fcn.74899d80
mov ecx, dword [ebp - 0x14]
mov bl, al
mov dword [ebp - 0x18], 0x74861014
test ecx, ecx
je 0x748afda0
push ecx
call dword [0x7494d120]
push edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x74861000
call dword [0x7494a110]
push dword [ebp - 0x20]
call dword [0x7494a110]
jmp 0x748b004f
push eax
call dword [0x7494d120]
jmp 0x7489dff6
push eax
call dword [0x7494d120]
jmp 0x7489e092
call dword [0x7494a294]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
mov ecx, dword [edx + 0x38]
or ecx, dword [edx + 0x3c]
je 0x748afe11
mov ecx, eax
mov eax, dword [ebp - 0x1c]
sub ecx, dword [edx + 0x38]
sbb eax, dword [edx + 0x3c]
mov dword [ebp - 0x48], eax
jne 0x748afe0e
cmp ecx, 0x36ee80
jbe 0x748afec1
mov eax, dword [ebp - 0x40]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [edx + 0x3c], eax
push edi
push 0x74885dfc
test esi, esi
jg 0x748afe28
mov eax, esi
jmp 0x748afe30
movzx eax, si
or eax, 0x80070000
push eax
sub esp, 0x58
mov ecx, esp
push ecx
push 0xb
push 0x7b8
push 0x74863590
push 0x748634ac
push 0x748634f8
call fcn.7489a1f0
push ebx
call fcn.748be3b7
add esp, 0x68
push ecx
push 0xb
push 0x7bd
push 0x74863590
push 0x748634ac
push 0x748634f8
lea ecx, [ebp - 0x118]
call fcn.7489a1f0
push edi
lea ecx, [ebp - 0xc0]
push ecx
mov ecx, eax
call fcn.748bdff5
sub esp, 0x58
mov ecx, esp
push esi
push ecx
mov ecx, eax
call fcn.748bdfa8
push 2
mov edx, 0x2026
mov ecx, ebx
call fcn.748bec6c
add esp, 0x5c
lea ecx, [ebp - 0xc0]
call fcn.7489a266
lea ecx, [ebp - 0x118]
call fcn.7489a266
push esi
push edi
push 0x74885e38
push 0x80042302
sub esp, 0x58
mov ecx, esp
push ecx
push 0xb
push 0x7c1
push 0x74863590
push 0x748634ac
push 0x748634f8
call fcn.7489a1f0
push ebx
call fcn.748bf8f2
mov ecx, dword [ebp + 8]
push dword [ecx + 0x18]
push 0x7da
push 0x74863590
push 0x748634ac
push 0x748634f8
push dword [ebp - 0x60]
call fcn.748beb2d
mov eax, 0x748af31c
ret
push 1
mov ecx, ebx
call fcn.74899d80
mov ecx, dword [ebp - 0x14]
mov bl, al
mov dword [ebp - 0x18], 0x74861014
test ecx, ecx
je 0x748affc5
push ecx
call dword [0x7494d120]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0x74861000
test edi, edi
je 0x748affde
push edi
call dword [0x7494a110]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x748b004f
push eax
call dword [0x7494a110]
jmp 0x748b004f
test edi, edi
jne 0x748afff9
mov ecx, 0x74863418
jmp 0x748afffe
mov ecx, 0x74862e7c
push ecx
push eax
push 0x74885d28
sub esp, 0x58
mov ecx, esp
push ecx
push 0xb
push 0x786
push 0x74863590
push 0x748634ac
push 0x748634f8
call fcn.7489a1f0
push ebx
call fcn.748a17a0
add esp, 0x68
mov ecx, ebx
push 0
call fcn.74899d80
mov ecx, dword [ebp - 0x14]
mov bl, al
mov dword [ebp - 0x18], 0x74861014
test ecx, ecx
je 0x748b004f
push ecx
call dword [0x7494d120]
mov al, bl
jmp 0x7489e0b2