Function at 0x640630
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x6c
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x706290
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x18]
mov eax, dword fs:[0]
test ecx, ecx
mov dword [ebp - 0x18], eax
mov dword fs:[0], ebx
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], ecx
je 0x640698
mov eax, ecx
movzx ecx, byte [esi]
mov dword [ebp - 0x44], edx
cmp eax, 1
movzx ebx, cl
mov dword [ebp - 0x24], ecx
jne 0x6406b8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], 1
jmp 0x64070a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x2c], 0x5ec3f0
jmp 0x640e02
mov edx, eax
movzx edx, byte [esi + 1]
lea ecx, [esi + eax]
mov dword [ebp - 0x50], 2
lea eax, [edx + ebx*2]
mov edx, 2
mov dword [ebp - 0x4c], eax
cmp dword [ebp + 0xc], edx
je 0x6406fe
nop dword [eax + eax]
mov eax, dword [ebp + 8]
movzx esi, byte [eax + edx]
mov eax, dword [ebp - 0x4c]
inc edx
lea eax, [esi + eax*2]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x50]
add eax, eax
mov dword [ebp - 0x50], eax
cmp dword [ebp + 0xc], edx
jne 0x6406e0
cmp dword [ebp + 0xc], 2
mov esi, dword [ebp + 8]
jae 0x640716
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x5ec400
jmp 0x640e02
movzx eax, byte [esi + 1]
mov byte [ebp - 0x26], 0
mov byte [ebp - 0x25], 1
mov dword [ebp - 0x2c], ecx
movzx edx, byte [eax + str.743210_._g]
cmp dl, byte [ebx + str.743210_._g]
jae 0x640761
mov cl, 1
mov byte [ebp - 0x26], 1
mov byte [ebp - 0x25], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x54], edi
cmp edx, 3
jae 0x64077a
mov eax, dword [ebp - 0x30]
jmp 0x6408c5
mov cl, 1
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], ecx
mov ecx, eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x54], edi
cmp edx, 3
jb 0x640759
movzx eax, byte [esi + 2]
mov ebx, dword [ebp - 0x24]
movzx edx, byte [eax + str.743210_._g]
movzx esi, bl
cmp dl, byte [esi + str.743210_._g]
jae 0x6407af
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 0x26], 2
mov byte [ebp - 0x1d], bl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x25], cl
mov dword [ebp - 0x38], ecx
mov cl, 2
mov dword [ebp - 0x30], ecx
mov ecx, ebx
jmp 0x6407cd
cmp al, bl
mov byte [ebp - 0x1d], cl
je 0x6407cd
movzx esi, cl
cmp dl, byte [esi + str.743210_._g]
jae 0x6407cd
mov cl, 2
mov byte [ebp - 0x25], 2
mov byte [ebp - 0x1d], al
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
cmp edx, 3
jne 0x6407e7
mov eax, dword [ebp - 0x38]
mov bh, al
mov eax, dword [ebp - 0x30]
mov bl, al
jmp 0x6408bd
lea eax, [edx - 4]
mov edx, dword [ebp - 0x24]
mov ecx, 0xfb
mov edi, 3
cmp eax, 0xfb
cmovb ecx, eax
mov eax, dword [ebp - 0x30]
mov byte [ebp - 0x3c], al
mov eax, dword [ebp - 0x38]
mov byte [ebp - 0x48], al
neg ecx
mov dword [ebp - 0x34], ecx
jmp 0x640851
movzx eax, byte [ebp - 0x3c]
mov dword [ebp - 0x24], edi
mov edi, esi
mov esi, edx
mov edx, ecx
mov byte [ebp - 0x3c], cl
mov dword [ebp - 0x30], edx
mov edx, eax
mov byte [ebp - 0x48], al
mov eax, esi
mov esi, edi
mov edi, dword [ebp - 0x24]
mov byte [ebp - 0x1d], al
mov dword [ebp - 0x38], edx
mov ecx, dword [ebp - 0x34]
mov edx, ebx
add ecx, edi
cmp ecx, 4
je 0x6408a1
movzx ebx, byte [esi + edi]
mov ecx, edi
movzx edi, dl
movzx eax, byte [ebx + str.743210_._g]
cmp al, byte [edi + str.743210_._g]
lea edi, [ecx + 1]
jb 0x640820
cmp bl, dl
mov dword [ebp - 0x24], ebx
jne 0x640880
mov ebx, edx
jmp 0x640845
movzx esi, byte [ebp - 0x1d]
cmp al, byte [esi + str.743210_._g]
jae 0x64089a
mov ebx, ecx
mov eax, dword [ebp - 0x24]
mov byte [ebp - 0x48], cl
mov byte [ebp - 0x1d], al
mov dword [ebp - 0x38], ebx
mov esi, dword [ebp + 8]
mov ebx, edx
jmp 0x640845
mov eax, dword [ebp - 0x38]
mov bh, byte [ebp - 0x48]
mov bl, byte [ebp - 0x3c]
mov edx, dword [ebp + 0xc]
mov byte [ebp - 0x25], al
mov eax, dword [ebp - 0x30]
mov cl, bh
mov dword [ebp - 0x38], ecx
mov byte [ebp - 0x26], al
mov eax, ebx
cmp bl, bh
je 0x640ef3
cmp byte [ebp - 0x44], 0
je 0x640b98
movzx ecx, al
mov dword [ebp - 0x30], eax
cmp ecx, edx
jae 0x640ec5
movzx eax, byte [esi + ecx]
movzx ebx, al
mov byte [ebp - 0x1d], al
movzx eax, byte [ebx + str.743210_._g]
mov byte [ebp - 0x3d], al
cmp al, 0xfa
mov eax, 0
ja 0x640926
movzx eax, byte [ebp - 0x38]
cmp eax, edx
jae 0x640edb
mov esi, eax
shl ebx, 0x10
shl esi, 8
or ebx, esi
mov esi, dword [ebp + 8]
movzx eax, byte [esi + eax]
shl eax, 0x18
or eax, ebx
or eax, ecx
mov dword [ebp - 0x48], eax
mov eax, 0x5ed210
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
cmp edx, 4
mov edi, 0
mov eax, esi
mov edx, 0
jb 0x640a10
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
movdqa xmm2, xmmword [0x7257d0]
movdqa xmm3, xmmword [0x7257e0]
pxor xmm0, xmm0
xorpd xmm4, xmm4
xorpd xmm1, xmm1
and ecx, 0xfffffffc
lea edi, [edx + 2]
lea eax, [edx + ecx]
mov esi, ecx
nop
movzx edx, word [edi - 2]
xorps xmm6, xmm6
movdqa xmm7, xmm3
movd xmm5, edx
movzx edx, word [edi]
add edi, 4
add esi, 0xfffffffc
pand xmm5, xmm2
punpcklbw xmm5, xmm0
punpcklwd xmm5, xmm0
movss xmm6, xmm5
psrlq xmm5, 0x20
psllq xmm7, xmm6
movdqa xmm6, xmm3
psllq xmm6, xmm5
movd xmm5, edx
pand xmm5, xmm2
movsd xmm6, xmm7
xorpd xmm7, xmm7
punpcklbw xmm5, xmm0
orpd xmm4, xmm6
movdqa xmm6, xmm3
punpcklwd xmm5, xmm0
movss xmm7, xmm5
psrlq xmm5, 0x20
psllq xmm6, xmm7
movdqa xmm7, xmm3
psllq xmm7, xmm5
movsd xmm7, xmm6
orpd xmm1, xmm7
jne 0x640970
orpd xmm1, xmm4
cmp ecx, dword [ebp + 0xc]
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
movd edi, xmm0
pshufd xmm0, xmm0, 0x55
movd edx, xmm0
je 0x640a45
nop word [eax + eax]
movzx ecx, byte [eax]
mov dword [ebp - 0x3c], edi
xor edi, edi
mov esi, 1
inc eax
shld edi, esi, cl
mov esi, ebx
mov ebx, 1
shl ebx, cl
test cl, 0x20
mov ecx, 0
cmovne edi, ebx
cmovne ebx, ecx
or edx, edi
mov edi, dword [ebp - 0x3c]
or edi, ebx
mov ebx, esi
cmp eax, esi
jne 0x640a10
mov dword [ebp - 0x44], edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], edi
mov edi, 1
mov esi, 1
xor ebx, ebx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 1
jmp 0x640a8b
lea ecx, [esi + 1]
mov dword [ebp - 0x2c], 1
xor ebx, ebx
mov dword [ebp - 0x24], esi
mov edx, dword [ebp + 0xc]
lea edi, [ecx + ebx]
mov esi, ecx
cmp edi, edx
jae 0x640ad4
mov eax, dword [ebp - 0x24]
lea ecx, [eax + ebx]
cmp ecx, edx
jae 0x640e64
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
movzx ecx, byte [edx + edi]
cmp cl, al
jb 0x640a70
inc ebx
cmp cl, al
jbe 0x640ac0
mov ecx, ebx
xor ebx, ebx
add ecx, esi
mov eax, ecx
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
jmp 0x640a7f
mov eax, dword [ebp - 0x2c]
mov ecx, 0
cmp ebx, eax
cmove ebx, ecx
cmove ecx, eax
add ecx, esi
jmp 0x640a7f
mov eax, 1
xor ecx, ecx
mov edi, 1
xor esi, esi
mov dword [ebp - 0x34], 1
jmp 0x640b0c
lea ecx, [edi + 1]
xor esi, esi
mov ebx, edi
mov dword [ebp - 0x34], 1
mov edx, dword [ebp + 0xc]
lea eax, [ecx + esi]
mov edi, ecx
mov ecx, ebx
cmp eax, edx
jae 0x640b54
mov ebx, ecx
add ecx, esi
cmp ecx, edx
jae 0x640e7d
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + ecx]
movzx eax, byte [edx + eax]
cmp al, cl
ja 0x640af0
inc esi
cmp al, cl
jae 0x640b40
mov ecx, esi
xor esi, esi
add ecx, edi
mov eax, ecx
sub eax, ebx
mov dword [ebp - 0x34], eax
jmp 0x640afe
mov eax, dword [ebp - 0x34]
mov ecx, 0
cmp esi, eax
cmove esi, ecx
cmove ecx, eax
add ecx, edi
jmp 0x640afe
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x10], 0
cmp eax, ecx
cmova ecx, eax
cmova esi, dword [ebp - 0x2c]
mov eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x34], eax
push eax
push esi
call fcn.005ebf10
add esp, 8
mov dword [ebp - 0x24], eax
cmp byte [ebp - 0x3d], 0xfb
mov esi, 0x5ec540
mov eax, 0x5ec9d0
cmovae eax, esi
mov dword [ebp - 0x2c], eax
jmp 0x640df9
cmp edx, 4
mov edi, 0
mov eax, 0
mov ebx, esi
jb 0x640c80
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
movdqa xmm2, xmmword [0x7257d0]
movdqa xmm3, xmmword [0x7257e0]
pxor xmm0, xmm0
xorpd xmm4, xmm4
xorpd xmm1, xmm1
and ecx, 0xfffffffc
lea edi, [edx + 2]
lea ebx, [edx + ecx]
mov esi, ecx
nop word [eax + eax]
movzx edx, word [edi - 2]
xorps xmm6, xmm6
movdqa xmm7, xmm3
movd xmm5, edx
movzx edx, word [edi]
add edi, 4
add esi, 0xfffffffc
pand xmm5, xmm2
punpcklbw xmm5, xmm0
punpcklwd xmm5, xmm0
movss xmm6, xmm5
psrlq xmm5, 0x20
psllq xmm7, xmm6
movdqa xmm6, xmm3
psllq xmm6, xmm5
movd xmm5, edx
pand xmm5, xmm2
movsd xmm6, xmm7
xorpd xmm7, xmm7
punpcklbw xmm5, xmm0
orpd xmm4, xmm6
movdqa xmm6, xmm3
punpcklwd xmm5, xmm0
movss xmm7, xmm5
psrlq xmm5, 0x20
psllq xmm6, xmm7
movdqa xmm7, xmm3
psllq xmm7, xmm5
movsd xmm7, xmm6
orpd xmm1, xmm7
jne 0x640be0
orpd xmm1, xmm4
cmp ecx, dword [ebp + 0xc]
pshufd xmm0, xmm1, 0xee
por xmm0, xmm1
movd edi, xmm0
pshufd xmm0, xmm0, 0x55
movd eax, xmm0
je 0x640cb2
nop word [eax + eax]
movzx ecx, byte [ebx]
xor esi, esi
mov edx, 1
inc ebx
shld esi, edx, cl
mov edx, edi
mov edi, 1
shl edi, cl
test cl, 0x20
mov ecx, 0
cmovne esi, edi
cmovne edi, ecx
mov ecx, dword [ebp - 0x2c]
or edx, edi
or eax, esi
mov edi, edx
cmp ebx, ecx
jne 0x640c80
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], edi
mov ebx, 1
mov edi, 1
xor esi, esi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 1
jmp 0x640cfb
lea ecx, [edi + 1]
mov dword [ebp - 0x2c], 1
xor esi, esi
mov dword [ebp - 0x24], edi
mov edx, dword [ebp + 0xc]
lea ebx, [ecx + esi]
mov edi, ecx
cmp ebx, edx
jae 0x640d44
mov eax, dword [ebp - 0x24]
lea ecx, [eax + esi]
cmp ecx, edx
jae 0x640e96
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
movzx ecx, byte [edx + ebx]
cmp cl, al
jb 0x640ce0
inc esi
cmp cl, al
jbe 0x640d30
mov ecx, esi
xor esi, esi
add ecx, edi
mov eax, ecx
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
jmp 0x640cef
mov eax, dword [ebp - 0x2c]
mov ecx, 0
cmp esi, eax
cmove esi, ecx
cmove ecx, eax
add ecx, edi
jmp 0x640cef
mov eax, 1
xor ecx, ecx
mov edi, 1
xor esi, esi
mov dword [ebp - 0x34], 1
jmp 0x640d7c
lea ecx, [edi + 1]
xor esi, esi
mov ebx, edi
mov dword [ebp - 0x34], 1
mov edx, dword [ebp + 0xc]
lea eax, [ecx + esi]
mov edi, ecx
mov ecx, ebx
cmp eax, edx
jae 0x640dc4
mov ebx, ecx
add ecx, esi
cmp ecx, edx
jae 0x640eac
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + ecx]
movzx eax, byte [edx + eax]
cmp al, cl
ja 0x640d60
inc esi
cmp al, cl
jae 0x640db0
mov ecx, esi
xor esi, esi
add ecx, edi
mov eax, ecx
sub eax, ebx
mov dword [ebp - 0x34], eax
jmp 0x640d6e
mov eax, dword [ebp - 0x34]
mov ecx, 0
cmp esi, eax
cmove esi, ecx
cmove ecx, eax
add ecx, edi
jmp 0x640d6e
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x10], 0
cmp eax, ecx
cmova ecx, eax
cmova esi, dword [ebp - 0x2c]
mov eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x34], eax
push eax
push esi
call fcn.005ebf10
add esp, 8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x5ec540
mov edi, dword [ebp - 0x54]
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x58]
movsd xmm0, qword [ebp - 0x60]
movzx ecx, byte [ebp - 0x24]
mov dword [edi + 0x40], esi
movsd qword [edi + 0x38], xmm0
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [edi + 8], ebx
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x2c]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x38]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x48]
mov dword [edi + 0x1c], eax
movzx eax, byte [ebp - 0x1d]
mov byte [edi + 0x20], al
mov eax, dword [ebp - 0x30]
mov byte [edi + 0x21], al
mov dword [edi + 0x28], ecx
mov ecx, dword [ebp - 0x50]
mov dword [edi + 0x2c], ecx
mov ecx, dword [ebp - 0x18]
mov dword [edi + 0x30], edx
mov dword fs:[0], ecx
add esp, 0x6c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
push 0x8b835c
call fcn.00709fa0
add esp, 4
jmp 0x640f13
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
push 0x8b835c
call fcn.00709fa0
add esp, 4
jmp 0x640f13
mov dword [ebp - 0x10], 0
push 0x8b835c
call fcn.00709fa0
add esp, 4
jmp 0x640f13
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0
push 0x8b835c
call fcn.00709fa0
add esp, 4
jmp 0x640f13
mov dword [ebp - 0x10], 0
push 0x8c1284
call fcn.00709fa0
add esp, 4
jmp 0x640f13
mov dword [ebp - 0x10], 0
mov ecx, eax
push 0x8c1204
call fcn.00709fa0
add esp, 4
jmp 0x640f13
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x26]
lea edx, [ebp - 0x25]
push eax
call fcn.00720110
add esp, 4
ud2