Function at 0x536050
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x595992
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x5eb3c0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
xor edi, edi
xor esi, esi
mov ecx, 0x5f7780
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x3c], edi
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x70], edi
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esp + 0x24], eax
mov byte [esp + 0x70], 1
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x70], 2
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x70], 3
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esp + 0x38], eax
mov byte [esp + 0x70], 4
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x70], 5
mov eax, dword [0x5f7780]
mov edx, dword [eax + 0xc]
mov ecx, 0x5f7780
call edx
add eax, 0x10
mov dword [esp + 0x2c], eax
mov ecx, dword [ebp + 8]
push 0x5aead8
lea eax, [esp + 0x44]
push eax
push ecx
lea ebx, [esp + 0x48]
mov byte [esp + 0x7c], 6
call fcn.00440fd0
lea edi, [esp + 0x14]
mov byte [esp + 0x70], 7
call fcn.00480f90
mov byte [esp + 0x70], 6
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x536192
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx - 0xc]
test ecx, ecx
je 0x5365fa
test esi, esi
jne 0x536236
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x24]
add eax, 0xfffffff0
add edi, 0xfffffff0
cmp eax, edi
je 0x536203
cmp dword [edi + 0xc], esi
lea ebx, [edi + 0xc]
jl 0x5361f3
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x5361f3
call fcn.00481090
mov esi, eax
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x5361e6
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
add esi, 0x10
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x28]
jmp 0x536203
mov edx, dword [esp + 0x14]
push edx
mov ebx, ecx
lea eax, [esp + 0x28]
call fcn.00480ff0
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
cmp eax, 1
jne 0x536220
mov dword [esp + 0x34], SysStringLen
jmp 0x5362cb
cmp eax, 2
jne 0x5365fa
mov dword [esp + 0x34], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x5362cb
cmp esi, 1
jne 0x536298
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
add eax, 0xfffffff0
add edi, 0xfffffff0
cmp eax, edi
je 0x5362cb
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x536286
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x536286
call fcn.00481090
mov esi, eax
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x536279
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
add esi, 0x10
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x28]
jmp 0x5362cb
mov edx, dword [esp + 0x14]
push edx
mov ebx, ecx
lea eax, [esp + 0x1c]
call fcn.00480ff0
jmp 0x5362cb
cmp esi, 2
jne 0x5362a3
lea edi, [esp + 0x20]
jmp 0x5362c2
cmp esi, 3
jne 0x5362ae
lea edi, [esp + 0x2c]
jmp 0x5362c2
cmp esi, 4
jne 0x5362b9
lea edi, [esp + 0x38]
jmp 0x5362c2
cmp esi, 5
jne 0x5362cb
lea edi, [esp + 0x30]
lea eax, [esp + 0x14]
call fcn.00480f90
mov ecx, dword [ebp + 8]
push 0x5aead8
lea eax, [esp + 0x44]
push eax
add esi, 1
push ecx
lea ebx, [esp + 0x48]
mov dword [esp + 0x34], esi
call fcn.00440fd0
mov byte [esp + 0x70], 8
mov ecx, dword [eax]
mov edi, dword [esp + 0x14]
lea eax, [ecx - 0x10]
add edi, 0xfffffff0
cmp eax, edi
je 0x536344
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x536337
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x536337
call fcn.00481090
mov esi, eax
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x53632a
mov ecx, dword [edi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push edi
call eax
add esi, 0x10
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x28]
jmp 0x536344
mov ebx, dword [ecx - 0xc]
push ecx
lea eax, [esp + 0x18]
call fcn.00480ff0
mov byte [esp + 0x70], 6
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x536369
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx - 0xc]
test ecx, ecx
jne 0x5361a1
cmp esi, 6
jne 0x5365fa
mov edx, dword [esp + 0x30]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrToIntW]
push edx
call ebx
mov eax, dword [esp + 0x38]
push eax
call ebx
mov edx, dword [0x5f7780]
mov edi, eax
mov eax, dword [edx + 0xc]
mov ecx, 0x5f7780
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
cmp edi, 1
mov byte [esp + 0x70], 9
jne 0x536506
mov eax, dword [esp + 0x34]
cmp eax, 0x80000001
jne 0x536474
lea esi, [esp + 0x18]
lea edi, [esp + 0x44]
call fcn.004ba8d0
lea ecx, [esp + 0x3c]
push ecx
mov ecx, 0x5adcfc
mov byte [esp + 0x74], 0xa
call fcn.00481430
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
push ecx
mov edx, edi
mov bl, 0xb
push edx
mov byte [esp + 0x80], bl
call fcn.0047e040
lea edi, [esp + 0x28]
mov byte [esp + 0x70], 0xc
call fcn.00480f90
mov byte [esp + 0x70], bl
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x53643e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x70], 0xa
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x536463
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x44]
push ecx
mov byte [esp + 0x74], 9
call fcn.004ba9d0
jmp 0x5364ed
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x5364ed
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.0047e0d0
lea ecx, [esp + 0x3c]
push ecx
mov ecx, 0x5adcfc
mov byte [esp + 0x74], 0xd
call fcn.00481430
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x50]
push edx
mov byte [esp + 0x80], 0xe
call fcn.0047e040
lea edi, [esp + 0x28]
mov byte [esp + 0x70], 0xf
call fcn.00480f90
lea ecx, [esp + 0x40]
call fcn.004818c0
lea ecx, [esp + 0x3c]
call fcn.004818c0
lea esi, [esp + 0x44]
mov byte [esp + 0x70], 9
call fcn.00480400
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
call fcn.005645c3
add esp, 8
test eax, eax
jmp 0x5365cb
cmp edi, 2
jne case.default.0x5365aa
mov edx, dword [esp + 0x2c]
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0x34]
xor edi, edi
cmp eax, 0x80000001
mov dword [esp + 0x40], esi
jne 0x536567
lea esi, [esp + 0x18]
lea edi, [esp + 0x44]
call fcn.004ba8d0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea esi, [esp + 0x58]
mov dword [esp + 0x44], 0
call fcn.00479280
mov edi, eax
neg edi
lea edx, [esp + 0x44]
sbb edi, edi
and edi, dword [esp + 0x3c]
push edx
call fcn.004ba9d0
jmp 0x536597
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x53659b
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.0047e0d0
xor edi, edi
lea ecx, [esp + 0x20]
lea edx, [esp + 0x44]
call fcn.004baa60
lea esi, [esp + 0x44]
mov edi, eax
call fcn.00480400
mov esi, dword [esp + 0x40]
mov edx, dword [esp + 0x30]
push edx
call ebx
add eax, 0xffffffff
cmp eax, 4
ja case.default.0x5365aa
jmp dword [eax*4 + 0x53671c]
cmp esi, edi
jb case.default.0x5365aa
jmp 0x5365cd
cmp esi, edi
ja case.default.0x5365aa
jmp 0x5365cd
cmp esi, edi
jbe case.default.0x5365aa
jmp 0x5365cd
cmp esi, edi
jae case.default.0x5365aa
jmp 0x5365cd
cmp esi, edi
jne case.default.0x5365aa
mov dword [esp + 0x1c], 1
mov byte [esp + 0x70], 6
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5365fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x70], 5
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x53661f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x70], 4
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x536644
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x70], 3
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x536669
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x70], 2
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x53668e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x70], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5366b3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x70], 0
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5366d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x70], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x536700
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4