Function at 0xb4662c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x50927d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c0
mov eax, dword [0x58e2fc]
xor eax, esp
mov dword [esp + 0x1bc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58e2fc]
xor eax, esp
push eax
lea eax, [esp + 0x1d4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1f8]
mov ebp, dword [esp + 0x20c]
mov esi, ecx
mov dword [esp + 0x28], eax
mov edi, dword [esi + 4]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xc
mov ebx, 0xf
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], 0
push 0x527550
mov dword [esp + 0x200], 4
mov byte [ecx + 4], 0
call fcn.00af9a2c
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x27], al
call fcn.00b50d1c
cmp byte [esp + 0x200], 0
mov byte [esp + 0x1dc], 5
je 0xb46dfa
cmp byte [esp + 0x27], 0
jne 0xb46dfa
mov edi, dword [esi + 4]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 3
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], 0
push 0x52754c
mov byte [ecx + 4], 0
call fcn.00af9a2c
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
test al, al
je 0xb46ab0
mov edi, dword [esi + 4]
push 0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x52754c
call fcn.00af9bfc
mov edx, dword [edi]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0x1d8]
push eax
mov ecx, edi
call edx
cmp dword [eax + 0x14], 0
setne bl
cmp dword [esp + 0x1cc], 0x10
jb 0xb4676b
mov eax, dword [esp + 0x1b8]
push eax
call fcn.00bd897e
add esp, 4
test bl, bl
je 0xb46b72
mov edi, dword [esi + 4]
push 0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x52754c
call fcn.00af9bfc
mov edx, dword [edi]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0x1d8]
push eax
mov ecx, edi
call edx
push 0x2304
mov byte [esp + 0x1e0], 6
call fcn.00bd8cde
mov ebx, eax
add esp, 4
mov dword [esp + 0x14], ebx
mov byte [esp + 0x1dc], 7
test ebx, ebx
je 0xb467fa
mov edi, dword [esi + 4]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x527174
call fcn.00af9bfc
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov ecx, ebx
push eax
push 0
lea eax, [esp + 0x1bc]
push eax
call fcn.00b21d7c
mov edi, eax
jmp 0xb467fc
xor edi, edi
mov byte [esp + 0x1dc], 6
mov dword [esp + 0x18], edi
test edi, edi
je 0xb46814
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
mov eax, dword [edi + 0x4c]
mov ecx, 4
mov byte [esp + 0x1dc], 8
cmp eax, ecx
ja 0xb46a3d
jmp dword [eax*4 + 0x44eec8]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c]
push ecx
push ebp
mov dword [esp + 0x24], 0x410aa0
call fcn.00b08eac
push 0x522468
push ebp
call fcn.00b0733c
add esp, 0x10
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00b07a0c
mov ecx, esi
call fcn.00afed8c
push 0x522444
lea ecx, [esp + 0x80]
call fcn.00af9bfc
lea edx, [esp + 0x7c]
push edx
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1e0], 0xd
call fcn.00afa96c
push 0x55deec
lea eax, [esp + 0xe0]
push eax
call fcn.00bd8d43
mov dword [esp + 0x1cc], ebx
mov dword [esp + 0x1c8], 0
mov byte [esp + 0x1b8], 0
lea ecx, [esp + 0x1b4]
mov byte [esp + 0x1dc], 0xe
call fcn.00b3d9cc
push 0x2304
call fcn.00bd8cde
mov edi, eax
add esp, 4
mov dword [esp + 0x14], edi
mov byte [esp + 0x1dc], bl
test edi, edi
je 0xb46b31
mov ebx, dword [esi + 4]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x527174
call fcn.00af9bfc
mov edx, dword [ebx]
mov eax, dword [edx + 0xc]
mov ecx, ebx
call eax
lea ecx, [esp + 0x1b4]
push eax
push 0
push ecx
mov ecx, edi
call fcn.00b21d7c
mov edi, eax
jmp 0xb46b33
xor edi, edi
mov byte [esp + 0x1dc], 0xe
test edi, edi
je 0xb46b50
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
cmp dword [esp + 0x1cc], 0x10
mov byte [esp + 0x1dc], 5
jb 0xb46b72
mov ecx, dword [esp + 0x1b8]
push ecx
call fcn.00bd897e
add esp, 4
mov edi, dword [esi + 4]
push 0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x527544
call fcn.00af9bfc
mov edx, dword [edi]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0x1d8]
push eax
mov ecx, edi
call edx
cmp dword [eax + 0x14], 0
setne bl
cmp dword [esp + 0x1cc], 0x10
jb 0xb46bbe
mov eax, dword [esp + 0x1b8]
push eax
call fcn.00bd897e
add esp, 4
test bl, bl
je 0xb46f27
mov edi, dword [esi + 4]
push 0
push 0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x527544
call fcn.00af9bfc
mov edx, dword [edi]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0x1d8]
push eax
mov ecx, edi
call edx
push 0x2304
mov byte [esp + 0x1e0], 0x10
call fcn.00bd8cde
mov ebx, eax
add esp, 4
mov dword [esp + 0x14], ebx
mov byte [esp + 0x1dc], 0x11
test ebx, ebx
je 0xb46c4d
mov edi, dword [esi + 4]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0x527174
call fcn.00af9bfc
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
mov ecx, edi
call edx
mov ecx, ebx
push eax
push 1
lea eax, [esp + 0x1bc]
push eax
call fcn.00b21d7c
mov edi, eax
jmp 0xb46c4f
xor edi, edi
mov byte [esp + 0x1dc], 0x10
mov dword [esp + 0x18], edi
test edi, edi
je 0xb46c67
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
mov eax, dword [edi + 0x4c]
sub eax, 0
mov byte [esp + 0x1dc], 0x12
je 0xb46dc2
sub eax, 1
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], 0x410aa0
mov dword [esp + 0x24], 4
push ebp
je 0xb46d5e
sub eax, 2
je 0xb46d00
call fcn.00b08eac
push 0x527520
push ebp
call fcn.00b0733c
add esp, 0x10
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00b07a0c
mov ecx, esi
call fcn.00afed8c
push 0x527520
lea ecx, [esp + 0x80]
call fcn.00af9bfc
lea edx, [esp + 0x7c]
push edx
lea ecx, [esp + 0xe0]
mov byte [esp + 0x1e0], 0x15
call fcn.00afa96c
push 0x55deec
lea eax, [esp + 0xe0]
push eax
call fcn.00bd8d43
call fcn.00b08eac
push 0x5274f8
push ebp
call fcn.00b0733c
add esp, 0x10
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00b07a0c
mov ecx, esi
call fcn.00afed8c
push 0x5274f8
lea ecx, [esp + 0x64]
call fcn.00af9bfc
lea edx, [esp + 0x60]
push edx
lea ecx, [esp + 0x108]
mov byte [esp + 0x1e0], 0x14
call fcn.00afa96c
push 0x55deec
lea eax, [esp + 0x108]
push eax
call fcn.00bd8d43
call fcn.00b08eac
push 0x5274f8
push ebp
call fcn.00b0733c
add esp, 0x10
mov esi, eax
push 0xa
mov ecx, esi
call fcn.00b07a0c
mov ecx, esi
call fcn.00afed8c
push 0x5274f8
lea ecx, [esp + 0x9c]
call fcn.00af9bfc
lea edx, [esp + 0x98]
push edx
lea ecx, [esp + 0xb8]
mov byte [esp + 0x1e0], 0x13
call fcn.00afa96c
push 0x55deec
lea eax, [esp + 0xb8]
push eax
call fcn.00bd8d43
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x30]
call fcn.00b3e79c
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
mov byte [esp + 0x1dc], 0x10
call eax
lea ecx, [esp + 0x1b4]
mov byte [esp + 0x1dc], 5
call fcn.00af991c
jmp 0xb46f27
push 0x5274dc
call fcn.00bd9206
add esp, 4
mov dword [esp + 0x1cc], ebx
mov dword [esp + 0x1c8], 0
mov byte [esp + 0x1b8], 0
lea ecx, [esp + 0x1b4]
mov byte [esp + 0x1dc], 0x16
call fcn.00b3d9cc
push 0x2304
call fcn.00bd8cde
add esp, 4
mov dword [esp + 0x18], eax
mov byte [esp + 0x1dc], 0x17
test eax, eax
je 0xb46e99
mov edi, dword [esi + 4]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xa
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], 0
push 0x527174
mov byte [ecx + 4], 0
call fcn.00af9a2c
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea ecx, [esp + 0x1b4]
push eax
push 2
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00b21d7c
mov ebx, eax
jmp 0xb46e9b
xor ebx, ebx
mov byte [esp + 0x1dc], 0x16
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0xb46eb3
mov edx, dword [ebx]
mov eax, dword [edx]
mov ecx, ebx
call eax
mov eax, dword [esp + 0x40]
lea ecx, [eax + 4]
mov dword [esp + 0x14], ecx
mov ecx, dword [ecx]
lea edx, [esp + 0x18]
push edx
push ecx
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x1e8], 0x18
call fcn.00b5276c
push 1
lea ecx, [esp + 0x30]
mov edi, eax
call fcn.00b3e11c
mov edx, dword [esp + 0x14]
mov dword [edx], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
mov byte [esp + 0x1dc], 0x16
test ebx, ebx
je 0xb46f05
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
cmp dword [esp + 0x1cc], 0x10
mov byte [esp + 0x1dc], 5
jb 0xb46f27
mov eax, dword [esp + 0x1b8]
push eax
call fcn.00bd897e
add esp, 4
push 0x527498
push ebp
call fcn.00b0733c
add esp, 8
mov edi, eax
push 0xa
mov ecx, edi
call fcn.00b07a0c
mov ecx, edi
call fcn.00afed8c
push 0xa
mov ecx, ebp
call fcn.00b07a0c
mov ecx, ebp
call fcn.00afed8c
mov edi, dword [esp + 0x204]
push ebp
push edi
push ecx
mov ecx, dword [esp + 0x1f4]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x1f4]
mov dword [esp + 0x20], esp
test ecx, ecx
je 0xb46f81
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x1fc]
push 0
push ecx
push ecx
mov eax, esp
mov dword [eax], edx
mov ecx, dword [esp + 0x208]
mov byte [esp + 0x1f4], 0x1a
mov dword [esp + 0x40], esp
test ecx, ecx
je 0xb46fb1
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
push ecx
mov ecx, dword [esp + 0x208]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x208]
mov byte [esp + 0x1f8], 0x1b
mov dword [esp + 0x34], esp
test ecx, ecx
je 0xb46fda
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
push ecx
mov ecx, dword [esp + 0x204]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x204]
mov byte [esp + 0x1fc], 0x1c
mov dword [esp + 0x3c], esp
test ecx, ecx
je 0xb47003
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
mov eax, dword [esi]
mov edx, dword [eax + 8]
lea ecx, [esp + 0x68]
add eax, 8
push ecx
mov ecx, esi
mov byte [esp + 0x200], 5
call edx
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
xor esi, esi
mov byte [esp + 0x1dc], 0x1d
test edi, edi
jl 0xb4703f
mov edx, eax
sub edx, ecx
sar edx, 2
cmp edi, edx
jge 0xb4703f
mov esi, edi
sub eax, ecx
sar eax, 2
cmp esi, eax
jb 0xb47051
call fcn.00bd9428
mov ecx, dword [esp + 0x54]
mov edi, dword [ecx + esi*4]
mov dword [esp + 0x1c], edi
test edi, edi
je 0xb47064
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
mov eax, dword [esp + 0x40]
mov ebp, dword [eax]
mov ebx, dword [esp + 0x2c]
mov byte [esp + 0x1dc], 0x1e
lea ebx, [ebx]
mov esi, dword [esp + 0x40]
test ebx, ebx
je 0xb4708a
cmp ebx, dword [esp + 0x2c]
je 0xb4708f
call fcn.00bd9428
cmp ebp, esi
je 0xb471ff
test ebx, ebx
jne 0xb471f4
call fcn.00bd9428
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0xb470b0
call fcn.00bd9428
mov esi, dword [ebp + 8]
mov dword [esp + 0x28], esi
test esi, esi
je 0xb470c3
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
push ecx
mov ecx, dword [esp + 0x1f8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x1f8]
mov byte [esp + 0x1e0], 0x1f
mov dword [esp + 0x18], esp
test ecx, ecx
je 0xb470ec
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
push ecx
mov ecx, dword [esp + 0x1f8]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x1f8]
mov byte [esp + 0x1e4], 0x20
mov dword [esp + 0x20], esp
test ecx, ecx
je 0xb47115
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
mov ecx, esi
mov byte [esp + 0x1e4], 0x1f
call fcn.00b2151c
push 1
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
mov dword [eax], edi
test edi, edi
je 0xb4713b
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
push ecx
mov ecx, dword [esp + 0x1f0]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x1f0]
mov byte [esp + 0x1e8], 0x21
mov dword [esp + 0x24], esp
test ecx, ecx
je 0xb47164
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
mov ecx, esi
mov byte [esp + 0x1e8], 0x1f
call fcn.00b215ec
push 1
push ecx
mov eax, esp
mov dword [esp + 0x1c], esp
mov dword [eax], edi
test edi, edi
je 0xb4718a
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
push ecx
mov ecx, dword [esp + 0x1f0]
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x1f0]
mov byte [esp + 0x1e8], 0x22
mov dword [esp + 0x24], esp
test ecx, ecx
je 0xb471b3
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
mov ecx, esi
mov byte [esp + 0x1e8], 0x1f
call fcn.00b22c3c
mov byte [esp + 0x1dc], 0x1e
test esi, esi
je 0xb471d7
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
test ebx, ebx
jne 0xb471fb
call fcn.00bd9428
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0xb471ec
call fcn.00bd9428
mov ebp, dword [ebp]
jmp 0xb4707c
mov eax, dword [ebx]
jmp 0xb470a6
mov eax, dword [ebx]
jmp 0xb471e2
mov byte [esp + 0x1dc], 0x1d
test edi, edi
je 0xb47214
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x1dc], 0x23
call fcn.00b24f5c
mov ecx, dword [esp + 0x48]
push ecx
call fcn.00bd897e
add esp, 4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1dc], 0x24
call fcn.00b3dc0c
mov edx, dword [esp + 0x40]
push edx
call fcn.00bd897e
mov eax, dword [esp + 0x30]
push eax
mov dword [esp + 0x48], 0
call fcn.00bd897e
mov ecx, dword [esp + 0x1ec]
add esp, 8
mov byte [esp + 0x1dc], 3
test ecx, ecx
je 0xb4727c
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1e8]
mov byte [esp + 0x1dc], 2
test ecx, ecx
je 0xb47296
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1ec]
mov byte [esp + 0x1dc], 1
test ecx, ecx
je 0xb472b0
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1f0]
mov byte [esp + 0x1dc], 0
test ecx, ecx
je 0xb472ca
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1f4]
mov dword [esp + 0x1dc], 0xffffffff
test ecx, ecx
je 0xb472e7
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1d4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1bc]
xor ecx, esp
call fcn.00bd9175
add esp, 0x1cc
ret 0x2c