Function at 0x6d5ba0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x32d096a8
mov eax, dword fs:[0]
push eax
sub esp, 0x248
push ebx
push esi
push edi
mov eax, dword [0x32d0e008]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebx + 0x24], esi
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x18], edi
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], edi
mov ecx, dword [eax + 4]
mov dword [ebx + 0x28], ecx
xor edx, edx
cmp byte [esi + 0xc], dl
mov dword [ebx + 0x30], edi
sete dl
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x3c], edi
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x44], edi
lea esi, [ebx + 0x98]
inc edx
mov dword [ebx + 0x2c], edx
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0x48], ecx
mov edx, dword [eax + 0x24]
mov dword [ebx + 0x4c], edx
mov ecx, dword [eax]
mov dword [ebx + 0x54], ecx
mov edx, dword [eax + 0x20]
mov dword [ebx + 0x58], edx
mov dword [ebx + 0x60], edi
mov dword [ebx + 0x64], edi
mov byte [ebx + 0x68], 0
mov byte [ebx + 0x69], 0
call fcn.006dc850
lea eax, [ebx + 0xa48]
mov dword [ebx + 0x2ac], edi
mov dword [ebx + 0x2b0], edi
mov dword [ebx + 0x2b4], edi
mov dword [ebx + 0x2b8], edi
mov dword [ebx + 0x2bc], edi
mov dword [ebx + 0x2e0], edi
mov byte [ebx + 0x364], 0
mov dword [ebx + 0x368], edi
mov dword [ebx + 0xa44], edi
call fcn.006d6a20
mov dword [ebx + 0x22ac], edi
mov dword [ebx + 0x22b0], edi
mov dword [ebx + 0x22b4], edi
mov dword [ebx + 0x22b8], edi
mov dword [ebx + 0x22bc], edi
mov dword [ebx + 0x22c0], edi
mov dword [ebx + 0x2320], edi
mov dword [ebx + 0x2338], edi
mov byte [ebx + 0x233c], 0
mov byte [ebx + 0x233d], 0
mov dword [ebx + 0x2340], edi
mov dword [ebx + 0x2600], edi
mov dword [ebx + 0x2604], edi
mov dword [ebx + 0x2608], edi
mov dword [ebx + 0x260c], edi
mov dword [ebx + 0x2610], edi
mov dword [ebx + 0x2614], edi
mov dword [ebx + 0x2618], edi
mov dword [ebx + 0x261c], edi
mov dword [ebx + 0x2620], edi
mov dword [ebx + 0x2624], edi
mov dword [ebx + 0x2628], edi
mov dword [ebx + 0x262c], edi
mov dword [ebx + 0x2630], edi
mov dword [ebx + 0x2634], edi
mov dword [ebx + 0x2638], edi
mov byte [ebx + 0x263c], 0
mov dword [ebx + 0x2640], edi
mov dword [ebx + 0x2644], edi
mov dword [ebx + 0x2648], edi
mov dword [ebx + 0x264c], edi
lea esi, [ebx + 0x2654]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [ebx + 0x2b24], edi
mov dword [ebx + 0x2b28], edi
mov dword [ebx + 0x2b2c], edi
mov dword [ebx + 0x2b30], edi
mov dword [ebx + 0x2b34], edi
mov dword [ebx + 0x2fec], edi
mov dword [ebx + 0x2ff0], edi
mov dword [ebx + 0x2ff4], edi
mov dword [ebx + 0x2ff8], edi
push 0x32d23c28
mov dword [ebx + 0x2ffc], edi
call dword [0x32c010f4]
push 0x4c8
push edi
push esi
mov dword [ebx + 0x2650], eax
call 0x7d3636
add esp, 0xc
push 0x4c8
lea eax, [ebx + 0x2b1c]
push edi
push eax
call 0x7d3636
add esp, 0xc
push 0x7f0
lea eax, [ebx + 0x2fe4]
push edi
push eax
call 0x7d3636
mov dword [ebx + 0x2c0], edi
mov dword [ebx + 0x2c4], edi
mov dword [ebx + 0x2c8], edi
add esp, 0xc
mov dword [ebx + 0x2cc], edi
mov dword [ebx + 0x2d0], edi
push 0x80
mov dword [ebx + 0x2d4], edi
lea eax, [ebx + 0x2e4]
push edi
mov dword [ebx + 0x2d8], edi
push eax
mov dword [ebx + 0x2dc], edi
call 0x7d3636
add esp, 0xc
mov dword [ebx + 0x36c], edi
push 0xb4
mov dword [ebx + 0x370], edi
lea ecx, [ebx + 0x37c]
push edi
mov dword [ebx + 0x374], edi
push ecx
mov dword [ebx + 0x378], edi
call 0x7d3636
add esp, 0xc
push 0x58
lea edx, [ebx + 0x22c8]
push edi
push edx
call 0x7d3636
xor eax, eax
add esp, 0xc
mov word [ebx + 0x430], ax
push 0x600
mov byte [ebx + 0x432], al
lea eax, [ebx + 0x434]
push edi
push eax
call 0x7d3636
add esp, 0xc
push 0x290
xor eax, eax
push edi
lea ecx, [ebx + 0x2350]
mov word [ebx + 0xa34], ax
mov byte [ebx + 0xa36], al
push ecx
call 0x7d3636
mov dword [ebx + 0x25e0], edi
mov dword [ebx + 0x25e4], edi
mov dword [ebx + 0x25e8], edi
add esp, 0xc
mov dword [ebx + 0x25ec], edi
mov dword [ebx + 0x25f0], edi
push 0x34
mov dword [ebx + 0x25f4], edi
push edi
mov dword [ebx + 0x25f8], edi
push 0x32d18d10
mov dword [ebx + 0x25fc], edi
call 0x7d3636
add esp, 0xc
push 0x108
push edi
push 0x32d18c08
call 0x7d3636
add esp, 0xc
push 0x3c
push edi
push 0x32d18664
call 0x7d3636
mov dword [0x32d18be0], edi
mov dword [0x32d18be4], edi
mov dword [0x32d18be8], edi
mov dword [0x32d18bec], edi
mov dword [0x32d18bf0], edi
mov dword [0x32d18bf4], edi
mov dword [0x32d18bf8], edi
mov dword [0x32d18bfc], edi
mov dword [0x32d18c00], edi
mov dword [0x32d18c04], edi
lea eax, [ebx + 0x1414]
mov dword [ebx + 0xa3c], eax
mov eax, dword [ebp + 0xc]
lea edx, [ebx + 0xfac]
lea ecx, [ebx + 0x1a7c]
mov dword [ebx + 0xa40], ecx
mov dword [ebx + 0x34ac], 1
mov dword [ebx + 0x34b0], edi
mov dword [ebx + 0xa38], edx
mov edx, dword [eax + 0xc]
mov dword [ebx + 0x48], edx
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x4c], ecx
mov ecx, dword [ebx + 0x28]
add ecx, 0xfff5ffff
add esp, 0xc
cmp ecx, 6
ja 0x6d644b
movzx edx, byte [ecx + 0x32c0960c]
jmp dword [edx*4 + 0x32c09600]
mov edi, dword [eax + 0x1c]
mov eax, dword [ebp + 0xc]
mov ecx, 7
lea esi, [esp + 0x1d8]
mov dword [esp + 0x1d8], 0x32c0e7c0
mov dword [esp + 0x1dc], 0x32c0edd0
mov dword [esp + 0x1e0], 0x32c0ee10
mov dword [esp + 0x1e4], 0x32c0ee20
mov dword [esp + 0x1e8], 0x32c0ee50
mov dword [esp + 0x1ec], 0x32c0ed40
mov dword [esp + 0x1f0], 0x32c0eec0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x18]
push 0x18
mov dword [ebx + 0x50], ecx
mov dword [esp + 0x18], 0x8007000e
call 0x7d312e
xor edi, edi
add esp, 4
cmp eax, edi
je 0x6d64cf
mov dword [eax + 8], edi
jmp 0x6d64d1
xor eax, eax
mov dword [ebx + 0x2ac], eax
cmp eax, edi
je 0x6d69bb
push 0x18
call 0x7d312e
add esp, 4
cmp eax, edi
je 0x6d64f2
mov dword [eax + 8], edi
jmp 0x6d64f4
xor eax, eax
mov dword [ebx + 0x2b0], eax
cmp eax, edi
je 0x6d69bb
push 0x18
call 0x7d312e
add esp, 4
cmp eax, edi
je 0x6d6515
mov dword [eax + 8], edi
jmp 0x6d6517
xor eax, eax
mov dword [ebx + 0x2b4], eax
cmp eax, edi
je 0x6d69bb
push 0x1660
call 0x7d312e
mov esi, eax
add esp, 4
mov dword [esp + 0x1f4], esi
mov dword [esp + 0x260], edi
cmp esi, edi
je 0x6d654f
mov eax, ebx
call fcn.00705190
jmp 0x6d6551
xor eax, eax
mov dword [esp + 0x260], 0xffffffff
mov dword [ebx + 0x2b8], eax
cmp eax, edi
je 0x6d69bb
push 0x7d0
call 0x762fd0
mov dword [ebx + 0x22b0], eax
cmp eax, edi
je 0x6d69bb
lea edx, [esp + 0x1f8]
push edx
call dword [0x32c010c0]
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x20c]
mov esi, 1
test dword [eax + 0x28], esi
jne 0x6d65b4
cmp dword [0x32d23c38], edi
jne 0x6d65b4
cmp ecx, esi
je 0x6d65b4
xor eax, eax
jmp 0x6d65b6
mov eax, esi
mov byte [ebx + 0x2348], al
mov dword [ebx + 0x234c], 2
test al, al
je 0x6d65d4
mov dword [ebx + 0x234c], esi
mov eax, esi
jmp 0x6d65d6
mov eax, ecx
push 0x14
mov dword [ebx + 0x2344], eax
call 0x7d312e
add esp, 4
cmp eax, edi
je 0x6d65fa
mov dword [eax], edi
mov dword [eax + 0x10], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 4], edi
jmp 0x6d65fc
xor eax, eax
mov dword [ebx], eax
cmp eax, edi
je 0x6d69bb
mov ecx, dword [ebx + 0x234c]
push ecx
push eax
call 0x7632d0
test al, al
jne 0x6d6629
mov eax, dword [ebx]
cmp eax, edi
je 0x6d6622
call fcn.006d6a70
mov dword [ebx], edi
jmp 0x6d69bb
push edi
push esi
push esi
push edi
call dword [0x32c010c4]
mov dword [ebx + 0x2340], eax
cmp eax, edi
je 0x6d69bb
push 0x1c
call 0x7d312e
add esp, 4
cmp eax, edi
je 0x6d6659
mov edx, dword [ebx]
push edx
call fcn.006dc800
jmp 0x6d665b
xor eax, eax
mov dword [ebx + 0x22b4], eax
cmp eax, edi
je 0x6d69bb
push 0x1c
call 0x7d312e
add esp, 4
cmp eax, edi
je 0x6d6681
mov ecx, dword [ebx]
push ecx
call fcn.006dc800
jmp 0x6d6683
xor eax, eax
mov dword [ebx + 0x22b8], eax
cmp eax, edi
je 0x6d69bb
push 0x1864
lea eax, [ebx + 0xa48]
push edi
push eax
mov dword [ebx + 0x2334], 0xea60
mov dword [ebx + 0x2324], 0x30d40
mov dword [ebx + 0x2328], 0x200
mov dword [ebx + 0x232c], 0x18
mov dword [ebx + 0x2330], 0x14
call 0x7d3636
add esp, 0xc
push 0x38
lea edx, [esp + 0x220]
push edi
push edx
call 0x7d3636
mov eax, dword [ebx + 0x48]
mov edx, dword [ebx + 0x54]
mov eax, dword [eax + 0x38]
add esp, 0xc
lea ecx, [esp + 0x21c]
push ecx
push edx
call eax
cmp eax, edi
mov dword [esp + 0x14], eax
jl 0x6d69bb
mov ecx, dword [esp + 0x230]
lea edx, [esp + 0x1cc]
mov eax, ebx
mov dword [ebx + 0x20], ecx
mov dword [esp + 0x1cc], edi
mov dword [esp + 0x1d0], ebx
mov dword [esp + 0x1d4], edi
call fcn.006dc6f0
cmp eax, edi
mov dword [esp + 0x14], eax
jl 0x6d69bb
mov eax, dword [esp + 0x1d4]
push eax
mov dword [ebx + 0x2600], eax
call dword [0x32c010f4]
movzx edx, byte [ebx + 0x2348]
mov edi, dword [ebx + 0x2b8]
push edx
call fcn.007052c0
mov dword [esp + 0x14], eax
test eax, eax
jl 0x6d69bb
mov eax, dword [ebx + 0x2b8]
mov ecx, dword [eax + 0x998]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [eax]
mov dword [ebx + 0x1ee4], ecx
mov dword [esp + 0x14], 0
xor esi, esi
mov edi, dword [esp + 0x14]
xor edx, edx
mov eax, ebx
call fcn.006db8c0
inc esi
cmp esi, 0x10
jb 0x6d679c
mov eax, edi
inc eax
mov dword [esp + 0x14], eax
cmp eax, 3
jb 0x6d679a
cmp byte [ebx + 0x2348], 0
mov edx, dword [ebx + 0x2c]
mov dword [esp + 0x1c0], edx
je 0x6d67db
mov dword [esp + 0x1c4], 1
jmp 0x6d67e9
mov eax, dword [esp + 0x20c]
mov dword [esp + 0x1c4], eax
mov ecx, dword [ebx + 0x2650]
lea edx, [esp + 0x1c0]
push edx
mov dword [esp + 0x1cc], ecx
call 0x7638b0
movzx eax, byte [ebx + 0x2348]
push 0x400000
push eax
push 0x1f98
call 0x762e20
movzx ecx, byte [ebx + 0x2348]
push 0x100000
push ecx
push 0x648
mov dword [ebx + 0x2604], eax
call 0x762e20
movzx edx, byte [ebx + 0x2348]
push 0x33cc80
push edx
push 0x33cc8
mov dword [ebx + 0x2608], eax
call 0x762e20
mov dword [ebx + 0x260c], eax
movzx eax, byte [ebx + 0x2348]
push 0x400000
push eax
push 0x3600
call 0x762e20
movzx ecx, byte [ebx + 0x2348]
push 0x2800000
push ecx
push 0xfc8
mov dword [ebx + 0x2610], eax
call 0x762e20
movzx edx, byte [ebx + 0x2348]
push 0x10000
push edx
push 0x14c
mov dword [ebx + 0x2614], eax
call 0x762e20
mov dword [ebx + 0x2618], eax
movzx eax, byte [ebx + 0x2348]
push 0x100000
push eax
push 0x108
call 0x762e20
movzx ecx, byte [ebx + 0x2348]
push 0x5f40
push ecx
push 0x5f4
mov dword [ebx + 0x261c], eax
call 0x762e20
movzx edx, byte [ebx + 0x2348]
push 0x100000
push edx
push 0x5480
mov dword [ebx + 0x2620], eax
call 0x762e20
mov dword [ebx + 0x2624], eax
movzx eax, byte [ebx + 0x2348]
push 0x400000
push eax
push 0x17ee4
call 0x762e20
cmp dword [ebx + 0x2604], 0
mov dword [ebx + 0x2628], eax
je 0x6d69b3
cmp dword [ebx + 0x2608], 0
je 0x6d69b3
cmp dword [ebx + 0x260c], 0
je 0x6d69b3
cmp dword [ebx + 0x2610], 0
je 0x6d69b3
cmp dword [ebx + 0x2614], 0
je 0x6d69b3
cmp dword [ebx + 0x2618], 0
je 0x6d69b3
cmp dword [ebx + 0x2620], 0
je 0x6d69b3
cmp dword [ebx + 0x261c], 0
je 0x6d69b3
cmp dword [ebx + 0x2624], 0
je 0x6d69b3
test eax, eax
je 0x6d69b3
push 0x3e8
call 0x762fd0
mov dword [ebx + 0x2630], eax
test eax, eax
je 0x6d69b3
mov byte [ebx + 0x233d], 1
mov eax, ebx
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [esp + 0x14], 0x8007000e
cmp byte [ebx + 0x233d], 0
mov esi, dword [esp + 0x14]
je 0x6d69e3
cmp esi, 0x88760870
jne 0x6d69d7
mov byte [ebx + 0x233c], 1
mov ecx, dword [ebx + 0x4c]
mov edx, dword [ebx + 0x58]
mov eax, dword [ecx]
push esi
push edx
call eax
mov edi, ebx
call fcn.006d6aa0
push 0x32d09858
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], esi
call 0x7d3870
lea ecx, [ecx]
mov ah, 0x8b
sal byte [edx], 0xc
mov eax, es
xor cl, byte [ebx - 0x70]
sal byte [edx], 0
add dword [eax], eax
add dword [edx], eax
add byte [ecx], al
int3