Function at 0x665df0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x96f5d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.00911f0c
xor edi, edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], edi
call fcn.00911f0c
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.00911f0c
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call fcn.00911f0c
mov esi, dword [ebp + 0xc]
mov byte [ebx + 0x8da], 1
mov ax, word [0xa8e768]
mov byte [esp + 0x30], 3
mov word [ebx + 0x51a0], ax
mov word [ebx + 0x51a2], si
mov eax, dword [0xa8e768]
cmp eax, 0x23
je 0x665ebb
cmp eax, 0x51
je 0x665ebb
cmp eax, 0x41
je 0x665ebb
cmp eax, 0x42
je 0x665ebb
cmp eax, 0x43
je 0x665ebb
cmp eax, 0x44
je 0x665ebb
cmp eax, 0x4d
je 0x665ebb
cmp eax, 0x55
je 0x665ebb
cmp eax, 0x57
je 0x665ebb
cmp eax, 0x5a
je 0x665ebb
cmp eax, 0x5b
je 0x665ebb
cmp eax, 0x67
je 0x665ebb
cmp eax, 0x97
je 0x665ebb
mov word [ebx + 0x51a4], di
jmp 0x665ec6
mov cx, word [ebp + 0x10]
mov word [ebx + 0x51a4], cx
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x51a8], edx
mov dword [ebx + 0x51ac], eax
movsx ecx, word [ebx + 0x51a2]
mov dword [ebx + 0x25a18], ecx
mov ecx, ebx
movsx edx, word [ebx + 0x51a4]
mov dword [ebx + 0x25a1c], edx
call fcn.00651390
mov ecx, dword [ebx + 0x51ac]
mov edx, dword [ebx + 0x51a8]
mov al, byte [ebp + 0x24]
push ecx
push edx
mov ecx, ebx
mov byte [ebx + 0x51f8], al
call fcn.006515d0
mov edi, eax
test edi, edi
jle 0x66634c
push edi
mov ecx, ebx
call fcn.00650dc0
mov eax, dword [ebx + 0xb08]
mov ecx, ebx
push eax
call fcn.00650b90
mov ecx, dword [ebx + 0xb08]
push ecx
mov ecx, ebx
call fcn.00650e10
push edi
mov ecx, ebx
call fcn.006516f0
mov dx, word [0xa8e768]
mov ax, word [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov word [ebx + 0x51a0], dx
mov edx, dword [ebp + 0x18]
mov word [ebx + 0x51a2], si
mov word [ebx + 0x51a4], ax
mov dword [ebx + 0x51a8], ecx
mov dword [ebx + 0x51ac], edx
lea edx, [ebx + 0x51b0]
mov ecx, 0xf
xor eax, eax
mov edi, edx
lea esi, [ebx + 0x51ed]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
lea ecx, [ebx + 0x24564]
mov dword [esi], eax
push 0x3c
push ecx
push edx
mov dword [esi + 4], eax
mov word [esi + 8], ax
mov byte [esi + 0xa], al
nop
call fcn.00b182e6
lea edi, [ebx + 0x245c9]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [ebx + 0x51ed]
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [0xa8e798]
test cl, cl
jne 0x666010
push eax
nop
call fcn.00b182ef
mov dword [esp + 0x20], eax
add esp, 4
fild dword [esp + 0x1c]
fst qword [ebx + 0x4e28]
fcomp qword [0x9cb960]
fnstsw ax
test ah, 1
je 0x666024
mov dword [ebx + 0x4e28], 0
mov dword [ebx + 0x4e2c], 0x3ff00000
mov eax, dword [ebx + 0x25560]
mov ecx, dword [ebx + 0x25564]
mov edx, dword [ebx + 0x25568]
mov dword [ebx + 0x5220], eax
mov eax, dword [ebx + 0x2556c]
mov dword [ebx + 0x5224], ecx
mov ecx, dword [ebx + 0x25570]
mov dword [ebx + 0x5228], edx
mov edx, dword [ebx + 0x25574]
mov dword [ebx + 0x522c], eax
mov ax, word [ebx + 0x24542]
mov dword [ebx + 0x5230], ecx
mov ecx, dword [ebx + 0x2455c]
mov dword [ebx + 0x5234], edx
mov edx, dword [ebx + 0x25578]
mov word [ebx + 0x51a2], ax
mov eax, dword [ebx + 0x2557c]
mov dword [ebx + 0x5240], edx
fld qword [ebx + 0x25558]
mov edx, dword [ebx + 0x25584]
mov dword [ebx + 0x5244], eax
mov eax, dword [ebx + 0x25588]
mov dword [ebx + 0x5200], ecx
mov ecx, dword [ebx + 0x25580]
mov dword [ebx + 0x5270], eax
mov ax, word [ebx + 0x245de]
mov dword [ebx + 0x5248], ecx
mov ecx, dword [ebx + 0x2558c]
cmp ax, 2
fst qword [esp + 0x1c]
fstp qword [ebx + 0x5218]
mov dword [ebx + 0x524c], edx
mov dword [ebx + 0x5274], ecx
jne 0x6660f6
mov word [ebx + 0x51a6], 9
jmp 0x666152
cmp ax, 4
jne 0x666107
mov word [ebx + 0x51a6], 0xa
jmp 0x666152
cmp ax, 5
jne 0x666118
mov word [ebx + 0x51a6], 0xb
jmp 0x666152
cmp ax, 6
jne 0x666129
mov word [ebx + 0x51a6], 0xc
jmp 0x666152
cmp ax, 7
jne 0x66613a
mov word [ebx + 0x51a6], 0xd
jmp 0x666152
cmp ax, 8
jne 0x666149
mov word [ebx + 0x51a6], ax
jmp 0x666152
mov word [ebx + 0x51a6], 0
mov edx, dword [ebx + 0x254b0]
mov eax, dword [ebx + 0x254b4]
mov ecx, dword [ebx + 0x254b8]
mov dword [ebx + 0x5250], edx
mov edx, dword [ebx + 0x254bc]
mov dword [ebx + 0x5254], eax
mov eax, dword [ebx + 0x254c0]
mov dword [ebx + 0x5258], ecx
mov ecx, dword [ebx + 0x254c4]
mov dword [ebx + 0x525c], edx
mov edx, dword [ebx + 0x254c8]
mov dword [ebx + 0x5260], eax
mov eax, dword [ebx + 0x254cc]
mov dword [ebx + 0x5264], ecx
mov ecx, dword [esp + 0x20]
mov dword [ebx + 0x5268], edx
mov edx, dword [esp + 0x1c]
push 2
push ecx
push edx
mov ecx, ebx
mov dword [ebx + 0x526c], eax
call fcn.00614330
mov eax, dword [ebx + 0x5224]
mov ecx, dword [ebx + 0x5220]
fstp qword [ebx + 0x5218]
push 2
push eax
push ecx
mov ecx, ebx
call fcn.00614330
mov edx, dword [ebx + 0x522c]
mov eax, dword [ebx + 0x5228]
fstp qword [ebx + 0x5220]
push 2
push edx
push eax
mov ecx, ebx
call fcn.00614330
mov ecx, dword [ebx + 0x5234]
mov edx, dword [ebx + 0x5230]
fstp qword [ebx + 0x5228]
push 2
push ecx
push edx
mov ecx, ebx
call fcn.00614330
mov eax, dword [ebx + 0x5244]
mov ecx, dword [ebx + 0x5240]
fstp qword [ebx + 0x5230]
push 2
push eax
push ecx
mov ecx, ebx
call fcn.00614330
mov edx, dword [ebx + 0x5254]
mov eax, dword [ebx + 0x5250]
fstp qword [ebx + 0x5240]
push 2
push edx
push eax
mov ecx, ebx
call fcn.00614330
mov ecx, dword [ebx + 0x525c]
mov edx, dword [ebx + 0x5258]
fstp qword [ebx + 0x5250]
push 2
push ecx
push edx
mov ecx, ebx
call fcn.00614330
mov eax, dword [ebx + 0x5264]
mov ecx, dword [ebx + 0x5260]
fstp qword [ebx + 0x5258]
push 2
push eax
push ecx
mov ecx, ebx
call fcn.00614330
fstp qword [ebx + 0x5260]
push 2
mov edx, dword [ebx + 0x526c]
mov eax, dword [ebx + 0x5268]
push edx
push eax
mov ecx, ebx
call fcn.00614330
mov ecx, dword [ebx + 0x524c]
mov edx, dword [ebx + 0x5248]
fstp qword [ebx + 0x5268]
push 2
push ecx
push edx
mov ecx, ebx
call fcn.00614330
mov eax, dword [ebx + 0x5274]
mov ecx, dword [ebx + 0x5270]
fstp qword [ebx + 0x5248]
push 2
push eax
push ecx
mov ecx, ebx
call fcn.00614330
mov edx, dword [ebx + 0xbb4]
mov ecx, ebx
fstp qword [ebx + 0x5270]
push edx
call fcn.0061fc20
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call fcn.00911ee2
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.00911ee2
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.00911ee2
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00911ee2
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov ax, word [0xa8e768]
mov cx, word [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov word [ebx + 0x51a0], ax
mov eax, dword [ebp + 0x18]
mov word [ebx + 0x51a2], si
mov word [ebx + 0x51a4], cx
mov dword [ebx + 0x51a8], edx
mov dword [ebx + 0x51ac], eax
mov ecx, 0xf
xor eax, eax
lea edi, [ebx + 0x51b0]
mov byte [ebx + 0x51f8], 0
lea edx, [ebx + 0x51ed]
rep stosd dword es:[edi], eax
xor ecx, ecx
stosb byte es:[edi], al
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov word [edx + 8], cx
mov byte [edx + 0xa], cl
mov eax, dword [ebx + 0xbb4]
mov word [ebx + 0x51a6], cx
push eax
mov ecx, ebx
call fcn.0061fc20
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 2
call fcn.00911ee2
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.00911ee2
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.00911ee2
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.00911ee2
mov ecx, dword [esp + 0x28]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x20