Function at 0x51c360
Capabilities:
Access peb ldr_data
Check os version
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4caafe
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x503870]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
mov edi, dword [ebp + 8]
mov esi, edi
call fcn.005006e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [eax]
push eax
push 0x4e0c70
mov esi, ebx
call fcn.00515fa0
xor esi, esi
push esi
call 0x584da3
add esp, 0xc
add eax, 0x1e13380
lea ecx, [esp + 0x44]
adc edx, esi
push ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
mov byte [esp + 0x17], 0
call fcn.00532040
mov dword [esp + 0xb0], esi
push edi
call fcn.00500300
mov ecx, dword [eax + 0x10]
sub ecx, dword [eax + 0xc]
mov dword [esp + 0x40], eax
sar ecx, 2
cmp ecx, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], esi
jle 0x51c640
lea ecx, [ecx]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x40]
call fcn.00531b70
mov edi, dword [eax]
mov ebx, dword [edi + 4]
push 0x4dd6dc
mov dword [esp + 0x38], edi
call 0x55a5a0
mov ecx, eax
call 0x559f10
cmp eax, 3
jne 0x51c485
mov ebx, dword [edi + 4]
push 0x4dd728
call 0x55a5a0
mov ecx, eax
call 0x559f10
cmp eax, 6
jne 0x51c485
push edi
call fcn.004feea0
cmp eax, 1
je 0x51c485
mov edx, dword [esp + 0x14]
cmp byte [edx + 0xc1e], 0
jne 0x51c6e6
call fcn.004f96b0
mov ecx, eax
call fcn.00504e20
test al, al
je 0x51c6e6
mov ebx, dword [edi + 4]
push 0x4dd6dc
call 0x55a5a0
mov ecx, eax
call 0x559f10
cmp eax, 4
jne 0x51c5df
mov ebx, dword [edi + 4]
push 0x4dd728
call 0x55a5a0
mov ecx, eax
call 0x559f10
cmp eax, 5
jne 0x51c5df
mov edi, dword [edi + 4]
push 0x4dd6bc
mov ebx, edi
call 0x55a5a0
mov ecx, eax
call 0x559f10
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edi, [esp + 0x4c]
call fcn.005321a0
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x5c]
test edi, edi
je 0x51c4fe
cmp edi, dword [esp + 0x44]
je 0x51c503
call 0x5846f9
mov esi, dword [esp + 0x3c]
cmp esi, ebx
jne 0x51c553
mov esi, dword [esp + 0x34]
mov ebx, dword [esi + 4]
push 0x4dd6bc
call 0x55a5a0
mov ecx, eax
call 0x559f10
lea edx, [esp + 0x94]
mov dword [esp + 0x1c], eax
push edx
mov eax, esi
call fcn.004ff820
mov esi, dword [eax]
mov edi, dword [eax + 4]
lea eax, [esp + 0x1c]
push eax
lea ebx, [esp + 0x48]
call fcn.00532090
mov dword [eax], esi
mov dword [eax + 4], edi
jmp 0x51c62a
test edi, edi
jne 0x51c5db
call 0x5846f9
cmp esi, dword [edi + 0x18]
jne 0x51c56a
call 0x5846f9
mov ebx, dword [esi + 0x10]
mov edi, dword [esi + 0x14]
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x84]
push ecx
mov eax, esi
call fcn.004ff820
mov edx, dword [eax + 4]
cmp edx, edi
jl 0x51c62a
jg 0x51c59a
mov eax, dword [eax]
cmp eax, ebx
jbe 0x51c62a
mov ebx, dword [esi + 4]
push 0x4dd6bc
call 0x55a5a0
mov ecx, eax
call 0x559f10
lea ecx, [esp + 0x8c]
mov dword [esp + 0x1c], eax
push ecx
mov eax, esi
call fcn.004ff820
mov esi, dword [eax]
mov edi, dword [eax + 4]
lea edx, [esp + 0x1c]
push edx
lea ebx, [esp + 0x48]
call fcn.00532090
mov dword [eax], esi
mov dword [eax + 4], edi
jmp 0x51c62a
mov edi, dword [edi]
jmp 0x51c560
mov esi, edi
call fcn.004ff960
test al, al
je 0x51c62a
lea eax, [esp + 0x9c]
push eax
mov eax, edi
call fcn.004ff820
mov ecx, dword [eax + 4]
cmp ecx, dword [esp + 0x30]
jg 0x51c62a
jl 0x51c60c
mov edx, dword [eax]
cmp edx, dword [esp + 0x2c]
jae 0x51c62a
lea eax, [esp + 0x64]
push eax
mov eax, edi
call fcn.004ff820
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x18]
inc eax
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
jl 0x51c410
mov edi, dword [ebp + 8]
mov eax, dword [esp + 0x5c]
mov ebx, dword [esp + 0x44]
mov esi, dword [eax]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
lea ebx, [ebx]
test ebx, ebx
je 0x51c66a
cmp ebx, dword [esp + 0x1c]
je 0x51c66f
call 0x5846f9
cmp esi, dword [esp + 0x20]
je 0x51c76f
test ebx, ebx
jne 0x51c761
call 0x5846f9
xor eax, eax
cmp esi, dword [eax + 0x18]
jne 0x51c692
call 0x5846f9
mov edx, dword [esi + 0x14]
cmp edx, dword [esp + 0x30]
jg 0x51c6d0
jl 0x51c6a6
mov eax, dword [esi + 0x10]
cmp eax, dword [esp + 0x2c]
jae 0x51c6d0
test ebx, ebx
jne 0x51c768
call 0x5846f9
cmp esi, dword [ebx + 0x18]
jne 0x51c6bd
call 0x5846f9
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov byte [esp + 0x13], 1
lea esi, [esp + 0x24]
call fcn.00533dc0
mov esi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
jmp 0x51c660
mov esi, dword [ebp + 8]
call fcn.005006e0
cmp byte [eax + 0x1c], 0
je 0x51c721
mov dword [esp + 0xb0], 0xffffffff
lea eax, [esp + 0x44]
push eax
call fcn.0051cc60
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [esp + 0x18]
push edi
call fcn.0051be20
push esi
mov ecx, edi
call fcn.0051c360
mov dword [esp + 0xb0], 0xffffffff
lea ecx, [esp + 0x44]
push ecx
call fcn.0051cc60
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx]
jmp 0x51c688
mov ebx, dword [ebx]
jmp 0x51c6b3
mov esi, edi
call fcn.005006e0
cmp byte [esp + 0x13], 0
mov esi, eax
je 0x51c7c5
cmp dword [esi + 0x10], 0
jne 0x51c7b5
mov ebx, dword [esi + 4]
push 0x4dd690
call 0x55a5a0
mov ecx, eax
call 0x55a0b0
mov ebx, eax
call fcn.004f96b0
mov edi, eax
call fcn.004fa090
push eax
mov ecx, ebx
call fcn.004fc500
mov edi, dword [ebp + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x2c]
mov esi, dword [esi + 0x10]
push eax
push esi
call fcn.004fd3e0
jmp 0x51c806
cmp dword [esi + 0x10], 0
jne 0x51c7fb
mov ebx, dword [esi + 4]
push 0x4dd690
call 0x55a5a0
mov ecx, eax
call 0x55a0b0
mov ebx, eax
call fcn.004f96b0
mov edi, eax
call fcn.004fa090
push eax
mov ecx, ebx
call fcn.004fc500
mov edi, dword [ebp + 8]
mov dword [esi + 0x10], eax
mov esi, dword [esi + 0x10]
push 1
push esi
call fcn.004fd640
mov esi, edi
call fcn.005006e0
mov esi, eax
cmp dword [esi + 0x10], 0
jne 0x51c845
mov ebx, dword [esi + 4]
push 0x4dd690
call 0x55a5a0
mov ecx, eax
call 0x55a0b0
mov ebx, eax
call fcn.004f96b0
mov edi, eax
call fcn.004fa090
push eax
mov ecx, ebx
call fcn.004fc500
mov edi, dword [ebp + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x10]
push eax
call fcn.004fd520
mov edx, dword [esp + 0x14]
cmp eax, 2
mov ecx, esi
mov eax, 1
jne 0x51c86b
mov esi, dword [edx + 0xc10]
call fcn.004fe7b0
jmp 0x51c876
mov edx, dword [edx + 0xc10]
call fcn.004fe890
call fcn.004f96b0
mov ecx, eax
call fcn.00504e20
test al, al
jne 0x51c9bd
push edi
call fcn.005004d0
xor ebx, ebx
call fcn.00531c00
mov eax, dword [eax]
mov eax, dword [eax + 4]
push 0x4db928
mov ebx, eax
call 0x55a5a0
mov ecx, eax
call 0x559f10
test eax, eax
je 0x51c9bd
push edi
call fcn.005004d0
xor ebx, ebx
call fcn.00531c00
mov eax, dword [eax]
mov eax, dword [eax + 4]
push 0x4db928
mov ebx, eax
call 0x55a5a0
mov ecx, eax
call 0x559f10
cmp eax, 1
jle 0x51c8e7
inc eax
cdq
sub eax, edx
sar eax, 1
push eax
push 2
mov esi, edi
call fcn.005006e0
mov ecx, dword [esp + 0x1c]
push eax
push 1
call fcn.00523c80
push edi
call fcn.005004d0
xor ebx, ebx
call fcn.00531c00
mov esi, dword [eax]
mov ebx, dword [esi + 4]
push 0x4db928
call 0x55a5a0
mov ecx, eax
call 0x559f10
cmp eax, 1
jle 0x51c9a9
mov esi, dword [esi + 4]
push 0x4db928
mov ebx, esi
call 0x55a5a0
mov ecx, eax
call 0x559f10
cdq
sub eax, edx
sar eax, 1
je 0x51c9a9
push edi
call fcn.005004d0
xor ebx, ebx
call fcn.00531c00
mov eax, dword [eax]
mov ebx, dword [eax + 4]
push 0x4db928
mov dword [esp + 0x28], eax
xor esi, esi
call 0x55a5a0
mov ecx, eax
call 0x559f10
cmp eax, 1
jle 0x51c993
mov eax, dword [esp + 0x24]
mov ebx, dword [eax + 4]
push 0x4db928
call 0x55a5a0
mov ecx, eax
call 0x559f10
cdq
sub eax, edx
mov esi, eax
sar esi, 1
push esi
push 1
mov esi, edi
call fcn.005006e0
mov ecx, dword [esp + 0x1c]
push eax
push 1
call fcn.00523c80
push edi
call fcn.005004d0
xor ebx, ebx
call fcn.00531c00
mov ecx, dword [eax]
call fcn.00513390
call fcn.004f96b0
mov ecx, eax
call fcn.00504f20
test al, al
jne 0x51ca69
push edi
mov dword [esp + 0x1c], 0
call fcn.005004d0
mov ebx, 1
call fcn.00531c00
mov eax, dword [eax]
mov eax, dword [eax + 4]
push 0x4db928
mov ebx, eax
call 0x55a5a0
mov ecx, eax
call 0x559f10
test eax, eax
jle 0x51ca52
mov ebx, dword [esp + 0x18]
push 1
push ebx
mov esi, edi
call fcn.005006e0
mov ecx, dword [esp + 0x1c]
push eax
push 2
call fcn.00523c80
inc ebx
push edi
mov dword [esp + 0x1c], ebx
call fcn.005004d0
mov ebx, 1
call fcn.00531c00
mov eax, dword [eax]
mov eax, dword [eax + 4]
push 0x4db928
mov ebx, eax
call 0x55a5a0
mov ecx, eax
call 0x559f10
cmp dword [esp + 0x18], eax
jl 0x51ca05
push edi
call fcn.005004d0
mov ebx, 1
call fcn.00531c00
mov ecx, dword [eax]
call fcn.00513390
mov ecx, edi
call fcn.00500600
lea ecx, [esp + 0x6c]
push ecx
mov ecx, eax
mov dword [esp + 0x28], eax
call 0x55aa00
mov byte [esp + 0xb0], 1
mov ecx, dword [esp + 0x7c]
sub ecx, dword [esp + 0x78]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
xor esi, esi
add eax, edx
je 0x51cbc9
jmp 0x51cab0
mov eax, esi
lea edi, [esp + 0x6c]
call fcn.00531770
mov ebx, 0x10
cmp dword [eax + 0x18], ebx
jb 0x51caca
mov eax, dword [eax + 4]
jmp 0x51cacd
add eax, 4
push eax
call 0x58568d
mov dword [esp + 0x20], eax
add esp, 4
mov eax, esi
lea edi, [esp + 0x6c]
call fcn.00531770
cmp dword [eax + 0x18], ebx
jb 0x51caef
mov eax, dword [eax + 4]
jmp 0x51caf2
add eax, 4
mov ebx, dword [esp + 0x24]
push eax
call 0x55a5a0
mov ecx, eax
call 0x559f10
cmp eax, 3
jne 0x51cb41
mov ecx, dword [esp + 0x5c]
mov ebx, dword [esp + 0x44]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x68]
push eax
lea edi, [esp + 0x4c]
mov dword [esp + 0x44], ecx
call fcn.005321a0
mov edi, eax
mov eax, dword [edi]
test eax, eax
je 0x51cb33
cmp eax, ebx
je 0x51cb38
call 0x5846f9
mov ecx, dword [esp + 0x3c]
cmp dword [edi + 4], ecx
je 0x51cb67
mov ecx, dword [esp + 0x7c]
sub ecx, dword [esp + 0x78]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
cmp esi, eax
jb 0x51cab0
jmp 0x51cbc6
push 0
call 0x584da3
mov esi, dword [ebp + 8]
add esp, 4
sub eax, dword [0x504f40]
sbb edx, dword [0x504f44]
mov edi, eax
mov dword [esp + 0x68], edx
call fcn.005006e0
mov eax, dword [eax + 4]
push 0x4dd690
mov ebx, eax
call 0x55a5a0
mov ecx, eax
call 0x55a0b0
push edi
mov esi, eax
call fcn.004f96b0
mov edi, eax
call fcn.004f9bd0
push eax
mov ecx, esi
call fcn.004fb590
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x14]
push ecx
push edx
call fcn.00523fc0
mov edi, dword [ebp + 8]
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x2b8]
push 0x4df794
push 0x100
push 0x40b
push eax
call dword [fcn.004cd5fc]
call fcn.004f96b0
mov ecx, eax
call fcn.004f9490
test eax, eax
je 0x51cc00
push edi
push esi
call fcn.0052f1d0
mov byte [esp + 0xb0], 0
lea ecx, [esp + 0x6c]
push ecx
call fcn.004f7bd0
mov dword [esp + 0xb0], 3
lea esi, [esp + 0x44]
call fcn.00532a00
mov dword [esp + 0xb0], 0xffffffff
mov edx, dword [esp + 0x44]
push edx
call 0x5600be
add esp, 4
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4