Function at 0x6a4520
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x7313eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
fld dword [esp + 0xb8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xc0]
push edi
push 0x60
fmul dword [esi + 0x30]
fstp dword [esp + 0x14]
fld dword [esp + 0xcc]
fmul dword [esi + 0x34]
fstp dword [esp + 0x18]
fld dword [esp + 0xcc]
fmul dword [esi + 0x38]
fstp dword [esp + 0x1c]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
fld dword [esp + 0x1c]
fmul dword [esi + 0x2c]
lea edi, [esi + 0x24]
sub esp, 8
lea ecx, [esp + 0x38]
mov dword [esp + 0x28], eax
fstp dword [esp + 8]
fld dword [esp + 0x24]
fmul dword [edi + 4]
fstp dword [esp + 4]
fld dword [esp + 0x24]
fmul dword [edi]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x14]
fmul dword [esi + 0x20]
lea ebx, [esi + 0x18]
sub esp, 0xc
lea ecx, [esp + 0x50]
fstp dword [esp + 8]
fld dword [esp + 0x20]
fmul dword [ebx + 4]
fstp dword [esp + 4]
fld dword [esp + 0x20]
fmul dword [ebx]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x10]
fmul dword [esi + 0x14]
lea ebp, [esi + 0xc]
sub esp, 0xc
lea ecx, [esp + 0x68]
fstp dword [esp + 8]
fld dword [esp + 0x1c]
fmul dword [ebp + 4]
fstp dword [esp + 4]
fld dword [esp + 0x1c]
fmul dword [ebp]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x64]
fadd dword [esi + 8]
sub esp, 0xc
lea ecx, [esp + 0x5c]
fstp dword [esp + 8]
fld dword [esp + 0x6c]
fadd dword [esi + 4]
fstp dword [esp + 4]
fld dword [esp + 0x68]
fadd dword [esi]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x58]
fsub dword [esp + 0x4c]
sub esp, 0xc
lea ecx, [esp + 0x44]
fstp dword [esp + 8]
fld dword [esp + 0x60]
fsub dword [esp + 0x54]
fstp dword [esp + 4]
fld dword [esp + 0x5c]
fsub dword [esp + 0x50]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x40]
fsub dword [esp + 0x34]
sub esp, 0xc
lea ecx, [esp + 0x2c]
fstp dword [esp + 8]
fld dword [esp + 0x48]
fsub dword [esp + 0x3c]
fstp dword [esp + 4]
fld dword [esp + 0x44]
fsub dword [esp + 0x38]
fstp dword [esp]
call fcn.004057e0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub esp, 0xc
fld dword [esp + 0x24]
mov dword [eax], ecx
mov ecx, dword [esp + 0x34]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
fmul dword [edi + 8]
lea ecx, [esp + 0x5c]
fstp dword [esp + 8]
fld dword [esp + 0x24]
fmul dword [edi + 4]
fstp dword [esp + 4]
fld dword [esp + 0x24]
fmul dword [edi]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x14]
fmul dword [ebx + 8]
sub esp, 0xc
lea ecx, [esp + 0x38]
fstp dword [esp + 8]
fld dword [esp + 0x20]
fmul dword [ebx + 4]
fstp dword [esp + 4]
fld dword [esp + 0x20]
fmul dword [ebx]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x10]
fmul dword [ebp + 8]
sub esp, 0xc
lea ecx, [esp + 0x2c]
fstp dword [esp + 8]
fld dword [esp + 0x1c]
fmul dword [ebp + 4]
fstp dword [esp + 4]
fld dword [esp + 0x1c]
fmul dword [ebp]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x28]
fadd dword [esi + 8]
sub esp, 0xc
lea ecx, [esp + 0x44]
fstp dword [esp + 8]
fld dword [esp + 0x30]
fadd dword [esi + 4]
fstp dword [esp + 4]
fld dword [esp + 0x2c]
fadd dword [esi]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x34]
fadd dword [esp + 0x40]
sub esp, 0xc
lea ecx, [esp + 0x50]
fstp dword [esp + 8]
fld dword [esp + 0x3c]
fadd dword [esp + 0x48]
fstp dword [esp + 4]
fld dword [esp + 0x38]
fadd dword [esp + 0x44]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x4c]
fsub dword [esp + 0x58]
sub esp, 0xc
fstp dword [esp + 8]
fld dword [esp + 0x54]
fsub dword [esp + 0x60]
lea ecx, [esp + 0x68]
fstp dword [esp + 4]
fld dword [esp + 0x50]
fsub dword [esp + 0x5c]
fstp dword [esp]
call fcn.004057e0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
sub esp, 0xc
fld dword [esp + 0x24]
mov dword [eax + 0xc], edx
mov edx, dword [esp + 0x70]
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
fmul dword [edi + 8]
lea ecx, [esp + 0x5c]
fstp dword [esp + 8]
fld dword [esp + 0x24]
fmul dword [edi + 4]
fstp dword [esp + 4]
fld dword [esp + 0x24]
fmul dword [edi]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x14]
fmul dword [ebx + 8]
sub esp, 0xc
lea ecx, [esp + 0x38]
fstp dword [esp + 8]
fld dword [esp + 0x20]
fmul dword [ebx + 4]
fstp dword [esp + 4]
fld dword [esp + 0x20]
fmul dword [ebx]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x10]
fmul dword [ebp + 8]
sub esp, 0xc
lea ecx, [esp + 0x2c]
fstp dword [esp + 8]
fld dword [esp + 0x1c]
fmul dword [ebp + 4]
fstp dword [esp + 4]
fld dword [esp + 0x1c]
fmul dword [ebp]
fstp dword [esp]
call fcn.004057e0
fld dword [esi + 8]
fsub dword [esp + 0x28]
sub esp, 0xc
lea ecx, [esp + 0x44]
fstp dword [esp + 8]
fld dword [esi + 4]
fsub dword [esp + 0x30]
fstp dword [esp + 4]
fld dword [esi]
fsub dword [esp + 0x2c]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x34]
fadd dword [esp + 0x40]
sub esp, 0xc
lea ecx, [esp + 0x50]
fstp dword [esp + 8]
fld dword [esp + 0x3c]
fadd dword [esp + 0x48]
fstp dword [esp + 4]
fld dword [esp + 0x38]
fadd dword [esp + 0x44]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x4c]
fsub dword [esp + 0x58]
sub esp, 0xc
fstp dword [esp + 8]
fld dword [esp + 0x54]
fsub dword [esp + 0x60]
lea ecx, [esp + 0x68]
fstp dword [esp + 4]
fld dword [esp + 0x50]
fsub dword [esp + 0x5c]
fstp dword [esp]
call fcn.004057e0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
sub esp, 0xc
fld dword [esp + 0x24]
mov dword [eax + 0x18], ecx
mov ecx, dword [esp + 0x70]
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], ecx
fmul dword [edi + 8]
lea ecx, [esp + 0x5c]
fstp dword [esp + 8]
fld dword [esp + 0x24]
fmul dword [edi + 4]
fstp dword [esp + 4]
fld dword [esp + 0x24]
fmul dword [edi]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x14]
fmul dword [ebx + 8]
sub esp, 0xc
lea ecx, [esp + 0x44]
fstp dword [esp + 8]
fld dword [esp + 0x20]
fmul dword [ebx + 4]
fstp dword [esp + 4]
fld dword [esp + 0x20]
fmul dword [ebx]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x10]
fmul dword [ebp + 8]
sub esp, 0xc
lea ecx, [esp + 0x2c]
fstp dword [esp + 8]
fld dword [esp + 0x1c]
fmul dword [ebp + 4]
fstp dword [esp + 4]
fld dword [esp + 0x1c]
fmul dword [ebp]
fstp dword [esp]
call fcn.004057e0
fld dword [esi + 8]
fsub dword [esp + 0x28]
sub esp, 0xc
lea ecx, [esp + 0x38]
fstp dword [esp + 8]
fld dword [esi + 4]
fsub dword [esp + 0x30]
fstp dword [esp + 4]
fld dword [esi]
fsub dword [esp + 0x2c]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x34]
fsub dword [esp + 0x40]
sub esp, 0xc
lea ecx, [esp + 0x50]
fstp dword [esp + 8]
fld dword [esp + 0x3c]
fsub dword [esp + 0x48]
fstp dword [esp + 4]
fld dword [esp + 0x38]
fsub dword [esp + 0x44]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x4c]
fsub dword [esp + 0x58]
sub esp, 0xc
fstp dword [esp + 8]
fld dword [esp + 0x54]
fsub dword [esp + 0x60]
fstp dword [esp + 4]
fld dword [esp + 0x50]
fsub dword [esp + 0x5c]
lea ecx, [esp + 0x68]
fstp dword [esp]
call fcn.004057e0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
sub esp, 0xc
fld dword [esp + 0x24]
mov dword [eax + 0x24], edx
mov edx, dword [esp + 0x70]
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], edx
fmul dword [edi + 8]
lea ecx, [esp + 0x50]
fstp dword [esp + 8]
fld dword [esp + 0x24]
fmul dword [edi + 4]
fstp dword [esp + 4]
fld dword [esp + 0x24]
fmul dword [edi]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x14]
fmul dword [ebx + 8]
sub esp, 0xc
lea ecx, [esp + 0x44]
fstp dword [esp + 8]
fld dword [esp + 0x20]
fmul dword [ebx + 4]
fstp dword [esp + 4]
fld dword [esp + 0x20]
fmul dword [ebx]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x10]
fmul dword [ebp + 8]
sub esp, 0xc
lea ecx, [esp + 0x2c]
fstp dword [esp + 8]
fld dword [esp + 0x1c]
fmul dword [ebp + 4]
fstp dword [esp + 4]
fld dword [esp + 0x1c]
fmul dword [ebp]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x28]
fadd dword [esi + 8]
sub esp, 0xc
lea ecx, [esp + 0x38]
fstp dword [esp + 8]
fld dword [esp + 0x30]
fadd dword [esi + 4]
fstp dword [esp + 4]
fld dword [esp + 0x2c]
fadd dword [esi]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x34]
fsub dword [esp + 0x40]
sub esp, 0xc
lea ecx, [esp + 0x5c]
fstp dword [esp + 8]
fld dword [esp + 0x3c]
fsub dword [esp + 0x48]
fstp dword [esp + 4]
fld dword [esp + 0x38]
fsub dword [esp + 0x44]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x4c]
fadd dword [esp + 0x58]
sub esp, 0xc
fstp dword [esp + 8]
fld dword [esp + 0x54]
fadd dword [esp + 0x60]
fstp dword [esp + 4]
fld dword [esp + 0x50]
fadd dword [esp + 0x5c]
fstp dword [esp]
lea ecx, [esp + 0x68]
call fcn.004057e0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x60]
sub esp, 0xc
fld dword [esp + 0x24]
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 0x70]
mov dword [eax + 0x34], edx
mov dword [eax + 0x38], ecx
fmul dword [edi + 8]
lea ecx, [esp + 0x38]
fstp dword [esp + 8]
fld dword [esp + 0x24]
fmul dword [edi + 4]
fstp dword [esp + 4]
fld dword [esp + 0x24]
fmul dword [edi]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x14]
fmul dword [ebx + 8]
sub esp, 0xc
lea ecx, [esp + 0x44]
fstp dword [esp + 8]
fld dword [esp + 0x20]
fmul dword [ebx + 4]
fstp dword [esp + 4]
fld dword [esp + 0x20]
fmul dword [ebx]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x10]
fmul dword [ebp + 8]
sub esp, 0xc
lea ecx, [esp + 0x2c]
fstp dword [esp + 8]
fld dword [esp + 0x1c]
fmul dword [ebp + 4]
fstp dword [esp + 4]
fld dword [esp + 0x1c]
fmul dword [ebp]
fstp dword [esp]
call fcn.004057e0
fld dword [esp + 0x28]
fadd dword [esi + 8]
sub esp, 0xc
lea ecx, [esp + 0x50]
fstp dword [esp + 8]
fld dword [esp + 0x30]
fadd dword [esi + 4]
fstp dword [esp + 4]
fld dword [esp + 0x2c]
fadd dword [esi]
fstp dword [esp]
call fcn.004057e0
lea edx, [esp + 0x2c]
lea eax, [esp + 0x50]
push edx
lea ecx, [esp + 0x3c]
push eax
lea edx, [esp + 0x64]
push ecx
push edx
lea ecx, [esp + 0x54]
call fcn.00438820
mov ecx, eax
call fcn.00438820
push eax
mov eax, dword [esp + 0x20]
lea ecx, [eax + 0x3c]
call fcn.0040a7e0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push edx
mov ecx, edi
call fcn.004521a0
push eax
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x30]
push eax
lea edx, [esp + 0x40]
push ecx
push edx
mov ecx, ebx
call fcn.004521a0
mov ecx, dword [esp + 0x18]
push eax
lea eax, [esp + 0x50]
lea edx, [esp + 0x5c]
push eax
push ecx
push edx
mov ecx, ebp
call fcn.004521a0
push eax
lea eax, [esp + 0x70]
push eax
mov ecx, esi
call fcn.00438850
mov ecx, eax
call fcn.00438820
mov ecx, eax
call fcn.00438820
mov ecx, dword [esp + 0x1c]
push eax
add ecx, 0x48
call fcn.0040a7e0
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x6c]
push edx
push eax
mov ecx, edi
call fcn.004521a0
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x84]
push eax
push ecx
lea eax, [esp + 0xa4]
push edx
push eax
mov ecx, ebx
call fcn.004521a0
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x80]
push eax
push ecx
lea eax, [esp + 0xa0]
push edx
push eax
mov ecx, ebp
call fcn.004521a0
lea ecx, [esp + 0xb8]
push eax
push ecx
mov ecx, esi
call fcn.00438850
mov ecx, eax
call fcn.00438850
mov ecx, eax
call fcn.00438820
mov edx, dword [esp + 0x1c]
push eax
lea ecx, [edx + 0x54]
call fcn.0040a7e0
push 0x48
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov edx, 1
xor edi, edi
mov ebp, 5
mov word [esi], 3
mov word [esi + 2], 2
mov word [esi + 4], dx
mov word [esi + 6], 3
mov word [esi + 8], dx
mov word [esi + 0xa], di
mov word [esi + 0xc], di
mov word [esi + 0xe], dx
mov ebx, 4
mov ecx, 6
mov eax, 7
push 0xac
mov word [esi + 0x10], bp
mov word [esi + 0x12], di
mov word [esi + 0x14], bp
mov word [esi + 0x16], bx
mov word [esi + 0x18], bx
mov word [esi + 0x1a], bp
mov word [esi + 0x1c], cx
mov word [esi + 0x1e], bx
mov word [esi + 0x20], cx
mov word [esi + 0x22], ax
mov word [esi + 0x24], ax
mov word [esi + 0x26], cx
mov word [esi + 0x28], 2
mov word [esi + 0x2a], ax
mov word [esi + 0x2c], 2
mov word [esi + 0x2e], 3
mov word [esi + 0x30], dx
mov word [esi + 0x32], 2
mov word [esi + 0x34], cx
mov word [esi + 0x36], dx
mov word [esi + 0x38], cx
mov word [esi + 0x3a], bp
mov word [esi + 0x3c], di
mov word [esi + 0x3e], bx
mov word [esi + 0x40], ax
mov word [esi + 0x42], di
mov word [esi + 0x44], ax
mov word [esi + 0x46], 3
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 8
mov dword [esp + 0x68], eax
cmp eax, edi
mov dword [esp + 0xbc], edi
je 0x6a4de8
mov ecx, dword [esp + 0x1c]
push edi
push esi
push 0xc
push edi
push edi
push edi
push ecx
push 8
mov ecx, eax
call fcn.006e4dd0
jmp 0x6a4dea
xor eax, eax
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xb0
ret