Function at 0x5609b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x62126e
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x67dc50]
xor eax, esp
mov dword [esp + 0x94], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x67dc50]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xbc]
xor edi, edi
mov esi, ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x50], ebp
mov dword [esp + 0x18], edi
xor ebx, ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x4c], edi
call fcn.0051d230
lea ecx, [esp + 0x84]
mov dword [esp + 0xb4], ebx
call fcn.00517e90
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 1
mov dword [esp + 0x44], ebx
call fcn.005eb500
mov ecx, dword [esi + 0xc]
mov eax, dword [esi]
mov edx, dword [eax + 0x68]
push ecx
mov ecx, esi
mov byte [esp + 0xb8], 2
call edx
xor ecx, ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 4], ecx
mov eax, dword [ebp]
cmp eax, ecx
jle 0x5611f9
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
mov ecx, dword [eax + ecx*4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x5c]
call eax
add eax, 0xffffffef
cmp eax, 0x21
ja case.0x560a94.18
movzx ecx, byte [eax + 0x561278]
jmp dword [ecx*4 + 0x561264]
cmp dword [esp + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
mov ebp, dword [edx + eax*4]
mov dword [esp + 0x48], ebp
je 0x560acc
mov eax, dword [esi + 0xc]
test byte [eax + 2], 8
mov ecx, dword [ebp + 0x24]
je 0x560ac1
mov dword [eax + 4], ecx
jmp 0x560ac4
mov dword [eax + 0xc], ecx
mov dword [esp + 0x44], 0
mov ecx, esi
call fcn.0055f1e0
mov ebx, eax
push ebx
push ebp
mov ecx, esi
call fcn.0055be60
test eax, eax
je 0x561175
test ebx, ebx
jl 0x561175
jmp 0x5610f2
cmp dword [esp + 0x44], 0
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov edi, dword [ecx + edx*4]
je 0x560b20
mov eax, dword [esi + 0xc]
test byte [eax + 2], 8
mov ecx, dword [edi + 0x14]
je 0x560b15
mov dword [eax + 4], ecx
jmp 0x560b18
mov dword [eax + 0xc], ecx
mov dword [esp + 0x44], 0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x560b5a
cmp eax, 0x16
je 0x560b5a
cmp eax, 0x20
jne 0x560b9c
mov ecx, dword [esi + 0xc]
mov eax, ebx
shl eax, 4
test dword [eax + ecx], 0xffff
je 0x560b5a
mov edx, dword [esp + 0x4c]
add edx, 4
push edx
mov ecx, edi
call fcn.0051dca0
test eax, eax
jne 0x5610f2
mov ecx, esi
call fcn.0055f1e0
mov ebp, eax
push ebp
lea eax, [edi + 4]
push eax
mov ecx, esi
call fcn.0055bc90
test eax, eax
je 0x561175
mov ebx, ebp
test ebp, ebp
jl 0x561175
mov eax, dword [edi + 0x14]
shl ebp, 4
add ebp, dword [esi + 0xc]
test byte [ebp + 2], 8
je 0x560d62
mov dword [ebp + 4], eax
jmp 0x5610f2
cmp eax, 0x31
je 0x560baa
cmp eax, 0x32
jne 0x560ce6
cmp dword [esp + 0x1c], 0
je 0x560ce6
push edi
lea ecx, [esp + 0x70]
call fcn.005275e0
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push eax
mov ecx, ebp
mov dword [esp + 0x58], 0
call fcn.005c5da0
cmp dword [esp + 0x6c], 0
jne 0x560be5
cmp dword [esp + 0x70], 0
je 0x560c23
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x40]
push edx
lea ecx, [esp + 0x74]
call fcn.005277e0
test eax, eax
jne 0x560c23
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
call fcn.00560260
mov ebx, eax
test ebx, ebx
jl 0x561175
mov eax, dword [edi + 0x14]
mov ecx, ebx
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.0040add0
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.00521130
add esp, 8
test eax, eax
jne 0x560c41
lea eax, [edi + 4]
push eax
jmp 0x560d24
mov edx, dword [edi + 0xc]
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [edi + 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x1c], esp
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov edx, dword [esp + 0x50]
mov dword [eax + 4], edx
mov ecx, dword [ebp + 4]
mov dword [esp + 0x24], esp
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [esp + 0x2c], esp
mov dword [eax + 4], ecx
call fcn.0055f130
add esp, 0x18
test eax, eax
je 0x560c94
lea eax, [edi + 4]
push eax
jmp 0x560d24
mov edx, dword [ebp + 8]
mov ebp, dword [ebp + 4]
mov ecx, dword [edi + 0xc]
mov eax, dword [edi + 0x10]
sub ecx, dword [edi + 4]
sub eax, dword [edi + 8]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x3c]
sub edx, ebp
mov ebp, dword [esp + 0x40]
sub ebp, dword [esp + 0x14]
test ecx, ecx
jle 0x560cc2
test edx, edx
jl 0x560ce0
test ecx, ecx
jge 0x560cc8
test edx, edx
jg 0x560ce0
test eax, eax
jle 0x560cd2
test ebp, ebp
jl 0x560ce0
test eax, eax
jge 0x5610f2
test ebp, ebp
jle 0x5610f2
lea eax, [edi + 4]
push eax
jmp 0x560d24
cmp eax, 0x11
jne 0x5610f2
mov eax, dword [esp + 0x48]
mov eax, dword [eax + 0x28]
cmp eax, dword [edi + 0x14]
je 0x5610f2
mov ecx, dword [esp + 0x48]
lea ebp, [edi + 4]
add ecx, 0xc
push ebp
push ecx
call fcn.00521130
add esp, 8
test eax, eax
je 0x560d23
mov eax, dword [esp + 0x48]
mov edx, dword [eax + 0x24]
cmp edx, dword [eax + 0x28]
je 0x560d4b
push ebp
mov ecx, esi
call fcn.00560260
mov ebx, eax
test ebx, ebx
jl 0x561175
mov eax, dword [edi + 0x14]
mov ecx, ebx
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.0040add0
jmp 0x5610f2
mov eax, dword [edi + 0x14]
lea ecx, [ebx + 2]
shl ecx, 4
add ecx, dword [esi + 0xc]
push eax
call fcn.0040add0
jmp 0x5610f2
mov dword [ebp + 0xc], eax
jmp 0x5610f2
cmp dword [esp + 0x14], 0x16
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov eax, dword [ecx + edx*4]
mov dword [esp + 0x1c], eax
jne 0x560eca
test edi, edi
je 0x560eca
push edi
lea ecx, [esp + 0x60]
call fcn.005275e0
mov ebp, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
mov dword [esp + 0x5c], 0
call fcn.005c5da0
cmp dword [esp + 0x5c], 0
jne 0x560dbb
cmp dword [esp + 0x60], 0
je 0x560df6
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x64]
call fcn.005277e0
test eax, eax
jne 0x560df6
lea ecx, [edi + 0xc]
push ecx
mov ecx, esi
call fcn.00560260
test eax, eax
jl 0x561175
mov ecx, dword [edi + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.0040add0
lea ebx, [edi + 0xc]
lea edx, [esp + 0x34]
push ebx
push edx
call fcn.00521130
add esp, 8
test eax, eax
jne 0x560e15
lea eax, [esp + 0x34]
push eax
jmp 0x560eaa
mov ecx, dword [ebp + 4]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x1c], esp
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], ecx
mov edx, dword [edi + 4]
mov dword [esp + 0x24], esp
sub esp, 8
mov eax, esp
mov dword [eax], edx
mov ecx, dword [edi + 8]
mov dword [esp + 0x2c], esp
mov dword [eax + 4], ecx
call fcn.0055f130
add esp, 0x18
test eax, eax
je 0x560e66
lea eax, [esp + 0x34]
push eax
jmp 0x560eaa
mov eax, dword [ebx + 4]
mov edx, dword [edi + 8]
mov ecx, dword [ebx]
mov ebx, dword [esp + 0x1c]
sub ecx, dword [edi + 4]
mov ebp, dword [ebx + 4]
sub ebp, dword [esp + 0x34]
sub eax, edx
mov edx, dword [ebx + 8]
sub edx, dword [esp + 0x38]
test ecx, ecx
jle 0x560e8f
test ebp, ebp
jl 0x560ea5
test ecx, ecx
jge 0x560e95
test ebp, ebp
jg 0x560ea5
test eax, eax
jle 0x560e9f
test edx, edx
jl 0x560ea5
test eax, eax
jge 0x560eca
test edx, edx
jle 0x560eca
lea ecx, [esp + 0x34]
push ecx
mov ecx, esi
call fcn.00560260
test eax, eax
jl 0x561175
mov ecx, dword [edi + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.0040add0
cmp dword [esp + 0x18], 0
mov ebx, dword [esp + 0x1c]
jne 0x560f3a
lea edx, [esp + 0x84]
push edx
mov ecx, ebx
mov dword [esp + 0x48], 1
call fcn.005c5dc0
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x24]
call fcn.005808e0
test dword [esp + 0x20], 0x80000
mov eax, dword [ebx + 0x20]
je 0x560f10
mov dword [esp + 0x24], eax
jmp 0x560f14
mov dword [esp + 0x2c], eax
mov ecx, esi
call fcn.0055f1e0
mov ebp, eax
push ebp
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.0055bb40
test eax, eax
je 0x561175
test ebp, ebp
jl 0x561175
mov ecx, esi
call fcn.0055f1e0
mov ebp, eax
push ebp
add ebx, 4
push ebx
mov ecx, esi
call fcn.0055bc90
test eax, eax
je 0x561175
mov ebx, ebp
test ebp, ebp
jl 0x561175
mov ecx, dword [esi + 0xc]
shl ebp, 4
push 1
add ecx, ebp
call fcn.00580c80
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0xc]
mov edx, dword [ecx + 0x1c]
add eax, ebp
mov dword [eax + 0xc], edx
mov edx, dword [ecx]
mov eax, dword [edx + 0x5c]
call eax
cmp eax, 0x32
jne 0x560f97
mov ecx, dword [esi + 0xc]
push 1
add ecx, ebp
call fcn.00580cc0
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx]
dec eax
cmp dword [esp + 0x18], eax
jne 0x5610f2
mov ebx, dword [esp + 0x1c]
lea edx, [esp + 0x84]
push edx
mov ecx, ebx
call fcn.005c5dc0
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x24]
call fcn.005808e0
test dword [esp + 0x20], 0x80000
mov eax, dword [ebx + 0x20]
je 0x560fdf
mov dword [esp + 0x24], eax
jmp 0x560fe3
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00560230
mov ebx, eax
test ebx, ebx
jl 0x561175
jmp 0x5610f2
mov edx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ebp, dword [edx + eax*4]
lea eax, [edx + eax*4]
mov dword [esp + 0x4c], ebp
cmp ecx, 0x16
jne 0x561077
cmp dword [ebp + 0x14], 1
jne 0x561036
lea ecx, [edi + 0xc]
push ecx
mov ecx, esi
call fcn.00560260
test eax, eax
jl 0x561175
mov ecx, dword [edi + 0x14]
jmp 0x561090
lea edx, [esp + 0x7c]
push edx
mov ecx, ebp
call fcn.0057c920
mov ecx, dword [eax]
cmp ecx, dword [ebp + 0xc]
jne 0x5610a4
mov edx, dword [eax + 4]
cmp edx, dword [ebp + 0x10]
jne 0x5610a4
lea eax, [edi + 0xc]
push eax
mov ecx, esi
call fcn.00560260
test eax, eax
jl 0x561175
mov ecx, dword [edi + 0x14]
push ecx
mov ecx, eax
shl ecx, 4
add ecx, dword [esi + 0xc]
call fcn.0040add0
jmp 0x5610a4
cmp ecx, 0x20
jne 0x5610a4
mov ebx, dword [eax - 4]
lea ecx, [ebx + 4]
push ecx
mov ecx, esi
call fcn.00560260
mov ebx, dword [ebx + 0x1c]
lea ecx, [ebx + ebx]
shl eax, 4
add eax, dword [esi + 0xc]
test byte [eax + 2], 8
je 0x5610a1
mov dword [eax + 4], ecx
jmp 0x5610a4
mov dword [eax + 0xc], ecx
cmp dword [esp + 0x18], 0
jne 0x5610d9
cmp dword [ebp + 0x14], 1
mov ecx, esi
jne 0x5610b9
lea edx, [ebp + 4]
push edx
jmp 0x5610bd
lea eax, [ebp + 0xc]
push eax
call fcn.00560260
mov ecx, dword [ebp + 0x24]
shl eax, 4
add eax, dword [esi + 0xc]
test byte [eax + 2], 8
je 0x5610d6
mov dword [eax + 4], ecx
jmp 0x5610d9
mov dword [eax + 0xc], ecx
mov ecx, esi
call fcn.0055f1e0
mov ebx, eax
push ebx
push ebp
mov ecx, esi
call fcn.0055bfb0
test eax, eax
jne 0x5610f2
or ebx, 0xffffffff
mov ebp, dword [esp + 0x50]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
mov ecx, dword [ecx + edx*4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x5c]
call edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
inc eax
cmp eax, dword [ebp]
mov dword [esp + 0x18], eax
jl 0x560a70
mov eax, dword [esp + 0x14]
cmp eax, 0x20
jne 0x5611c0
mov ebx, dword [esp + 0x4c]
mov ecx, esi
call fcn.0055f1e0
cmp dword [ebx + 0x14], 0
mov edi, eax
push edi
jne 0x5611b5
lea eax, [ebx + 4]
push eax
mov ecx, esi
call fcn.0055bc90
test eax, eax
je 0x561175
test edi, edi
jl 0x561175
mov ebx, dword [ebx + 0x24]
shl edi, 4
add edi, dword [esi + 0xc]
test byte [edi + 2], 8
je 0x5611bb
mov dword [edi + 4], ebx
jmp 0x5611f9
push 0x302
call fcn.00526f80
add esp, 4
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 1
call fcn.004ed1b0
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0
call fcn.00518980
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], 0xffffffff
call fcn.0051d2c0
xor eax, eax
jmp 0x561237
lea ecx, [ebx + 0xc]
push ecx
jmp 0x561142
mov dword [edi + 0xc], ebx
jmp 0x5611f9
cmp eax, 0x16
jne 0x5611f9
mov ecx, esi
call fcn.0055f1e0
mov ebx, eax
push ebx
lea edx, [edi + 0xc]
push edx
mov ecx, esi
call fcn.0055bc90
test eax, eax
je 0x561175
test ebx, ebx
jl 0x561175
mov edi, dword [edi + 0x14]
shl ebx, 4
add ebx, dword [esi + 0xc]
test byte [ebx + 2], 8
je 0x5611f6
mov dword [ebx + 4], edi
jmp 0x5611f9
mov dword [ebx + 0xc], edi
lea ecx, [esp + 0x20]
mov byte [esp + 0xb4], 1
call fcn.004ed1b0
lea ecx, [esp + 0x84]
mov byte [esp + 0xb4], 0
call fcn.00518980
lea ecx, [esp + 0x30]
mov dword [esp + 0xb4], 0xffffffff
call fcn.0051d2c0
mov eax, 1
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.005f617e
add esp, 0xa4
ret 4