Function at 0x5442d0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x629d23
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x14], edi
mov ecx, dword [edi + 0x18]
cmp ecx, ebx
je 0x544493
lea eax, [esp + 0x34]
lea edx, [esp + 0x2c]
push eax
push edx
lea eax, [esp + 0x2c]
lea edx, [esp + 0x24]
push eax
push edx
lea eax, [esp + 0x1c]
lea edx, [esp + 0x54]
push eax
push edx
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x54]
push eax
push edx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
call fcn.00555f20
test eax, eax
je 0x544493
mov ecx, dword [edi + 0x88]
cmp ecx, ebx
jne 0x5443f8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xb0]
mov edx, dword [ecx + 0x30]
mov ecx, edi
push edx
push eax
call fcn.00543a50
mov eax, dword [edi + 0x88]
cmp eax, ebx
je 0x5443df
mov ecx, dword [esp + 0x1c]
mov dword [eax + 0x38], ecx
mov edx, dword [esp + 0x20]
mov dword [eax + 0x3c], edx
mov eax, dword [edi + 0x88]
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x40], ecx
mov edx, dword [esp + 0x28]
mov dword [eax + 0x44], edx
mov eax, dword [edi + 0x88]
mov ecx, dword [esp + 0x2c]
mov dword [eax + 0x48], ecx
mov edx, dword [esp + 0x30]
mov dword [eax + 0x4c], edx
mov eax, dword [edi + 0x88]
mov ecx, dword [esp + 0x34]
mov dword [eax + 0x50], ecx
mov edx, dword [esp + 0x38]
mov dword [eax + 0x54], edx
mov eax, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ecx + 0x58]
mov dword [esp + 0x10], ecx
cmp eax, ebx
je 0x544420
mov edx, dword [esp + 0xc]
jmp 0x54440d
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + 0x60]
inc ecx
cmp edx, ecx
je 0x544420
mov dword [esp + 0x10], eax
mov eax, dword [eax + 0x58]
cmp eax, ebx
jne 0x544409
push 0x70
call fcn.005feedc
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebx
mov dword [esp + 0x58], ebx
je 0x544441
mov ecx, eax
call fcn.0054bc10
mov esi, eax
jmp 0x544443
xor esi, esi
cmp esi, ebx
mov dword [esp + 0x58], 0xffffffff
je 0x544493
mov edx, dword [edi + 0xd4]
mov dword [esi + 0x64], edx
mov eax, dword [edi + 0xdc]
mov dword [esi + 0x68], eax
mov ecx, dword [edi + 0x88]
mov edx, dword [ecx + 0x10]
push edx
call fcn.005e639f
lea eax, [eax + eax + 0x14]
push eax
call fcn.005feedc
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x5444a9
mov ecx, esi
call fcn.0054bc60
push esi
call fcn.005fef05
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [edi + 0x94]
inc ecx
mov dword [edi + 0x94], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x60], ecx
mov eax, dword [edi + 0x88]
mov edx, dword [esp + 0xc]
mov ecx, dword [eax + 0x10]
push edx
push ecx
push str._s_d
push ebx
call fcn.005e72e7
add esp, 0x10
mov ecx, esi
push ebx
call fcn.0054bcf0
test eax, eax
je 0x5444fe
mov ecx, esi
call fcn.0054bc60
push esi
call fcn.005fef05
push ebx
call fcn.005fef05
add esp, 8
jmp 0x544493
mov edi, dword [ebp + 8]
push ebx
lea ecx, [edi + 0x10]
call fcn.00554e50
test eax, eax
je 0x54456e
mov edx, dword [0x6cc708]
mov dword [esp + 0x10], edx
push eax
push ebx
lea eax, [esp + 0x18]
push str.Error_opening_file__ls__errcode___ld._n
push eax
mov dword [esp + 0x68], 1
call fcn.005fb90b
mov ecx, dword [esp + 0x20]
add esp, 0x10
push ecx
mov ecx, dword [esp + 0x18]
call fcn.00541a30
mov ecx, esi
call fcn.0054bc60
push esi
call fcn.005fef05
push ebx
call fcn.005fef05
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x58], 0xffffffff
call fcn.00602ad6
jmp 0x544493
push ebx
mov dword [edi + 0x17c], 0x40
mov dword [edi + 0x180], 0
mov byte [edi + 0xc6], 0
mov byte [edi + 0xc7], 0
call fcn.005fef05
mov dword [esi], edi
mov edx, dword [esp + 0x40]
fld qword [esp + 0x48]
fmul qword [0x6359f0]
xor eax, eax
mov dword [edi + 0xe0], edx
mov dword [edi + 0x50], eax
mov dword [edi + 0x68], eax
mov dword [edi + 0x60], eax
mov dword [edi + 0x54], eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x64], eax
mov eax, dword [esp + 0x44]
add esp, 4
mov dword [edi + 0xe4], eax
call fcn.005e6974
mov ebx, eax
mov dword [esi + 0x1c], ebx
fld qword [esp + 0x3c]
fmul qword [0x635a00]
call fcn.005e6974
sub ebx, eax
mov dword [esi + 0x20], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x38], ecx
mov edx, dword [esp + 0x20]
mov dword [esi + 0x3c], edx
mov eax, dword [esp + 0x24]
mov dword [esi + 0x40], eax
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x44], ecx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0x48], edx
mov eax, dword [esp + 0x30]
mov dword [esi + 0x4c], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x50], ecx
mov edx, dword [esp + 0x38]
mov dword [esi + 0x54], edx
mov ecx, dword [eax + 0x58]
mov dword [esi + 0x58], ecx
mov dword [eax + 0x58], esi
mov edx, dword [edi + 0x50]
mov dword [edi + 0x90], esi
mov dword [esi + 8], edx
mov eax, dword [edi + 0x54]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x50]
mov edx, dword [edi + 0x54]
mov dword [edi + 0x58], ecx
mov ecx, dword [esp + 0x50]
mov dword [edi + 0x5c], edx
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8