Function at 0x560820
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov ebx, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
call fcn.004857f4
xor eax, eax
push ebp
push 0x560c4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 1
xor ecx, ecx
push ebp
push 0x560c0b
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 0xc]
call fcn.0056016c
mov eax, dword [ebp - 0xc]
call fcn.005600d8
mov edx, eax
inc edx
mov eax, dword [ebp - 0xc]
call fcn.005600e4
mov eax, dword [ebp - 0xc]
call fcn.005600d8
imul eax, eax, 0x35
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 8]
lea eax, [edx + eax - 0xd]
mov edx, dword [ebp + 8]
call fcn.004853b8
mov dl, 1
mov eax, dword [0x53ff08]
call fcn.00541644
mov esi, eax
mov eax, dword [ebp - 0xc]
call fcn.005600d8
imul eax, eax, 0x35
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 8]
mov dword [edx + eax - 0x35], esi
xor ecx, ecx
push ebp
push 0x560bfa
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, dword [ebp - 0xc]
call fcn.005600d8
imul eax, eax, 0x35
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 8]
lea eax, [edx + eax - 0x35]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, ebx
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
movzx edx, byte [ebp - 1]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], 0x3ff00000
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], 0x3ff00000
mov eax, dword [ebp - 0x18]
add eax, 0x10
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x18
push eax
mov eax, dword [ebp - 0x18]
add eax, 0x20
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [eax + 8]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.00560188
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov eax, dword [eax + 0x8c]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov eax, dword [eax + 0x48]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x30], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
call fcn.00542108
test al, al
je 0x5609f6
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov cl, 1
call fcn.0055e29c
mov eax, dword [ebp - 0x14]
add eax, 0x44
mov edx, dword [ebp + 8]
call fcn.004853b8
mov eax, dword [ebp - 0x14]
movzx edx, byte [ebp - 1]
mov byte [eax + 0x37], dl
mov eax, dword [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
mov dl, 1
mov eax, dword [0x5505b0]
call fcn.0055974c
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], ebx
mov eax, ebx
movzx edx, byte [eax + 0x96]
cmp dl, byte [ebp - 1]
je 0x5609ea
movzx edx, byte [ebp - 1]
mov byte [eax + 0x96], dl
cmp dword [eax + 0x15], 0
je 0x5609ea
call fcn.0055a674
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x34], 1
jmp 0x560bec
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
mov dl, 1
mov eax, dword [0x5505b0]
call fcn.0055974c
mov esi, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], esi
cmp dword [ebp + 0xc], 0xffffffff
jne 0x560a33
push ebp
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov edx, ebx
call fcn.00560758
pop ecx
mov ebx, eax
jmp 0x560b62
mov ebx, dword [esi + 0x15]
test ebx, ebx
je 0x560a54
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
cmp byte [eax + 0xa5], 0
je 0x560a54
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
call fcn.0055a530
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0
je 0x560a6d
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx + 0x11]
call fcn.00486f84
jmp 0x560a75
lea eax, [ebp - 8]
call fcn.00486f6c
cmp dword [ebp - 8], 0
je 0x560b60
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x1c]
call fcn.00554750
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
call fcn.004a746c
mov ebx, eax
push 8
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x108]
mov ecx, 1
mov edx, 1
call fcn.00542df0
mov eax, ebx
mov byte [ebp - 0x26], al
mov edx, eax
shr edx, 8
mov byte [ebp - 0x27], dl
shr eax, 0x10
mov byte [ebp - 0x28], al
mov byte [ebp - 0x25], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x108]
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x400a0], edx
call fcn.00542fb4
push 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x108]
xor ecx, ecx
xor edx, edx
call fcn.00542528
mov eax, dword [ebp - 0x1c]
call fcn.00554708
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x560b39
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x108]
push eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x24]
call fcn.004a8570
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x560b40
mov eax, dword [ebp - 0x24]
call fcn.00551750
ret
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x97]
mov edx, ebx
cmp ecx, edx
je 0x560b8e
mov dword [eax + 0x97], edx
cmp dword [eax + 0x15], 0
je 0x560b8e
cmp byte [eax + 0x96], 0
je 0x560b8e
call fcn.0055a674
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov esi, dword [eax + 0x15]
test esi, esi
je 0x560bb5
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
cmp byte [eax + 0xa5], 0
je 0x560bb5
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
call fcn.0055a530
mov edx, ebx
mov eax, esi
call fcn.005552cc
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
movzx edx, byte [eax + 0x96]
cmp dl, byte [ebp - 1]
je 0x560be5
movzx edx, byte [ebp - 1]
mov byte [eax + 0x96], dl
cmp dword [eax + 0x15], 0
je 0x560be5
call fcn.0055a674
mov eax, dword [ebp - 0x18]
mov byte [eax + 0x34], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x560c01
ret