Function at 0x5e95a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x878532
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], 0x434c34
mov eax, dword [esp + 0x28]
mov dword [esi + 4], eax
mov dword [esi + 0xc], 0xd7
xor ebx, ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [esi + 0x18], bl
mov edi, fcn.00434ba4
mov dword [esi + 8], edi
mov dword [esi + 0x24], 0x73c5
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], bl
mov dword [esi + 0x20], edi
mov dword [esi + 0x3c], 0x83
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov byte [esi + 0x48], bl
mov dword [esi + 0x38], edi
mov dword [esi + 0x54], 0xb9
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x60], bl
mov dword [esi + 0x50], edi
mov dword [esi + 0x6c], 0x88
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov byte [esi + 0x78], bl
mov dword [esi + 0x68], edi
mov dword [esi + 0x84], 0x9c
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov byte [esi + 0x90], bl
mov dword [esi + 0x80], edi
mov dword [esi + 0x9c], 0x6de7
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov byte [esi + 0xa8], bl
mov dword [esi + 0x98], edi
mov dword [esi + 0xb4], 0x6df8
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov byte [esi + 0xc0], bl
mov dword [esi + 0xb0], edi
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x5e96be
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xd0], eax
mov ebp, 0x434bf8
mov dword [esi + 0xcc], 0x536e
mov dword [esi + 0xc8], ebp
mov dword [esp + 0x20], ebx
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x5e9703
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xdc], eax
mov dword [esi + 0xd8], 0x22b59c
mov dword [esi + 0xd4], 0x434c04
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov eax, 0x4347f8
mov dword [esi + 0xe4], 0x86
mov dword [esi + 0xe0], eax
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x108], ebx
mov dword [esi + 0x10c], ebx
mov dword [esi + 0xfc], 0x63a2
mov dword [esi + 0xf8], eax
mov byte [esp + 0x20], 3
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x5e979d
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x118], eax
mov dword [esi + 0x114], 0x258688
mov dword [esi + 0x110], ebp
mov byte [esp + 0x20], 4
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x5e97de
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x124], eax
mov dword [esi + 0x120], 0x3a9697
mov dword [esi + 0x11c], ebp
mov byte [esp + 0x20], 5
call fcn.007cff5d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x5e981f
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x130], eax
mov ebp, 0x434c04
mov dword [esi + 0x12c], 0x3b4040
mov dword [esi + 0x128], ebp
mov byte [esp + 0x20], 6
call fcn.007cff5d
cmp eax, ebx
jne 0x5e985e
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x13c], eax
mov dword [esi + 0x138], 0x26b240
mov dword [esi + 0x134], ebp
mov dword [esi + 0x144], 0xaa
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov byte [esi + 0x150], bl
mov dword [esi + 0x140], edi
mov dword [esi + 0x15c], 0x6fab
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov byte [esi + 0x168], bl
mov dword [esi + 0x158], edi
push 0xe0
lea ecx, [esi + 0x190]
mov dword [esi + 0x174], 0x23e383
mov dword [esi + 0x178], ebx
mov dword [esi + 0x17c], ebx
mov byte [esi + 0x180], bl
mov dword [esi + 0x170], edi
call fcn.005e8070
push 0xe1
lea ecx, [esi + 0x290]
call fcn.005e8d50
mov dword [esi + 0x188], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4