Function at 0x10047510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099850
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x10
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
lea ecx, [esi + 0x10]
call fcn.100487a0
lea ecx, [esi + 0x1508]
mov dword [ebp - 4], 0
call fcn.10048640
lea edi, [esi + 0x18c0]
mov ecx, edi
call fcn.100617a0
mov dword [esi + 0x1960], 0
mov dword [esi + 0x195c], 0
mov dword [esi + 0x1964], 0
mov dword [esi + 0x196c], 0
mov dword [esi + 0x1968], 0
mov dword [esi + 0x1970], 0
mov dword [esi + 0x1978], 0
mov dword [esi + 0x1974], 0
mov dword [esi + 0x197c], 0
mov dword [esi + 0x1984], 0
mov dword [esi + 0x1980], 0
mov dword [esi + 0x1988], 0
mov dword [esi + 0x1990], 0
mov dword [esi + 0x198c], 0
mov dword [esi + 0x1994], 0
mov dword [esi + 0x19e0], 0
mov dword [esi + 0x19dc], 0
mov dword [esi + 0x19fc], 0
mov dword [esi + 0x19f8], 0
mov dword [esi + 0x1a08], 0
mov dword [esi + 0x1a04], 0
mov dword [esi + 0x1a0c], 0
mov dword [esi + 0x1a14], 0
mov dword [esi + 0x1a10], 0
mov dword [esi + 0x1a18], 0
mov dword [esi + 0x1a20], 0
mov dword [esi + 0x1a1c], 0
mov dword [esi + 0x1a24], 0
mov dword [esi + 0x1a2c], 0
mov dword [esi + 0x1a28], 0
mov dword [esi + 0x1a30], 0
mov dword [esi + 0x1a38], 0
mov dword [esi + 0x1a34], 0
mov dword [esi + 0x1a3c], 0
mov dword [esi + 0x1a8c], 0xff7fffff
mov dword [esi + 0x1a58], 0
mov dword [esi + 0x1a54], 0
mov dword [esi + 0x1a50], 0
mov dword [esi + 0x1a4c], 0
mov dword [esi + 0x1a48], 0
mov dword [esi + 0x1a44], 0
mov dword [esi + 0x1a40], 0
mov dword [esi + 0x1a6c], 0
mov dword [esi + 0x1a70], 0
mov dword [esi + 0x1a64], 0
mov dword [esi + 0x1a68], 0
mov dword [esi + 0x1a5c], 0
mov dword [esi + 0x1a60], 0
mov dword [esi + 0x1a74], 0
mov dword [esi + 0x1a78], 0
mov byte [esi + 0x1a7c], 0
mov dword [esi + 0x1a80], 0x7f7fffff
mov dword [esi + 0x1a84], 0x7f7fffff
mov dword [esi + 0x1a88], 0xff7fffff
mov dword [esi + 0x1a8c], 0xff7fffff
mov dword [esi + 0x1a90], 0
mov dword [esi + 0x1a94], 0
mov dword [esi + 0x1a98], 0x7f7fffff
mov dword [esi + 0x1a9c], 0
mov dword [esi + 0x1aa0], 0
mov dword [esi + 0x1ad8], 0x7f7fffff
mov dword [esi + 0x1adc], 0x7f7fffff
mov dword [esi + 0x1ae0], 0xff7fffff
mov dword [esi + 0x1ae4], 0xff7fffff
mov dword [esi + 0x1b18], 0x7f7fffff
mov dword [esi + 0x1b1c], 0x7f7fffff
mov dword [esi + 0x1b20], 0xff7fffff
mov dword [esi + 0x1b24], 0xff7fffff
mov dword [esi + 0x1b64], 0xff7fffff
mov dword [esi + 0x1b44], 0
mov dword [esi + 0x1b40], 0
mov dword [esi + 0x1b48], 0
mov dword [esi + 0x1b54], 0x7f7fffff
mov dword [esi + 0x1b50], 0x7f7fffff
mov dword [esi + 0x1b4c], 0x7f7fffff
mov dword [esi + 0x1b58], 0x7f7fffff
mov dword [esi + 0x1b5c], 0x7f7fffff
mov dword [esi + 0x1b60], 0xff7fffff
mov dword [esi + 0x1b64], 0xff7fffff
mov dword [esi + 0x1b8c], 0xff7fffff
mov dword [esi + 0x1b6c], 0
mov dword [esi + 0x1b68], 0
mov dword [esi + 0x1b70], 0
mov dword [esi + 0x1b7c], 0x7f7fffff
mov dword [esi + 0x1b78], 0x7f7fffff
mov dword [esi + 0x1b74], 0x7f7fffff
mov dword [esi + 0x1b80], 0x7f7fffff
mov dword [esi + 0x1b84], 0x7f7fffff
mov dword [esi + 0x1b88], 0xff7fffff
mov dword [esi + 0x1b8c], 0xff7fffff
mov dword [esi + 0x1bb4], 0xff7fffff
mov dword [esi + 0x1b94], 0
mov dword [esi + 0x1b90], 0
mov dword [esi + 0x1b98], 0
mov dword [esi + 0x1ba4], 0x7f7fffff
mov dword [esi + 0x1ba0], 0x7f7fffff
mov dword [esi + 0x1b9c], 0x7f7fffff
mov dword [esi + 0x1ba8], 0x7f7fffff
mov dword [esi + 0x1bac], 0x7f7fffff
mov dword [esi + 0x1bb0], 0xff7fffff
mov dword [esi + 0x1bb4], 0xff7fffff
mov byte [esi + 0x1bb8], 0
mov dword [esi + 0x1bbc], 0
mov dword [esi + 0x1bc4], 0
mov dword [esi + 0x1bc8], 0
mov dword [esi + 0x1bc0], 0
mov dword [esi + 0x1bdc], 0
mov dword [esi + 0x1be0], 0
mov dword [esi + 0x1bd4], 0
mov dword [esi + 0x1bd8], 0
mov dword [esi + 0x1bcc], 0
mov dword [esi + 0x1bd0], 0
push 0x10059410
push 0x100599d0
push 2
lea eax, [esi + 0x1be4]
mov byte [ebp - 4], 0xb
push 0xc
push eax
mov dword [ebp - 0x1c], eax
call fcn.10096bf0
lea ecx, [esi + 0x1c00]
mov byte [ebp - 4], 0xc
push 0
call fcn.10047190
lea eax, [esi + 0x1c78]
mov dword [eax + 0xc], 0x7f7fffff
mov dword [eax + 0x10], 0x7f7fffff
mov dword [eax + 0x14], 0xff7fffff
mov dword [eax + 0x18], 0xff7fffff
mov dword [eax + 0x1c], 0x7f7fffff
mov dword [eax + 0x20], 0x7f7fffff
mov dword [eax + 0x24], 0xff7fffff
mov dword [eax + 0x28], 0xff7fffff
mov dword [eax + 0x2c], 0x7f7fffff
mov dword [eax + 0x30], 0x7f7fffff
push 0x3c
push 0
push eax
mov dword [eax + 0x34], 0xff7fffff
mov dword [eax + 0x38], 0xff7fffff
call sub.VCRUNTIME140.dll_memset
mov dword [esi + 0x1cd0], 0
xorps xmm0, xmm0
mov dword [esi + 0x1ccc], 0
add esp, 0xc
mov dword [esi + 0x1cc4], 0
mov dword [esi + 0x1cc8], 0
movups xmmword [esi + 0x1cd8], xmm0
movups xmmword [esi + 0x1ce8], xmm0
mov word [esi + 0x1cf8], 0
mov dword [esi + 0x1cd4], 0xffffffff
mov byte [esi + 0x1cfa], 0
mov dword [esi + 0x1cfc], 0x7f7fffff
mov dword [esi + 0x1d00], 0x7f7fffff
mov dword [esi + 0x1d04], 0xff7fffff
mov dword [esi + 0x1d08], 0xff7fffff
mov dword [esi + 0x1d28], 0
mov dword [esi + 0x1d24], 0
mov dword [esi + 0x1d2c], 0
mov dword [esi + 0x1d3c], 0
mov dword [esi + 0x1d38], 0
mov dword [esi + 0x1d40], 0
mov dword [esi + 0x1d48], 0
mov dword [esi + 0x1d44], 0
mov dword [esi + 0x1d4c], 0
mov dword [esi + 0x1d50], 0
mov dword [esi + 0x1d5c], 0
mov dword [esi + 0x1d58], 0
mov dword [esi + 0x1d60], 0
mov dword [esi + 0x1d68], 0
mov dword [esi + 0x1d64], 0
mov dword [esi + 0x1d6c], 0
lea eax, [esi + 0x1d70]
mov dword [eax + 0x10], 0
push 0xe70
push 0
push eax
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x2c], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [esi + 0x2be0]
call fcn.10066610
mov dword [esi + 0x2c4c], 0
mov dword [esi + 0x2c48], 0
mov dword [esi + 0x2c44], 0
mov dword [esi + 0x2c40], 0
mov dword [esi + 0x2c60], 0
mov dword [esi + 0x2c5c], 0
mov dword [esi + 0x2c6c], 0
mov dword [esi + 0x2c68], 0
mov dword [esi + 0x2c70], 0
mov dword [esi + 0x2c7c], 0
mov dword [esi + 0x2c78], 0
mov dword [esi + 0x2c84], 0
mov dword [esi + 0x2c80], 0
mov dword [esi + 0x2c94], 0
mov dword [esi + 0x2c90], 0
mov dword [esi + 0x2c98], 0
mov dword [esi + 0x2ca0], 0
mov dword [esi + 0x2c9c], 0
mov dword [esi + 0x2ca4], 0
mov dword [esi + 0x2cac], 0
mov dword [esi + 0x2ca8], 0
mov dword [esi + 0x2cb0], 0
mov dword [esi + 0x2cc0], 0
mov dword [esi + 0x2cbc], 0
mov dword [esi + 0x2cc4], 0
mov eax, dword [0x10105adc]
mov byte [esi], 0
mov word [esi + 8], 0
mov dword [esi + 0x18b4], 0
mov dword [esi + 0x18bc], 0
mov dword [esi + 0x18b8], 0
mov byte [esi + 0xa], 1
test eax, eax
je 0x10047d0f
inc dword [eax + 0x374]
push 0x5c
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x10047dd2
mov dword [eax + 0x24], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x54], 0
mov byte [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 1
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x58], 0xffffffff
jmp 0x10047dd4
xor eax, eax
mov dword [esi + 0x9c], eax
xorps xmm0, xmm0
movsd qword [esi + 0x1948], xmm0
mov dword [esi + 0x1950], 0
mov dword [esi + 0x1958], 0xffffffff
mov dword [esi + 0x1954], 0xffffffff
mov dword [esi + 0x1998], 0
mov dword [esi + 0x199c], 0
mov dword [esi + 0x19a0], 0
mov dword [esi + 0x19a4], 0
mov dword [esi + 0x19a8], 0
mov byte [esi + 0x19ac], 0
mov dword [esi + 0x19b0], 0
mov dword [esi + 0x19b8], 0
mov dword [esi + 0x19b4], 0
mov dword [esi + 0x19bc], 0
mov dword [esi + 0x19c0], 0
mov dword [esi + 0x19c4], 0
mov dword [esi + 0x19c8], 0
mov dword [esi + 0x19cc], 0
mov word [esi + 0x19d0], 0
mov dword [esi + 0x19d4], 0
mov dword [esi + 0x19d8], 0
mov dword [esi + 0x19dc], 0xbf800000
mov dword [esi + 0x19e0], 0xbf800000
mov dword [esi + 0x19e8], 0
mov dword [esi + 0x19e4], 0
mov dword [esi + 0x19ec], 0
mov dword [esi + 0x19f0], 0
mov dword [esi + 0x19f4], 0
mov dword [esi + 0x19f8], 0
mov dword [esi + 0x19fc], 0
mov dword [esi + 0x1a00], 0
mov byte [esi + 0x1aa4], 0
mov dword [esi + 0x1aa8], 0
mov dword [esi + 0x1aac], 0
mov dword [esi + 0x1ac0], 0
mov dword [esi + 0x1abc], 0
mov dword [esi + 0x1ab8], 0
mov dword [esi + 0x1ab4], 0
mov dword [esi + 0x1ab0], 0
mov dword [esi + 0x1ad0], 0
mov dword [esi + 0x1acc], 0
mov dword [esi + 0x1ac8], 0
mov dword [esi + 0x1ac4], 0
mov dword [esi + 0x1ad4], 0
mov dword [esi + 0x1ad8], 0x7f7fffff
mov dword [esi + 0x1adc], 0x7f7fffff
mov dword [esi + 0x1ae0], 0xff7fffff
mov dword [esi + 0x1ae4], 0xff7fffff
mov dword [esi + 0x1ae8], 0
mov dword [esi + 0x1af4], 0
mov dword [esi + 0x1af0], 0
mov dword [esi + 0x1aec], 0
mov dword [esi + 0x1afc], 0
mov dword [esi + 0x1af8], 0
mov byte [esi + 0x1b00], 0
mov dword [esi + 0x1b04], 0
mov dword [esi + 0x1b08], 0x7fffffff
mov dword [esi + 0x1b0c], 0x10000
mov word [esi + 0x1b10], 0
mov byte [esi + 0x1b12], 0
mov dword [esi + 0x1b14], 0
mov word [esi + 0x1b28], 0
mov dword [esi + 0x1b2c], 0
mov dword [esi + 0x1b30], 0
mov dword [esi + 0x1b3c], 0xffffffff
mov dword [esi + 0x1b38], 0xffffffff
mov dword [esi + 0x1b34], 0xffffffff
mov dword [esi + 0x1bfc], 0
mov dword [esi + 0x1c28], edi
mov dword [esi + 0x1c2c], 0x100c7c54
mov dword [esi + 0x1c74], 0
mov word [esi + 0x1cb4], 0
mov dword [esi + 0x1cb8], 0
mov dword [esi + 0x1cbc], 0xffffffff
mov dword [esi + 0x1cc0], 0xffffffff
mov dword [esi + 0x1d0c], 0
mov dword [esi + 0x1d10], 0
mov dword [esi + 0x1d14], 0
mov dword [esi + 0x1d18], 0
mov dword [esi + 0x1d1c], 0
lea eax, [esi + 0x2cd0]
mov dword [esi + 0x1d20], 0xffffffff
movq qword [esi + 0x1d30], xmm0
mov dword [esi + 0x2c38], 0
mov dword [esi + 0x2c3c], 0x2900000
mov byte [esi + 0x2c50], 0
mov dword [esi + 0x2c54], 0
mov dword [esi + 0x2c58], 0x3c23d70a
mov dword [esi + 0x2c5c], 0
mov dword [esi + 0x2c60], 0
mov dword [esi + 0x2c64], 0
mov dword [esi + 0x2c74], 0
mov dword [esi + 0x2c80], 0x7f7fffff
mov dword [esi + 0x2c84], 0x7f7fffff
mov dword [esi + 0x2c78], 0x7f7fffff
mov dword [esi + 0x2c7c], 0x7f7fffff
mov byte [esi + 0x2c88], 0
mov dword [esi + 0x2c8c], 0
mov byte [esi + 0x2cb4], 0
push 0x1e0
mov dword [esi + 0x2cb8], 0
push 0
mov dword [esi + 0x2cc8], 0
push eax
mov dword [esi + 0x2ccc], 2
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi + 0x2eb0], 0
mov dword [esi + 0x2eb4], 0
lea eax, [esi + 0x2ec4]
mov dword [esi + 0x2ec0], 0xffffffff
mov dword [esi + 0x2ebc], 0xffffffff
push 0xc01
push 0
push eax
mov dword [esi + 0x2eb8], 0xffffffff
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 0xc]
add esp, 0xc
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4