Function at 0x100b05c0
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, ecx
mov byte [ebp - 1], 0
push esi
push edi
mov al, byte [ebx + 0x5c]
and al, 0xfd
cmp dword [ebx + 0x404], 0
mov byte [ebx + 0x5c], al
je 0x100b0abc
test byte [ebx + 0xc18], 1
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
je 0x100b065f
mov eax, dword [ebx + 0xc08]
mov ecx, dword [edi + 0x20]
mov edx, dword [edi + 0x24]
test eax, eax
je 0x100b061d
cmp dword [eax], ecx
jne 0x100b0616
cmp dword [eax + 4], edx
jne 0x100b0616
test byte [eax + 0x10], 2
jne 0x100b06da
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x100b0603
mov dword [ebx + 0xc00], 0
cmp dword [ebx + 0x9f0], 0
jne 0x100b0647
push ecx
push dword [ebx + 0x590]
mov ecx, ebx
push esi
call fcn.100b0cd0
test al, al
je 0x100b0b17
push 1
push edi
push esi
mov ecx, ebx
call fcn.100b0490
mov dword [ebx + 0xc00], eax
and byte [ebx + 0xc18], 0xfe
mov ecx, dword [ebx + 0x54]
test ecx, ecx
je 0x100b0733
mov edi, dword [ebx + 0x68]
mov esi, dword [ebx + 0x6c]
mov edx, dword [ecx + 0x80]
cmp edx, edi
jne 0x100b0722
cmp dword [ecx + 0x84], esi
jne 0x100b0722
mov eax, dword [ecx + 0x88]
cmp eax, dword [ebx + 0x5b0]
jne 0x100b0722
and edx, 0xff000000
or edx, 0
je 0x100b06be
mov ah, byte [ebx + 0x5bc]
lea edx, [ecx + 0x244]
and ah, 1
test edx, edx
jne 0x100b06ed
test ah, ah
jne 0x100b0722
mov dword [ebx + 0x50], ecx
mov al, byte [ecx + 0x78]
shl al, 3
xor al, byte [ebx + 0x5c]
and al, 8
xor byte [ebx + 0x5c], al
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebx + 0xc00], eax
test eax, eax
je 0x100b0627
jmp 0x100b0658
mov al, byte [edx]
and al, 1
cmp ah, al
jne 0x100b0722
mov eax, dword [ebx + 0x5c0]
xor eax, dword [edx + 4]
movzx eax, ax
test eax, eax
jne 0x100b0722
mov al, byte [ebx + 0x5c4]
cmp al, byte [edx + 8]
jne 0x100b0722
movss xmm0, dword [ebx + 0x5c8]
ucomiss xmm0, dword [edx + 0xc]
lahf
test ah, 0x44
jnp 0x100b06be
mov ecx, dword [ecx + 0x154]
test ecx, ecx
jne 0x100b0670
mov esi, dword [ebp + 8]
cmp dword [ebx + 0x9f0], 0
jne 0x100b0753
push ecx
push dword [ebx + 0x590]
mov ecx, ebx
push esi
call fcn.100b0cd0
test al, al
je 0x100b0b17
push 0x10
push 0x258
call fcn.10434a32
mov edi, eax
add esp, 8
test edi, edi
je 0x100b0b17
push 0x258
push 0
push edi
call fcn.10425c00
and byte [edi + 0x78], 0xfe
mov ecx, 0x2e
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [edi + 0x24], 0x20
mov dword [edi + 0x88], 0xffff
mov dword [edi + 0x20], 0
mov dword [edi + 0x2c], 0x205
mov dword [edi + 0x30], 8
mov dword [edi + 0x15c], 0
mov dword [edi + 0x160], 0
mov dword [ebx + 0x50], edi
add edi, 0x8c
mov esi, dword [eax + 0x588]
add esi, 0x294
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx + 0x50]
mov esi, dword [0x11d0c5b8]
mov edi, dword fs:[0x2c]
mov dword [eax + 0x148], ecx
mov dword [eax + 0x14c], edx
mov eax, dword [ebx + 0x50]
mov ecx, dword [ebx + 0x68]
mov edx, dword [ebx + 0x6c]
mov dword [eax + 0x80], ecx
mov dword [eax + 0x84], edx
mov ecx, dword [ebx + 0x50]
mov eax, dword [ebx + 0x5b0]
mov dword [ecx + 0x88], eax
mov eax, dword [ebx + 0x50]
mov dword [eax + 0x134], 0
mov ecx, dword [ebx + 0x68]
mov eax, ecx
mov edx, dword [ebx + 0x6c]
and eax, 0x700
or eax, 0
je 0x100b0877
mov eax, dword [edi + esi*4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x7a68]
cmp dword [eax + 0x54], 2
jne 0x100b0863
mov eax, dword [ebx + 0x50]
shrd ecx, edx, 0x10
movzx ecx, cl
mov dword [eax + 0x13c], ecx
mov eax, dword [ebx + 0x50]
mov edx, 5
or dword [eax + 0x140], 0x200
jmp 0x100b087c
mov edx, 1
mov eax, dword [ebx + 0x68]
and eax, 0xff000000
or eax, 0
je 0x100b08bb
mov ecx, dword [ebx + 0x50]
add ecx, 0x244
mov al, byte [ecx]
xor al, byte [ebx + 0x5bc]
and al, 1
xor byte [ecx], al
mov ax, word [ebx + 0x5c0]
mov word [ecx + 4], ax
mov al, byte [ebx + 0x5c4]
mov byte [ecx + 8], al
mov eax, dword [ebx + 0x5c8]
mov dword [ecx + 0xc], eax
cmp dword [ebx + 0x408], 0xfffe0300
jb 0x100b08d4
mov eax, dword [ebx + 0x50]
or dword [eax + 0x140], 0x800
mov eax, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x68]
mov dword [ebp - 0x14], eax
mov eax, ecx
and eax, 0x4000
or eax, 0
je 0x100b08f8
mov eax, dword [ebx + 0x50]
or dword [eax + 0x140], 0x1000
jmp 0x100b0910
and ecx, 0x8000
or ecx, 0
je 0x100b0910
mov eax, dword [ebx + 0x50]
or dword [eax + 0x140], 0x2000
mov eax, dword [ebx + 0x50]
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [eax + 0x1c], 0
mov eax, dword [ebx + 0x50]
mov dword [ebx + 0x9d4], eax
add eax, 0x8c
mov dword [ebx + 0x9d0], eax
mov eax, dword [edi + esi*4]
mov eax, dword [eax + 0x10]
test byte [eax + 0xd350], 1
mov eax, 0
cmove edx, eax
lea eax, [ebp - 8]
mov dword [ebx + 0x934], edx
mov edi, dword [edi + esi*4]
mov dword [ebx + 0x5dc], eax
lea eax, [ebp - 0xc]
mov dword [ebx + 0x5e0], eax
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx + 0x7a68]
cmp dword [eax + 0x54], 2
jne 0x100b09d4
test byte [ecx + 0xd29f], 4
jne 0x100b09ca
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xf7c]
mov eax, dword [eax + 0x1838]
cmp eax, 0x5e25
je 0x100b09ca
cmp eax, 0x8918
je 0x100b09ca
cmp eax, 0x5e26
je 0x100b09ca
cmp eax, 0xf080
je 0x100b09ca
cmp eax, 0x15cb
je 0x100b09ca
cmp eax, 0x467
je 0x100b09ca
cmp eax, 0x5490
jne 0x100b09d4
mov dword [ebx + 0x6f0], 1
lea eax, [ebx + 0xa08]
xor edx, edx
push eax
lea eax, [ebx + 0x424]
push eax
lea ecx, [edx + 0x10]
call fcn.10062e90
mov esi, eax
mov edx, 1
lea eax, [esi + 0xd6]
lea eax, [eax + eax*2]
lea eax, [ebx + eax*4]
push eax
lea eax, [ebx + 0x4b8]
push eax
lea ecx, [edx + 0x18]
call fcn.10062e90
add eax, esi
mov dword [ebx + 0x614], 4
mov dword [ebx + 0x600], eax
mov dword [ebx + 0x618], 4
mov eax, dword [edi + 0x10]
mov eax, dword [eax + 0x7a68]
cmp dword [eax + 0x54], 2
jne 0x100b0a4e
push ecx
push dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp + 8]
call fcn.101556e0
mov byte [ebp - 1], al
mov esi, dword [ebx + 0x18]
test esi, esi
je 0x100b0a7f
mov eax, dword [esi + 0xa8]
test eax, eax
je 0x100b0a63
mov esi, eax
jmp 0x100b0a55
mov eax, dword [ebx + 0x9f8]
push esi
push dword [ebx + 0xa00]
mov esi, dword [esi + 0xa4]
call eax
test esi, esi
jne 0x100b0a63
mov dword [ebx + 0x18], esi
cmp byte [ebp - 1], 0
mov esi, dword [ebx + 0x50]
je 0x100b0ac8
cmp dword [ebx + 0x54], 0
jne 0x100b0aaa
mov al, byte [ebp - 1]
mov dword [ebx + 0x54], esi
mov dword [ebx + 0x5ac], 1
mov dword [ebx + 0x58], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebx + 0x58]
mov dword [eax + 0x154], esi
inc dword [ebx + 0x5ac]
mov dword [ebx + 0x58], esi
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, esi
call fcn.100b00d0
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x100b0aef
call fcn.100b00d0
push 0x70
push dword [esi + 0x70]
call fcn.1045088a
add esp, 8
mov dword [esi + 0x70], 0
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x100b0b04
push 0x258
push eax
call fcn.1045088a
add esp, 8
mov al, byte [ebp - 1]
mov dword [ebx + 0x50], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8