Function at 0x70e5ab01
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70e6d585
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x228], esi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edi
lea ecx, [ebx + 0x20]
mov dword [ebx], 0x70e0a43c
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], eax
call fcn.70df39c7
lea ecx, [ebx + 0x28]
mov byte [ebp - 4], 1
call fcn.70df39c7
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x48]
mov byte [ebx + 0x30], 0
mov dword [ebx + 0x38], edi
mov dword [ebx + 0x3c], edi
mov dword [ebx + 0x40], edi
mov dword [ebx + 0x44], edi
call fcn.70df39c7
mov byte [ebx + 0x50], 0
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x234], 0x70df59dc
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
push 0x400
lea edi, [ebp - 0x234]
mov byte [ebp - 4], 4
call fcn.70df5183
lea edx, [ebx + 0x34]
push edx
lea edx, [ebx + 0x1c]
push edx
lea edx, [ebp - 0x21c]
push edx
mov edx, dword [ebp + 0xc]
push 0
mov byte [ebp - 4], 5
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
push 0
push edx
push eax
mov eax, dword [ecx + 0x30]
call eax
test eax, eax
jns 0x70e5ac0f
push 0x70e7788c
lea ecx, [ebp - 0x218]
push ecx
mov dword [ebp - 0x214], 0x8000ffff
mov dword [ebp - 0x218], 0x70e07980
call fcn.70e610ef
mov edx, dword [ebp - 0x21c]
inc edx
push edx
lea edi, [ebp - 0x234]
call fcn.70df5183
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
push 0
push 0
lea edx, [ebp - 0x21c]
push edx
mov edx, dword [ebp - 0x21c]
push edx
mov edx, dword [ebp - 0x22c]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x30]
call eax
test eax, eax
js 0x70e5abea
lea edx, [ebp - 0x23c]
push edx
mov eax, edi
push eax
call fcn.70df3e97
mov dword [ebp - 0x240], eax
lea edi, [ebx + 0x20]
mov byte [ebp - 4], 6
cmp edi, eax
je 0x70e5acaa
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x70e5ac93
mov eax, dword [edi + 4]
push eax
call fcn.70df3455
mov eax, dword [edi]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov eax, dword [ebp - 0x240]
mov ecx, dword [eax]
mov dword [edi], ecx
mov eax, dword [eax + 4]
push eax
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x238]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x70e5acdd
mov eax, dword [ebp - 0x238]
push eax
call fcn.70df3455
mov ecx, dword [ebp - 0x23c]
add esp, 4
push ecx
call fcn.70df3455
add esp, 4
mov eax, dword [esi + 0x70]
mov edx, dword [eax]
mov edx, dword [edx + 0xf8]
lea ecx, [ebx + 0x38]
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
push eax
call edx
xor ecx, ecx
cmp eax, ecx
jl 0x70e5acfe
mov byte [ebx + 0x30], cl
jmp 0x70e5ad18
lea esi, [ebx + 0x28]
mov dword [ebx + 0x38], ecx
mov dword [ebx + 0x40], ecx
call fcn.70e0ec82
mov esi, dword [ebp - 0x228]
mov byte [ebx + 0x30], 1
xor ecx, ecx
push 0x400
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], ecx
call fcn.70df39ac
mov edi, eax
add esp, 4
mov dword [ebp - 0x228], edi
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp + 0xc]
push 0x100
push edi
push edx
mov byte [ebp - 4], 7
mov eax, dword [esi + 0x70]
mov ecx, dword [eax]
lea edx, [ebp - 0x224]
push edx
push eax
mov eax, dword [ecx + 0x104]
call eax
test eax, eax
jne 0x70e5ad9a
mov ecx, dword [ebp - 0x220]
add dword [ebx + 0x44], ecx
mov eax, dword [esi + 0x70]
mov edx, dword [eax]
mov edx, dword [edx + 0x104]
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp + 0xc]
push 0x100
push edi
push ecx
lea ecx, [ebp - 0x224]
push ecx
push eax
call edx
test eax, eax
je 0x70e5ad67
mov esi, dword [esi + 0x70]
mov ecx, dword [ebp - 0x224]
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push ecx
push esi
call edx
push edi
mov byte [ebp - 4], 5
call fcn.70df3455
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x22c]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.70df25ed
mov esp, ebp
pop ebp
ret 8