Function at 0x100ce61
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1025050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
lea eax, [ebp - 0x30]
push eax
push dword [0x1025388]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
call fcn.010114f7
mov edi, eax
cmp edi, ebx
jge 0x100ceb1
push 0xc1008005
call fcn.010110ed
pop ecx
jmp 0x100d28e
push esi
push 0x1001424
call fcn.0100f531
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
jne 0x100ced4
mov edi, 0xc000000d
push 0xc1008019
jmp 0x100d24f
cmp dword [esi + 0xc], ebx
jbe 0x100cec5
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x10]
call fcn.01010323
test eax, eax
jge 0x100cefa
mov esi, 0x1001df4
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x24]
jmp 0x100cefd
xor ebx, ebx
inc ebx
cmp ebx, dword [esi + 0xc]
jae 0x100cec5
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x30]
call fcn.010186a2
mov edi, eax
test edi, edi
jge 0x100cf22
push 0xc100800e
jmp 0x100d24f
push 0
lea eax, [ebp - 0x48]
push eax
push 1
push dword [ebp - 0x2c]
call fcn.010184d0
mov edi, eax
test edi, edi
jl 0x100cf18
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
push dword [esi + ebx*4 + 0x10]
call fcn.0100c848
mov edi, eax
xor edx, edx
cmp edi, edx
jge 0x100cf5a
push 0xc100801a
jmp 0x100d24f
mov eax, dword [esi + 0xc]
inc ebx
cmp ebx, eax
jae 0x100cec5
mov ecx, dword [ebp - 0x20]
shr ecx, 0x18
and ecx, 0xf
dec ecx
je 0x100d1ea
dec ecx
je 0x100d18f
dec ecx
je 0x100d150
dec ecx
je 0x100d0bb
dec ecx
je 0x100d08d
dec ecx
je 0x100d065
dec ecx
jne 0x100cec5
sub eax, ebx
shl eax, 3
mov dword [ebp - 0x18], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100d1ca
mov eax, dword [esi + 0xc]
and dword [ebp - 0x24], 0
sub eax, ebx
je 0x100d03b
lea eax, [esi + ebx*4 + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
push dword [ebp - 0x44]
push dword [eax]
call fcn.0100c526
mov edi, eax
test edi, edi
jl 0x100d0b1
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x24]
mov dword [edx + edi*8], ecx
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x1c]
push eax
mov eax, dword fs:[0x18]
mov dword [edx + edi*8 + 4], ecx
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [esi + 0xc]
add dword [ebp - 0x34], 4
inc edi
sub eax, ebx
mov dword [ebp - 0x24], edi
cmp edi, eax
jb 0x100cfdb
push 0
call fcn.0100f531
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x100d213
push dword [eax + 8]
push 0xc100803a
call fcn.010110ed
pop ecx
mov edi, 0xc000000d
jmp 0x100d254
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [esi + ebx*4 + 0x10]
mov dword [ebp - 0x18], 2
call fcn.0100b93e
mov edi, eax
test edi, edi
jge 0x100d03b
push 0xc100801f
jmp 0x100d24f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x18], 8
push dword [ebp - 0x44]
push dword [esi + ebx*4 + 0x10]
call fcn.0100c526
mov edi, eax
test edi, edi
jge 0x100d03b
push 0xc100801e
jmp 0x100d24f
push 0x10014bc
call fcn.0100f531
push 0x10014ac
mov dword [ebp - 0x38], eax
call fcn.0100f531
push 0x100149c
mov dword [ebp - 0x24], eax
call fcn.0100f531
xor ecx, ecx
cmp dword [ebp - 0x38], ecx
je 0x100d0ee
inc ecx
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x24], 0
je 0x100d0fc
inc ecx
mov dword [ebp - 0x28], 3
test eax, eax
je 0x100d108
inc ecx
mov dword [ebp - 0x28], 1
mov eax, dword [esi + 0xc]
sub eax, ebx
mov dword [ebp - 0x18], eax
test ecx, ecx
jbe 0x100d128
cmp ecx, 1
ja 0x100d11e
cmp eax, 1
je 0x100d128
push 0xc1008033
jmp 0x100d24f
lea ecx, [ebp - 0x1c]
push ecx
push eax
lea eax, [esi + ebx*4 + 0x10]
push eax
call fcn.0101158f
mov edi, eax
test edi, edi
jge 0x100d147
push 0xc100801d
jmp 0x100d24f
shl dword [ebp - 0x18], 4
jmp 0x100d03b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x10
pop ecx
push ecx
push edx
push dword [eax + 0x18]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100d1ca
push eax
push dword [esi + ebx*4 + 0x10]
call fcn.01010323
mov edi, eax
test edi, edi
jge 0x100d03b
push 0xc100801c
jmp 0x100d24f
lea ebx, [esi + ebx*4 + 0x10]
mov eax, dword [ebx]
lea ecx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
cmp di, dx
jne 0x100d198
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0x18], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x100d1d4
mov edi, 0xc000009a
jmp 0x100d255
push dword [ebx]
mov ecx, dword [ebp - 0x18]
shr ecx, 1
push ecx
push eax
call fcn.01012a9c
add esp, 0xc
jmp 0x100d03b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [esi + ebx*4 + 0x10]
push dword [ebp - 0x20]
call fcn.0100ca84
mov edi, eax
test edi, edi
jge 0x100d03b
push 0xc100801b
jmp 0x100d24f
cmp dword [ebp - 0x28], 0
jne 0x100d22f
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x40]
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
call fcn.0101a81a
jmp 0x100d244
push dword [ebp - 0x28]
lea eax, [ebp - 0x14]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x30]
call fcn.0101162e
mov edi, eax
test edi, edi
jge 0x100d255
push 0xc1008020
call fcn.010110ed
pop ecx
test esi, esi
je 0x100d26e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x3c], 0
pop esi
je 0x100d28c
push dword [ebp - 0x3c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x100d2a9
push dword [ebp - 0x1c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x2c], ebx
je 0x100d2b6
push dword [ebp - 0x2c]
call fcn.01017f42
cmp dword [ebp - 0x30], ebx
je 0x100d2c9
push dword [ebp - 0x30]
call fcn.010176be
cmp edi, ebx
jl 0x100d2c9
mov edi, eax
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.0101113d
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.010125ff
leave
ret