Function at 0x10011c90
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100cc77b
push eax
mov eax, 0xfad4
mov dword fs:[0], esp
call fcn.10002fa0
push ebx
mov ebx, dword [esp + 0xfae8]
push esi
mov esi, ecx
push ebx
call fcn.100118f0
push ebx
mov ecx, esi
call fcn.10011c20
push 2
lea ecx, [esp + 0x30]
call fcn.10003620
xor eax, eax
mov dword [esp + 0x2c], 0x100cd3c8
mov dword [esp + 0xfad8], eax
mov byte [esp + 0x214], al
mov byte [esp + 0xf9d8], al
mov ecx, dword [esi + 0x10]
mov dword [esp + 0xfae4], eax
cmp ecx, eax
mov dword [esp + 0xc], eax
jle 0x10011eaa
push ebp
push edi
mov eax, dword [esi + 0xc]
xor edi, edi
test eax, eax
mov dword [esp + 0x20], edi
jle 0x10011e92
sub eax, edi
cmp eax, 0x11
jge 0x10011d2a
mov ebx, eax
mov dword [esp + 0x18], ebx
jmp 0x10011d36
mov dword [esp + 0x18], 0x11
mov ebx, dword [esp + 0x18]
mov ebp, dword [esi + 0x10]
mov ecx, dword [esp + 0x14]
sub ebp, ecx
cmp ebp, 0xf
jl 0x10011d49
mov ebp, 0xf
lea ecx, [esp + 0x34]
call fcn.10004290
cmp ebx, eax
jne 0x10011d63
lea ecx, [esp + 0x34]
call fcn.10004280
cmp ebp, eax
je 0x10011d72
push 0
push 8
push ebp
push ebx
lea ecx, [esp + 0x44]
call fcn.10003960
mov ecx, esi
call fcn.10004110
test al, al
je 0x10011da2
push 0
lea ecx, [esp + 0x38]
call fcn.100040c0
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.10004070
mov ecx, dword [eax]
push ecx
push 0
lea ecx, [esp + 0x3c]
call fcn.100049d0
xor ecx, ecx
test ebp, ebp
mov dword [esp + 0x1c], ecx
jbe 0x10011e54
mov eax, dword [esp + 0x18]
xor ebx, ebx
test eax, eax
jbe 0x10011e47
mov al, cl
mov dl, 0x11
imul dl
inc al
mov byte [esp + 0x13], al
jmp 0x10011dd4
mov al, byte [esp + 0x13]
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
add al, bl
mov byte [esp + 0x24], al
mov eax, dword [esi + 0x10]
sub eax, edx
push 1
sub eax, ebp
lea edx, [esp + 0x2c]
add eax, ecx
lea ecx, [ebx + edi]
push eax
push ecx
push edx
mov ecx, esi
call fcn.10004c80
mov eax, dword [eax]
mov edi, dword [esp + 0x24]
push eax
push edi
lea ecx, [esp + 0x3c]
call fcn.100049d0
lea ecx, [esp + 0x2c]
push edi
push ecx
lea ecx, [esp + 0x3c]
call fcn.10004a40
mov edx, dword [eax]
lea ecx, [esp + 0x34]
push edx
call fcn.10005150
push eax
mov eax, dword [esp + 0x20]
push eax
push ebx
lea ecx, [esp + 0x40]
call fcn.10004f20
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
inc ebx
cmp ebx, eax
jb 0x10011dcc
mov edi, dword [esp + 0x20]
inc ecx
cmp ecx, ebp
mov dword [esp + 0x1c], ecx
jb 0x10011db0
mov ecx, dword [esp + 0x14]
push ecx
push edi
lea ecx, [esp + 0x3c]
call fcn.10004790
mov ebx, dword [esp + 0xfaf4]
lea ecx, [esp + 0x34]
push ebx
call fcn.100119b0
push 1
push ebx
lea ecx, [esp + 0x3c]
call fcn.10011ad0
mov eax, dword [esi + 0xc]
add edi, 0x11
cmp edi, eax
mov dword [esp + 0x20], edi
jl 0x10011d1b
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x10]
add eax, 0xf
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x10011d0a
pop edi
pop ebp
mov edx, dword [ebx]
push 0x3b
mov ecx, ebx
call dword [edx + 0x28]
lea ecx, [esp + 0x2c]
mov dword [esp + 0xfae4], 0xffffffff
mov dword [esp + 0x2c], sym.BuildBG.dll_const_CxImage::vftable
call fcn.100036f0
lea ecx, [esp + 0x2c]
call fcn.10003640
mov ecx, dword [esp + 0xfadc]
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0xfae0
ret 4