Function at 0x10001426
Capabilities:
Access peb ldr_data

Disassembly:
sub ecx, 4
mov edi, edi
jmp 0x10002004
push ebx
xchg cl, cl
push esi
mov dx, dx
push edi
mov bl, bl
jmp 0x10001414
push 4
mov cx, cx
add eax, 0x200
push ebp
pop ebp
jmp 0x100016aa
push ebp
push ecx
pop ecx
add ebp, 0x1b6e30ba
add ebp, 0xf185e46
inc ebp
xor ebp, dword [esp]
mov ebp, esp
and esp, 0xfffffff8
mov cx, cx
sub esp, 0x1c
mov bx, bx
mov al, cl
xor eax, esp
and eax, 0
add eax, dword [0x100034c0]
jmp 0x100011c4
push eax
nop
call fcn.10001296
nop
dec esi
shl esi, cl
mov esi, edx
shr esi, cl
mov esi, eax
mov dword [esp + 0x14], esi
push ebp
pop ebp
call fcn.100011a0
push edi
pop edi
jmp 0x100018b7
shl al, cl
mov eax, dword [0x100034c8]
or bl, al
or ebx, dword [esp + 0xc]
mov ebx, dword [eax + 0x3c]
add ebx, eax
push ecx
pop ecx
jmp 0x1000192c
movzx ecx, word [ebx + 0x14]
nop
nop
nop
nop
nop
push 2
xchg cx, cx
add dl, bl
add dl, 0x89
pop edx
jmp 0x10001a85
cmp word [ebx + 6], dx
mov bl, bl
mov dword [esp + 0x24], ebx
nop
nop
nop
nop
nop
nop
nop
nop
lea ecx, [ecx + ebx + 0x18]
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0xc], esi
nop
nop
nop
nop
nop
mov dword [esp + 0x10], edx
nop
nop
nop
nop
nop
jbe 0x10001dd2
jmp 0x10001bdf
lea edx, [ecx + 0x60]
nop
nop
nop
nop
jmp 0x10001bf5
and eax, dword [esp]
mov eax, dword [0x100034c8]
and ecx, 0x195f2ccb
and cx, dx
or cl, cl
mov ecx, dword [edx]
mov dword [esp + 0x18], ecx
xchg dx, dx
and ecx, dword [esp + 0x18]
inc cx
xor cl, bl
mov ecx, dword [edx - 4]
add ecx, eax
push eax
pop eax
mov dword [esp + 0x1c], ecx
xchg dx, dx
jmp 0x10001c63
rol ecx, cl
xor ecx, 0x76ba0fce
mov cx, bx
add cx, 0x2cf2
and ecx, 0x2f4c5013
mov ecx, dword [esp + 0x18]
xor esi, 0x17fb1b63
add esi, 0x3af209ea
mov esi, dword [esp + 0x1c]
xor edi, esp
and edi, 0x72db2942
and edi, ebx
add edi, 0x92b141c
xor edi, dword [esp + 0x14]
mov edi, dword [esp + 0xc]
jmp 0x10001d3c
rep movsb byte es:[edi], byte [esi]
nop
nop
nop
nop
nop
mov eax, edi
xor eax, 0x7c696d23
xor al, 0x9e
sub ax, bx
xor ax, 0x1be8
mov eax, dword [edx]
add dword [esp + 0xc], eax
xchg ax, ax
movzx eax, word [ebx + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc dword [esp + 0x10]
xchg ebp, ebp
add edx, 0x28
mov dl, dl
cmp dword [esp + 0x10], eax
push ebx
pop ebx
jl 0x10001beb
shl esi, cl
and esi, 0x6e741e68
add esi, 0x670a01a6
ror esi, cl
mov esi, dword [esp + 0x14]
jmp 0x10001dd2
add al, dl
sub ax, 0x3af
mov eax, dword [0x100034c0]
inc ecx
shr cx, cl
dec cx
shr cx, cl
mov ecx, 0
add ecx, 0
add ecx, dword [0x100034b4]
and dword [esp + 0xc], 0
push ecx
pop ecx
or edi, 0x5f834818
dec edi
sub edi, 0x65006135
or edi, dword [esp + 0xc]
mov edi, 0
add edi, dword [0x100034b8]
add eax, 0xfffffffc
xchg dx, dx
mov dword [esp + 0x10], ecx
nop
mov ecx, eax
mov ecx, eax
add eax, 4
cld
jmp 0x10001e50
cdq
nop
nop
nop
nop
nop
and edx, 3
mov al, al
add eax, edx
xchg ax, ax
sar eax, 2
nop
nop
nop
nop
nop
nop
shr ecx, 2
nop
nop
nop
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
lea ecx, [esi + ecx*4]
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x20], eax
nop
nop
nop
nop
nop
nop
nop
jmp 0x10001ec6
jle 0x10002015
mov dword [esp + 0x1c], eax
cld
jmp 0x10001f26
test edi, edi
nop
nop
nop
nop
nop
nop
nop
jle 0x1000103b
ror edx, cl
or dl, cl
mov edx, dword [ecx]
mov dword [esp + 0x18], edi
xchg bx, bx
sub dword [esp + 0x10], edx
nop
sub edx, dword [esp + 0x10]
cld
jmp 0x10001f8e
dec dword [esp + 0x18]
nop
nop
nop
nop
nop
nop
nop
jne 0x10001f42
shl al, cl
xor eax, dword [esp + 0x1c]
mov eax, edx
mov eax, dword [esp + 0x20]
mov dword [ecx], edx
xchg cl, cl
jmp 0x1000103b
dec dword [esp + 0x1c]
nop
nop
nop
nop
nop
nop
nop
jne 0x10001f26
test eax, eax
nop
nop
nop
nop
mov ecx, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jle 0x1000206f
dec dx
shr dx, cl
mov edx, eax
xor edi, 0x663d76c1
mov edi, dword [ecx]
jmp 0x10002052
add dword [esp + 0xc], edi
nop
add ecx, 4
xchg ax, ax
dec edx
nop
nop
nop
nop
nop
nop
jne 0x10002035
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, esi
nop
nop
nop
nop
nop
nop
nop
jle 0x100020ed
ror dword [esp + 0xc], 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dx, 0x229f
mov dx, 0x6d4
xor edx, dword [esp + 8]
mov edx, dword [esp + 0xc]
xor dword [ecx], edx
xchg al, al
jmp 0x100020dd
add ecx, 4
mov ecx, ecx
dec eax
nop
nop
nop
nop
jne 0x1000208b
push 4
push ebp
pop ebp
push dword [0x100034b0]
nop
call fcn.10001296
nop
jmp 0x10002117
mov dword [esp + 0x10], eax
cld
jmp 0x10002149
call fcn.100011a0
cld
test eax, eax
nop
nop
nop
nop
nop
je 0x100021d1
inc bx
mov ebx, ebp
or ebx, dword [esp + 0x24]
add bl, 0xcc
mov ebx, dword [esp + 0x10]
rol ax, cl
and eax, 0x5be16569
rol eax, cl
add ax, bx
sub ax, 0x1b2c
mov eax, dword [esp + 0x14]
call fcn.10001049
nop
nop
nop
nop
nop
nop
shr bx, cl
rol bl, cl
mov bx, bx
or bx, cx
inc ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
xchg dl, dl
jmp 0x100021d8
or dword [esp + 0x1c], 0xffffffff
xchg eax, eax
sub cx, 0x7000
xor cx, 0x5d3a
mov ecx, dword [esp + 0x1c]
inc esi
sub esi, ecx
dec esi
xor esi, 0x58a6369
and esi, edx
mov esi, dword [esp + 0x10]
push dword [0x100034c8]
shr edi, cl
and edi, ecx
mov edi, dword [esp + 0x10]
and edi, ecx
pop edi
jmp 0x1000223a
rep movsb byte es:[edi], byte [esi]
nop
nop
nop
nop
nop
nop
nop
nop
nop
push dword [esp + 0x14]
nop
call fcn.100012d0
mov dl, dl
push dword [esp + 0x10]
xchg esi, esi
call fcn.100012d0
push ebx
pop ebx
xor ax, dx
dec eax
shr ax, cl
xor eax, esp
xor eax, edi
mov eax, dword [ebx + 0xa0]
jmp 0x1000229d
test eax, eax
nop
nop
nop
nop
jmp 0x100022db
je 0x10002482
rol dx, cl
mov dx, ax
and edx, eax
inc dl
sub edx, edi
mov edx, 0
add edx, dword [0x100034c8]
or esi, 0x6ab3757a
rol esi, cl
add esi, 0x2f2740d3
sub esi, dword [esp + 0x20]
ror esi, cl
mov esi, edx
add eax, edx
nop
sub esi, dword [0x100034ac]
push edi
pop edi
jmp 0x10002477
xor ecx, ebp
add ecx, ebx
and cx, 0x22f0
xor cl, al
mov ecx, dword [eax + 4]
sub ecx, 8
mov ax, ax
shr ecx, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
test ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edi, [eax + 8]
nop
nop
nop
nop
nop
mov dword [esp + 0x14], edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x10002374
jle 0x10002472
mov dword [esp + 0x1c], ecx
nop
or ecx, dword [esp + 0x1c]
shl cx, cl
xor ecx, 0x6e7a744c
mov ecx, dword [esp + 0x14]
movzx ecx, word [ecx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
add edi, ecx
and edi, esi
and edi, 0x65950b21
rol edi, cl
sub edi, 0x4a122896
mov edi, ecx
and di, 0xf000
push ecx
pop ecx
cmp di, 0x3000
mov bl, bl
jne 0x10002458
and ecx, 0xfff
nop
jmp 0x1000240a
add ecx, dword [eax]
xchg ecx, ecx
add ecx, edx
xchg bx, bx
add dword [ecx], esi
nop
dec dl
and edx, dword [esp + 0x10]
or edx, 0x7235358c
shl dx, cl
sub edx, ebx
mov edx, 0
add edx, 0
add edx, dword [0x100034c8]
jmp 0x10002458
add dword [esp + 0x14], 2
mov cl, cl
dec dword [esp + 0x1c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x1000237f
add eax, dword [eax + 4]
nop
cmp dword [eax], 0
nop
jne 0x10002324
push dword fs:[0x30]
nop
nop
nop
nop
nop
nop
nop
nop
nop
or ax, 0x1a24
add eax, ecx
shr eax, cl
xor ax, 0x2ed3
pop eax
nop
nop
nop
nop
nop
mov eax, dword [eax + 0xc]
push ebp
pop ebp
mov eax, dword [eax + 0x1c]
xchg al, al
nop
nop
nop
nop
nop
mov eax, dword [eax]
nop
inc dx
xor dx, cx
or dl, 0xee
mov edx, dword [eax + 8]
push 0xf2509b84
nop
call fcn.100011e7
nop
dec cx
sub cl, dl
shl cx, cl
pop ecx
push 0xa412fd89
xchg cl, cl
mov dword [esp + 0x1c], eax
nop
nop
nop
nop
nop
nop
call fcn.100011e7
xchg al, al
mov ebx, dword [ebx + 0x80]
nop
test ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop ecx
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x24], eax
nop
nop
nop
nop
nop
je 0x10002674
add eax, 0x111508aa
xor eax, ebx
sub al, bl
inc eax
and eax, 0
add eax, 0
add eax, dword [0x100034c8]
nop
nop
nop
nop
nop
lea edi, [ebx + eax]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x10002668
xor eax, 0x5b435b78
add al, 0xf6
mov al, dl
xor al, al
shl ax, cl
mov eax, dword [edi + 0xc]
add eax, dword [0x100034c8]
nop
push eax
nop
call dword [esp + 0x28]
mov dl, dl
cmp eax, 0xffffffff
xchg eax, eax
mov dword [esp + 0x1c], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
je 0x10002662
and bx, ax
or ebx, dword [esp + 0x10]
ror bl, cl
ror bl, cl
add bl, 0xe8
mov ebx, dword [edi]
nop
nop
nop
nop
nop
test ebx, ebx
nop
nop
nop
nop
nop
jne 0x100025b7
mov ebx, 0x5edd4bfe
mov ebx, dword [edi + 0x10]
sub ax, bx
mov eax, 0
add eax, dword [0x100034c8]
inc esi
mov esi, dword [edi + 0x10]
add ebx, eax
mov ax, ax
nop
nop
nop
nop
nop
add esi, eax
xchg cl, cl
jmp 0x10002637
jns 0x100025f5
movzx eax, word [ebx]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x10002616
push dword [0x100034c8]
or cl, dl
add ecx, 0x34877e16
or cl, cl
inc cl
pop ecx
nop
nop
nop
nop
nop
add eax, ecx
nop
add eax, 2
nop
push eax
cld
push dword [esp + 0x20]
mov al, al
call dword [esp + 0x20]
nop
mov dword [esi], eax
mov bx, bx
add ebx, 4
nop
add esi, 4
nop
nop
nop
nop
nop
nop
or eax, dword [esp + 8]
add eax, dword [esp + 0xc]
sub eax, dword [esp + 0x14]
sub eax, edx
shr eax, cl
mov eax, dword [ebx]
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x100025dc
nop
nop
nop
nop
nop
add edi, 0x14
mov ax, ax
cmp dword [edi + 0x10], 0
nop
jne 0x1000254c
push dword fs:[0x30]
nop
nop
nop
nop
nop
mov al, 0x79
and ax, 0x56e3
inc eax
pop eax
mov eax, dword [eax + 0xc]
nop
or cl, cl
sub cx, 0x25a0
or cx, dx
or cx, bx
mov ecx, dword [eax + 0xc]
sub eax, 0x67717fe2
dec eax
inc al
or al, 0x34
mov eax, 0
add eax, dword [0x100034c8]
nop
nop
nop
nop
nop
mov ecx, dword [ecx]
nop
cmp dword [ecx + 0x18], eax
xchg ecx, ecx
nop
nop
nop
nop
nop
jne 0x100026ba
push 0
and edx, dword [esp + 0x20]
or dx, 0x293a
ror edx, cl
xor dx, ax
or dx, 0x5d37
pop edx
add edx, dword [0x100034a8]
nop
nop
nop
nop
nop
add edx, eax
xchg ax, ax
rol edi, cl
or edi, eax
pop edi
mov dword [ecx + 0x1c], edx
nop
push 0
and eax, esp
inc al
sub eax, edi
xor eax, 0x6bd602e3
pop eax
add eax, dword [0x100034c8]
add dword [0x100034a8], eax
cld
and esi, 0x374b1e9e
xor esi, esi
sub esi, 0x36a82df8
ror esi, cl
pop esi
xor bl, cl
shr ebx, cl
shr ebx, cl
pop ebx
shr esp, cl
and esp, 0x41b00d9c
add esp, ebp
xor esp, eax
mov esp, ebp
nop
nop
nop
nop
nop
and ebp, 0x3d6f3db2
mov ebp, ebp
rol ebp, cl
xor ebp, 0x162f0b6e
or ebp, dword [esp + 4]
pop ebp
ret