Function at 0x10018990
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051678
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x1005f424]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
call fcn.100197b0
lea ecx, [esi + 0x1518]
mov dword [ebp - 4], 0
call fcn.10019aa0
lea ecx, [esi + 0x1938]
call fcn.1003e750
mov dword [esi + 0x1a30], 0
mov dword [esi + 0x1a2c], 0
mov dword [esi + 0x1a34], 0
mov dword [esi + 0x1a3c], 0
mov dword [esi + 0x1a38], 0
mov dword [esi + 0x1a40], 0
mov dword [esi + 0x1a48], 0
mov dword [esi + 0x1a44], 0
mov dword [esi + 0x1a4c], 0
mov dword [esi + 0x1a54], 0
mov dword [esi + 0x1a50], 0
mov dword [esi + 0x1a58], 0
mov dword [esi + 0x1a60], 0
mov dword [esi + 0x1a5c], 0
mov dword [esi + 0x1a64], 0
mov dword [esi + 0x1a88], 0
lea eax, [esi + 0x1af0]
mov dword [esi + 0x1a84], 0
mov dword [esi + 0x1acc], 0
mov dword [esi + 0x1ac8], 0
push 0x60
push 0
push eax
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x58], 0
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [esi + 0x1b50], xmm0
mov dword [esi + 0x1b60], 0
mov dword [esi + 0x1b68], 0
mov dword [esi + 0x1b64], 0
mov dword [esi + 0x1b6c], 0
mov dword [esi + 0x1b74], 0
mov dword [esi + 0x1b70], 0
mov dword [esi + 0x1b78], 0
mov dword [esi + 0x1b80], 0
mov dword [esi + 0x1b7c], 0
mov dword [esi + 0x1b84], 0
mov dword [esi + 0x1b8c], 0
mov dword [esi + 0x1b88], 0
mov dword [esi + 0x1b90], 0
mov dword [esi + 0x1b98], 0
mov dword [esi + 0x1b94], 0
mov dword [esi + 0x1b9c], 0
mov dword [esi + 0x1ba4], 0
mov dword [esi + 0x1ba0], 0
mov dword [esi + 0x1ba8], 0
mov dword [esi + 0x1bb0], 0
mov dword [esi + 0x1bac], 0
mov dword [esi + 0x1bb4], 0
mov dword [esi + 0x1bbc], 0
mov dword [esi + 0x1bb8], 0
mov dword [esi + 0x1bc0], 0
mov dword [esi + 0x1bc8], 0
mov dword [esi + 0x1bc4], 0
mov dword [esi + 0x1bcc], 0
mov dword [esi + 0x1c04], 0
mov dword [esi + 0x1c08], 0
mov dword [esi + 0x1c0c], 0
mov dword [esi + 0x1c10], 0
mov dword [esi + 0x1c2c], 0
mov dword [esi + 0x1c30], 0
mov dword [esi + 0x1c34], 0
mov dword [esi + 0x1c38], 0
mov dword [esi + 0x1c7c], 0
mov dword [esi + 0x1c58], 0
mov dword [esi + 0x1c60], 0
mov dword [esi + 0x1c5c], 0
mov dword [esi + 0x1c6c], 0x7f7fffff
mov dword [esi + 0x1c68], 0x7f7fffff
mov dword [esi + 0x1c64], 0x7f7fffff
mov dword [esi + 0x1c70], 0
mov dword [esi + 0x1c74], 0
mov dword [esi + 0x1c78], 0
mov dword [esi + 0x1c7c], 0
mov dword [esi + 0x1ca4], 0
mov dword [esi + 0x1c80], 0
mov dword [esi + 0x1c88], 0
mov dword [esi + 0x1c84], 0
mov dword [esi + 0x1c94], 0x7f7fffff
mov dword [esi + 0x1c90], 0x7f7fffff
mov dword [esi + 0x1c8c], 0x7f7fffff
mov dword [esi + 0x1c98], 0
mov dword [esi + 0x1c9c], 0
mov dword [esi + 0x1ca0], 0
mov dword [esi + 0x1ca4], 0
mov dword [esi + 0x1ccc], 0
mov dword [esi + 0x1ca8], 0
mov dword [esi + 0x1cb0], 0
mov dword [esi + 0x1cac], 0
mov dword [esi + 0x1cbc], 0x7f7fffff
mov dword [esi + 0x1cb8], 0x7f7fffff
mov dword [esi + 0x1cb4], 0x7f7fffff
mov dword [esi + 0x1cc0], 0
mov dword [esi + 0x1cc4], 0
mov dword [esi + 0x1cc8], 0
mov dword [esi + 0x1ccc], 0
mov dword [esi + 0x1d30], 0
mov dword [esi + 0x1d2c], 0
mov dword [esi + 0x1d24], 0
mov dword [esi + 0x1d28], 0
movups xmmword [esi + 0x1d38], xmm0
movups xmmword [esi + 0x1d48], xmm0
mov word [esi + 0x1d58], 0
mov dword [esi + 0x1d34], 0xffffffff
mov byte [esi + 0x1d5a], 0
mov dword [esi + 0x1d5c], 0
mov dword [esi + 0x1d60], 0
mov dword [esi + 0x1d64], 0
mov dword [esi + 0x1d68], 0
mov dword [esi + 0x1d8c], 0
mov dword [esi + 0x1d88], 0
mov dword [esi + 0x1d90], 0
mov dword [esi + 0x1dac], 0
mov dword [esi + 0x1da8], 0
mov dword [esi + 0x1db0], 0
mov dword [esi + 0x1db8], 0
mov dword [esi + 0x1db4], 0
mov dword [esi + 0x1dbc], 0
mov dword [esi + 0x1dc0], 0
mov dword [esi + 0x1dc8], 0
mov dword [esi + 0x1dc4], 0
mov dword [esi + 0x1dcc], 0
mov dword [esi + 0x1dd4], 0
mov dword [esi + 0x1dd0], 0
mov dword [esi + 0x1dd8], 0
mov dword [esi + 0x1de0], 0
mov dword [esi + 0x1ddc], 0
mov dword [esi + 0x1de4], 0
mov dword [esi + 0x1df0], 0
mov dword [esi + 0x1dec], 0
mov dword [esi + 0x1df4], 0
mov dword [esi + 0x1dfc], 0
mov dword [esi + 0x1df8], 0
mov dword [esi + 0x1e00], 0
mov dword [esi + 0x1e04], 0
mov dword [esi + 0x1e0c], 0
mov dword [esi + 0x1e08], 0
mov dword [esi + 0x1e10], 0
mov dword [esi + 0x1e18], 0
mov dword [esi + 0x1e14], 0
mov dword [esi + 0x1e1c], 0
lea eax, [esi + 0x1e28]
mov dword [esi + 0x1e24], 0
mov dword [esi + 0x1e20], 0
push 0xe7c
push 0
push eax
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x2c], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea ecx, [esi + 0x2ca4]
mov byte [ebp - 4], 0x17
call fcn.1003e810
mov dword [esi + 0x2d20], 0
mov dword [esi + 0x2d1c], 0
mov dword [esi + 0x2d18], 0
mov dword [esi + 0x2d14], 0
mov dword [esi + 0x2d44], 0
mov dword [esi + 0x2d40], 0
mov dword [esi + 0x2d48], 0
mov dword [esi + 0x2d50], 0
mov dword [esi + 0x2d4c], 0
mov dword [esi + 0x2d54], 0
mov dword [esi + 0x2d5c], 0
mov dword [esi + 0x2d58], 0
mov dword [esi + 0x2d64], 0
mov dword [esi + 0x2d60], 0
mov dword [esi + 0x2d74], 0
mov dword [esi + 0x2d70], 0
mov dword [esi + 0x2d78], 0
mov dword [esi + 0x2d80], 0
mov dword [esi + 0x2d7c], 0
mov dword [esi + 0x2d84], 0
mov dword [esi + 0x2d8c], 0
mov dword [esi + 0x2d88], 0
mov dword [esi + 0x2d90], 0
mov dword [esi + 0x2d98], 0
mov dword [esi + 0x2d94], 0
mov dword [esi + 0x2d9c], 0
mov dword [esi + 0x2da4], 0
mov dword [esi + 0x2da0], 0
mov dword [esi + 0x2da8], 0
mov dword [esi + 0x2dc0], 0
mov dword [esi + 0x2dbc], 0
mov dword [esi + 0x2dc4], 0
mov ecx, dword [ebp + 8]
test ecx, ecx
mov dword [esi + 0x2dec], 0x1000000
mov byte [esi + 0x2df0], 1
sete al
mov dword [esi + 0x2df4], 0xffffffff
mov dword [esi + 0x2df8], 0xffffffff
mov byte [ebp - 4], 0x20
mov byte [esi], 0
mov byte [esi + 1], al
mov dword [esi + 0x192c], 0
mov dword [esi + 0x1934], 0
mov dword [esi + 0x1930], 0
test ecx, ecx
jne 0x100191e7
mov eax, dword [0x1005fdc0]
test eax, eax
je 0x100191b2
inc dword [eax + 0x370]
push dword [0x1005fdc8]
push 0x468
call dword [0x1005f260]
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 0xb]
add esp, 8
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0x21
test eax, eax
je 0x100191e3
mov ecx, eax
call fcn.1003e8b0
jmp 0x100191e5
xor eax, eax
mov ecx, eax
mov dword [esi + 0x98], ecx
xorps xmm0, xmm0
movsd qword [esi + 0x1a08], xmm0
mov dword [esi + 0x1a10], 0
mov dword [esi + 0x1a18], 0xffffffff
mov dword [esi + 0x1a14], 0xffffffff
mov dword [esi + 0x1a1d], 0
mov byte [esi + 0x1a1c], 0
mov dword [esi + 0x1a24], 0
mov dword [esi + 0x1a28], 0
mov dword [esi + 0x1a68], 0
mov dword [esi + 0x1a6c], 0
mov dword [esi + 0x1a70], 0
mov dword [esi + 0x1a74], 0
mov dword [esi + 0x1a78], 0
mov dword [esi + 0x1a7c], 0
mov dword [esi + 0x1a80], 0
mov dword [esi + 0x1a8c], 0
mov dword [esi + 0x1a94], 0
mov dword [esi + 0x1a90], 0
mov dword [esi + 0x1a98], 0
mov dword [esi + 0x1aa0], 0
mov dword [esi + 0x1a9c], 0
mov dword [esi + 0x1aa4], 0
mov dword [esi + 0x1aa8], 0
mov dword [esi + 0x1aac], 0
mov dword [esi + 0x1ab0], 0
mov word [esi + 0x1ab4], 0
mov byte [esi + 0x1ab6], 0
mov dword [esi + 0x1ab8], 0
mov dword [esi + 0x1abc], 0
mov dword [esi + 0x1ac0], 0
mov dword [esi + 0x1ac4], 0
mov dword [esi + 0x1ac8], 0xbf800000
mov dword [esi + 0x1acc], 0xbf800000
mov dword [esi + 0x1ad0], 0
mov dword [esi + 0x1ad4], 0
mov dword [esi + 0x1ad8], 0
mov dword [esi + 0x1adc], 0
mov word [esi + 0x1ae0], 0
mov dword [esi + 0x1ae4], 0
mov dword [esi + 0x1ae8], 0
mov dword [esi + 0x1aec], 0
mov dword [esi + 0x1bd0], 0
mov dword [esi + 0x1be8], 0
mov dword [esi + 0x1be4], 0
mov dword [esi + 0x1be0], 0
mov dword [esi + 0x1bdc], 0
mov dword [esi + 0x1bd8], 0
mov dword [esi + 0x1bd4], 0
mov dword [esi + 0x1bfc], 0
mov dword [esi + 0x1bf4], 0
mov dword [esi + 0x1bf0], 0
mov dword [esi + 0x1bec], 0
mov dword [esi + 0x1bf8], 0
mov dword [esi + 0x1c00], 0
mov dword [esi + 0x1c04], 0
mov dword [esi + 0x1c08], 0
mov dword [esi + 0x1c0c], 0
mov dword [esi + 0x1c10], 0
mov dword [esi + 0x1c14], 0
mov dword [esi + 0x1c18], 0
mov dword [esi + 0x1c1c], 0x7fffffff
mov dword [esi + 0x1c20], 0x10000
mov word [esi + 0x1c24], 0
mov byte [esi + 0x1c26], 0
mov dword [esi + 0x1c28], 0
mov byte [esi + 0x1c3c], 0
mov dword [esi + 0x1c40], 0
mov dword [esi + 0x1c44], 0
mov dword [esi + 0x1c48], 0
mov dword [esi + 0x1c54], 0xffffffff
mov dword [esi + 0x1c50], 0xffffffff
mov dword [esi + 0x1c4c], 0xffffffff
mov dword [esi + 0x1cd0], 0
mov dword [esi + 0x1cd4], 0
mov dword [esi + 0x1ce0], 0
mov dword [esi + 0x1cdc], 0
mov dword [esi + 0x1cd8], 0
mov dword [esi + 0x1ce8], 0
mov dword [esi + 0x1ce4], 0
mov byte [esi + 0x1cec], 0
lea eax, [esi + 0x2dfc]
mov dword [esi + 0x1cf4], 0
mov dword [esi + 0x1cf0], 0
mov dword [esi + 0x1cfc], 0x7fffffff
mov dword [esi + 0x1cf8], 0x7fffffff
mov dword [esi + 0x1d04], 0x7fffffff
mov dword [esi + 0x1d00], 0x7fffffff
mov byte [esi + 0x1d08], 0
mov dword [esi + 0x1d0c], 0
mov dword [esi + 0x1d10], 0
mov word [esi + 0x1d15], 0
mov byte [esi + 0x1d14], 0
mov dword [esi + 0x1d18], 0
mov dword [esi + 0x1d1c], 0xffffffff
mov dword [esi + 0x1d20], 0xffffffff
mov dword [esi + 0x1d6c], 0
mov dword [esi + 0x1d70], 0
mov dword [esi + 0x1d74], 0
mov dword [esi + 0x1d78], 0
mov dword [esi + 0x1d7c], 0
mov dword [esi + 0x1d80], 0xffffffff
mov dword [esi + 0x1d84], 0
movups xmmword [esi + 0x1d94], xmm0
mov dword [esi + 0x1da4], 0
mov dword [esi + 0x1de8], 0
mov dword [esi + 0x1e20], 0
mov dword [esi + 0x1e24], 0
mov dword [esi + 0x2cf8], 0
mov dword [esi + 0x2cfc], 0xa900000
mov dword [esi + 0x2d04], 0
mov dword [esi + 0x2d00], 0
mov dword [esi + 0x2d10], 0x7f7fffff
mov dword [esi + 0x2d0c], 0x7f7fffff
mov dword [esi + 0x2d08], 0x7f7fffff
mov dword [esi + 0x2d24], 0
mov word [esi + 0x2d28], 0
mov dword [esi + 0x2d2c], 0
mov dword [esi + 0x2d30], 0x3c23d70a
mov dword [esi + 0x2d34], 0
mov dword [esi + 0x2d38], 0
mov dword [esi + 0x2d3c], 0x3f000000
mov dword [esi + 0x2d60], 0x7f7fffff
mov dword [esi + 0x2d64], 0x7f7fffff
mov dword [esi + 0x2d58], 0x7f7fffff
mov dword [esi + 0x2d5c], 0x7f7fffff
mov word [esi + 0x2d68], 0x2e
mov dword [esi + 0x2d6c], 0
mov dword [esi + 0x2dac], 0
mov byte [esi + 0x2db0], 0
mov dword [esi + 0x2db4], 0
mov dword [esi + 0x2dcc], 0
mov dword [esi + 0x2dc8], 0
mov dword [esi + 0x2db8], 0
mov dword [esi + 0x2dd0], 0x7f7fffff
mov byte [esi + 0x2dd4], 0
mov dword [esi + 0x2dd8], 0
mov dword [esi + 0x2de0], 2
push 0x1e0
mov dword [esi + 0x2ddc], 2
push 0
mov byte [esi + 0x2de4], 0
push eax
mov dword [esi + 0x2de8], 0
call sub.VCRUNTIME140.dll_memset
mov dword [esi + 0x2fdc], 0
lea eax, [esi + 0x2ff0]
mov dword [esi + 0x2fe0], 0
push 0xc01
mov dword [esi + 0x2fec], 0xffffffff
push 0
mov dword [esi + 0x2fe8], 0xffffffff
push eax
mov dword [esi + 0x2fe4], 0xffffffff
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4