Function at 0x10026470
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10065a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x10c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0x10025e80
call fcn.10018670
mov esi, eax
test esi, esi
je 0x10026857
push edi
push 0x10025ee0
push esi
call fcn.10001330
push 1
push 0x10004fa0
push 0x1004fd98
push esi
call fcn.10003830
push 0xfffffffffffffffe
push esi
call fcn.10002670
push 1
push 0x1001bd80
push str.string
push esi
call fcn.10003830
push 0xfffffffffffffffe
push esi
call fcn.10002670
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test ebx, ebx
je 0x1002684e
push ebx
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x110], edi
test edi, edi
je 0x1002684e
push ebx
push dword [ebp - 0x10c]
push edi
call fcn.10027730
add esp, 0xc
push edi
push ebx
push dword [ebp - 0x10c]
call fcn.10025e30
push 0
push str.main
push ebx
push edi
push esi
call fcn.100035d0
push ebx
mov ebx, dword [ebp - 0x110]
mov edi, eax
push 0
push ebx
call fcn.10027e90
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
jne 0x10026844
push edi
push edi
push esi
call fcn.10001590
push edi
push 0x100263f0
push esi
call fcn.10001ec0
push edi
push 1
push 0xfffffffffffffffe
push esi
call fcn.10002380
push edi
push 0x100261f0
push esi
call fcn.10001ec0
push edi
push 2
push 0xfffffffffffffffe
push esi
call fcn.10002380
push edi
push 0x10026390
push esi
call fcn.10001ec0
push edi
push 3
push 0xfffffffffffffffe
push esi
call fcn.10002380
push edi
push 0x100260d0
push esi
call fcn.10001ec0
push edi
push 4
push 0xfffffffffffffffe
push esi
call fcn.10002380
push edi
push 0x10025f00
push esi
call fcn.10001ec0
push edi
push 5
push 0xfffffffffffffffe
push esi
call fcn.10002380
push edi
push 0x10026360
push esi
call fcn.10001ec0
push edi
push 6
push 0xfffffffffffffffe
push esi
call fcn.10002380
push edi
push 0x10025ff0
push esi
call fcn.10001ec0
push edi
push 7
push 0xfffffffffffffffe
push esi
call fcn.10002380
push edi
push 0x100261c0
push esi
call fcn.10001ec0
push edi
push 8
push 0xfffffffffffffffe
push esi
call fcn.10002380
mov eax, sym.imp.KERNEL32.dll_GetLastError
mov edi, 0x5a4d
mov eax, dword [eax]
and eax, 0xffff0000
cmp word [eax], di
je 0x1002664c
sub eax, 0x10000
cmp word [eax], di
jne 0x10026642
push eax
push esi
call fcn.10001fc0
push 0
push 0x3c
push 0xfffffffffffffffe
push esi
call fcn.10002380
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
and eax, 0xffff0000
cmp word [eax], di
je 0x1002667f
sub eax, 0x10000
cmp word [eax], di
jne 0x10026675
push eax
push esi
call fcn.10001fc0
push 0
push 0x3d
push 0xfffffffffffffffe
push esi
call fcn.10002380
mov eax, 0xffff0000
and eax, dword [ebp + 4]
cmp word [eax], di
je 0x100266aa
nop
sub eax, 0x10000
cmp word [eax], di
jne 0x100266a0
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.10002080
push 0
push 0xc8
push 0xfffffffffffffffe
push esi
call fcn.10002380
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
push dword [ebp - 0x10c]
push esi
call fcn.10001e90
push 0
push 0xc9
push 0xfffffffffffffffe
push esi
call fcn.10002380
push 0
push esi
call fcn.10001e90
push 0
push 0xca
push 0xfffffffffffffffe
push esi
call fcn.10002380
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0x7be6ca1
push 0
push 0x12
push esi
mov dword [ebp - 0x90], 0xaa2feff7
mov dword [ebp - 0x8c], 0x2e27bc62
mov dword [ebp - 0x88], 0xdaf166f6
mov dword [ebp - 0x84], 0xfbdcfa66
mov dword [ebp - 0x80], 0x7100da0e
mov dword [ebp - 0x7c], 0x1d209657
mov dword [ebp - 0x78], 0xa4e017bf
movlpd qword [ebp - 0x74], xmm0
movlpd qword [ebp - 0x6c], xmm0
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0xe2b65793
mov dword [ebp - 0x10], 0xdcf6787a
mov dword [ebp - 0xc], 0x24fdc394
mov dword [ebp - 8], 0xc4ffda0f
call fcn.10001590
xor edi, edi
nop word [eax + eax]
mov edx, dword [ebp + edi*8 - 0x94]
mov eax, edx
mov ecx, dword [ebp + edi*8 - 0x90]
inc edi
or eax, ecx
je 0x1002680a
push ecx
push edx
push esi
call fcn.10001f90
mov eax, edi
cdq
push edx
push eax
push 0xfffffffffffffffe
push esi
call fcn.10002380
cmp edi, 0x12
jb 0x100267e0
push 0
push 0x78
push 0xfffffffffffffffe
push esi
call fcn.10002380
push 0
push 0
push 0
push 1
push 1
push esi
call fcn.10001db0
test eax, eax
jne 0x10026844
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004cf0e
mov esp, ebp
pop ebp
ret 8
push 0
push 0xffffffffffffffff
push esi
call fcn.100028a0
push esi
call fcn.100185c0
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1004cf0e
mov esp, ebp
pop ebp
ret 8