Function at 0x6f248b80
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags

Disassembly:
push ebp
mov ecx, edx
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [0x6f27a360]
test ebx, ebx
je 0x6f248d68
test byte [0x6f266160], 8
jne 0x6f248d2f
mov eax, 0x6f27a388
xor ebx, ebx
jmp 0x6f248bbf
add ebx, 1
add eax, 0x14
cmp ebx, 0x14
je 0x6f248d20
mov edx, dword [eax]
test edx, edx
jne 0x6f248bb0
lea esi, [ebx*4]
mov dword [esp], edi
lea edx, [esi + ebx]
lea ebp, [edx*4]
lea eax, [ebp + 0x6f27a380]
mov dword [ebp + 0x6f27a380], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.kernel32.dll_LockResource]
movd xmm0, edi
mov edi, ebx
movd xmm1, eax
sub esp, 4
punpckldq xmm0, xmm1
movq qword [ebp + 0x6f27a384], xmm0
test byte [0x6f266160], 8
jne 0x6f248d86
xor ecx, ecx
lea eax, [esi + ebx]
mov edx, dword [eax*4 + 0x6f27a388]
cmp word [edx], 0
je 0x6f248c55
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6f248c30
sub eax, edx
add eax, 2
add edx, eax
movzx eax, word [edx + 4]
add edx, 6
test ax, ax
jne 0x6f248c70
add ecx, 1
cmp word [edx], 0
jne 0x6f248c27
mov eax, 2
add edx, eax
movzx eax, word [edx + 4]
add edx, 6
test ax, ax
je 0x6f248c4c
lea esi, [esi]
nop
cmp ax, 6
jne 0x6f248c21
movzx ebp, cx
mov dword [esp + 4], 0
add esi, ebx
xor ebx, ebx
lea edx, [ebp*4]
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, eax
sub esp, 0xc
lea eax, [esi*4 + 0x6f27a380]
mov ecx, dword [eax + 8]
mov dword [eax + 0x10], edx
mov dword [eax + 0xc], ebp
cmp word [ecx], 0
je 0x6f248cf5
mov eax, ecx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6f248cc8
sub eax, ecx
add eax, 2
add eax, ecx
movzx esi, word [eax + 4]
add eax, 6
test si, si
jne 0x6f248d10
movzx esi, bx
add ebx, 1
mov dword [edx + esi*4], ecx
mov ecx, eax
cmp word [ecx], 0
jne 0x6f248cc0
mov eax, 2
add eax, ecx
movzx esi, word [eax + 4]
add eax, 6
test si, si
je 0x6f248ce4
lea esi, [esi]
nop
cmp si, 6
jne 0x6f248ced
add esp, 0x3c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x3c
mov edi, 0xffff
pop ebx
mov eax, edi
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x6f26a257
mov dword [esp + 8], str.MCI_SetCommandTable
mov dword [esp + 4], 0x6f266160
mov dword [esp], 3
mov dword [esp + 0x24], ecx
call fcn.6f2486f0
mov ecx, dword [esp + 0x24]
jmp 0x6f248ba6
xor eax, eax
mov dword [esp + 0x24], edx
mov dword [0x6f27a360], 1
call fcn.6f248f80
mov ecx, dword [esp + 0x24]
jmp 0x6f248b99
mov dword [esp], 0x6f266160
call fcn.6f264d10
test al, 8
je 0x6f248c15
test byte [0x6f266160], 8
jne 0x6f248ec8
lea eax, [esi + ebx]
mov edx, dword [eax*4 + 0x6f27a388]
test edx, edx
je case.0x6f248f29.0
mov eax, edx
mov dword [esp + 0x28], 0
xor ebp, ebp
movzx ecx, word [eax]
add ebp, 1
mov word [esp + 0x2e], cx
test cx, cx
je 0x6f248f11
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6f248dd8
lea ecx, [eax + 2]
cmp word [ecx + 4], 0xc
mov eax, dword [eax + 2]
mov dword [esp + 0x24], eax
lea eax, [ecx + 6]
ja case.0x6f248f29.0
movzx ecx, word [ecx + 4]
jmp dword [ecx*4 + 0x6f26a2a8]
mov ecx, dword [esp + 0x28]
test ecx, ecx
je case.0x6f248df9.0
test byte [0x6f266160], 2
je 0x6f248c15
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Ooops:__d_is_not_valid_n
mov dword [esp + 8], str.MCI_DumpCommandTable
mov dword [esp + 4], 0x6f266160
mov dword [esp], 1
call fcn.6f2486f0
jmp 0x6f248c15
mov ecx, dword [esp + 0x28]
test ecx, ecx
jne case.0x6f248f29.0
mov dword [esp + 0x28], 1
jmp case.0x6f248df9.0
mov ebp, dword [esp + 0x24]
test ebp, ebp
jne 0x6f248dbf
jmp case.0x6f248f29.0
mov ebp, dword [esp + 0x24]
test ebp, ebp
setne al
cmp word [esp + 0x2e], 0
setne cl
or al, cl
jne case.0x6f248f29.0
nop
cmp word [edx], 0
je 0x6f248f0a
mov eax, edx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6f248e90
sub eax, edx
add eax, 2
add eax, edx
cmp word [eax + 4], 6
lea edx, [eax + 6]
jne 0x6f248e80
jmp 0x6f248c15
mov ecx, dword [esp + 0x28]
test ecx, ecx
jne case.0x6f248f29.0
mov dword [esp + 0x28], 0
jmp case.0x6f248df9.0
mov eax, dword [ebp + 0x6f27a380]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Dumping_cmdTbl_d__lpTable_p_devType_d__n
mov dword [esp + 8], str.MCI_IsCommandTableValid
mov dword [esp + 4], 0x6f266160
mov dword [esp + 0x14], eax
mov dword [esp], 3
call fcn.6f2486f0
jmp 0x6f248da7
mov eax, 2
jmp 0x6f248e9e
mov ecx, dword [eax + 2]
add eax, 8
mov dword [esp + 0x24], ecx
movzx ecx, word [eax - 2]
cmp cx, 0xc
ja case.0x6f248f29.0
jmp dword [ecx*4 + 0x6f26a2dc]
mov ecx, dword [esp + 0x24]
test ecx, ecx
jne case.0x6f248f29.0
test ebp, ebp
jne 0x6f248dbf
jmp case.0x6f248f29.0
mov ecx, dword [esp + 0x24]
test ecx, ecx
jne case.0x6f248f29.0
mov ecx, dword [esp + 0x28]
test ecx, ecx
jne 0x6f248ebb
jmp case.0x6f248f29.0
cmp ebp, 1
je case.0x6f248df9.0
jmp case.0x6f248f29.0