Function at 0x1010ea4a
Capabilities:
Access peb ldr_data
Check os version
Inspect section memory permissions
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor eax, eax
push ebx
push esi
push edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
call fcn.1010ea42
mov esi, eax
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1010ea8f
mov edx, dword [esi + 0x3c]
lea ecx, [edx - 0x40]
cmp ecx, 0x3bf
ja 0x1010ea8f
cmp dword [edx + esi], 0x4550
je 0x1010ea92
dec esi
jmp 0x1010ea6e
mov eax, dword fs:[0x30]
push 4
mov dword [ebp - 8], esi
mov dword [ebp - 0x2c], 2
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x38], 1
mov ebx, dword [eax + 0x14]
mov dword [ebp - 0x14], ebx
pop eax
test ebx, ebx
je 0x1010ec90
mov edx, dword [ebx + 0x28]
xor ecx, ecx
movzx edi, word [ebx + 0x24]
mov al, byte [edx]
ror ecx, 0xd
cmp al, 0x61
movzx eax, al
jb 0x1010ead5
add ecx, 0xffffffe0
add ecx, eax
add edi, 0xffff
inc edx
test di, di
jne 0x1010eac6
cmp ecx, 0x6a4abc5b
jne 0x1010ebdc
mov edi, dword [ebx + 0x10]
mov dword [ebp - 0xc], 5
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov dword [ebp - 0x34], eax
mov esi, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
add esi, edi
add eax, edi
mov dword [ebp - 0x10], eax
mov ebx, eax
mov ecx, dword [esi]
add ecx, edi
xor edx, edx
mov al, byte [ecx]
ror edx, 0xd
movsx eax, al
add edx, eax
inc ecx
mov al, byte [ecx]
test al, al
jne 0x1010eb1c
cmp edx, 0xec0e4e8e
je 0x1010eb53
cmp edx, 0x7c0dfcaa
je 0x1010eb53
cmp edx, 0x91afca54
je 0x1010eb53
cmp edx, 0x7946c61b
je 0x1010eb53
cmp edx, 0xef632f2
jne 0x1010ebc1
mov eax, dword [ebp - 0x34]
movzx ecx, word [ebx]
mov eax, dword [eax + 0x1c]
lea eax, [eax + ecx*4]
add eax, edi
cmp edx, 0xec0e4e8e
jne 0x1010eb72
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x20], eax
jmp 0x1010ebb4
cmp edx, 0x7c0dfcaa
jne 0x1010eb83
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x24], eax
jmp 0x1010ebb4
cmp edx, 0x91afca54
jne 0x1010eb94
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x18], eax
jmp 0x1010ebb4
cmp edx, 0x7946c61b
jne 0x1010eba5
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x30], eax
jmp 0x1010ebb4
cmp edx, 0xef632f2
jne 0x1010ebb4
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
add eax, 0xffff
mov dword [ebp - 0xc], eax
jmp 0x1010ebc4
mov eax, dword [ebp - 0xc]
push 4
pop ecx
add esi, ecx
push 2
pop ecx
add ebx, ecx
test ax, ax
jne 0x1010eb14
jmp 0x1010ec5c
cmp ecx, 0x3cfa685d
jne 0x1010ec5f
mov edx, dword [ebx + 0x10]
mov eax, dword [edx + 0x3c]
mov eax, dword [eax + edx + 0x78]
add eax, edx
mov dword [ebp - 0x34], eax
mov esi, dword [ebp - 0x34]
mov ebx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
add ebx, edx
add eax, edx
mov dword [ebp - 0x10], eax
xor eax, eax
inc eax
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx]
add ecx, edx
xor edi, edi
mov al, byte [ecx]
ror edi, 0xd
movsx eax, al
add edi, eax
inc ecx
mov al, byte [ecx]
test al, al
jne 0x1010ec11
cmp edi, 0x534c0ab8
jne 0x1010ec49
mov eax, dword [ebp - 0x10]
movzx ecx, word [eax]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
add eax, 0xffff
mov dword [ebp - 0xc], eax
jmp 0x1010ec4c
mov eax, dword [ebp - 0xc]
push 4
pop ecx
add ebx, ecx
push 2
pop ecx
add dword [ebp - 0x10], ecx
test ax, ax
jne 0x1010ec09
mov ebx, dword [ebp - 0x14]
cmp dword [ebp - 0x20], 0
je 0x1010ec7d
cmp dword [ebp - 0x24], 0
je 0x1010ec7d
cmp dword [ebp - 0x18], 0
je 0x1010ec7d
cmp dword [ebp - 0x1c], 0
je 0x1010ec7d
cmp dword [ebp - 0x28], 0
jne 0x1010ec8a
mov ebx, dword [ebx]
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x1010eabd
mov esi, dword [ebp - 8]
push 4
pop eax
mov edi, dword [esi + 0x3c]
push eax
add edi, esi
push 0x3000
mov dword [ebp - 0xc], edi
push dword [edi + 0x50]
push 0
call dword [ebp - 0x18]
push dword [edi + 0x50]
mov ebx, eax
push ebx
mov dword [ebp - 0x14], ebx
call dword [ebp - 0x1c]
mov edx, dword [edi + 0x54]
mov ecx, esi
test edx, edx
je 0x1010ecc9
mov esi, ebx
sub esi, dword [ebp - 8]
mov al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
dec edx
jne 0x1010ecc0
movzx eax, word [edi + 6]
movzx ecx, word [edi + 0x14]
test eax, eax
je 0x1010ed05
add ecx, 0x2c
add ecx, edi
mov edx, dword [ecx - 8]
dec eax
mov esi, dword [ecx]
add edx, ebx
add esi, dword [ebp - 8]
mov edi, dword [ecx - 4]
mov dword [ebp - 0x34], eax
test edi, edi
je 0x1010ecfb
mov al, byte [esi]
mov byte [edx], al
inc edx
inc esi
dec edi
jne 0x1010ecef
mov eax, dword [ebp - 0x34]
add ecx, 0x28
test eax, eax
jne 0x1010ecda
mov edi, dword [ebp - 0xc]
mov esi, dword [edi + 0x80]
add esi, ebx
mov dword [ebp - 0x1c], esi
cmp dword [esi], 0
je 0x1010ed94
mov eax, dword [esi + 0xc]
add eax, ebx
push eax
call dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1010ed86
mov edi, dword [esi + 0x10]
mov eax, dword [esi]
add edi, ebx
add eax, ebx
mov dword [ebp - 0x18], eax
cmp dword [edi], 0
je 0x1010ed86
mov esi, dword [ebp - 0x34]
test eax, eax
je 0x1010ed5f
mov ecx, dword [eax]
test ecx, ecx
jns 0x1010ed5f
mov eax, dword [esi + 0x3c]
movzx ecx, cx
mov eax, dword [eax + esi + 0x78]
sub ecx, dword [eax + esi + 0x10]
mov eax, dword [eax + esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x1010ed6b
mov eax, dword [edi]
add eax, 2
add eax, ebx
push eax
push esi
call dword [ebp - 0x24]
push 4
mov dword [edi], eax
mov eax, dword [ebp - 0x18]
pop ecx
add edi, ecx
test eax, eax
je 0x1010ed7e
add eax, ecx
mov dword [ebp - 0x18], eax
cmp dword [edi], 0
jne 0x1010ed39
mov esi, dword [ebp - 0x1c]
add esi, 0x14
mov dword [ebp - 0x1c], esi
cmp dword [esi], 0
jne 0x1010ed15
mov edi, dword [ebp - 0xc]
mov ecx, dword [edi + 0xa4]
mov eax, ebx
sub eax, dword [edi + 0x34]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], ecx
test ecx, ecx
je 0x1010ee50
mov esi, dword [edi + 0xa0]
mov edi, eax
add esi, ebx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 4]
test eax, eax
je 0x1010ee4d
mov edx, dword [esi]
add eax, 0xfffffff8
add edx, ebx
shr eax, 1
mov dword [ebp - 0x34], eax
lea eax, [esi + 8]
mov dword [ebp - 0x1c], eax
je 0x1010ee39
mov ebx, dword [ebp - 0x34]
mov esi, eax
movzx ecx, word [esi]
dec ebx
mov ax, cx
shr ax, 0xc
cmp ax, 0xa
je 0x1010edf5
cmp ax, 3
jne 0x1010ee00
and ecx, 0xfff
add dword [ecx + edx], edi
jmp 0x1010ee27
cmp ax, word [ebp - 0x38]
jne 0x1010ee17
and ecx, 0xfff
mov eax, edi
shr eax, 0x10
add word [ecx + edx], ax
jmp 0x1010ee27
cmp ax, word [ebp - 0x2c]
jne 0x1010ee27
and ecx, 0xfff
add word [ecx + edx], di
push 2
pop eax
add esi, eax
test ebx, ebx
jne 0x1010edde
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [esi + 4]
add esi, dword [esi + 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], esi
test ecx, ecx
jne 0x1010edba
mov edi, dword [ebp - 0xc]
movzx eax, word [edi + 6]
movzx ecx, word [edi + 0x14]
mov dword [ebp - 0x38], eax
test eax, eax
je 0x1010ef25
lea esi, [edi + 0x3c]
mov edi, eax
add esi, ecx
mov ecx, dword [esi - 0x18]
dec edi
and dword [ebp - 4], 0
add ecx, ebx
test dword [esi], 0x80000000
push 0
pop eax
push 8
pop edx
cmovne eax, edx
mov edx, 0x40000000
mov dword [ebp - 4], eax
test dword [esi], edx
cmovne eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
test dword [esi], 0x80000000
je 0x1010eea7
test dword [esi], edx
push 4
pop edx
cmovne eax, edx
mov dword [ebp - 4], eax
test dword [esi], 0x20000000
push 0x10
pop edx
cmovne eax, edx
mov dword [ebp - 4], eax
test dword [esi], 0x20000000
je 0x1010ef05
test dword [esi], 0x80000000
mov edx, 0x80
cmovne eax, edx
mov dword [ebp - 4], eax
test dword [esi], 0x20000000
je 0x1010ef05
test dword [esi], 0x40000000
push 0x20
pop edx
cmovne eax, edx
mov dword [ebp - 4], eax
test dword [esi], 0x20000000
je 0x1010ef05
test dword [esi], 0x80000000
je 0x1010ef05
test dword [esi], 0x40000000
push 0x40
pop edx
cmovne eax, edx
mov dword [ebp - 4], eax
cmp dword [esi - 0x14], 0
je 0x1010ef17
lea edx, [ebp - 4]
push edx
push eax
push dword [esi - 0x14]
push ecx
call dword [ebp - 0x30]
add esi, 0x28
test edi, edi
jne 0x1010ee6a
mov edi, dword [ebp - 0xc]
mov esi, dword [edi + 0x28]
xor edi, edi
push edi
push edi
push 0xffffffffffffffff
add esi, ebx
call dword [ebp - 0x28]
xor eax, eax
push edi
inc eax
push eax
push ebx
call esi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret