Function at 0x100be2b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101aae36
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10242040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov eax, 0xc6e05e01
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x100be354
cmp eax, 0x18dc0
ja 0x100be5b2
push eax
mov ecx, edi
call fcn.100be240
mov eax, dword [esi + 4]
mov esi, dword [esi]
mov edi, dword [edi]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x100be349
nop
push esi
mov ecx, edi
call fcn.100be7f0
add esi, 0xa4c4
add edi, 0xa4c4
cmp esi, dword [ebp - 0x14]
jne 0x100be330
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov dword [eax + 4], edi
mov edi, eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
movzx eax, byte [esi + 0x21]
mov byte [edi + 0x21], al
movzx eax, byte [esi + 0x22]
mov byte [edi + 0x22], al
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
movzx eax, byte [esi + 0x30]
mov byte [edi + 0x30], al
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
lea eax, [esi + 0x3c]
push 0x1800
push eax
lea eax, [edi + 0x3c]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esi + 0x183c]
lea ecx, [edi + 0x189c]
mov dword [edi + 0x183c], eax
add esp, 0xc
mov eax, dword [esi + 0x1840]
mov dword [edi + 0x1840], eax
mov eax, dword [esi + 0x1844]
mov dword [edi + 0x1844], eax
movzx eax, byte [esi + 0x1848]
mov byte [edi + 0x1848], al
movups xmm0, xmmword [esi + 0x184c]
movups xmmword [edi + 0x184c], xmm0
movups xmm0, xmmword [esi + 0x185c]
movups xmmword [edi + 0x185c], xmm0
movq xmm0, qword [esi + 0x186c]
movq qword [edi + 0x186c], xmm0
movzx eax, byte [esi + 0x1874]
mov byte [edi + 0x1874], al
mov eax, dword [esi + 0x1878]
mov dword [edi + 0x1878], eax
mov eax, dword [esi + 0x187c]
mov dword [edi + 0x187c], eax
mov eax, dword [esi + 0x1880]
mov dword [edi + 0x1880], eax
mov eax, dword [esi + 0x1884]
mov dword [edi + 0x1884], eax
mov eax, dword [esi + 0x1888]
mov dword [edi + 0x1888], eax
mov eax, dword [esi + 0x188c]
mov dword [edi + 0x188c], eax
mov eax, dword [esi + 0x1890]
mov dword [edi + 0x1890], eax
mov eax, dword [esi + 0x1894]
mov dword [edi + 0x1894], eax
mov eax, dword [esi + 0x1898]
mov dword [edi + 0x1898], eax
lea eax, [esi + 0x189c]
push eax
call fcn.10018230
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x18b4]
mov dword [edi + 0x18b4], eax
mov eax, dword [esi + 0x18b8]
mov dword [edi + 0x18b8], eax
movzx eax, byte [esi + 0x18bc]
mov edx, dword [ebp + 8]
mov byte [edi + 0x18bc], al
movzx eax, byte [esi + 0x18bd]
mov byte [edi + 0x18bd], al
movzx eax, byte [esi + 0x18be]
mov byte [edi + 0x18be], al
movzx eax, byte [esi + 0x18bf]
mov byte [edi + 0x18bf], al
movzx eax, byte [esi + 0x18c0]
mov byte [edi + 0x18c0], al
movzx eax, byte [esi + 0x18c1]
mov byte [edi + 0x18c1], al
movzx eax, byte [esi + 0x18c2]
mov byte [edi + 0x18c2], al
mov eax, dword [esi + 0x18c4]
mov dword [edi + 0x18c4], eax
mov eax, dword [esi + 0x18c8]
lea esi, [edi + 0x18cc]
mov dword [edi + 0x18c8], eax
lea ecx, [esi + 0x14]
movzx eax, byte [edx + 0x18cc]
mov byte [esi], al
mov eax, dword [edx + 0x18d0]
mov dword [esi + 4], eax
mov eax, dword [edx + 0x18d4]
mov dword [esi + 8], eax
movzx eax, byte [edx + 0x18d8]
mov byte [esi + 0xc], al
mov eax, dword [edx + 0x18dc]
mov dword [esi + 0x10], eax
lea eax, [edx + 0x18e0]
push eax
mov dword [ebp - 0x14], esi
call fcn.10018230
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x2c]
add eax, 0x18f8
mov byte [ebp - 4], 2
push eax
call fcn.10018230
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.100189c0
int3