Function at 0x1010d040
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0x1010d8b0
mov ebx, dword [ebp + 0xc]
lea eax, [esi + 0x38]
mov ecx, dword fs:[0]
mov dword [esi + 0x38], ecx
mov dword fs:[0], eax
mov edi, dword [ebx]
test edi, edi
jne 0x1010d0d0
movsd xmm0, qword [0x101ed708]
movsd xmm1, qword [0x101ed700]
movsd qword [esi + 0x28], xmm0
movsd qword [esi + 0x20], xmm1
movzx eax, byte [0x10284b09]
push 4
push 0x10
call fcn.10013450
add esp, 8
test eax, eax
je 0x1010d293
movsd xmm0, qword [0x101ed708]
movsd xmm1, qword [0x101ed700]
mov edi, eax
mov dword [ebx], eax
movsd qword [eax + 8], xmm0
movsd qword [eax], xmm1
movzx eax, byte [0x10284b09]
push 8
push 0x40
call fcn.10013450
add esp, 8
test eax, eax
je 0x1010d27e
mov ecx, dword [ebp + 0x10]
mov edx, 0xa5ec081e
mov byte [esi + 7], 0
mov dword [esi + 0x40], 0
movsd xmm1, qword [ecx + 0x30]
movsd xmm2, qword [ecx + 0x28]
movsd xmm0, qword [ecx + 0x38]
movsd qword [eax + 0x30], xmm1
movsd xmm1, qword [ecx + 0x20]
movsd qword [eax + 0x28], xmm2
movsd xmm2, qword [ecx + 0x18]
movsd qword [eax + 0x38], xmm0
movsd qword [eax + 0x20], xmm1
movsd xmm1, qword [ecx + 0x10]
movsd qword [eax + 0x18], xmm2
movsd xmm2, qword [ecx]
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [ecx + 8]
movsd qword [eax], xmm2
mov ecx, edi
movsd qword [eax + 8], xmm1
push 0x101ed6d0
push eax
push 0xbb05220a
push 0xd63e8c80
push 0x6dd1c7b7
call fcn.1010d680
add esp, 0x14
mov edi, eax
mov eax, dword [ebp + 8]
test edi, edi
je 0x1010d25f
mov eax, dword [edx + 0xc]
mov dword [esi + 8], edx
mov dword [esi + 0x40], 2
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], edi
push edi
push ecx
call eax
add esp, 8
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x10]
mov edi, dword [esi + 0x14]
xor edi, 0x6dd1c7b7
xor eax, 0xbb05220a
xor edx, 0xa5ec081e
xor ecx, 0xd63e8c80
or eax, edi
or ecx, edx
or ecx, eax
jne 0x1010d22b
mov eax, dword [esi + 0xc]
mov edi, dword [ebp + 8]
movsd xmm0, qword [eax + 0x38]
movsd qword [edi + 0x38], xmm0
movsd xmm0, qword [eax + 0x30]
movsd qword [edi + 0x30], xmm0
movsd xmm0, qword [eax + 0x28]
movsd qword [edi + 0x28], xmm0
movsd xmm0, qword [eax + 0x20]
movsd qword [edi + 0x20], xmm0
movsd xmm0, qword [eax + 0x18]
movsd qword [edi + 0x18], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [edi + 0x10], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [edi + 8], xmm1
movsd qword [edi], xmm0
push 8
push 0x40
push eax
call fcn.10013460
add esp, 0xc
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
jmp 0x1010d276
mov eax, dword [esi + 8]
mov eax, dword [eax]
test eax, eax
je 0x1010d243
mov dword [esi + 0x40], 1
push dword [esi + 0xc]
call eax
add esp, 4
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 4]
test eax, eax
je 0x1010d25c
push dword [ecx + 8]
push eax
push dword [esi + 0xc]
call fcn.10013460
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x38]
mov dword [eax + 4], 0
mov dword [eax], 3
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x40], 3
push 0x40
push 8
call fcn.101cc329
add esp, 8
jmp 0x1010d2a6
mov dword [esi + 0x40], 4
push 0x10
push 4
call fcn.101cc329
add esp, 8
ud2