Function at 0x101332a3
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
mov eax, dword [0x101fe1c0]
xor eax, esp
mov dword [esp + 0x268], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov dword [esp + 0x20], eax
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], ebx
mov edi, edx
push ecx
mov ecx, eax
mov dword [esp + 0x20], edi
call fcn.1007d904
push dword [eax + 4]
push dword [eax]
call fcn.10132cde
test al, al
jne 0x10133437
lea eax, [esp + 0x30]
push eax
call fcn.1006ab2f
mov ecx, dword [0x1020370c]
lea edi, [esp + 0x48]
mov esi, eax
mov eax, dword fs:[0x2c]
push 4
mov eax, dword [eax + ecx*4]
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0xa0]
mov eax, dword [eax + 0xa4]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x154]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
push esi
push eax
push str.Protections
call fcn.1008bcc5
mov ecx, dword [ebx]
push dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov edx, dword [ecx + 0xc]
mov ecx, ebx
call edx
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x100]
push esi
lea eax, [esp + 0x20]
push eax
push str.FunctionId
call fcn.1006afbe
push esi
push ecx
mov edx, ebx
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x60]
call fcn.10132fde
pop ecx
push eax
push str.ActionsContext
lea ecx, [esp + 0xa4]
call fcn.10088c21
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x210]
push esi
lea eax, [esp + 0x4c]
push eax
push str.InsightId
call fcn.100853c6
push esi
push dword [esp + 0x28]
lea ecx, [esp + 0x1b0]
mov ebx, eax
push str.CallStack
call fcn.10088c7a
push 0x6e
push 2
push 1
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1b], 0
mov edi, eax
call fcn.1008e301
mov esi, eax
mov dword [esp + 0x1c], str.OvfDetection
lea eax, [esp + 0x1c]
push eax
push 0x101d791c
lea ecx, [esp + 0x38]
call fcn.1006b0fd
push dword [esp + 0x28]
lea eax, [esp + 0x13]
push dword [esp + 0x24]
push dword [esp + 0x18]
push ebx
push edi
push eax
mov edx, esi
lea ecx, [esp + 0x48]
call fcn.100a0b14
lea ecx, [esp + 0x1f0]
call fcn.100093c1
lea ecx, [esp + 0xe0]
call fcn.100093c1
lea ecx, [esp + 0x58]
jmp 0x10133536
mov ecx, dword [0x1020370c]
mov eax, dword fs:[0x2c]
mov dword [esp + 0x10], str.Protections
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + 0xa0]
mov eax, dword [eax + 0xa4]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push ecx
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x30], ecx
push eax
lea ecx, [esp + 0x15c]
call fcn.1009857e
mov esi, dword [esp + 0x20]
mov ebx, eax
push edi
mov ecx, dword [esi]
mov edx, dword [ecx + 0xc]
mov ecx, esi
call edx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push ecx
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x28], str.FunctionId
push eax
lea ecx, [esp + 0x7c]
call fcn.1006ae41
mov edx, esi
lea ecx, [esp + 0x58]
mov edi, eax
call fcn.10132fde
push ecx
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], str.ActionsContext
push eax
lea ecx, [esp + 0x10c]
call fcn.10098549
push 4
push dword [esp + 0x28]
lea ecx, [esp + 0xa0]
mov esi, eax
push str.CallStack
call fcn.10088c7a
push ebx
push edi
push esi
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x20], str.Office_Vulnerability_Filter_detection_of_already_seen_call_stack
push eax
push ecx
push ecx
call fcn.10132560
lea ecx, [esp + 0xe0]
call fcn.100093c1
lea ecx, [esp + 0x100]
call fcn.1006b133
lea ecx, [esp + 0x58]
call fcn.100093c1
lea ecx, [esp + 0x80]
call fcn.100093c1
lea ecx, [esp + 0x164]
call fcn.100093c1
mov ecx, dword [esp + 0x274]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10033218
mov esp, ebp
pop ebp
ret 4