Function at 0x10061aa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10089baa
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x100c20a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
mov dword [edi], 0x100b13f4
mov dword [edi + 4], 0x100ad8f8
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
lea eax, [edi + 0x14]
mov dword [eax], 0x100ad8f8
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [edi + 0x24], 0x100ae39c
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xa
mov dword [edi + 0x34], 0
lea ecx, [edi + 0x3c]
mov dword [ecx], 0x100ae384
mov dword [ecx + 4], 0
mov dword [ecx + 8], 1
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x30], 0x100ad8f8
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], esi
mov byte [ebp - 4], 6
mov edx, dword [eax + 0xc]
cmp edx, dword [ebp + 0x18]
je 0x10061bbf
test edx, edx
je 0x10061b9a
push edx
call fcn.1006a76f
add esp, 4
lea eax, [edi + 0x14]
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0x18]
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
call fcn.1003d5d0
lea ecx, [edi + 0x3c]
mov eax, dword [ecx]
push 0x25
call dword [eax + 4]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
cmp dword [edi + 0x18], ecx
jle 0x10061c01
cmp ecx, dword [edi + 0x18]
sbb eax, eax
inc eax
je 0x10061bdc
xor eax, eax
jmp 0x10061be3
mov eax, dword [edi + 0x20]
movzx eax, word [eax + ecx*2]
mov edx, dword [edi + 0x3c]
movzx eax, ax
push 0
push eax
lea ecx, [edi + 0x3c]
call dword [edx + 8]
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, dword [edi + 0x18]
jl 0x10061bd3
mov ebx, dword [ebp - 0x24]
mov edx, dword [ebp + 8]
mov dword [edi + 0x38], 0
mov eax, dword [edx + 4]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
test eax, eax
jle 0x10061ee4
mov dword [ebp - 0x20], 4
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
je 0x10061c30
xor eax, eax
jmp 0x10061c37
mov eax, dword [edx + 0xc]
movzx eax, word [eax + ecx*2]
push eax
mov ecx, edi
call fcn.10061f90
test eax, eax
je 0x10061e0d
test ebx, ebx
je 0x10061d5b
test esi, esi
je 0x10061d5b
push 0x10
call fcn.1006977d
mov ebx, eax
add esp, 4
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x10061cd6
mov byte [ebp - 4], 8
mov dword [ebx + 4], 0
mov dword [ebx], 0x100ad8f8
mov dword [ebx + 0xc], 0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 0
cmp esi, 0xffffffff
jne 0x10061caf
mov esi, dword [ebp - 0x24]
lea ecx, [esi + 2]
jmp 0x10061ca0
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10061ca0
sub esi, ecx
sar esi, 1
test esi, esi
je 0x10061cd8
push esi
mov ecx, ebx
call fcn.1003dc00
push esi
push dword [ebp - 0x24]
push dword [ebx + 8]
push dword [ebx + 0xc]
call fcn.1006b7f4
add esp, 0x10
mov dword [ebx + 4], esi
inc esi
mov dword [ebx + 8], esi
jmp 0x10061cd8
xor ebx, ebx
mov byte [ebp - 4], 6
push dword [ebp - 0x24]
call fcn.1006a76f
mov ecx, dword [edi + 0x28]
mov edx, dword [edi + 0x2c]
xor esi, esi
inc ecx
add esp, 4
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], esi
cmp ecx, edx
jb 0x10061d4c
mov eax, dword [edi + 0x30]
add eax, edx
add eax, ecx
xor ecx, ecx
mov dword [edi + 0x2c], eax
mul dword [ebp - 0x20]
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10069760
mov edi, eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x28]
shl ecx, 2
push ecx
push dword [eax + 0x34]
push edi
call fcn.100709f0
mov eax, dword [ebp - 0x14]
push dword [eax + 0x34]
call fcn.1006a76f
mov eax, dword [ebp - 0x14]
add esp, 0x14
mov dword [eax + 0x34], edi
mov edi, eax
mov ecx, dword [edi + 0x28]
mov eax, dword [edi + 0x34]
mov dword [eax + ecx*4], ebx
inc dword [edi + 0x28]
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
inc ecx
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], ecx
cmp ecx, eax
jl 0x10061c24
test ebx, ebx
je 0x10061ee4
test esi, esi
je 0x10061edb
push 0x10
call fcn.1006977d
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x10061e5a
mov byte [ebp - 4], 0xa
mov dword [eax + 4], 0
mov dword [eax], 0x100ad8f8
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
cmp esi, 0xffffffff
jne 0x10061de2
mov esi, ebx
lea ecx, [esi + 2]
jmp 0x10061dd0
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10061dd0
mov eax, dword [ebp + 8]
sub esi, ecx
sar esi, 1
test esi, esi
je 0x10061e61
push esi
mov ecx, eax
call fcn.1003dc00
mov edx, dword [ebp + 8]
push esi
push ebx
push dword [edx + 8]
push dword [edx + 0xc]
call fcn.1006b7f4
mov eax, dword [ebp + 8]
add esp, 0x10
mov dword [eax + 4], esi
inc esi
mov dword [eax + 8], esi
jmp 0x10061e61
cmp dword [ebp - 0x1c], 0
je 0x10061e1c
mov dword [ebp - 0x1c], 0
jmp 0x10061e2c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
movzx eax, word [eax + ecx*2]
mov dword [ebp - 0x1c], eax
inc esi
push esi
lea ecx, [ebp - 0x30]
call fcn.1003dc00
mov esi, dword [ebp - 0x2c]
test eax, eax
je 0x10061d58
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov word [ebx + esi*2], ax
inc esi
xor eax, eax
mov dword [ebp - 0x2c], esi
mov word [ebx + esi*2], ax
jmp 0x10061d5b
mov dword [ebp + 8], 0
push ebx
mov byte [ebp - 4], 6
call fcn.1006a76f
mov ecx, dword [edi + 0x28]
mov edx, dword [edi + 0x2c]
inc ecx
add esp, 4
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
cmp ecx, edx
jb 0x10061eca
mov eax, dword [edi + 0x30]
add eax, edx
add eax, ecx
xor ecx, ecx
mov dword [edi + 0x2c], eax
mul dword [ebp - 0x20]
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10069760
mov ecx, dword [edi + 0x28]
shl ecx, 2
push ecx
push dword [edi + 0x34]
mov esi, eax
push esi
call fcn.100709f0
push dword [edi + 0x34]
call fcn.1006a76f
add esp, 0x14
mov dword [edi + 0x34], esi
mov ecx, dword [edi + 0x28]
mov eax, dword [edi + 0x34]
mov edx, dword [ebp + 8]
mov dword [eax + ecx*4], edx
inc dword [edi + 0x28]
jmp 0x10061ee4
push ebx
call fcn.1006a76f
add esp, 4
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0xc], 0x100ad8f8
test eax, eax
je 0x10061efb
push eax
call fcn.1006a76f
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14