Function at 0x1001cc20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10038c30
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x100461d8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x20
mov edi, ecx
push 0xe
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x8c], esi
call fcn.10015e60
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
sar ecx, 1
mov dword [eax + 8], ecx
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
sar ecx, 1
shr ecx, 1
mov dword [eax + 0xc], ecx
mov ecx, dword [esi + 0x34]
sub ecx, dword [esi + 0x30]
sar ecx, 1
mov dword [eax + 0x10], ecx
mov ecx, dword [esi + 0x24]
mov dword [eax + 0x14], ecx
mov edx, dword [esi + 0x28]
mov dword [eax + 0x18], edx
mov dword [ebp - 0x74], edx
mov edx, dword [edi]
test dword [edx + 0x18], 0x100000
je 0x1001cce0
mov edx, dword [edi + 0x34]
mov ebx, edx
and ebx, ecx
cmp ebx, edx
je 0x1001ccb7
mov edx, dword [edi + 0x38]
mov ebx, edx
and ebx, ecx
cmp ebx, edx
jne 0x1001ccbf
mov edx, dword [edi + 0x3c]
or edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [edi + 0x34]
mov edx, dword [ebp - 0x74]
mov ebx, ecx
and ebx, edx
cmp ebx, ecx
je 0x1001ccd8
mov ecx, dword [edi + 0x38]
mov ebx, ecx
and ebx, edx
cmp ebx, ecx
jne 0x1001cce0
mov ecx, dword [edi + 0x3c]
or ecx, edx
mov dword [eax + 0x18], ecx
mov cl, byte [esi + 0x20]
mov byte [eax + 0x1c], cl
mov cl, byte [esi + 0x21]
test cl, cl
sete dl
mov byte [eax + 0x1d], dl
mov ecx, dword [edi]
mov edi, dword [esi]
sub eax, dword [ecx + 0x13c]
mov esi, dword [esi + 4]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x74], esi
cmp edi, esi
je 0x1001cda4
mov ecx, dword [ebp - 0x6c]
mov esi, dword [ecx]
mov edx, dword [esi + 0x140]
mov eax, dword [esi + 0x138]
xor ebx, ebx
cmp byte [edi + 1], bl
setne bl
sub eax, edx
add ebx, 2
cmp eax, ebx
jae 0x1001cd47
sub edx, dword [esi + 0x13c]
lea ecx, [esi + 0x138]
add edx, ebx
call fcn.10024380
mov ecx, dword [ebp - 0x6c]
mov eax, dword [esi + 0x140]
lea edx, [eax + ebx]
mov dword [esi + 0x140], edx
cmp byte [ecx + 0xc], 0
mov dl, byte [edi]
mov esi, dword [ecx + 4]
je 0x1001cd6d
mov esi, dword [esi]
movzx edx, dl
mov dl, byte [edx + esi + 0x104]
mov byte [eax], dl
mov dl, byte [edi + 1]
test dl, dl
je 0x1001cd94
cmp byte [ecx + 0xc], 0
mov esi, dword [ecx + 4]
je 0x1001cd8b
mov esi, dword [esi]
movzx edx, dl
mov dl, byte [edx + esi + 0x104]
mov byte [eax + 1], dl
mov byte [eax + 2], 0
jmp 0x1001cd98
mov byte [eax + 1], 0
add edi, 2
cmp edi, dword [ebp - 0x74]
jne 0x1001cd12
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + 0x14]
mov edi, dword [eax + 0x10]
mov dword [ebp - 0x74], ecx
cmp edi, ecx
jne 0x1001ce23
mov ebx, dword [eax + 0x30]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], eax
cmp ebx, eax
je 0x1001d49c
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov al, byte [ebx + 1]
lea ecx, [ebx + 1]
mov dword [ebp - 4], 7
test al, al
je 0x1001d3bf
mov cl, byte [ebx]
lea edx, [ebp - 0x66]
push edx
mov edx, dword [ebp - 0x6c]
mov byte [ebp - 0x67], al
mov byte [ebp - 0x68], cl
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x64]
push ecx
mov ecx, dword [edx + 4]
mov byte [ebp - 0x66], 0
call fcn.10004b10
mov byte [ebp - 4], 8
jmp 0x1001d3d4
mov edi, dword [ebp - 0x78]
mov eax, dword [ebp - 0x6c]
mov esi, dword [eax + 4]
mov al, byte [eax + 0xc]
mov dl, byte [edi]
mov bl, byte [edi + 1]
mov dword [ebp - 0x78], esi
test al, al
je 0x1001ce44
mov ecx, dword [esi]
movzx edx, dl
mov dl, byte [edx + ecx + 0x104]
mov byte [ebp - 0x88], dl
test al, al
je 0x1001ce5c
mov ecx, dword [esi]
movzx edx, bl
mov dl, byte [edx + ecx + 0x104]
jmp 0x1001ce5e
mov dl, bl
mov cl, byte [edi + 3]
mov bl, dl
mov dl, byte [edi + 2]
mov byte [ebp - 0x87], bl
test al, al
je 0x1001ce7f
mov esi, dword [esi]
movzx edx, dl
mov dl, byte [edx + esi + 0x104]
mov esi, dword [ebp - 0x78]
mov byte [ebp - 0x80], dl
test al, al
je 0x1001ce94
mov eax, dword [esi]
movzx ecx, cl
mov al, byte [ecx + eax + 0x104]
jmp 0x1001ce96
mov al, cl
add edi, 4
mov cl, al
mov dword [ebp - 0x78], edi
xor eax, eax
mov edi, 0xf
mov byte [ebp - 0x7f], cl
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
mov dword [ebp - 4], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x48], al
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
test dword [eax + 0x18], 0x200000
mov byte [ebp - 4], 1
je 0x1001d0f0
mov al, byte [ebp - 0x88]
mov byte [ebp - 0x68], al
mov byte [ebp - 0x67], bl
mov byte [ebp - 0x66], 0
mov byte [ebp - 0x70], dl
mov byte [ebp - 0x6f], cl
mov byte [ebp - 0x6e], 0
lea eax, [ebp - 0x66]
test bl, bl
jne 0x1001cef7
lea eax, [ebp - 0x67]
push eax
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x64]
push edx
mov ecx, esi
call fcn.10003660
mov esi, eax
lea eax, [ebp - 0x2c]
cmp eax, esi
je 0x1001cf64
cmp dword [ebp - 0x18], 0x10
jb 0x1001cf22
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10026b18
add esp, 4
xor ebx, ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
cmp dword [esi + 0x14], 0x10
jae 0x1001cf47
mov eax, dword [esi + 0x10]
inc eax
push eax
lea edx, [ebp - 0x2c]
push esi
push edx
call fcn.100265f0
add esp, 0xc
jmp 0x1001cf4e
mov eax, dword [esi]
mov dword [ebp - 0x2c], eax
mov dword [esi], ebx
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x1c], ecx
mov edx, dword [esi + 0x14]
mov dword [ebp - 0x18], edx
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov byte [esi], bl
jmp 0x1001cf66
xor ebx, ebx
cmp dword [ebp - 0x50], 0x10
mov byte [ebp - 4], 1
jb 0x1001cf7c
mov eax, dword [ebp - 0x64]
push eax
call fcn.10026b18
add esp, 4
cmp byte [ebp - 0x6f], 0
lea eax, [ebp - 0x6e]
jne 0x1001cf88
lea eax, [ebp - 0x6f]
push eax
mov eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0x70]
push ecx
mov ecx, dword [eax + 4]
lea edx, [ebp - 0x64]
push edx
call fcn.10003660
mov esi, eax
lea ecx, [ebp - 0x48]
cmp ecx, esi
je 0x1001cff7
cmp dword [ebp - 0x34], 0x10
jb 0x1001cfb7
mov edx, dword [ebp - 0x48]
push edx
call fcn.10026b18
add esp, 4
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], 0
cmp dword [esi + 0x14], 0x10
jae 0x1001cfdb
mov eax, dword [esi + 0x10]
inc eax
push eax
lea eax, [ebp - 0x48]
push esi
push eax
call fcn.100265f0
add esp, 0xc
jmp 0x1001cfe2
mov ecx, dword [esi]
mov dword [ebp - 0x48], ecx
mov dword [esi], ebx
mov edx, dword [esi + 0x10]
mov dword [ebp - 0x38], edx
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x34], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], ebx
mov byte [esi], 0
cmp dword [ebp - 0x50], 0x10
mov byte [ebp - 4], 1
jb 0x1001d00d
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.10026b18
add esp, 4
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
jne 0x1001d073
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], 1
mov word [ebp - 0x64], 0
cmp dword [ebp - 0x18], 0x10
jb 0x1001d036
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10026b18
add esp, 4
cmp dword [ebp - 0x50], 0x10
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], 0
jae 0x1001d05d
mov eax, dword [ebp - 0x54]
inc eax
push eax
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
push ecx
call fcn.100265f0
add esp, 0xc
jmp 0x1001d063
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x2c], edx
mov esi, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x38]
cmp edi, ebx
jne 0x1001d232
mov dword [ebp - 0x50], 0xf
mov dword [ebp - 0x54], 1
mov word [ebp - 0x64], 0
cmp dword [ebp - 0x34], 0x10
jb 0x1001d0a7
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.10026b18
mov esi, dword [ebp - 0x1c]
add esp, 4
cmp dword [ebp - 0x50], 0x10
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], 0
jae 0x1001d0d5
mov eax, dword [ebp - 0x54]
inc eax
push eax
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x48]
push eax
call fcn.100265f0
mov esi, dword [ebp - 0x1c]
add esp, 0xc
jmp 0x1001d0db
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x48], ecx
mov edi, dword [ebp - 0x54]
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edx
mov byte [ebp - 4], 1
jmp 0x1001d232
test bl, bl
je 0x1001d152
mov eax, dword [ebp - 0x88]
push eax
push 1
push 0
lea ecx, [ebp - 0x2c]
call fcn.1000ec10
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov eax, edx
cmp ecx, 0x10
jae 0x1001d117
lea eax, [ebp - 0x2c]
add eax, dword [ebp - 0x1c]
cmp ecx, 0x10
mov ecx, edx
jae 0x1001d124
lea ecx, [ebp - 0x2c]
test eax, eax
jne 0x1001d13c
mov ecx, dword [ebp - 0x87]
push ecx
push 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000ec10
jmp 0x1001d199
sub eax, ecx
mov ecx, dword [ebp - 0x87]
push ecx
push 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000ec10
jmp 0x1001d199
mov dl, byte [ebp - 0x88]
mov dword [ebp - 0x50], edi
mov byte [ebp - 0x64], dl
mov dword [ebp - 0x54], 1
mov byte [ebp - 0x63], 0
push 2
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
call fcn.100265f0
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
add esp, 0xc
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
cmp byte [ebp - 0x7f], 0
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x34]
mov eax, edx
je 0x1001d200
cmp ecx, 0x10
jae 0x1001d1af
lea eax, [ebp - 0x48]
add eax, dword [ebp - 0x38]
cmp ecx, 0x10
mov ecx, edx
jae 0x1001d1bc
lea ecx, [ebp - 0x48]
test eax, eax
je 0x1001d1c2
sub eax, ecx
mov ecx, dword [ebp - 0x80]
push ecx
push 1
push eax
lea ecx, [ebp - 0x48]
call fcn.1000ec10
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x48]
mov eax, edx
cmp ecx, 0x10
jae 0x1001d1e1
lea eax, [ebp - 0x48]
add eax, dword [ebp - 0x38]
cmp ecx, 0x10
mov ecx, edx
jae 0x1001d1ee
lea ecx, [ebp - 0x48]
test eax, eax
jne 0x1001d1f8
mov edx, dword [ebp - 0x7f]
push edx
jmp 0x1001d21f
mov edx, dword [ebp - 0x7f]
sub eax, ecx
push edx
jmp 0x1001d21f
cmp ecx, 0x10
jae 0x1001d208
lea eax, [ebp - 0x48]
add eax, dword [ebp - 0x38]
cmp ecx, 0x10
mov ecx, edx
jae 0x1001d215
lea ecx, [ebp - 0x48]
test eax, eax
je 0x1001d21b
sub eax, ecx
mov ecx, dword [ebp - 0x80]
push ecx
push 1
push eax
lea ecx, [ebp - 0x48]
call fcn.1000ec10
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x1c]
xor ebx, ebx
cmp dword [ebp - 0x18], 0x10
mov edx, dword [ebp - 0x2c]
jae 0x1001d23e
lea edx, [ebp - 0x2c]
mov ecx, edi
cmp edi, esi
jb 0x1001d246
mov ecx, esi
cmp dword [ebp - 0x34], 0x10
mov eax, dword [ebp - 0x48]
jae 0x1001d252
lea eax, [ebp - 0x48]
push ecx
push edx
push eax
call fcn.10001ef0
add esp, 0xc
cmp eax, ebx
jne 0x1001d273
cmp edi, esi
jae 0x1001d26a
or eax, 0xffffffff
jmp 0x1001d271
xor eax, eax
cmp edi, esi
setne al
cmp eax, ebx
setl al
test al, al
jne 0x1001d386
mov edx, dword [ebp - 0x6c]
lea edi, [edi + esi + 2]
mov esi, dword [edx]
mov eax, dword [esi + 0x140]
mov ecx, dword [esi + 0x138]
sub ecx, eax
cmp ecx, edi
jae 0x1001d2ae
mov edx, edi
sub edx, dword [esi + 0x13c]
lea ecx, [esi + 0x138]
add edx, eax
call fcn.10024380
mov edx, dword [esi + 0x140]
add edi, edx
mov dword [esi + 0x140], edi
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov esi, eax
cmp ecx, 0x10
jae 0x1001d2cc
lea esi, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
add edi, esi
cmp ecx, 0x10
jae 0x1001d2d9
lea eax, [ebp - 0x2c]
mov ecx, edx
cmp eax, edi
je 0x1001d2ec
nop
mov bl, byte [eax]
inc eax
mov byte [ecx], bl
inc ecx
cmp eax, edi
jne 0x1001d2e0
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
mov byte [eax + edx], 0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
lea edx, [ecx + edx + 1]
mov ecx, dword [ebp - 0x34]
mov esi, eax
cmp ecx, 0x10
jae 0x1001d30a
lea esi, [ebp - 0x48]
mov edi, dword [ebp - 0x38]
add edi, esi
cmp ecx, 0x10
jae 0x1001d317
lea eax, [ebp - 0x48]
mov ecx, edx
cmp eax, edi
je 0x1001d32c
lea ecx, [ecx]
mov bl, byte [eax]
inc eax
mov byte [ecx], bl
inc ecx
cmp eax, edi
jne 0x1001d320
xor ebx, ebx
mov eax, dword [ebp - 0x38]
mov esi, 0x10
mov byte [eax + edx], 0
cmp dword [ebp - 0x34], esi
jb 0x1001d349
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.10026b18
add esp, 4
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], esi
jb 0x1001d36f
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10026b18
add esp, 4
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x78], eax
jne 0x1001ce20
mov eax, dword [ebp - 0x8c]
jmp 0x1001cdb7
cmp dword [ebp - 0x34], 0x10
jb 0x1001d398
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.10026b18
add esp, 4
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], 0
jb 0x1001d3b8
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10026b18
add esp, 4
xor eax, eax
jmp 0x1001d4b0
mov edx, dword [ebp - 0x6c]
push ecx
push ebx
lea ecx, [ebp - 0x64]
push ecx
mov ecx, dword [edx + 4]
call fcn.10004b10
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x2c]
call fcn.10004130
mov esi, 0x10
mov byte [ebp - 4], 7
cmp dword [ebp - 0x50], esi
jb 0x1001d3f7
mov eax, dword [ebp - 0x64]
push eax
call fcn.10026b18
add esp, 4
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x1001d4ce
mov ecx, dword [ebp - 0x6c]
mov esi, dword [ecx]
mov edx, dword [esi + 0x140]
mov eax, dword [esi + 0x138]
inc edi
sub eax, edx
cmp eax, edi
jae 0x1001d42d
sub edx, dword [esi + 0x13c]
lea ecx, [esi + 0x138]
add edx, edi
call fcn.10024380
mov edx, dword [esi + 0x140]
lea ecx, [edx + edi]
mov dword [esi + 0x140], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov esi, eax
cmp ecx, 0x10
jae 0x1001d44c
lea esi, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
add edi, esi
cmp ecx, 0x10
jae 0x1001d459
lea eax, [ebp - 0x2c]
mov ecx, edx
cmp eax, edi
je 0x1001d46d
nop
mov bl, byte [eax]
inc eax
mov byte [ecx], bl
inc ecx
cmp eax, edi
jne 0x1001d460
mov ebx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x1c]
add ebx, 2
mov byte [eax + edx], 0
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x78], ebx
mov dword [ebp - 4], 0xffffffff
jb 0x1001d493
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.10026b18
add esp, 4
cmp ebx, dword [ebp - 0x74]
jne 0x1001cdcb
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x13c]
add eax, dword [ebp - 0x90]
mov dword [ecx + 8], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026ffe
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp - 0x18], esi
jb 0x1001d3b8
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10026b18
add esp, 4
xor eax, eax
jmp 0x1001d4b0