Function at 0x101043d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0x10105140
mov ebx, dword [ebp + 0xc]
lea eax, [esi + 0x38]
mov ecx, dword fs:[0]
mov dword [esi + 0x38], ecx
mov dword fs:[0], eax
mov edi, dword [ebx]
test edi, edi
jne 0x10104460
movsd xmm0, qword [0x101e8b28]
movsd xmm1, qword [0x101e8b20]
movsd qword [esi + 0x28], xmm0
movsd qword [esi + 0x20], xmm1
movzx eax, byte [0x10283b09]
push 4
push 0x10
call fcn.10013860
add esp, 8
test eax, eax
je 0x10104623
movsd xmm0, qword [0x101e8b28]
movsd xmm1, qword [0x101e8b20]
mov edi, eax
mov dword [ebx], eax
movsd qword [eax + 8], xmm0
movsd qword [eax], xmm1
movzx eax, byte [0x10283b09]
push 8
push 0x40
call fcn.10013860
add esp, 8
test eax, eax
je 0x1010460e
mov ecx, dword [ebp + 0x10]
mov edx, 0x4894d328
mov byte [esi + 7], 0
mov dword [esi + 0x40], 0
movsd xmm1, qword [ecx + 0x30]
movsd xmm2, qword [ecx + 0x28]
movsd xmm0, qword [ecx + 0x38]
movsd qword [eax + 0x30], xmm1
movsd xmm1, qword [ecx + 0x20]
movsd qword [eax + 0x28], xmm2
movsd xmm2, qword [ecx + 0x18]
movsd qword [eax + 0x38], xmm0
movsd qword [eax + 0x20], xmm1
movsd xmm1, qword [ecx + 0x10]
movsd qword [eax + 0x18], xmm2
movsd xmm2, qword [ecx]
movsd qword [eax + 0x10], xmm1
movsd xmm1, qword [ecx + 8]
movsd qword [eax], xmm2
mov ecx, edi
movsd qword [eax + 8], xmm1
push 0x101e8ae8
push eax
push 0x417aca28
push 0x1420ee61
push 0x65ccfca9
call fcn.10104e00
add esp, 0x14
mov edi, eax
mov eax, dword [ebp + 8]
test edi, edi
je 0x101045ef
mov eax, dword [edx + 0xc]
mov dword [esi + 8], edx
mov dword [esi + 0x40], 2
lea ecx, [esi + 0x10]
mov dword [esi + 0xc], edi
push edi
push ecx
call eax
add esp, 8
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x10]
mov edi, dword [esi + 0x14]
xor edi, 0x65ccfca9
xor eax, 0x417aca28
xor edx, 0x4894d328
xor ecx, 0x1420ee61
or eax, edi
or ecx, edx
or ecx, eax
jne 0x101045bb
mov eax, dword [esi + 0xc]
mov edi, dword [ebp + 8]
movsd xmm0, qword [eax + 0x38]
movsd qword [edi + 0x38], xmm0
movsd xmm0, qword [eax + 0x30]
movsd qword [edi + 0x30], xmm0
movsd xmm0, qword [eax + 0x28]
movsd qword [edi + 0x28], xmm0
movsd xmm0, qword [eax + 0x20]
movsd qword [edi + 0x20], xmm0
movsd xmm0, qword [eax + 0x18]
movsd qword [edi + 0x18], xmm0
movsd xmm0, qword [eax + 0x10]
movsd qword [edi + 0x10], xmm0
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd qword [edi + 8], xmm1
movsd qword [edi], xmm0
push 8
push 0x40
push eax
call fcn.10013870
add esp, 0xc
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, edi
jmp 0x10104606
mov eax, dword [esi + 8]
mov eax, dword [eax]
test eax, eax
je 0x101045d3
mov dword [esi + 0x40], 1
push dword [esi + 0xc]
call eax
add esp, 4
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 4]
test eax, eax
je 0x101045ec
push dword [ecx + 8]
push eax
push dword [esi + 0xc]
call fcn.10013870
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 0x38]
mov dword [eax + 4], 0
mov dword [eax], 3
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x40], 3
push 0x40
push 8
call fcn.101cb670
add esp, 8
jmp 0x10104636
mov dword [esi + 0x40], 4
push 0x10
push 4
call fcn.101cb670
add esp, 8
ud2