Function at 0x100344a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10191354
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 8]
call fcn.10035060
lea ecx, [edi + 0x1520]
mov dword [ebp - 4], 0
call fcn.10035420
lea esi, [edi + 0x18e4]
mov ecx, esi
call fcn.100494d0
mov dword [edi + 0x19d4], 0
mov dword [edi + 0x19d0], 0
mov dword [edi + 0x19d8], 0
mov dword [edi + 0x19e0], 0
mov dword [edi + 0x19dc], 0
mov dword [edi + 0x19e4], 0
mov dword [edi + 0x19ec], 0
mov dword [edi + 0x19e8], 0
mov dword [edi + 0x19f0], 0
mov dword [edi + 0x19f8], 0
mov dword [edi + 0x19f4], 0
mov dword [edi + 0x19fc], 0
mov dword [edi + 0x1a04], 0
mov dword [edi + 0x1a00], 0
mov dword [edi + 0x1a08], 0
fldz
lea eax, [edi + 0x1a90]
fst dword [edi + 0x1a28]
fst dword [edi + 0x1a24]
fst dword [edi + 0x1a6c]
fst dword [edi + 0x1a68]
fst dword [eax + 0x14]
fst dword [eax + 0x10]
fst dword [eax + 0x1c]
fst dword [eax + 0x18]
fst dword [eax + 0x24]
fst dword [eax + 0x20]
fst dword [eax + 0x2c]
fst dword [eax + 0x28]
fst dword [eax + 0x34]
fst dword [eax + 0x30]
fst dword [eax + 0x3c]
fst dword [eax + 0x40]
fst dword [eax + 0x44]
fst dword [eax + 0x48]
push 0x60
fst dword [eax + 0x5c]
push 0
push eax
fstp dword [eax + 0x58]
call fcn.10164250
add esp, 0xc
xor eax, eax
mov dword [edi + 0x1af0], eax
mov dword [edi + 0x1af4], eax
mov dword [edi + 0x1af8], eax
mov dword [edi + 0x1afc], eax
mov dword [edi + 0x1b00], eax
mov dword [edi + 0x1b08], eax
mov dword [edi + 0x1b04], eax
mov dword [edi + 0x1b0c], eax
mov dword [edi + 0x1b14], eax
mov dword [edi + 0x1b10], eax
mov dword [edi + 0x1b18], eax
mov dword [edi + 0x1b20], eax
mov dword [edi + 0x1b1c], eax
mov dword [edi + 0x1b24], eax
mov dword [edi + 0x1b2c], eax
mov dword [edi + 0x1b28], eax
mov dword [edi + 0x1b30], eax
mov dword [edi + 0x1b38], eax
mov dword [edi + 0x1b34], eax
mov dword [edi + 0x1b3c], eax
fldz
fst dword [edi + 0x1b74]
fst dword [edi + 0x1b78]
fst dword [edi + 0x1b7c]
fst dword [edi + 0x1b80]
fst dword [edi + 0x1b9c]
fst dword [edi + 0x1ba0]
fst dword [edi + 0x1ba4]
fst dword [edi + 0x1ba8]
fst dword [edi + 0x1be4]
fst dword [edi + 0x1be8]
fst dword [edi + 0x1bec]
fld dword [0x101abae0]
fst dword [edi + 0x1bdc]
mov dword [edi + 0x1bc8], eax
mov dword [edi + 0x1bd0], eax
mov dword [edi + 0x1bcc], eax
fst dword [edi + 0x1bd8]
fst dword [edi + 0x1bd4]
fxch st(1)
fst dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [edi + 0x1be0], eax
fst dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x1be4], eax
fst dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [edi + 0x1be8], eax
fst dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [edi + 0x1bec], eax
fst dword [edi + 0x1c0c]
fst dword [edi + 0x1c10]
fst dword [edi + 0x1c14]
fxch st(1)
mov dword [edi + 0x1bf0], 0
fst dword [edi + 0x1c04]
fst dword [edi + 0x1c00]
fst dword [edi + 0x1bfc]
fxch st(1)
mov dword [edi + 0x1bf8], 0
fst dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [edi + 0x1c08], eax
mov dword [edi + 0x1bf4], 0
fst dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x1c0c], eax
fst dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [edi + 0x1c10], eax
fst dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [edi + 0x1c14], eax
fst dword [edi + 0x1c34]
fst dword [edi + 0x1c38]
fst dword [edi + 0x1c3c]
fxch st(1)
mov dword [edi + 0x1c18], 0
fst dword [edi + 0x1c2c]
fst dword [edi + 0x1c28]
fstp dword [edi + 0x1c24]
mov dword [edi + 0x1c20], 0
fst dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [edi + 0x1c30], eax
fst dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x1c34], eax
fst dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
fst dword [ebp - 0x20]
mov dword [edi + 0x1c38], eax
mov eax, dword [ebp - 0x20]
mov dword [edi + 0x1c1c], 0
mov dword [edi + 0x1c3c], eax
fst dword [edi + 0x1c94]
fst dword [edi + 0x1c9c]
fst dword [edi + 0x1ca4]
fst dword [edi + 0x1ca0]
fst dword [edi + 0x1ca4]
fst dword [edi + 0x1c98]
fst dword [edi + 0x1c9c]
fst dword [edi + 0x1c90]
fstp dword [edi + 0x1c94]
mov byte [edi + 0x1c7c], 0
mov dword [edi + 0x1c80], 0
mov dword [edi + 0x1c88], 0
mov dword [edi + 0x1c8c], 0
mov dword [edi + 0x1c84], 0
push 0x10035e80
push 0x10034360
push 2
lea eax, [edi + 0x1ca8]
mov byte [ebp - 4], 0xb
push 0xc
push eax
mov dword [ebp - 0x14], eax
call fcn.10162748
lea ecx, [edi + 0x1cc4]
mov byte [ebp - 4], 0xc
push esi
call fcn.100343b0
lea ecx, [edi + 0x1d3c]
mov byte [ebp - 4], 0xd
push esi
call fcn.100343b0
fldz
xor eax, eax
mov dword [edi + 0x1dd4], 0
mov dword [edi + 0x1dd0], 0
mov dword [edi + 0x1dc8], 0
mov dword [edi + 0x1dcc], 0
mov dword [edi + 0x1ddc], eax
mov dword [edi + 0x1de0], eax
mov dword [edi + 0x1de4], eax
mov dword [edi + 0x1de8], eax
mov dword [edi + 0x1dec], eax
mov dword [edi + 0x1df0], eax
mov dword [edi + 0x1df4], eax
mov dword [edi + 0x1df8], eax
mov word [edi + 0x1dfc], ax
mov dword [edi + 0x1dd8], 0xffffffff
mov byte [edi + 0x1dfe], al
fst dword [edi + 0x1e00]
fst dword [edi + 0x1e04]
fst dword [edi + 0x1e08]
fst dword [edi + 0x1e0c]
mov dword [edi + 0x1e30], eax
mov dword [edi + 0x1e2c], eax
mov dword [edi + 0x1e34], eax
mov dword [edi + 0x1e50], eax
mov dword [edi + 0x1e4c], eax
mov dword [edi + 0x1e54], eax
mov dword [edi + 0x1e5c], eax
mov dword [edi + 0x1e58], eax
mov dword [edi + 0x1e60], eax
mov dword [edi + 0x1e64], eax
mov dword [edi + 0x1e6c], eax
mov dword [edi + 0x1e68], eax
mov dword [edi + 0x1e70], eax
mov dword [edi + 0x1e78], eax
mov dword [edi + 0x1e74], eax
mov dword [edi + 0x1e7c], eax
fst dword [edi + 0x1e84]
lea eax, [edi + 0x1e88]
fstp dword [edi + 0x1e80]
mov dword [eax + 0x10], 0
push 0xe74
push 0
push eax
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x2c], 0
call fcn.10164250
add esp, 0xc
lea ecx, [edi + 0x2cfc]
mov byte [ebp - 4], 0x13
call fcn.10049590
fldz
fst dword [edi + 0x2d80]
fst dword [edi + 0x2d7c]
fst dword [edi + 0x2d78]
fst dword [edi + 0x2d74]
mov dword [edi + 0x2d9c], 0
mov dword [edi + 0x2d98], 0
mov dword [edi + 0x2da0], 0
mov dword [edi + 0x2da8], 0
mov dword [edi + 0x2da4], 0
mov dword [edi + 0x2dac], 0
fst dword [edi + 0x2db4]
fst dword [edi + 0x2db0]
fst dword [edi + 0x2dbc]
fst dword [edi + 0x2db8]
mov dword [edi + 0x2dcc], 0
mov dword [edi + 0x2dc8], 0
mov dword [edi + 0x2dd0], 0
mov dword [edi + 0x2dd8], 0
mov dword [edi + 0x2dd4], 0
mov dword [edi + 0x2ddc], 0
mov dword [edi + 0x2de4], 0
mov dword [edi + 0x2de0], 0
mov dword [edi + 0x2de8], 0
mov dword [edi + 0x2dfc], 0
mov dword [edi + 0x2df8], 0
mov dword [edi + 0x2e00], 0
mov ecx, dword [ebp + 8]
test ecx, ecx
fst dword [edi + 0x18e0]
sete al
mov byte [ebp - 4], 0x1a
mov byte [edi], 0
mov byte [edi + 1], al
mov dword [edi + 0x18d8], 0
fst dword [edi + 0x18dc]
test ecx, ecx
jne 0x10034b38
mov eax, dword [0x1021c4b0]
fstp st(0)
test eax, eax
je 0x10034b04
inc dword [eax + 0x378]
push dword [0x1021c4b8]
push 0x5c
call dword [0x102170b8]
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 0xb]
add esp, 8
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0x1b
test eax, eax
je 0x10034b32
mov ecx, eax
call fcn.10049630
jmp 0x10034b34
xor eax, eax
fldz
mov ecx, eax
fldz
fstp qword [edi + 0x19b0]
mov dword [edi + 0x9c], ecx
fst dword [edi + 0x1a2c]
fst dword [edi + 0x1a40]
fst dword [edi + 0x1a3c]
fst dword [edi + 0x1a4c]
fld dword [0x101aad24]
fst dword [edi + 0x1a68]
fstp dword [edi + 0x1a6c]
mov dword [edi + 0x19b8], 0
fst dword [edi + 0x1a8c]
fst dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov dword [edi + 0x1b74], eax
fst dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [edi + 0x1b78], eax
fst dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [edi + 0x1b7c], eax
fst dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [edi + 0x19c0], 0xffffffff
mov dword [edi + 0x19bc], 0xffffffff
mov word [edi + 0x19c5], 0
mov byte [edi + 0x19c4], 0
mov byte [edi + 0x19c7], 0
mov dword [edi + 0x19c8], 0
mov dword [edi + 0x19cc], 0
mov dword [edi + 0x1a0c], 0
mov dword [edi + 0x1a10], 0
mov dword [edi + 0x1a14], 0
mov dword [edi + 0x1a18], 0
mov dword [edi + 0x1a1c], 0
mov dword [edi + 0x1a20], 0
mov dword [edi + 0x1a30], 0
mov byte [edi + 0x1a34], 0
mov dword [edi + 0x1a38], 0
mov dword [edi + 0x1a44], 0
mov dword [edi + 0x1a48], 0
mov dword [edi + 0x1a50], 0
mov byte [edi + 0x1a54], 0
mov dword [edi + 0x1a58], 0
mov dword [edi + 0x1a5c], 0
mov dword [edi + 0x1a60], 0
mov dword [edi + 0x1a64], 0
mov dword [edi + 0x1a70], 0
mov dword [edi + 0x1a74], 0
mov dword [edi + 0x1a78], 0
mov dword [edi + 0x1a7c], 0
mov word [edi + 0x1a80], 0
mov dword [edi + 0x1a84], 0
mov dword [edi + 0x1a88], 0
mov dword [edi + 0x1b40], 0
mov dword [edi + 0x1b58], 0
mov dword [edi + 0x1b54], 0
mov dword [edi + 0x1b50], 0
mov dword [edi + 0x1b4c], 0
mov dword [edi + 0x1b48], 0
mov dword [edi + 0x1b44], 0
mov dword [edi + 0x1b6c], 0
mov dword [edi + 0x1b64], 0
mov dword [edi + 0x1b60], 0
mov dword [edi + 0x1b5c], 0
mov dword [edi + 0x1b68], 0
mov dword [edi + 0x1b70], 0
mov dword [edi + 0x1b80], eax
mov dword [edi + 0x1b84], 0
mov dword [edi + 0x1b88], 0
mov dword [edi + 0x1b8c], 0x7fffffff
mov dword [edi + 0x1b90], 0x10000
mov word [edi + 0x1b94], 0
mov byte [edi + 0x1b96], 0
mov dword [edi + 0x1b98], 0
mov word [edi + 0x1bac], 0
mov dword [edi + 0x1bb0], 0
mov dword [edi + 0x1bb4], 0
mov dword [edi + 0x1bb8], 0
mov dword [edi + 0x1bc4], 0xffffffff
mov dword [edi + 0x1bc0], 0xffffffff
fst dword [edi + 0x1c58]
fst dword [edi + 0x1c54]
mov dword [edi + 0x1bbc], 0xffffffff
xor eax, eax
mov dword [edi + 0x1c40], 0
mov dword [edi + 0x1c44], 0
mov dword [edi + 0x1c50], 0
mov dword [edi + 0x1c4c], 0
mov dword [edi + 0x1c48], 0
mov byte [edi + 0x1c5c], 0
mov dword [edi + 0x1c64], 0
mov dword [edi + 0x1c60], 0
mov dword [edi + 0x1c6c], 0x7fffffff
mov dword [edi + 0x1c68], 0x7fffffff
mov dword [edi + 0x1c74], 0x7fffffff
mov dword [edi + 0x1c70], 0x7fffffff
mov byte [edi + 0x1c78], 0
fst dword [edi + 0x1cc0]
mov dword [edi + 0x1cf0], 0x101ab834
mov dword [edi + 0x1d68], 0x101ab844
mov dword [edi + 0x1db4], 0
mov word [edi + 0x1db9], 0
mov byte [edi + 0x1db8], 0
mov dword [edi + 0x1dbc], 0
mov dword [edi + 0x1dc0], 0xffffffff
mov dword [edi + 0x1dc4], 0xffffffff
mov dword [edi + 0x1e10], 0
mov dword [edi + 0x1e14], 0
fst dword [edi + 0x1e18]
mov dword [edi + 0x1e1c], 0
mov dword [edi + 0x1e20], 0
mov dword [edi + 0x1e24], 0xffffffff
mov dword [edi + 0x1e28], 0
mov dword [edi + 0x1e38], eax
mov dword [edi + 0x1e3c], eax
mov dword [edi + 0x1e40], eax
mov dword [edi + 0x1e44], eax
mov dword [edi + 0x1e48], eax
fst dword [edi + 0x1e80]
fst dword [edi + 0x1e84]
mov dword [edi + 0x2d58], eax
mov dword [edi + 0x2d5c], 0xa900000
fst dword [edi + 0x2d64]
fst dword [edi + 0x2d60]
fld dword [0x101abae0]
fst dword [edi + 0x2d70]
fst dword [edi + 0x2d6c]
fst dword [edi + 0x2d68]
mov byte [edi + 0x2d84], al
fxch st(1)
fst dword [edi + 0x2d88]
fld dword [0x101aba44]
fstp dword [edi + 0x2d8c]
push 0x1e0
fst dword [edi + 0x2d90]
mov dword [edi + 0x2d94], eax
fxch st(1)
fst dword [edi + 0x2db8]
fst dword [edi + 0x2dbc]
fst dword [edi + 0x2db0]
fst dword [edi + 0x2db4]
mov byte [edi + 0x2dc0], al
fxch st(1)
fstp dword [edi + 0x2dc4]
mov byte [edi + 0x2dec], al
mov dword [edi + 0x2df0], eax
mov dword [edi + 0x2df4], eax
fstp dword [edi + 0x2e04]
mov byte [edi + 0x2e08], al
mov dword [edi + 0x2e0c], eax
mov dword [edi + 0x2e14], 2
mov dword [edi + 0x2e10], 2
mov byte [edi + 0x2e18], al
push eax
mov dword [edi + 0x2e1c], eax
lea eax, [edi + 0x2e20]
push eax
call fcn.10164250
fldz
mov dword [edi + 0x3000], 0
fstp dword [edi + 0x3004]
push 0xc01
mov dword [edi + 0x3010], 0xffffffff
lea eax, [edi + 0x3014]
push 0
mov dword [edi + 0x300c], 0xffffffff
push eax
mov dword [edi + 0x3008], 0xffffffff
call fcn.10164250
mov ecx, dword [ebp - 0xc]
add esp, 0x18
mov eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4