Function at 0x10170cc0
Capabilities:
Access peb ldr_data
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x284], eax
mov ecx, eax
mov dword [ebp - 0x280], ecx
mov ecx, dword fs:[0x30]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0xa4]
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0xa8]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 8]
movzx ecx, word [ecx + 0xac]
mov dword [eax + 8], ecx
xor eax, eax
lea eax, [ebp - 0xc]
mov dword [esp], 6
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
call fcn.10171bb0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x27c], 0xb3a6fd79
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x288], eax
nop dword [eax + eax]
sub eax, 0x83bff6a7
je 0x10171405
jmp 0x10170d70
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x8a7a56b1
je 0x101714c5
jmp 0x10170d90
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x91b05cab
je 0x10171365
jmp 0x10170db0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x9cea503c
je 0x101715c5
jmp 0x10170dd0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x9e70f744
je 0x101717f1
jmp 0x10170df0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x9f81cd97
je 0x1017190b
jmp 0x10170e10
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0xb36faa61
je 0x101718c5
jmp 0x10170e30
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0xb3a6fd79
je 0x10171275
jmp 0x10170e50
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0xb7bf7275
je 0x10171765
jmp 0x10170e70
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0xb8972431
je 0x101713e5
jmp 0x10170e90
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0xc4a45dfd
je 0x10171485
jmp 0x10170eb0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0xd554de01
je 0x101713c5
jmp 0x10170ed0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0xe86b6956
je 0x101713a5
jmp 0x10170ef0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0xf0f197ff
je 0x10171691
jmp 0x10170f10
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0xf9555ac8
je 0x1017187d
jmp 0x10170f30
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0xfd8b0f98
je 0x101714e5
jmp 0x10170f50
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0xfdc855c8
je 0x101712ed
jmp 0x10170f70
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x514286b
je 0x10171465
jmp 0x10170f90
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x9ab1682
je 0x10171505
jmp 0x10170fb0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x9ab24d2
je 0x10171837
jmp 0x10170fd0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0xedcf355
je 0x101712b1
jmp 0x10170ff0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x16dd3190
je 0x101717ab
jmp 0x10171010
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x22b17933
je 0x101714a5
jmp 0x10171030
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x2501704d
je 0x10171585
jmp 0x10171050
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x317331b9
je 0x10171605
jmp 0x10171070
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x35024622
je 0x10171425
jmp 0x10171090
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x44151f21
je 0x1017130b
jmp 0x101710b0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x448dc4e0
je 0x10171347
jmp 0x101710d0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x4ef148c3
je 0x101712cf
jmp 0x101710f0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x4f870306
je 0x10171951
jmp 0x10171110
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x514c6c37
je 0x10171385
jmp 0x10171130
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x58aad4d0
je 0x101719ec
jmp 0x10171150
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x59348994
je 0x10171545
jmp 0x10171170
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x59dd04e9
je 0x1017171d
jmp 0x10171190
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x5a8488ce
je 0x10171445
jmp 0x101711b0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x5b5751c7
je 0x10171293
jmp 0x101711d0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x5bb1b9ec
je 0x10171997
jmp 0x101711f0
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x5d5c9995
je 0x101719a6
jmp 0x10171210
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x6135af77
je 0x10171329
jmp 0x10171230
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x79fab67d
je 0x101716d7
jmp 0x10171250
mov eax, dword [ebp - 0x288]
nop word cs:[eax + eax]
sub eax, 0x7dc06a1e
je 0x1017164b
jmp 0x10171270
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x5b5751c7
mov ecx, 0xb8972431
cmp edx, 0xa
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0xedcf355
mov ecx, 0x514c6c37
cmp edx, 0xe
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x4ef148c3
mov ecx, 0x448dc4e0
cmp edx, 0x11
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0xfdc855c8
mov ecx, 0x4f870306
cmp edx, 0x12
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x44151f21
mov ecx, 0x6135af77
cmp edx, 0x19
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x5bb1b9ec
mov ecx, 0xf9555ac8
cmp edx, 0x19
cmove eax, ecx
mov dword [ebp - 0x27c], eax
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x5bb1b9ec
mov ecx, 0xf0f197ff
cmp edx, 0x12
cmove eax, ecx
mov dword [ebp - 0x27c], eax
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x91b05cab
mov ecx, 0x16dd3190
cmp edx, 0xf
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x5bb1b9ec
mov ecx, 0x9e70f744
cmp edx, 0xf
cmove eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0xe86b6956
mov ecx, 0xd554de01
cmp edx, 0xc
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x9f81cd97
mov ecx, 0x59dd04e9
cmp edx, 0xd
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x7dc06a1e
mov ecx, 0xb7bf7275
cmp edx, 0xb
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x83bff6a7
mov ecx, 0x514286b
cmp edx, 6
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x35024622
mov ecx, 0x5a8488ce
cmp edx, 8
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x9ab24d2
mov ecx, 0x79fab67d
cmp edx, 9
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0xb36faa61
mov ecx, 0x317331b9
cmp edx, 7
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0xc4a45dfd
mov ecx, 0x8a7a56b1
cmp edx, 3
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x22b17933
mov ecx, 0x59348994
cmp edx, 4
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x5bb1b9ec
mov ecx, 0x9cea503c
cmp edx, 4
cmove eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x2501704d
mov ecx, 0xfd8b0f98
cmp edx, 2
cmovl eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
mov edx, dword [ebp - 4]
mov eax, 0x5bb1b9ec
mov ecx, 0x9ab1682
cmp edx, 1
cmove eax, ecx
mov dword [ebp - 0x27c], eax
nop
jmp 0x10171a14
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x24]
mov dword [esp], eax
call fcn.10171c20
sub esp, 4
lea ecx, [ebp - 0x24]
call fcn.100b6a80
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
nop dword [eax]
jmp 0x10171a14
lea ecx, [ebp - 0x48]
lea eax, [ebp - 0x44]
mov dword [esp], eax
call fcn.10171c60
sub esp, 4
lea ecx, [ebp - 0x44]
call fcn.100864e0
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
nop dword [eax]
jmp 0x10171a14
lea ecx, [ebp - 0x64]
lea eax, [ebp - 0x60]
mov dword [esp], eax
call fcn.10171ca0
sub esp, 4
lea ecx, [ebp - 0x60]
call fcn.100adaa0
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
nop dword [eax]
jmp 0x10171a14
lea ecx, [ebp - 0x80]
lea eax, [ebp - 0x7c]
mov dword [esp], eax
call fcn.10171ce0
sub esp, 4
lea ecx, [ebp - 0x7c]
call fcn.100adaa0
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
nop dword [eax]
jmp 0x10171a14
lea ecx, [ebp - 0x94]
lea eax, [ebp - 0x90]
mov dword [esp], eax
call fcn.10171d20
sub esp, 4
lea ecx, [ebp - 0x90]
call fcn.10080580
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
jmp 0x10171a14
lea ecx, [ebp - 0xac]
lea eax, [ebp - 0xa8]
mov dword [esp], eax
call fcn.10171d60
sub esp, 4
lea ecx, [ebp - 0xa8]
call fcn.100a6640
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
jmp 0x10171a14
lea ecx, [ebp - 0xcc]
lea eax, [ebp - 0xc8]
mov dword [esp], eax
call fcn.10171da0
sub esp, 4
lea ecx, [ebp - 0xc8]
call fcn.100ab6e0
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
jmp 0x10171a14
lea ecx, [ebp - 0xe8]
lea eax, [ebp - 0xe4]
mov dword [esp], eax
call fcn.10171de0
sub esp, 4
lea ecx, [ebp - 0xe4]
call fcn.100adaa0
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
jmp 0x10171a14
lea ecx, [ebp - 0x118]
lea eax, [ebp - 0x114]
mov dword [esp], eax
call fcn.10171e20
sub esp, 4
lea ecx, [ebp - 0x114]
call fcn.10171e60
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
nop
jmp 0x10171a14
lea ecx, [ebp - 0x134]
lea eax, [ebp - 0x130]
mov dword [esp], eax
call fcn.10173a40
sub esp, 4
lea ecx, [ebp - 0x130]
call fcn.100adaa0
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
jmp 0x10171a14
lea ecx, [ebp - 0x164]
lea eax, [ebp - 0x160]
mov dword [esp], eax
call fcn.10173a80
sub esp, 4
lea ecx, [ebp - 0x160]
call fcn.10171e60
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
jmp 0x10171a14
lea ecx, [ebp - 0x19c]
lea eax, [ebp - 0x198]
mov dword [esp], eax
call fcn.10173ac0
sub esp, 4
lea ecx, [ebp - 0x198]
call fcn.10173b00
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
jmp 0x10171a14
lea ecx, [ebp - 0x1bc]
lea eax, [ebp - 0x1b8]
mov dword [esp], eax
call fcn.101747f0
sub esp, 4
lea ecx, [ebp - 0x1b8]
call fcn.100b8be0
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
jmp 0x10171a14
lea ecx, [ebp - 0x1ec]
lea eax, [ebp - 0x1e8]
mov dword [esp], eax
call fcn.10174830
sub esp, 4
lea ecx, [ebp - 0x1e8]
call fcn.10174880
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
nop
jmp 0x10171a14
lea ecx, [ebp - 0x208]
lea eax, [ebp - 0x204]
mov dword [esp], eax
call fcn.10176ad0
sub esp, 4
lea ecx, [ebp - 0x204]
call fcn.100b6a80
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
jmp 0x10171a14
lea ecx, [ebp - 0x238]
lea eax, [ebp - 0x234]
mov dword [esp], eax
call fcn.10176b10
sub esp, 4
lea ecx, [ebp - 0x234]
call fcn.100af400
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
jmp 0x10171a14
lea ecx, [ebp - 0x254]
lea eax, [ebp - 0x250]
mov dword [esp], eax
call fcn.10176b50
sub esp, 4
lea ecx, [ebp - 0x250]
call fcn.100adaa0
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
jmp 0x10171a14
mov dword [ebp - 0x27c], 0x5d5c9995
jmp 0x10171a14
lea ecx, [ebp - 0x278]
lea eax, [ebp - 0x274]
mov dword [esp], eax
call fcn.10176b90
sub esp, 4
lea ecx, [ebp - 0x274]
call fcn.100b03c0
mov ecx, dword [ebp - 0x284]
add ecx, 0x10
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10170ab0
mov dword [ebp - 0x27c], 0x58aad4d0
jmp 0x10171a14
mov eax, dword [ebp - 0x284]
add eax, 0xc
mov ecx, 0xffffffff
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10176bd0
mov eax, dword [ebp - 0x280]
add esp, 0x29c
pop ebp
ret
jmp 0x10170d4c