Function at 0x10011940
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get kernel32 base address
Get process heap flags
Get process heap force flags
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c879
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1009d350]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 4], eax
mov byte [ebp - 4], 1
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 8], eax
mov byte [ebp - 4], 2
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 3
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x10], eax
mov byte [ebp - 4], 4
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x14], eax
mov byte [ebp - 4], 5
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x18], eax
mov byte [ebp - 4], 6
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov byte [ebp - 4], 7
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x20], eax
mov byte [ebp - 4], 8
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x24], eax
mov byte [ebp - 4], 9
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x28], eax
mov byte [ebp - 4], 0xa
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x2c], eax
mov byte [ebp - 4], 0xb
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x30], eax
mov byte [ebp - 4], 0xc
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x34], eax
mov byte [ebp - 4], 0xd
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x38], eax
mov byte [ebp - 4], 0xe
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x3c], eax
mov byte [ebp - 4], 0xf
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x40], eax
mov byte [ebp - 4], 0x10
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x44], eax
mov byte [ebp - 4], 0x11
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x48], eax
mov byte [ebp - 4], 0x12
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x4c], eax
mov byte [ebp - 4], 0x13
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x50], eax
mov byte [ebp - 4], 0x14
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x54], eax
mov byte [ebp - 4], 0x15
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x58], eax
mov byte [ebp - 4], 0x16
mov ecx, 0x1009d2a8
mov eax, dword [0x1009d2a8]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x5c], eax
mov byte [ebp - 4], 0x17
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x60], eax
mov byte [ebp - 4], 0x18
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x64], eax
mov byte [ebp - 4], 0x19
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x68], eax
mov byte [ebp - 4], 0x1a
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x6c], eax
mov byte [ebp - 4], 0x1b
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x70], eax
mov byte [ebp - 4], 0x1c
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x74], eax
mov byte [ebp - 4], 0x1d
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x78], eax
mov byte [ebp - 4], 0x1e
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x7c], eax
mov byte [ebp - 4], 0x1f
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x80], eax
mov byte [ebp - 4], 0x20
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x84], eax
mov byte [ebp - 4], 0x21
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x88], eax
mov byte [ebp - 4], 0x22
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x8c], eax
mov byte [ebp - 4], 0x23
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x90], eax
mov byte [ebp - 4], 0x24
mov eax, dword [0x1009d2a8]
mov ecx, 0x1009d2a8
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x94], eax
mov byte [ebp - 4], 0x25
mov dword [esi + 0xd0], 0
mov eax, dword [0x1009d2a8]
lea ebx, [esi + 0xd4]
mov ecx, 0x1009d2a8
mov dword [ebp - 0x14], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov eax, 0x1009231d
mov byte [ebp - 4], 0x26
test eax, 0xffff0000
jne 0x10011d4b
movzx edi, ax
mov ecx, edi
call fcn.100017b9
test eax, eax
je 0x10011d59
push edi
push eax
mov ecx, ebx
call fcn.10007221
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x1009231d
mov ecx, ebx
call fcn.100081be
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret