Function at 0x10008d2d
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a131c
mov eax, dword fs:[0]
push eax
mov eax, 0x18bc
call fcn.100040f8
mov eax, dword [0x100b7bfc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [ebp - 0x18c0], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi], 0x100b5c70
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov word [esi + 0x18], ax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
push esi
lea ebx, [esi + 0x2c]
mov byte [ebp - 4], 1
push 1
mov dword [ebx], eax
mov byte [esi + 0x30], al
call fcn.10008ed7
test eax, eax
jne 0x1000c9e5
xorps xmm0, xmm0
movups xmmword [ebp - 0x18bc], xmm0
lea eax, [ebp - 0x18bc]
mov byte [ebp - 4], 2
push eax
push 0x100b5b2c
mov ecx, esi
call fcn.1000908e
test eax, eax
je 0x1000c9f5
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x438], 0x200
xor ecx, ecx
mov dword [ebp - 0x43c], eax
xor eax, eax
mov byte [ebp - 0x434], cl
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x42c], ecx
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x1898]
mov dword [ebp - 0x18a4], 0x825
mov dword [ebp - 0x18a8], eax
xor eax, eax
mov byte [ebp - 0x18a0], cl
mov dword [ebp - 0x189c], ecx
mov dword [ebp - 0x1898], ecx
mov word [ebp - 0x1894], ax
push 0x100b5b10
lea eax, [ebp - 0x43c]
mov byte [ebp - 4], 0x11
push eax
mov ecx, esi
call fcn.1000912c
mov ebx, eax
mov ecx, esi
push 0x100b5b20
lea eax, [ebp - 0x18a8]
neg ebx
push eax
sbb bl, bl
call fcn.1000912c
neg eax
mov edi, str.groovegrooveutildll_spfsfolderdescriptorbase.cpp
sbb al, al
inc al
mov dword [ebp - 0x14], eax
add bl, 1
jne 0x1000caca
test al, al
jne 0x1000cb57
lea eax, [ebp - 0x18a8]
push eax
mov ecx, eax
call fcn.100073a8
lea eax, [ebp - 0x43c]
push eax
mov ecx, eax
call fcn.100073a8
cmp dword [ebp - 0x18bc], 0
mov byte [ebp - 4], 0x16
jne 0x1000cb85
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001550
mov esp, ebp
pop ebp
ret
push eax
push 0x1615a1
call fcn.1003d01e
jmp 0x10008db0
push 0x17
push 0x100d4f18
push 0x100bf584
lea ecx, [ebp - 0x20]
call fcn.10007652
push dword [ebp - 0x18bc]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18c4]
push dword [ebp - 0x18b8]
mov byte [ebp - 4], 3
push eax
call fcn.10017ed4
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x18c8]
mov byte [ebp - 4], 4
push eax
call fcn.10019ff4
push 0
push eax
push 0x100d50d8
lea ecx, [ebp - 0x1c]
call fcn.10026793
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push ebx
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x18a9]
mov byte [ebp - 4], 5
call fcn.1002a38a
xor ebx, ebx
cmp dword [ebp - 0x18], ebx
jbe 0x1000caa1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
call fcn.1002a312
push 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 6
push eax
push dword [esi + 0x20]
lea ecx, [esi + 0x1c]
call fcn.1003b379
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.1002b209
inc ebx
cmp ebx, dword [ebp - 0x18]
jb 0x1000ca6f
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.10026969
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xc
call fcn.10026969
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xf
call fcn.10026969
jmp 0x10008ea8
test al, al
je 0x1000cb2a
mov ecx, dword [ebp - 0x43c]
xor eax, eax
cmp ax, word [ecx]
je 0x1000cb2a
mov eax, dword [ebp - 0x18a8]
xor edx, edx
cmp dx, word [eax]
je 0x1000cb2a
push edx
push ecx
lea ecx, [ebp - 0x84c]
call fcn.10009396
push 0
push 1
push dword [ebp - 0x18a8]
lea eax, [ebp - 0x84c]
mov byte [ebp - 4], 0x12
push eax
mov ecx, esi
call fcn.1002bfee
mov ecx, esi
call fcn.1003a6dd
lea eax, [ebp - 0x84c]
mov byte [ebp - 4], 0x11
push eax
mov ecx, eax
call fcn.100073a8
push 0x100b5b10
mov ecx, esi
call fcn.1002ec7f
test eax, eax
je 0x1000cb4f
push 0x1615c0
push str.ERROR_SUCCESS__m_RegistryKey.DeleteValue_COMMON_ATTRIBUTE_PATH_
push 0xcf
push edi
call fcn.10033747
mov eax, dword [ebp - 0x14]
jmp 0x10008e84
push 0x100b5b20
mov ecx, esi
call fcn.1002ec7f
test eax, eax
je 0x10008e8c
push 0x1615c1
push str.ERROR_SUCCESS__m_RegistryKey.DeleteValue_COMMON_ATTRIBUTE_URL_
push 0xd2
push edi
call fcn.10033747
jmp 0x10008e8c
push 0
push 0
lea ecx, [ebp - 0x18bc]
call fcn.1000e85c
jmp 0x10008eb9