Function at 0x1202cad0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1208986d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea eax, [esp + 0x24]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x20], 1
call fcn.120736df
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0x30]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x44]
lea ebp, [esi + 0x2c]
xor ebx, ebx
mov dword [esi + 0x18], ecx
mov ecx, ebp
mov byte [esp + 0x1c], 2
mov dword [esi + 8], ebx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
call fcn.1206d639
mov ecx, dword [0x120b3180]
mov dword [esi + 0x40], ecx
mov edx, dword [0x120b3180]
mov dword [esi + 0x44], edx
mov eax, dword [0x120b3180]
mov dword [esi + 0x48], eax
mov ecx, dword [0x120b3180]
mov dword [esi + 0x4c], ecx
mov edx, dword [0x120b3180]
mov dword [esi + 0x50], edx
mov eax, dword [0x120b3180]
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], ebx
mov byte [esi + 0x5c], bl
mov byte [esi + 0x5d], bl
mov byte [esi + 0x5e], bl
mov byte [esi + 0x5f], bl
mov byte [esi + 0x60], bl
mov byte [esi + 0x61], bl
mov byte [esi + 0x62], bl
mov ecx, dword [0x120b3180]
mov dword [esi + 0x64], ecx
mov edx, dword [0x120b3180]
mov dword [esi + 0x68], edx
mov eax, dword [esp + 0x3c]
lea ecx, [esi + 0x6c]
push eax
mov byte [esp + 0x20], 0xb
call fcn.120736df
mov ecx, dword [0x120b3180]
lea edi, [esi + 0x70]
mov dword [edi], ecx
mov edx, dword [esp + 0x40]
mov byte [esp + 0x1c], 0xd
push edx
lea ecx, [esi + 0x74]
call fcn.120736df
mov eax, dword [esp + 0x4c]
lea ecx, [esi + 0x78]
push eax
mov byte [esp + 0x20], 0xe
call fcn.120736df
mov ecx, dword [0x120b3180]
mov dword [esi + 0x7c], ecx
mov dl, byte [esp + 0x48]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
mov byte [esp + 0x24], 0x10
mov byte [esi + 0x80], dl
mov dword [esi], method.CCommandLineInfo.virtual_0
call fcn.1206d6cc
mov ebp, dword [esp + 0x3c]
mov ecx, edi
push ebp
call fcn.12073aa3
push str.:___
mov ecx, edi
mov byte [esp + 0x4c], bl
call fcn.12073ec6
test eax, eax
jl 0x1202cc79
push 0x120ad9e8
push 0x120aa368
mov ecx, edi
mov byte [esp + 0x50], 1
call fcn.1206bd38
push 0x120ad9e8
push 0x120b1c10
mov ecx, edi
call fcn.1206bd38
push 0x120b0e9c
push 0x120b1c0c
mov ecx, edi
call fcn.1206bd38
push 0x120b0e9c
push 0x120b1c08
mov ecx, edi
call fcn.1206bd38
mov ecx, edi
call fcn.1206c657
mov ecx, edi
call fcn.1206c74e
cmp byte [esp + 0x48], bl
je 0x1202cccf
mov eax, dword [edi]
cmp dword [eax - 8], 3
jl 0x1202cccf
mov eax, dword [ebp]
push 1
push 1
push 0x120b0e9c
push 0x120b0ea0
lea ecx, [esp + 0x58]
push eax
push ecx
call fcn.12028bf0
add esp, 0x18
push eax
mov ecx, edi
mov byte [esp + 0x20], 0x11
call fcn.12073aa3
lea ecx, [esp + 0x48]
mov byte [esp + 0x1c], 0x10
call fcn.1207396a
mov ecx, edi
call fcn.1206c657
mov ecx, edi
call fcn.1206c74e
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.1207396a
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x2c