Function at 0x10010a64
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100edcb5
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x101401a0]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x101401a0]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 0x14]
mov edx, 0x3000
and eax, edx
mov dword [esp + 0x30], ebx
cmp eax, edx
jne 0x10010adb
push edi
push ecx
push dword [esp + 0x20]
push esi
push ebx
push dword [ebp + 8]
call fcn.100111cc
add esp, 0x18
jmp 0x10010fc1
lea eax, [esp + 0x34]
push eax
call fcn.10014064
and dword [esp + 0x88], 0
push eax
call fcn.10012172
or dword [esp + 0x8c], 0xffffffff
pop ecx
mov ecx, dword [esp + 0x34]
mov edi, eax
mov dword [esp + 0x2c], edi
test ecx, ecx
je 0x10010b16
call fcn.100140ab
push eax
call fcn.1001408e
pop ecx
lea eax, [esp + 0x38]
push eax
mov ecx, edi
call fcn.10011895
push dword [esp + 0x18]
mov ecx, esi
mov dword [esp + 0x8c], 1
mov dword [esp + 0x20], ebx
mov byte [esp + 0x1b], 0
call fcn.10012681
test al, al
jne 0x10010b6d
mov ecx, esi
call fcn.1001179a
mov ecx, esi
cmp al, 0x2b
jne 0x10010b56
mov byte [ebx], al
jmp 0x10010b63
call fcn.1001179a
cmp al, 0x2d
jne 0x10010b6d
mov byte [ebx], al
mov ecx, esi
inc ebx
mov dword [esp + 0x1c], ebx
call fcn.100117c9
mov eax, dword [esp + 0x3c]
xor ecx, ecx
cmp dword [esp + 0x50], 0x10
mov byte [esp + 0x16], 0
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
jae 0x10010b8b
lea eax, [esp + 0x3c]
cmp byte [eax], 0x7f
je 0x10010d31
cmp dword [esp + 0x50], 0x10
mov eax, dword [esp + 0x3c]
jae 0x10010ba3
lea eax, [esp + 0x3c]
cmp byte [eax], cl
jle 0x10010d31
cmp dword [esp + 0x4c], ecx
jne 0x10010bb7
mov byte [esp + 0x23], cl
jmp 0x10010bc2
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
mov byte [esp + 0x23], al
xor edi, edi
push edi
push 1
lea ecx, [esp + 0x60]
call fcn.1000e3a4
push dword [esp + 0x18]
mov ecx, esi
mov byte [esp + 0x8c], 2
xor ebx, ebx
call fcn.10012681
test al, al
jne 0x10010cbd
mov ecx, esi
call fcn.1001179a
cmp al, 0x30
jl 0x10010c58
mov ecx, esi
call fcn.1001179a
cmp al, 0x39
jg 0x10010c58
cmp dword [esp + 0x24], 0x24
mov byte [esp + 0x16], 1
jl 0x10010c15
inc dword [esp + 0x28]
jmp 0x10010c3b
mov ecx, esi
call fcn.1001179a
cmp al, 0x30
jne 0x10010c26
cmp dword [esp + 0x24], edi
je 0x10010c3b
mov ecx, esi
call fcn.1001179a
mov ecx, dword [esp + 0x1c]
inc dword [esp + 0x1c]
inc dword [esp + 0x24]
mov byte [ecx], al
push ebx
lea ecx, [esp + 0x5c]
call fcn.100010d8
cmp byte [eax], 0x7f
je 0x10010c88
push ebx
lea ecx, [esp + 0x5c]
call fcn.100010d8
inc byte [eax]
jmp 0x10010c88
push ebx
lea ecx, [esp + 0x5c]
call fcn.100010d8
cmp byte [eax], 0
je 0x10010ca2
cmp byte [esp + 0x23], 0
je 0x10010ca2
mov ecx, esi
call fcn.1001179a
cmp al, byte [esp + 0x23]
jne 0x10010ca2
push edi
push 1
lea ecx, [esp + 0x60]
call fcn.1000352f
inc ebx
mov ecx, esi
call fcn.100117c9
push dword [esp + 0x18]
mov ecx, esi
call fcn.10012681
test al, al
je 0x10010bed
cmp ebx, edi
je 0x10010cbd
push ebx
lea ecx, [esp + 0x5c]
call fcn.100010d8
cmp byte [eax], 0
jle 0x10010cb8
inc ebx
jmp 0x10010cbd
mov byte [esp + 0x17], 1
cmp dword [esp + 0x50], 0x10
mov edi, dword [esp + 0x3c]
jae 0x10010ccc
lea edi, [esp + 0x3c]
cmp byte [esp + 0x17], 0
jne 0x10010d11
test ebx, ebx
je 0x10010d11
cmp byte [edi], 0x7f
je 0x10010d11
dec ebx
je 0x10010cef
push ebx
lea ecx, [esp + 0x5c]
call fcn.100010d8
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x10010d0c
test ebx, ebx
jne 0x10010d03
push ebx
lea ecx, [esp + 0x5c]
call fcn.100010d8
mov cl, byte [edi]
cmp cl, byte [eax]
jl 0x10010d0c
cmp byte [edi + 1], 0
jle 0x10010cd3
inc edi
jmp 0x10010cd3
mov byte [esp + 0x17], 1
push 0
push 1
lea ecx, [esp + 0x60]
mov byte [esp + 0x90], 1
call fcn.100015c0
lea ecx, [esp + 0x58]
call fcn.10002740
jmp 0x10010da5
push dword [esp + 0x18]
mov ecx, esi
call fcn.10012681
test al, al
jne 0x10010dbe
mov ecx, esi
call fcn.1001179a
cmp al, 0x30
jl 0x10010da5
mov ecx, esi
call fcn.1001179a
cmp al, 0x39
jg 0x10010da5
cmp dword [esp + 0x24], 0x24
jl 0x10010d63
inc dword [esp + 0x28]
jmp 0x10010d8a
mov ecx, esi
call fcn.1001179a
cmp al, 0x30
jne 0x10010d75
cmp dword [esp + 0x24], 0
je 0x10010d8a
mov ecx, esi
call fcn.1001179a
mov ecx, dword [esp + 0x1c]
inc dword [esp + 0x1c]
inc dword [esp + 0x24]
mov byte [ecx], al
mov ecx, esi
mov byte [esp + 0x16], 1
call fcn.100117c9
push dword [esp + 0x18]
mov ecx, esi
call fcn.10012681
test al, al
je 0x10010d40
cmp byte [esp + 0x16], 0
je 0x10010dbe
cmp dword [esp + 0x24], 0
jne 0x10010dbe
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x1c]
mov byte [eax], 0x30
push dword [esp + 0x18]
mov ecx, esi
call fcn.10012681
test al, al
jne 0x10010dfd
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
mov bl, al
call fcn.1001179a
cmp al, bl
jne 0x10010dfd
call fcn.100a8540
mov eax, dword [eax]
mov ecx, dword [esp + 0x1c]
mov al, byte [eax]
inc dword [esp + 0x1c]
mov byte [ecx], al
mov ecx, esi
call fcn.100117c9
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x10010e26
mov edi, dword [esp + 0x1c]
jmp 0x10010e7c
mov ecx, esi
call fcn.1001179a
cmp al, 0x30
jne 0x10010e35
dec dword [esp + 0x28]
mov ecx, esi
mov byte [esp + 0x16], 1
call fcn.100117c9
push dword [esp + 0x18]
mov ecx, esi
call fcn.10012681
test al, al
je 0x10010e0b
cmp dword [esp + 0x28], 0
mov edi, dword [esp + 0x1c]
jge 0x10010e7c
mov byte [edi], 0x30
inc edi
inc dword [esp + 0x28]
jmp 0x10010e7c
mov ecx, esi
call fcn.1001179a
cmp al, 0x30
jl 0x10010e8b
mov ecx, esi
call fcn.1001179a
cmp al, 0x39
jg 0x10010e8b
cmp ebx, 0x24
jge 0x10010e70
mov ecx, esi
call fcn.1001179a
mov byte [edi], al
inc edi
inc ebx
mov ecx, esi
mov byte [esp + 0x16], 1
call fcn.100117c9
push dword [esp + 0x18]
mov ecx, esi
call fcn.10012681
test al, al
je 0x10010e4a
cmp byte [esp + 0x16], 0
je 0x10010f8a
push dword [esp + 0x18]
mov ecx, esi
call fcn.10012681
test al, al
jne 0x10010f8a
mov ecx, esi
call fcn.1001179a
cmp al, 0x65
je 0x10010ec3
mov ecx, esi
call fcn.1001179a
cmp al, 0x45
jne 0x10010f8a
mov byte [edi], 0x65
mov ecx, esi
inc edi
call fcn.100117c9
push dword [esp + 0x18]
mov ecx, esi
mov byte [esp + 0x1a], 0
xor ebx, ebx
call fcn.10012681
test al, al
jne 0x10010f08
mov ecx, esi
call fcn.1001179a
mov ecx, esi
cmp al, 0x2b
jne 0x10010ef5
mov byte [edi], al
jmp 0x10010f02
call fcn.1001179a
cmp al, 0x2d
jne 0x10010f08
mov byte [edi], al
mov ecx, esi
inc edi
call fcn.100117c9
push dword [esp + 0x18]
mov ecx, esi
call fcn.10012681
test al, al
jne 0x10010f7b
mov ecx, esi
call fcn.1001179a
cmp al, 0x30
jne 0x10010f3d
mov ecx, esi
mov byte [esp + 0x16], 1
call fcn.100117c9
push dword [esp + 0x18]
mov ecx, esi
call fcn.10012681
test al, al
je 0x10010f17
cmp byte [esp + 0x16], bl
je 0x10010f7b
mov byte [edi], 0x30
inc edi
jmp 0x10010f7b
mov ecx, esi
call fcn.1001179a
cmp al, 0x30
jl 0x10010f8a
mov ecx, esi
call fcn.1001179a
cmp al, 0x39
jg 0x10010f8a
cmp ebx, 8
jge 0x10010f6f
mov ecx, esi
call fcn.1001179a
mov byte [edi], al
inc edi
inc ebx
mov ecx, esi
mov byte [esp + 0x16], 1
call fcn.100117c9
push dword [esp + 0x18]
mov ecx, esi
call fcn.10012681
test al, al
je 0x10010f49
cmp byte [esp + 0x17], 0
jne 0x10010f98
cmp byte [esp + 0x16], 0
jne 0x10010f9c
mov edi, dword [esp + 0x30]
or dword [esp + 0x88], 0xffffffff
push 0
push 1
lea ecx, [esp + 0x40]
mov byte [edi], 0
call fcn.100015c0
lea ecx, [esp + 0x38]
call fcn.10002740
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.100a1c30
mov esp, ebp
pop ebp
ret