Function at 0x1301efa0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x13044d0d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea eax, [esp + 0x24]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x20], 1
call fcn.13039365
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov dword [esi + 0xc], ecx
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0x30]
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x44]
lea ebp, [esi + 0x2c]
xor ebx, ebx
mov dword [esi + 0x18], ecx
mov ecx, ebp
mov byte [esp + 0x1c], 2
mov dword [esi + 8], ebx
mov dword [esi + 0x1c], edx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
call fcn.130386f8
mov ecx, dword [0x1305ad40]
mov dword [esi + 0x40], ecx
mov edx, dword [0x1305ad40]
mov dword [esi + 0x44], edx
mov eax, dword [0x1305ad40]
mov dword [esi + 0x48], eax
mov ecx, dword [0x1305ad40]
mov dword [esi + 0x4c], ecx
mov edx, dword [0x1305ad40]
mov dword [esi + 0x50], edx
mov eax, dword [0x1305ad40]
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], ebx
mov byte [esi + 0x5c], bl
mov byte [esi + 0x5d], bl
mov byte [esi + 0x5e], bl
mov byte [esi + 0x5f], bl
mov byte [esi + 0x60], bl
mov byte [esi + 0x61], bl
mov byte [esi + 0x62], bl
mov ecx, dword [0x1305ad40]
mov dword [esi + 0x64], ecx
mov edx, dword [0x1305ad40]
mov dword [esi + 0x68], edx
mov eax, dword [esp + 0x3c]
lea ecx, [esi + 0x6c]
push eax
mov byte [esp + 0x20], 0xb
call fcn.13039365
mov ecx, dword [0x1305ad40]
lea edi, [esi + 0x70]
mov dword [edi], ecx
mov edx, dword [esp + 0x40]
mov byte [esp + 0x1c], 0xd
push edx
lea ecx, [esi + 0x74]
call fcn.13039365
mov eax, dword [esp + 0x4c]
lea ecx, [esi + 0x78]
push eax
mov byte [esp + 0x20], 0xe
call fcn.13039365
mov ecx, dword [0x1305ad40]
mov dword [esi + 0x7c], ecx
mov dl, byte [esp + 0x48]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
mov byte [esp + 0x24], 0x10
mov byte [esi + 0x80], dl
mov dword [esi], 0x13049384
call fcn.1303878b
mov ebp, dword [esp + 0x3c]
mov ecx, edi
push ebp
call fcn.130396dd
push str.:___
mov ecx, edi
mov byte [esp + 0x4c], bl
call fcn.13039a91
test eax, eax
jl 0x1301f149
push 0x13053f44
push 0x13057ec8
mov ecx, edi
mov byte [esp + 0x50], 1
call fcn.13037e89
push 0x13053f44
push 0x13059a44
mov ecx, edi
call fcn.13037e89
push 0x13058de4
push 0x13059a40
mov ecx, edi
call fcn.13037e89
push 0x13058de4
push 0x13059a3c
mov ecx, edi
call fcn.13037e89
mov ecx, edi
call fcn.130384d8
mov ecx, edi
call fcn.13038524
cmp byte [esp + 0x48], bl
je 0x1301f19f
mov eax, dword [edi]
cmp dword [eax - 8], 3
jl 0x1301f19f
mov eax, dword [ebp]
push 1
push 1
push 0x13058de4
push 0x13058de8
lea ecx, [esp + 0x58]
push eax
push ecx
call fcn.1301b750
add esp, 0x18
push eax
mov ecx, edi
mov byte [esp + 0x20], 0x11
call fcn.130396dd
lea ecx, [esp + 0x48]
mov byte [esp + 0x1c], 0x10
call fcn.130395f0
mov ecx, edi
call fcn.130384d8
mov ecx, edi
call fcn.13038524
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.130395f0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x2c