Function at 0x10bc6e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10e278a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebp
xor ebp, ebp
mov dword [esp + 4], ebp
push esi
mov esi, ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
push 0x111fba04
mov dword [esp + 0x3c], 1
call fcn.1097a740
test eax, eax
jne 0x10bc6e4a
cmp dword [esp + 0x44], ebp
je 0x10bc6e8f
cmp dword [esi + 4], ebp
je 0x10bc6e53
mov eax, dword [esi]
jmp 0x10bc6e58
mov eax, 0x10e43c3c
push eax
lea ecx, [esp + 0x10]
call fcn.109059d0
push 0x10e58638
lea ecx, [esp + 0x10]
call fcn.109059d0
push 0x111fba4c
lea ecx, [esi + 0xc]
call fcn.1097a740
test eax, eax
je 0x10bc6e8f
push 0x10e4a010
lea ecx, [esp + 0x10]
call fcn.109059d0
push edi
lea edi, [esi + 0xc]
push 0x111fba4c
mov ecx, edi
call fcn.1097a740
test eax, eax
jne 0x10bc6eb2
mov eax, dword [esi + 0x18]
cmp eax, dword [0x111fba00]
je 0x10bc6f32
cmp dword [edi + 4], ebp
je 0x10bc6ebb
mov edi, dword [edi]
jmp 0x10bc6ec0
mov edi, 0x10e43c3c
push edi
lea ecx, [esp + 0x14]
call fcn.109059d0
mov ecx, dword [esi + 0x18]
cmp ecx, dword [0x111fba00]
je 0x10bc6f24
push 0x10e58638
lea ecx, [esp + 0x14]
call fcn.109059d0
mov edx, dword [esi + 0x18]
push edx
lea eax, [esp + 0x2c]
push 0x10e47760
push eax
call fcn.109bc8a0
add esp, 0xc
cmp dword [eax + 4], ebp
mov byte [esp + 0x3c], 2
je 0x10bc6f07
mov eax, dword [eax]
jmp 0x10bc6f0c
mov eax, 0x10e43c3c
push eax
lea ecx, [esp + 0x14]
call fcn.109059d0
lea ecx, [esp + 0x28]
mov byte [esp + 0x3c], 1
call fcn.10902a90
push 0x10e52618
lea ecx, [esp + 0x14]
call fcn.109059d0
mov eax, dword [esi + 0x20]
cmp eax, ebp
je 0x10bc6f51
cmp eax, ebp
je 0x10bc6f42
mov eax, dword [esi + 0x1c]
jmp 0x10bc6f47
mov eax, 0x10e43c3c
push eax
lea ecx, [esp + 0x14]
call fcn.109059d0
mov eax, dword [esi + 0x2c]
cmp eax, ebp
mov dword [esp + 0x48], ebp
jle 0x10bc70d0
xor edi, edi
push ebx
cmp dword [esp + 0x50], ebp
je 0x10bc6fae
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esi + 0x28]
add ecx, edi
call fcn.109277d0
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 4]
or edx, 1
cmp ecx, ebp
mov byte [esp + 0x40], 3
mov dword [esp + 0x10], edx
je 0x10bc6f93
mov eax, dword [eax]
jmp 0x10bc6f98
mov eax, 0x10e43c3c
push str.ADMINPASSWORD
push eax
call fcn.109b9f80
add esp, 8
test eax, eax
jne 0x10bc6fae
mov bl, 1
jmp 0x10bc6fb0
xor bl, bl
test byte [esp + 0x10], 1
mov dword [esp + 0x40], 1
je 0x10bc6fea
and dword [esp + 0x10], 0xfffffffe
push 2
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 4
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
call fcn.109b8e40
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 1
call fcn.109148d0
test bl, bl
je 0x10bc6ff8
push str._ADMINPASSWORDXXXXX
jmp 0x10bc70af
cmp dword [esp + 0x50], ebp
je 0x10bc7043
mov ecx, dword [esi + 0x28]
lea edx, [esp + 0x2c]
push edx
add ecx, edi
call fcn.109277d0
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 4]
or edx, 2
cmp ecx, ebp
mov byte [esp + 0x40], 5
mov dword [esp + 0x10], edx
je 0x10bc7028
mov eax, dword [eax]
jmp 0x10bc702d
mov eax, 0x10e43c3c
push str.PASSWORD
push eax
call fcn.109b9f80
add esp, 8
test eax, eax
jne 0x10bc7043
mov bl, 1
jmp 0x10bc7045
xor bl, bl
test byte [esp + 0x10], 2
mov dword [esp + 0x40], 1
je 0x10bc707f
and dword [esp + 0x10], 0xfffffffd
push 2
lea ecx, [esp + 0x30]
mov byte [esp + 0x44], 6
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
call fcn.109b8e40
lea ecx, [esp + 0x2c]
mov byte [esp + 0x40], 1
call fcn.109148d0
test bl, bl
lea ecx, [esp + 0x14]
je 0x10bc708e
push str._PASSWORDXXXXX
jmp 0x10bc70b3
push 0x10e61054
call fcn.109059d0
mov eax, dword [esi + 0x28]
mov ecx, dword [eax + edi + 4]
add eax, edi
cmp ecx, ebp
je 0x10bc70a9
mov eax, dword [eax]
jmp 0x10bc70ae
mov eax, 0x10e43c3c
push eax
lea ecx, [esp + 0x18]
call fcn.109059d0
mov eax, dword [esp + 0x4c]
mov ecx, dword [esi + 0x2c]
inc eax
add edi, 0xc
cmp eax, ecx
mov dword [esp + 0x4c], eax
jl 0x10bc6f63
pop ebx
cmp dword [esi + 0x38], ebp
pop edi
je 0x10bc70fd
push 0x10e57aa0
lea ecx, [esp + 0x10]
call fcn.109059d0
cmp dword [esi + 0x38], ebp
je 0x10bc70ee
mov esi, dword [esi + 0x34]
jmp 0x10bc70f3
mov esi, 0x10e43c3c
push esi
lea ecx, [esp + 0x10]
call fcn.109059d0
mov esi, dword [esp + 0x40]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.10905950
or dword [esp + 8], 4
push 2
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call fcn.109b8e40
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 0
call fcn.109148d0
mov ecx, dword [esp + 0x30]
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x34
ret 0xc