Function at 0x100788e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10244eef
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102e1e14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xd8
call fcn.100d1d56
mov ebx, eax
add esp, 4
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x10078ae5
lea eax, [edi + 4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebx + 4]
mov dword [ebx], vtable.FileSys::ISOLib::ISOSessionInfoAttr.0
call fcn.10016330
mov eax, dword [edi + 0x10]
lea esi, [ebx + 0x30]
mov dword [ebx + 0x10], eax
mov ecx, esi
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [edi + 0x2c]
add edi, 0x30
push edi
mov byte [ebp - 4], 2
mov dword [ebx + 0x2c], eax
mov dword [ebp - 0x14], esi
call fcn.10016330
lea eax, [edi + 0xc]
mov byte [ebp - 4], 3
push eax
lea ecx, [esi + 0xc]
call fcn.10016330
lea eax, [edi + 0x18]
mov byte [ebp - 4], 4
push eax
lea ecx, [esi + 0x18]
call fcn.10016330
lea eax, [edi + 0x24]
mov byte [ebp - 4], 5
push eax
lea ecx, [esi + 0x24]
call fcn.10016330
lea eax, [edi + 0x30]
mov byte [ebp - 4], 6
push eax
lea ecx, [esi + 0x30]
call fcn.10016330
lea eax, [edi + 0x3c]
mov byte [ebp - 4], 7
push eax
lea ecx, [esi + 0x3c]
call fcn.10016330
lea eax, [edi + 0x48]
mov byte [ebp - 4], 8
push eax
lea ecx, [esi + 0x48]
call fcn.10016330
lea eax, [edi + 0x54]
mov byte [ebp - 4], 9
push eax
lea ecx, [esi + 0x54]
call fcn.10016330
movzx eax, byte [edi + 0x60]
mov byte [esi + 0x60], al
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
movzx eax, byte [edi + 0x68]
mov byte [esi + 0x68], al
movzx eax, byte [edi + 0x69]
mov byte [esi + 0x69], al
movzx eax, byte [edi + 0x6a]
mov byte [esi + 0x6a], al
movzx eax, byte [edi + 0x6b]
mov byte [esi + 0x6b], al
movzx eax, byte [edi + 0x6c]
mov byte [esi + 0x6c], al
movq xmm0, qword [edi + 0x6d]
movq qword [esi + 0x6d], xmm0
mov eax, dword [edi + 0x75]
mov dword [esi + 0x75], eax
movzx eax, word [edi + 0x79]
mov word [esi + 0x79], ax
movzx eax, byte [edi + 0x7b]
mov byte [esi + 0x7b], al
movq xmm0, qword [edi + 0x7c]
movq qword [esi + 0x7c], xmm0
mov eax, dword [edi + 0x84]
mov dword [esi + 0x84], eax
movzx eax, word [edi + 0x88]
mov word [esi + 0x88], ax
movzx eax, byte [edi + 0x8a]
mov byte [esi + 0x8a], al
movq xmm0, qword [edi + 0x8b]
movq qword [esi + 0x8b], xmm0
mov eax, dword [edi + 0x93]
mov dword [esi + 0x93], eax
movzx eax, word [edi + 0x97]
mov word [esi + 0x97], ax
movzx eax, byte [edi + 0x99]
mov byte [esi + 0x99], al
mov eax, ebx
movq xmm0, qword [edi + 0x9a]
movq qword [esi + 0x9a], xmm0
mov ecx, dword [edi + 0xa2]
mov dword [esi + 0xa2], ecx
mov cx, word [edi + 0xa6]
mov word [esi + 0xa6], cx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret