Function at 0x1001a910
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x10052004]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
call fcn.1001a850
mov ecx, dword [eax + 4]
mov dword [esp + 0x5c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x60], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x64], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x40], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x4c], 1
mov dword [esp + 0x48], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0xffffffff
mov dword [esp + 0x70], 0
test eax, eax
je 0x1003394c
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [eax], 0
call fcn.10005765
test eax, eax
je 0x10033956
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x10033960
mov esi, dword [ebp + 0x10]
mov edx, 1
mov ecx, esi
call fcn.10006e40
mov ebx, eax
test ebx, ebx
js 0x1001ac0a
test esi, 0x21000
jne 0x10033977
test esi, 0x4000000
jne 0x10033981
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jne 0x1003398b
cmp dword [ebp + 0x18], 0
jne 0x100339b1
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x100339bb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0xf80]
mov dword [esp + 0x20], eax
test eax, eax
je 0x100339da
mov esi, dword [edi]
lea eax, [esp + 0x24]
push eax
push 0x10001ad0
push edi
mov esi, dword [esi]
mov ecx, esi
call dword [0x100532e8]
call esi
test eax, eax
jns 0x100339f4
mov edx, 1
lea ecx, [esp + 0x1c]
call fcn.10006be6
mov ebx, eax
test ebx, ebx
js 0x1001ac0a
call fcn.1001a850
mov ecx, dword [eax + 4]
mov dword [esp + 0x5c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x60], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x64], eax
call fcn.1001a850
mov ecx, dword [esp + 0x5c]
mov esi, dword [esp + 0x64]
mov edx, dword [esp + 0x60]
mov dword [esp + 0x14], eax
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
test ecx, ecx
jne 0x10033a59
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], esi
mov eax, dword fs:[0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 0xf80]
mov dword [eax], edx
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x30]
mov dword [ecx + 0xc], eax
call fcn.1001a850
push 0x44
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xc]
cmp esi, fcn.100180d0
jne 0x10033a64
call fcn.100180d0
mov esi, eax
test esi, esi
je 0x10033a96
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], 0
mov dword [esi + 0x20], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
call fcn.1001a850
push 0
mov ecx, dword [eax + 4]
mov dword [esi + 0x2c], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 0x30], ecx
mov ecx, esi
mov eax, dword [eax + 0x14]
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x18], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x40], 0
call fcn.1000e600
mov ebx, eax
push ecx
test ebx, ebx
js 0x10033a73
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x14]
push eax
push dword [ebp + 0x14]
push 0
call fcn.10006d2f
push eax
push 0
mov edx, edi
mov ecx, esi
call fcn.1000af60
mov ecx, dword [esp + 0x1c]
mov ebx, eax
push ecx
mov eax, dword [ecx]
mov edi, dword [eax + 8]
mov ecx, edi
call dword [0x100532e8]
call edi
or eax, 0xffffffff
lea ecx, [esi + 0x1c]
lock xadd dword [ecx], eax
dec eax
je 0x10033a7c
lea ecx, [esp + 0x14]
call fcn.100057f0
test ebx, ebx
js 0x1001ac0a
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [esp + 0x10]
push edi
mov dword [esp + 0x14], 0
mov dword [ecx], eax
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100532e8]
call esi
lea ecx, [esp + 0x30]
call fcn.1000e4a0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x10033aa9
mov ecx, dword [esp + 0x7c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100281a0
mov esp, ebp
pop ebp
ret 0x18
mov ebx, 0x80030009
jmp 0x1001ac0a
mov ebx, 0x80030009
jmp 0x1001ac0a
call fcn.10005765
test eax, eax
jne 0x1001a9e1
mov ebx, 0x80030009
jmp 0x1001ac0a
mov ebx, 0x800300ff
jmp 0x1001ac0a
mov ebx, 0x80030001
jmp 0x1001ac0a
mov eax, esi
and al, 3
cmp al, 2
je 0x1003399d
mov ebx, 0x80030005
jmp 0x1001ac0a
call fcn.1002128e
mov ebx, eax
test ebx, ebx
js 0x1001ac0a
jmp 0x1001aa1d
mov ebx, 0x80030057
jmp 0x1001ac0a
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x100532e8]
call esi
mov ebx, eax
test ebx, ebx
js 0x1001ac0a
jmp 0x1001aa32
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.api_ms_win_core_com_private_l1_1_0.dll_InternalTlsAllocData]
mov ebx, eax
test ebx, ebx
js 0x1001ac0a
jmp 0x1001aa4a
cmp dword [edi + 0x1c], 0
je 0x1001aa6b
mov eax, dword [esp + 0x24]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x100532e8]
call esi
mov esi, dword [edi + 0x1c]
lea ecx, [esp + 0x28]
push esi
call fcn.10005840
mov eax, dword [edi + 0x18]
push ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push 0
push dword [eax + 0xc]
call fcn.10006d2f
push eax
push 0
mov edx, edi
mov ecx, esi
call fcn.1000af60
lea ecx, [esp + 0x28]
mov ebx, eax
call fcn.100057f0
test ebx, ebx
js 0x1001ac0a
jmp 0x1001abe9
mov ecx, dword [ecx + 8]
sub ecx, 8
jmp 0x1001aac0
mov ecx, esi
call dword [0x100532e8]
call esi
jmp 0x1001ab04
mov ecx, esi
call fcn.1000e483
jmp 0x10033a9b
cmp dword [esi + 8], 0
je 0x10033a89
mov ecx, esi
call fcn.1000e356
push ecx
mov ecx, esi
call fcn.1000e483
jmp 0x1001abd9
mov ebx, 0x80030008
lea ecx, [esp + 0x14]
call fcn.100057f0
jmp 0x1001ac0a
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x100532e8]
call esi
jmp 0x1001ac1f