Function at 0x100175b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov dword [esp + 0x30], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x20], eax
mov edi, eax
lea esi, [esi]
mov ecx, dword [edi + 0x28]
movzx esi, word [edi + 0x24]
movzx edx, byte [ecx]
test esi, esi
je 0x10017620
mov ebx, ecx
mov eax, 0x1504
jmp 0x1001760d
lea ebp, [ebx + 1]
xor edx, edx
mov ebx, eax
shl ebx, 5
add eax, ebx
lea ebx, [ebp + 1]
add eax, edx
movzx edx, byte [ebp + 1]
mov ebp, ebx
sub ebp, ecx
cmp ebp, esi
jae 0x1001764e
test dl, dl
je 0x100175f0
mov ebp, ebx
cmp dl, 0x60
jbe 0x100175f5
sub edx, 0x20
movzx edx, dl
jmp 0x100175f5
test dl, dl
je 0x10017659
mov eax, 0x1504
lea esi, [esi]
mov ebx, eax
shl ebx, 5
add eax, ebx
cmp dl, 0x60
jbe 0x10017642
sub edx, 0x20
movzx edx, dl
add ecx, 1
add eax, edx
movzx edx, byte [ecx]
test dl, dl
jne 0x10017630
cmp eax, 0x7292e44f
je 0x100176f0
mov edi, dword [edi]
test edi, edi
je 0x10017669
cmp dword [esp + 0x20], edi
jne 0x100175d8
mov eax, 0xffffffff
mov dword [esp + 4], 0xf24b4177
mov dword [esp], eax
call fcn.1002ad30
mov ebx, eax
test eax, eax
je 0x100176fb
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x24], ebx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x20], eax
mov edi, eax
lea esi, [esi]
mov ecx, dword [edi + 0x28]
movzx esi, word [edi + 0x24]
movzx edx, byte [ecx]
test esi, esi
je 0x10017710
mov ebx, ecx
mov eax, 0x1504
jmp 0x100176dd
lea ebp, [ebx + 1]
xor edx, edx
mov ebx, eax
shl ebx, 5
add eax, ebx
lea ebx, [ebp + 1]
add eax, edx
movzx edx, byte [ebp + 1]
mov ebp, ebx
sub ebp, ecx
cmp ebp, esi
jae 0x1001773e
test dl, dl
je 0x100176c0
mov ebp, ebx
cmp dl, 0x60
jbe 0x100176c5
sub edx, 0x20
movzx edx, dl
jmp 0x100176c5
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x1001766e
xor ebx, ebx
add esp, 0x4c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test dl, dl
je 0x10017749
mov eax, 0x1504
lea esi, [esi]
mov ebx, eax
shl ebx, 5
add eax, ebx
cmp dl, 0x60
jbe 0x10017732
sub edx, 0x20
movzx edx, dl
add ecx, 1
add eax, edx
movzx edx, byte [ecx]
test dl, dl
jne 0x10017720
cmp eax, 0xeb896212
je 0x1001783a
mov edi, dword [edi]
test edi, edi
je 0x10017759
cmp dword [esp + 0x20], edi
jne 0x100176a0
mov ebx, dword [esp + 0x24]
mov eax, 0xffffffff
mov dword [esp + 4], 0x88b389c7
mov dword [esp], eax
call fcn.1002ad30
mov dword [esp + 0x28], eax
test eax, eax
je 0x100176fb
mov eax, dword [esp + 0x60]
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call ebx
sub esp, 0xc
mov ecx, eax
test eax, eax
je 0x100176fb
mov edi, dword [eax + 0x3c]
mov edx, 0x5f
mov word [esp + 0x3c], dx
mov edx, dword [str..texeW_]
add edi, eax
mov byte [esp + 0x3c], 0x74
cmp dword [edi], 0x4550
movzx eax, word [edi + 0x14]
mov dword [esp + 0x24], edi
mov dword [esp + 0x38], edx
jne 0x100176fb
movzx edi, word [edi + 6]
mov dword [esp + 0x20], edi
test di, di
je 0x100176fb
mov edi, dword [esp + 0x24]
mov dword [esp + 0x2c], ecx
lea ebp, [esp + 0x38]
lea esi, [edi + eax + 0x18]
xor edi, edi
lea esi, [esi]
nop
mov dword [esp + 4], ebp
mov dword [esp], esi
call sub.msvcrt.dll_strcmp
mov ebx, eax
test eax, eax
jne 0x10017827
mov eax, dword [esp + 0x64]
mov eax, dword [eax + 4]
cmp eax, dword [esi + 8]
jae 0x10017827
mov ecx, dword [esp + 0x24]
cmp eax, dword [ecx + 0x50]
jb 0x1001784e
mov eax, dword [esp + 0x20]
add edi, 1
add esi, 0x28
cmp edi, eax
jne 0x10017800
jmp 0x100176fb
mov eax, dword [edi + 0x10]
mov ebx, dword [esp + 0x24]
test eax, eax
jne 0x10017762
jmp 0x100176fb
mov edi, dword [esp + 0x68]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
add ecx, dword [esi + 0xc]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea esi, [esp + 0x34]
mov dword [edi], ecx
lea edi, [esp + 0x30]
call ebp
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x10], edi
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], 4
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
call eax
sub esp, 0x14
test eax, eax
js 0x100176fd
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x68]
mov edx, dword [ecx]
mov eax, dword [eax]
mov ecx, dword [ecx + 4]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
call ebp
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x68]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call eax
not eax
sub esp, 0x14
mov ebx, eax
shr ebx, 0x1f
jmp 0x100176fd