Function at 0xc5ab53
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov edx, ecx
mov dword [ebp - 0x10], edx
push esi
push edi
test edx, edx
jne 0xc5ab71
mov eax, 0xc00000ef
jmp 0xc5afed
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0xc5afe8
xor esi, esi
cmp word [ebx], si
je 0xc5afe8
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0xc5ab98
mov eax, 0xc00000f2
jmp 0xc5afed
xor eax, eax
mov dword [ebp - 0xc], esi
mov word [ebp - 4], ax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
push esi
push esi
mov dword [ebp - 0x1c], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x24], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x20], esi
mov dword [ecx], esi
stosd dword es:[edi], eax
xor eax, eax
mov word [edx], ax
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U_WithStatus]
mov esi, eax
test esi, esi
jns 0xc5abf3
push esi
push 0xa28480
push 0x8a6
push 0xa28444
push 1
call fcn.00a32ac8
add esp, 0x14
mov edi, dword [ebp + 0xc]
jmp 0xc5afaa
lea ecx, [ebp - 0x1c]
call fcn.00c5a852
mov esi, eax
test esi, esi
jns 0xc5ac0e
push esi
push 0xa28460
push 0x8b1
jmp 0xc5abdc
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
push eax
push 4
pop edx
call fcn.00c5c115
mov esi, eax
test esi, esi
jns 0xc5ac30
push esi
push 0xa284f8
push 0x8b7
jmp 0xc5abdc
mov eax, dword fs:[0x30]
movzx esi, word [ebp - 4]
push esi
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, eax
mov dword [ebp - 8], ecx
test ecx, ecx
jne 0xc5ac56
mov esi, 0xc0000017
jmp 0xc5abeb
movzx eax, word [ebp - 0x1c]
mov edx, esi
push eax
push dword [ebp - 0x18]
call fcn.00c5c085
mov esi, eax
test esi, esi
jns 0xc5ac7b
push esi
push 0xa28514
push 0x8c3
jmp 0xc5abdc
mov edi, dword [ebp - 8]
mov ecx, edi
call fcn.00c5bdbd
test eax, eax
jne 0xc5acac
push 0xa284ac
push 0x8d5
push 0xa28444
push 1
mov esi, 0xc0000039
call fcn.00a32ac8
add esp, 0x10
jmp 0xc5abeb
cmp eax, 1
jne 0xc5ad07
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x18]
or dword [edi], 0xffffffff
call fcn.00c5c4c0
test eax, eax
jne 0xc5accd
mov esi, reloc.OLEAUT32.dll_SysStringLen
jmp 0xc5afaa
mov ecx, dword [ebp - 0x10]
mov edx, 0x104
push ebx
call fcn.00a324b1
mov esi, eax
test esi, esi
jns 0xc5ad00
push esi
push 0xa28514
push 0x8e7
push 0xa28444
push 1
call fcn.00a32ac8
add esp, 0x14
jmp 0xc5afaa
xor esi, esi
jmp 0xc5afaa
mov eax, dword fs:[0x30]
push 0x20
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
je 0xc5ac4f
push 4
push 0x9fd694
push ebx
call fcn.00ab4aea
add esp, 0xc
lea ebx, [esi + 8]
neg eax
sbb eax, eax
neg eax
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], edi
xor edi, edi
push 6
mov dword [ebp - 8], edi
mov esi, 0xc0000095
pop ecx
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword fs:[0x30]
push 0x10
mov eax, dword [eax + 0x18]
and dword [ebx + 0xc], 0
and dword [ebx + 8], 0
and dword [ebx + 0x14], 0
mov dword [ebx], eax
pop eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0xc]
cmp eax, 8
jb 0xc5addb
mov esi, 0xc000000d
cmp dword [ebx + 0x14], 0
je 0xc5ad98
push dword [ebx + 0x14]
push 0
push dword [ebx]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push 6
xor eax, eax
mov edi, ebx
pop ecx
rep stosd dword es:[edi], eax
test esi, esi
jns 0xc5ae62
push esi
push 0x9fda50
push 0x844
push 0x9ffa58
push 1
call fcn.00a32ac8
add esp, 0x14
test esi, esi
jns 0xc5ae62
push esi
push 0xa284d0
push 0x90d
jmp 0xc5abdc
mov ecx, dword [ebx + 0x10]
lea edx, [ecx + 7]
cmp edx, 8
jb 0xc5ad85
neg ecx
and ecx, edx
mul dword [ebx + 4]
mov dword [ebp - 4], ecx
test edx, edx
jne 0xc5ae55
cmp eax, 0xffffffff
ja 0xc5ae55
mov eax, dword [ebx + 4]
mul ecx
mov edi, eax
test edx, edx
ja 0xc5ae55
jb 0xc5ae0b
cmp edi, 0xffffffff
ja 0xc5ae55
cmp dword [ebx + 0x14], 0
push edi
jne 0xc5ae30
push 0
push dword [ebx]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0xc5ae43
push edi
push 0
push esi
call fcn.00ab4bf6
add esp, 0xc
jmp 0xc5ae3f
push dword [ebx + 0x14]
push 0
push dword [ebx]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov esi, eax
test esi, esi
jne 0xc5ae4a
mov esi, 0xc0000017
jmp 0xc5ae55
mov eax, dword [ebp - 4]
mov dword [ebx + 0x14], esi
xor esi, esi
mov dword [ebx + 0xc], eax
test esi, esi
jne 0xc5ad85
jmp 0xc5adc3
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x24]
push dword [ebx + 4]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0
push 0
push 1
push dword [ebx + 4]
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x34]
call fcn.00c5bb1b
mov esi, eax
test esi, esi
jns 0xc5ae9c
push esi
push 0xa28330
push 0x91a
jmp 0xc5abdc
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x14], eax
cmp eax, dword [ebx + 0x14]
jb 0xc5af48
lea ecx, [eax + 1]
cmp ecx, dword [ebx + 0x14]
ja 0xc5aebd
mov esi, 0xc000000d
jmp 0xc5af78
mov edi, dword [ebx + 0x18]
dec edi
lea eax, [edi + ecx]
cmp eax, ecx
jb 0xc5af73
not edi
and edi, eax
mov eax, dword [ebx + 0x14]
mul dword [ebx + 0xc]
test edx, edx
jne 0xc5af3f
cmp eax, 0xffffffff
ja 0xc5af3f
mov eax, dword [ebx + 0xc]
mul edi
mov dword [ebp - 4], eax
test edx, edx
ja 0xc5af3f
jb 0xc5aef2
cmp eax, 0xffffffff
ja 0xc5af3f
cmp dword [ebx + 0x1c], 0
push eax
jne 0xc5af1a
push 0
push dword [ebx + 8]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0xc5af2e
push dword [ebp - 4]
push 0
push esi
call fcn.00ab4bf6
add esp, 0xc
jmp 0xc5af2a
push dword [ebx + 0x1c]
push 0
push dword [ebx + 8]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov esi, eax
test esi, esi
jne 0xc5af35
mov esi, 0xc0000017
jmp 0xc5af44
mov dword [ebx + 0x1c], esi
xor esi, esi
mov dword [ebx + 0x14], edi
jmp 0xc5af44
mov esi, 0xc0000095
test esi, esi
jne 0xc5af7a
mov eax, dword [ebx + 0xc]
mul dword [ebp - 0x14]
mov ecx, eax
test edx, edx
ja 0xc5af73
jb 0xc5af5b
cmp ecx, 0xffffffff
ja 0xc5af73
mov eax, dword [ebx + 0x1c]
lea edi, [eax + ecx]
cmp edi, eax
jb 0xc5af73
lea esi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
inc dword [ebx + 0x10]
xor esi, esi
jmp 0xc5af78
mov esi, 0xc0000095
test esi, esi
jns 0xc5af8c
push esi
push 0xa28374
push 0x920
jmp 0xc5abdc
mov ecx, dword [ebp - 0x10]
lea edi, [ebp - 0x34]
xor eax, eax
mov edx, 0x104
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
mov dword [edi], ebx
call fcn.00c5aff7
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, dword [ebp - 8]
test eax, eax
je 0xc5afcd
push eax
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
test esi, esi
jns 0xc5afe4
lea ecx, [ebp - 0xc]
call fcn.00c5bcdc
lea ecx, [ebp - 0x34]
call fcn.00c5bd7f
and dword [edi], 0
mov eax, esi
jmp 0xc5afed
mov eax, 0xc00000f1
pop edi
pop esi
pop ebx
leave
ret 8