Function at 0x10094a80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov esi, esp
mov dword [esi + 0x48], ebp
mov dword [esi + 0xc], ecx
mov dword [esi + 0x4c], esp
mov dword [esi + 0x58], 0xffffffff
lea eax, [esi + 0x50]
mov dword [esi + 0x54], 0x10095f80
mov edx, dword fs:[0]
mov dword [esi + 0x50], edx
mov dword fs:[0], eax
mov dword [ecx], 0x10357ae0
mov eax, 0xbaca26a7
mov ecx, 0x62436376
mov dword [esi + 0x14], ecx
mov dword [esi + 0x10], eax
mov eax, 0x8c975508
mov edi, 0x3f10db57
mov dword [esi + 4], eax
mov ebx, 0xf3ea0687
mov eax, 0x62436356
lea ecx, [esi + 0x30]
mov dword [esi + 8], 0
mov edx, dword [esi + 8]
mov dword [esi + 0x1c], edi
mov edx, dword [esi + 4]
mov dword [esi + 0x18], edx
mov dword [esi + 0x40], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x44], ebx
mov dword [esi + 0x30], ebx
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x2c], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edx
movaps xmm0, xmmword [esi + 0x10]
xorps xmm0, xmmword [ecx]
movaps xmmword [esi + 0x10], xmm0
mov dword [ebx + 4], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0xf
mov byte [ebx + 4], 0
lea eax, [ebx + 4]
mov dword [esi + 8], eax
lea eax, [esi + 0x10]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
cmp eax, 0xf
jbe 0x10094b6e
sub esp, 0xc
mov al, byte [esi + 0x30]
mov byte [esp + 4], al
lea eax, [esi + 0x10]
mov dword [esp + 8], eax
mov dword [esp], edi
mov ecx, dword [esi + 8]
call fcn.100258a0
jmp 0x10094b86
mov dword [ebx + 0x14], edi
push edi
lea eax, [esi + 0x10]
push eax
push dword [esi + 8]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebx + edi + 4], 0
mov byte [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov eax, 0x968469c9
mov ecx, 0x62436356
mov dword [esi + 0x14], ecx
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x40]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x44]
mov dword [esi + 0x30], eax
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x18], eax
mov dword [esi + 0x38], eax
xor eax, eax
lea ecx, [esi + 0x30]
movaps xmm0, xmmword [esi + 0x10]
xorps xmm0, xmmword [ecx]
lea eax, [ebx + 0x28]
mov dword [esi + 4], eax
movaps xmmword [esi + 0x10], xmm0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0xf
mov byte [ebx + 0x28], 0
lea eax, [esi + 0x10]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
cmp eax, 0xf
jbe 0x10094c30
mov dword [esi + 0x58], 0
sub esp, 0xc
mov al, byte [esi + 0x30]
mov byte [esp + 4], al
lea eax, [esi + 0x10]
mov dword [esp + 8], eax
mov dword [esp], edi
mov ecx, dword [esi + 4]
call fcn.100258a0
mov eax, dword [esi + 0xc]
jmp 0x10094c4a
mov dword [ebx + 0x38], edi
push edi
lea eax, [esi + 0x10]
push eax
push dword [esi + 4]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebx + edi + 0x28], 0
mov eax, ebx
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [esi + 0x58], 1
push 0x30
call fcn.102e53ba
add esp, 4
mov ecx, dword [esi + 0xc]
lea edx, [ecx + 0x40]
mov dword [esi + 0x2c], edx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [esi + 0x58], 2
push 0x30
call fcn.102e53ba
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov ecx, dword [esi + 0xc]
mov dword [ecx + 0x48], eax
mov eax, dword [esi + 0x50]
mov dword fs:[0], eax
mov eax, ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret