Function at 0x100cdcf0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x6cc
mov eax, dword [0x1019914c]
mov edx, dword fs:[0x2c]
mov esi, ecx
mov eax, dword [edx + eax*4]
mov eax, dword [eax + 0x1c]
cmp eax, 1
jne 0x100ce4a3
mov eax, dword [0x1019914c]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
cmp byte [eax + 0x24], 0
je 0x100cdd48
mov eax, dword [0x101981a8]
cmp eax, 2
jne 0x100ce4cd
mov edi, dword [0x10198198]
jmp 0x100cdd5d
mov eax, dword [0x1019914c]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov edi, dword [eax + 0x20]
add edi, 8
mov ecx, edi
call fcn.100c05c0
test al, al
je 0x100cddf3
mov edi, dword [edi]
mov eax, dword [edi + 8]
cmp eax, 0x3ffffffd
ja 0x100ce4b1
lea ecx, [eax + 1]
lock cmpxchg dword [edi + 8], ecx
jne 0x100ce4b1
movzx eax, byte [edi + 0x10]
mov ebx, dword [edi + 0x24]
test ebx, ebx
je 0x100cdda1
lock inc dword [ebx]
jle 0x100ce530
mov edx, 0xffffffff
lock xadd dword [edi + 8], edx
dec edx
mov eax, edx
and eax, 0xbfffffff
cmp eax, 0x80000000
je 0x100ce4d7
test ebx, ebx
mov dword [esp + 8], ebx
je 0x100cddfb
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x100cdedc
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ecx + 8]
dec edx
and edx, 0xfffffff8
add eax, edx
add eax, 8
je 0x100cdedc
push esi
push eax
call dword [ecx + 0x14]
add esp, 8
jmp 0x100cdef8
mov dword [esp + 8], 0
movzx eax, byte [esi + 0x41]
cmp al, 2
jne 0x100cdec0
movsd xmm1, qword [esi + 0x30]
movzx eax, byte [esi + 0x40]
movsd xmm0, qword [esi + 0x28]
movsd xmm2, qword [esi + 0x38]
lea ecx, [esp + 0xc]
mov dword [esp + 0x94], 2
movsd qword [esp + 0x60], xmm1
mov byte [esp + 0x30], al
mov eax, dword [esi + 0x24]
movsd xmm1, qword [esi + 0x1c]
movsd qword [esp + 0x58], xmm0
movsd qword [esp + 0x28], xmm2
mov dword [esp + 0x1c], eax
movsd qword [esp + 0x14], xmm1
call fcn.100db7c0
lea ecx, [esp + 0x21c]
call fcn.100dbd80
mov eax, dword [esp + 0x10]
movsd xmm0, qword [esp + 0x58]
movsd xmm1, qword [esp + 0x60]
mov edi, dword [esp + 0xc]
mov dword [esp + 4], eax
movzx eax, byte [esp + 0x30]
movsd qword [esp + 0x84], xmm0
movsd xmm0, qword [esp + 0x28]
movsd qword [esp + 0x8c], xmm1
mov byte [esp + 0x40], al
mov eax, dword [esp + 0x1c]
movsd qword [esp + 0x38], xmm0
movsd xmm0, qword [esp + 0x14]
mov dword [esp + 0x54], eax
mov al, 1
movsd qword [esp + 0x4c], xmm0
mov dword [esp + 0x24], eax
jmp 0x100ce2ac
mov cl, 1
test al, al
mov eax, 2
mov dword [esp + 0x24], ecx
mov cl, 1
setne byte [esp]
mov dword [esp + 0x34], ecx
jmp 0x100ce065
movzx eax, byte [esi + 0x41]
cmp al, 2
jne 0x100cdeec
mov eax, dword [ebx + 0xf8]
jmp 0x100cdef8
xor ecx, ecx
test al, al
mov eax, 0x3f800000
cmove eax, ecx
movd xmm0, eax
call fcn.100c90d0
mov ebx, eax
movsd xmm0, qword [esi + 0x10]
mov eax, dword [esi + 0x18]
movsd qword [esp + 0x28], xmm0
mov dword [esp + 0x30], eax
mov eax, dword [0x1019914c]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov eax, dword [eax + 0xc]
cmp eax, 1
jne 0x100ce4f2
mov eax, dword [0x1019914c]
mov ecx, dword fs:[0x2c]
mov eax, dword [ecx + eax*4]
mov ebp, dword [eax + 0x10]
inc dword [ebp]
je 0x100ce530
lea edi, [esp + 0x14]
mov edx, ebp
mov byte [esp], bl
mov ecx, edi
call fcn.100dbe20
dec dword [ebp]
jne 0x100cdf7a
dec dword [ebp + 4]
jne 0x100cdf7a
push ebp
push 0
push dword [0x101990e0]
call dword [sym.imp.kernel32.dll_HeapFree]
movzx eax, word [esp + 0x18]
movzx ebx, byte [esp + 0x1a]
mov bh, byte [esp + 0x1c]
mov edx, dword [esp + 0x1d]
mov ecx, dword [esp + 0x20]
mov word [esp + 0x24c], ax
mov eax, dword [esp + 0x14]
and bh, 0x3f
and bl, 0xf
mov dword [esp + 0xc], edx
mov dword [esp + 0xf], ecx
or bh, 0x80
or bl, 0x40
mov dword [esp + 0x248], eax
movzx eax, byte [esp + 0x1b]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov byte [esp + 4], al
push edi
call dword [sym.imp.kernel32.dll_GetSystemTimePreciseAsFileTime]
movzx edx, byte [esp + 4]
mov eax, dword [esp + 0x248]
movsd xmm2, qword [esp + 0x224]
movsd xmm1, qword [esp + 0x21c]
movsd xmm3, qword [esp + 0x234]
movsd xmm0, qword [esp + 0x14]
mov dword [esp + 0x24], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x44], eax
movzx eax, word [esp + 0x24c]
movsd qword [esp + 0x60], xmm2
movsd xmm2, qword [esp + 0x22c]
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x70], xmm3
mov word [esp + 0x48], ax
movsd qword [esp + 0x68], xmm2
movsd xmm2, qword [esp + 0x23c]
mov eax, dword [esp + 0x244]
mov dword [esp + 0x80], eax
movsd qword [esp + 0x78], xmm2
xor eax, eax
movsd xmm1, qword [esp + 0x28]
mov dword [esp + 0x94], eax
mov dword [esp + 0xa0], 3
mov dword [esp + 0x130], 0
mov dword [esp + 0x134], 4
mov dword [esp + 0x138], 0
mov eax, dword [esp + 0x30]
movsd xmm2, qword [esp + 0x60]
mov ecx, dword [esp + 0xf]
movsd xmm3, qword [esi + 0x28]
movsd qword [esp + 0x13c], xmm1
movsd xmm1, qword [esp + 0x58]
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], 0x80000000
mov dword [esp + 0x14c], str.other_default_
mov dword [esp + 0x150], 5
mov dword [esp + 0x154], 0x80000001
mov dword [esp + 0x160], 0x80000001
mov dword [esp + 0x16c], 0x80000001
mov dword [esp + 0x1b0], 0x80000001
mov eax, dword [esp + 0x80]
movsd qword [esp + 0x1bc], xmm2
movsd xmm2, qword [esi + 0x38]
movsd qword [esp + 0x58], xmm3
movsd qword [esp + 0x1b4], xmm1
movsd xmm1, qword [esp + 0x68]
mov dword [esp + 0x1dc], eax
movzx eax, word [esp + 0x48]
movsd qword [esp + 0x28], xmm2
movsd qword [esp + 0x1c4], xmm1
movsd xmm1, qword [esp + 0x70]
movsd qword [esp + 0x1cc], xmm1
movsd xmm1, qword [esp + 0x78]
movsd qword [esp + 0x1d4], xmm1
mov word [esp + 0x1e4], ax
mov eax, dword [esp + 0x44]
movsd xmm1, qword [esi + 0x30]
mov dword [esp + 0x1e0], eax
mov eax, dword [esp + 0xc]
mov byte [esp + 0x1e6], bl
mov byte [esp + 0x1e7], dl
mov byte [esp + 0x1e8], bh
movsd qword [esp + 0x60], xmm1
movsd xmm1, qword [esi + 0x1c]
mov dword [esp + 0x1e9], eax
movzx eax, byte [esi + 0x40]
mov dword [esp + 0x1ec], ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x1f0], 0
mov dword [esp + 0x1f8], 0
mov dword [esp + 0x1fc], 0
mov dword [esp + 0x204], 0
movlps qword [esp + 0x208], xmm0
mov dword [esp + 0x210], 0
mov dword [esp + 0x218], 0
movsd qword [esp + 0x14], xmm1
mov byte [esp + 0x30], al
mov eax, dword [esi + 0x24]
mov dword [esp + 0x1c], eax
call fcn.100db7c0
lea ecx, [esp + 0x21c]
call fcn.100dbd80
mov eax, dword [esp + 0x10]
movsd xmm1, qword [esp + 0x60]
movsd xmm0, qword [esp + 0x58]
movsd xmm2, qword [esp + 0x28]
mov edi, dword [esp + 0xc]
cmp byte [esp], 0
mov dword [esp + 4], eax
movzx eax, byte [esp + 0x30]
movsd qword [esp + 0x8c], xmm1
movsd xmm1, qword [esp + 0x14]
movsd qword [esp + 0x84], xmm0
movsd qword [esp + 0x38], xmm2
mov byte [esp + 0x40], al
mov eax, dword [esp + 0x1c]
movsd qword [esp + 0x4c], xmm1
mov dword [esp + 0x54], eax
je 0x100ce299
mov ebp, dword [esp + 8]
mov bl, 1
mov dword [esp], edi
jmp 0x100ce2f3
cmp byte [esp + 0x34], 0
jne 0x100ce2ac
lea ecx, [esp + 0x94]
call fcn.100c4fa0
lea eax, [esp + 0x98]
mov dword [esp + 0x94], 2
lea ecx, [esp + 0x21c]
push 0x184
push ecx
push eax
call fcn.10100490
add esp, 0xc
mov eax, dword [esp + 8]
mov dword [esp], edi
test eax, eax
je 0x100ce2ef
xor ebp, ebp
lock dec dword [eax]
jne 0x100ce2f1
lea ecx, [esp + 8]
call fcn.100c3a60
xor ebp, ebp
xor ebx, ebx
mov eax, dword [esp + 0x54]
movsd xmm0, qword [esp + 0x4c]
lea edi, [esp + 0x3a0]
mov dword [esp + 0x530], eax
lea eax, [esp + 0x94]
movsd qword [esp + 0x528], xmm0
push 0x188
push eax
push edi
call fcn.10100490
add esp, 0xc
lea eax, [esp + 0x538]
push 0x194
push edi
push eax
call fcn.10100490
add esp, 0xc
movzx eax, byte [0x10199148]
xor ecx, ecx
mov edx, 0x1d8
call fcn.100ea7d0
test eax, eax
je 0x100ce521
mov edi, eax
mov dword [eax], 1
mov dword [eax + 4], 1
mov word [eax + 8], 0
add eax, 0xa
lea ecx, [esp + 0x536]
push 0x196
push ecx
push eax
call fcn.10100490
add esp, 0xc
mov eax, dword [esp + 4]
mov dword [edi + 0x1a0], 0x80000000
mov dword [edi + 0x1a8], 0
mov dword [edi + 0x1a4], 0
cmp byte [esp + 0x24], 0
mov dword [edi + 0x1b0], eax
mov eax, dword [esp]
mov dword [edi + 0x1ac], eax
movsd xmm0, qword [esp + 0x84]
movsd xmm1, qword [esp + 0x8c]
movsd qword [edi + 0x1b4], xmm0
movsd qword [edi + 0x1bc], xmm1
movzx eax, byte [esp + 0x40]
mov byte [edi + 0x1cc], al
movsd xmm0, qword [esp + 0x38]
movsd qword [edi + 0x1c4], xmm0
mov byte [edi + 0x1cd], 0x11
mov dword [edi + 0x1d0], ebp
mov byte [edi + 0x1d4], bl
je 0x100ce426
cmp dword [esi + 0x10], 0
je 0x100ce426
push dword [esi + 0x14]
push 0
push dword [0x101990e0]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esi], 0
je 0x100ce496
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x100ce471
mov edx, dword [esi + 8]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x220], 0
mov dword [esp + 0x224], ecx
mov dword [esp + 0x228], edx
mov dword [esp + 0x230], 0
mov dword [esp + 0x234], ecx
mov ecx, 1
mov dword [esp + 0x238], edx
jmp 0x100ce475
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x21c], ecx
mov dword [esp + 0x22c], ecx
lea ecx, [esp + 0x21c]
mov dword [esp + 0x23c], eax
call fcn.100c4e00
mov eax, edi
add esp, 0x6cc
pop esi
pop edi
pop ebx
pop ebp
ret
test eax, eax
jne 0x100ce500
call fcn.101136f0
jmp 0x100cdd1a
lea ecx, [edi + 8]
call fcn.10115340
movzx eax, byte [edi + 0x10]
mov ebx, dword [edi + 0x24]
test ebx, ebx
jne 0x100cdd98
jmp 0x100cdda1
call fcn.10113a40
jmp 0x100cdd40
add edi, 8
mov ecx, edi
call fcn.10115290
test ebx, ebx
mov dword [esp + 8], ebx
jne 0x100cddc6
jmp 0x100cddfb
test eax, eax
jne 0x100ce500
call fcn.10110a80
jmp 0x100cdf33
lea eax, [esp + 0x21c]
mov ecx, 0x1018d5b0
mov edx, 0x46
push 0x1018d648
push 0x1018d4ec
push eax
call fcn.1010d2e0
mov ecx, 4
mov edx, 0x1d8
call fcn.1010cb80
ud2