Function at 0x1000b080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], edi
mov eax, dword [edi + 0x3c]
add eax, edi
mov dword [ebp - 0x10], eax
mov edx, dword [eax + 0xa0]
test edx, edx
je 0x1000b145
mov esi, dword [eax + 0xa4]
test esi, esi
je 0x1000b145
sub ebx, dword [eax + 0x34]
call fcn.1000ef10
lea ecx, [edi + eax]
xor eax, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
test esi, esi
je 0x1000b145
nop
mov edx, dword [eax + ecx]
lea esi, [eax + ecx]
mov ecx, edi
mov dword [ebp - 8], esi
call fcn.1000ef10
mov esi, dword [esi + 4]
mov edi, eax
add edi, dword [ebp - 4]
sub esi, 8
shr esi, 1
je 0x1000b128
mov edx, dword [ebp - 8]
add edx, 8
movzx eax, word [edx]
mov cx, ax
shr cx, 0xc
cmp cl, 3
jne 0x1000b10e
and eax, 0xfff
add dword [eax + edi], ebx
jmp 0x1000b120
cmp cl, 0xa
jne 0x1000b120
and eax, 0xfff
add eax, edi
add dword [eax], ebx
adc dword [eax + 4], 0
add edx, 2
sub esi, 1
jne 0x1000b0f5
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
add eax, dword [ecx + 4]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp eax, dword [ecx + 0xa4]
mov ecx, dword [ebp - 0x14]
jb 0x1000b0d0
mov ebx, dword [ebp + 0x14]
mov esi, ebx
and esi, 0x40000000
je 0x1000b196
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
add eax, ecx
push 1
push dword [ebp + 0x10]
push eax
lea eax, [edi + ecx]
mov ecx, edi
push eax
call fcn.10003500
test eax, eax
jns 0x1000b196
push eax
push str.Failed_to_resolve_syscalls:__i
push str.NCMN::NInjLdr::PrepareRawModule
push 0xf00
call fcn.10002ec0
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [edi + 0x3c]
add ecx, edi
mov dword [ecx + 0xa4], 0
mov dword [ecx + 0xa0], 0
test esi, esi
je 0x1000b1c7
mov dword [ecx + 0x84], 0
mov dword [ecx + 0x80], 0
mov edx, dword [ebp + 0x18]
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x8c], 0
mov dword [ecx + 0x88], 0
test edx, edx
jle 0x1000b1fc
movzx eax, word [ecx + 6]
cmp edx, eax
jge 0x1000b1fc
mov word [ecx + 6], dx
movzx edx, word [ecx + 6]
mov eax, dword [edi + 0x3c]
movzx ecx, word [ecx + 0x14]
add eax, 0x18
push 0
push 0
push edi
add ecx, eax
call fcn.1000ace0
mov edx, dword [0x7ffe0000]
test edx, edx
je 0x1000b229
mov dword [ebp - 0x18], 0
jmp 0x1000b234
mov edx, dword [0x7ffe0320]
mov eax, dword [0x7ffe0324]
xor al, al
mov ecx, 4
nop dword [eax + eax]
cmp ecx, 0x1c
jge 0x1000b24e
mov eax, edx
shr eax, cl
inc ecx
test al, al
je 0x1000b240
movzx esi, al
mov eax, dword [edi + 0x3c]
or esi, ebx
mov ecx, dword [eax + edi + 0x50]
mov dword [ebp + 0x14], ecx
mov ecx, 0x20b
cmp word [eax + edi + 0x18], cx
mov ecx, edi
jne 0x1000b295
call fcn.10003740
or esi, 0x20000000
mov ebx, eax
mov ecx, esi
mov edx, esi
shr ecx, 0x1c
or edx, 0x10000
and cl, 1
movzx ecx, cl
push ecx
mov ecx, edi
call fcn.10003e20
jmp 0x1000b2b6
call fcn.10003740
mov ebx, eax
mov edx, esi
mov eax, esi
or edx, 0x10000
shr eax, 0x1c
mov ecx, edi
and al, 1
movzx eax, al
push eax
call fcn.10003790
mov eax, dword [ebp + 8]
cdq
mov dword [edi + 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x20], esi
mov dword [edi + 0x32], eax
xor eax, eax
mov dword [edi + 0x36], ebx
mov dword [edi + 0x2c], edx
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14