Function at 0x10020970
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10165969
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101c3584]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
xor ebx, ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esp + 0x28], ebx
lea ebp, [esi + 0x1fc]
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
push 0xffffffffffffffff
lea ecx, [esi + 0x24]
mov byte [esp + 0x2c], 1
push ebx
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.100015f0
lea edi, [esi + 0x40]
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [esi + 0x6c], 0xf
mov dword [esi + 0x68], ebx
mov byte [esi + 0x58], bl
fld1
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], ecx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x8c], 0xffffffff
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], ebx
fst qword [esi + 0xb8]
fst qword [esi + 0xc0]
mov eax, vtable.CImageResample.0
fldz
mov ecx, 1
fst qword [esi + 0xc8]
mov dword [esi + 0x98], eax
fst qword [esi + 0xd0]
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ecx
fxch st(1)
fst qword [esi + 0xf8]
mov dword [esi + 0xd8], eax
fst qword [esi + 0x100]
mov dword [esi + 0xe0], ebx
fxch st(1)
mov dword [esi + 0xe4], ebx
fst qword [esi + 0x108]
mov dword [esi + 0xe8], ebx
fst qword [esi + 0x110]
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ecx
fxch st(1)
fst qword [esi + 0x138]
mov dword [esi + 0x118], eax
fstp qword [esi + 0x140]
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
fst qword [esi + 0x148]
mov dword [esi + 0x128], ebx
fstp qword [esi + 0x150]
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ecx
mov byte [esp + 0x28], 7
mov byte [esi + 0x158], bl
lea edx, [esi + 0x15c]
push edx
mov byte [esi + 0x159], bl
mov byte [esi + 0x15a], bl
call fcn.1001f4d0
lea eax, [esi + 0x18c]
push eax
mov byte [esp + 0x2c], 8
call fcn.1001f4d0
mov byte [esi + 0x1d4], bl
mov dword [esi + 0x1d8], ebx
mov dword [esi + 0x1dc], ebx
mov dword [esi + 0x1e0], ebx
mov dword [esi + 0x1e4], ebx
mov dword [esi + 0x1e8], ebx
mov dword [esi + 0x1ec], ebx
mov dword [esi + 0x1f0], ebx
mov dword [esi + 0x1f4], ebx
mov dword [esi + 0x1f8], ebx
push ebp
mov byte [esp + 0x2c], 0xd
call fcn.10027bc0
lea ecx, [esi + 0x214]
push ecx
mov byte [esp + 0x2c], 0xe
call fcn.10027bc0
lea ebp, [esi + 0x22c]
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [esi + 0x238], ebx
mov dword [esi + 0x23c], ebx
mov byte [esp + 0x28], 0x11
or eax, 0xffffffff
push 8
mov dword [esi + 0x240], eax
mov dword [esi + 0x244], eax
mov byte [esi + 0x248], bl
call fcn.1013d60d
add esp, 4
cmp eax, ebx
je 0x10020bba
mov dword [eax], ebx
mov dword [eax + 4], ebx
jmp 0x10020bbc
xor eax, eax
lea edx, [esp + 0x18]
push edx
mov ecx, eax
call fcn.10029d90
mov byte [esp + 0x28], 0x12
call fcn.10027120
mov byte [esp + 0x28], 0x11
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x10020c0b
mov edi, eax
add eax, 4
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10020c0b
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10020c0b
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
push 8
call fcn.1013d60d
add esp, 4
cmp eax, ebx
je 0x10020c20
mov dword [eax], ebx
mov dword [eax + 4], ebx
jmp 0x10020c22
xor eax, eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.10029d90
mov edi, ebp
mov byte [esp + 0x28], 0x13
call fcn.10027120
mov byte [esp + 0x28], 0x11
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x10020c73
mov edi, eax
add eax, 4
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x10020c73
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
lea eax, [edi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10020c73
mov edx, dword [edi]
mov eax, dword [edx + 8]
mov ecx, edi
call eax
push 8
call fcn.1013d60d
add esp, 4
cmp eax, ebx
je 0x10020c89
fldz
mov ecx, eax
fstp qword [eax]
jmp 0x10020c8b
xor ecx, ecx
lea edx, [esp + 0x18]
push edx
call fcn.10029df0
lea edi, [esi + 0x1f4]
mov byte [esp + 0x28], 0x14
call fcn.10027120
mov byte [esp + 0x28], 0x11
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x10020cde
mov edi, eax
add eax, 4
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10020cde
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
lea ecx, [edi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10020cde
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
push 4
call fcn.1013d60d
add esp, 4
cmp eax, ebx
je 0x10020cf2
mov dword [eax], ebx
mov ecx, eax
jmp 0x10020cf4
xor ecx, ecx
lea eax, [esp + 0x18]
push eax
call fcn.10029e50
lea edi, [esi + 0x1d8]
mov byte [esp + 0x28], 0x15
call fcn.10027120
mov byte [esp + 0x28], 0x11
mov edi, dword [esp + 0x1c]
cmp edi, ebx
je 0x10020d45
lea ecx, [edi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x10020d45
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
lea eax, [edi + 8]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x10020d45
mov edx, dword [edi]
mov eax, dword [edx + 8]
mov ecx, edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10