Function at 0x1000f520
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a504
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x1004d070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp + 8]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi], edi
mov dword [ebp - 4], 0
cmp byte [0x1004f610], 0
je 0x1000f6cc
push 0x40
call fcn.10017735
mov ecx, eax
add esp, 4
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], ecx
push 0x40
push 0
push ecx
call fcn.10019200
mov ecx, dword [ebp - 0x14]
xorps xmm0, xmm0
lea edx, [ecx + 0x20]
add esp, 0xc
mov dword [ecx + 4], edi
mov dword [ecx], vtable.HUD_Static.0
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov byte [edx], 0
mov byte [ebp - 4], 2
mov dword [ecx + 0x3c], 0
movups xmm0, xmmword [0x1004f610]
movups xmmword [ecx + 0xc], xmm0
mov eax, dword [0x1004f620]
mov dword [ecx + 0x1c], eax
cmp edx, 0x1004f624
je 0x1000f668
cmp dword [0x1004f638], 0x10
mov eax, 0x1004f624
push dword [0x1004f634]
cmovae eax, dword [0x1004f624]
mov ecx, edx
push eax
call fcn.1000ad30
mov ecx, dword [ebp - 0x14]
mov al, byte [0x1004f63c]
mov byte [ecx + 0x38], al
cmp dword [ecx + 0x30], 0
je 0x1000f6c5
push 0x78
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x78
push 0
push eax
mov byte [ebp - 4], 3
call fcn.10019200
mov ecx, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
push dword [ebp - 0x2c]
mov al, byte [ecx + 0x38]
push dword [ebp - 0x30]
push eax
lea eax, [ecx + 0x20]
mov ecx, dword [ebp - 0x18]
push eax
push edi
call fcn.1000caf0
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x3c], eax
mov byte [ebp - 4], 0
mov dword [esi + 4], ecx
cmp byte [0x1004f640], 0
je 0x1000f75b
push 0x148
mov dword [0x1004f73c], 0x100026e0
mov dword [0x1004f740], 0x10002700
mov dword [0x1004f744], 0x10002700
mov dword [0x1004f748], 0x1000fde0
mov dword [0x1004f74c], 0x100011d0
mov dword [0x1004f750], 0x100026e0
mov dword [0x1004f758], 0x10002750
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x148
push 0
push eax
mov byte [ebp - 4], 4
call fcn.10019200
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x1004f640
push edi
call fcn.1000d820
mov byte [ebp - 4], 0
mov dword [esi + 8], eax
cmp byte [0x1004fdf0], 0
je 0x1000f7a7
push 0x90
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x90
push 0
push eax
mov byte [ebp - 4], 5
call fcn.10019200
sub esp, 0x68
mov ecx, esp
push 0x1004fdf0
call fcn.10010520
mov ecx, dword [ebp - 0x18]
push edi
call fcn.1000ed30
mov byte [ebp - 4], 0
mov dword [esi + 0xc], eax
cmp byte [0x1004fbcc], 0
je 0x1000f800
push 0x80
mov dword [0x1004fc2c], 0x100026e0
mov dword [0x1004fc34], 0x10002750
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x80
push 0
push eax
mov byte [ebp - 4], 6
call fcn.10019200
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x1004fbcc
push edi
call fcn.1000ef50
mov byte [ebp - 4], 0
mov dword [esi + 0x10], eax
cmp byte [0x1004fd7c], 0
je 0x1000f84c
push 0x8c
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x8c
push 0
push eax
mov byte [ebp - 4], 7
call fcn.10019200
sub esp, 0x68
mov ecx, esp
push 0x1004fd7c
call fcn.10010520
mov ecx, dword [ebp - 0x18]
push edi
call fcn.1000e7c0
mov byte [ebp - 4], 0
mov dword [esi + 0x18], eax
cmp byte [0x1004f75c], 0
je 0x1000f8af
push 0x148
mov dword [0x1004f858], 0x100026a0
mov dword [0x1004f868], 0x100011d0
mov dword [0x1004f86c], 0x100026a0
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x148
push 0
push eax
mov byte [ebp - 4], 8
call fcn.10019200
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x1004f75c
push edi
call fcn.1000d820
mov byte [ebp - 4], 0
mov dword [esi + 0x14], eax
cmp byte [0x1004f994], 0
je 0x1000f91c
push 0x148
mov dword [0x1004fa90], 0x10002610
mov dword [0x1004faa0], 0x100011d0
mov dword [0x1004faa4], 0x10002610
mov dword [0x1004faa8], 0x10002650
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x148
push 0
push eax
mov byte [ebp - 4], 9
call fcn.10019200
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x1004f994
push edi
call fcn.1000d820
mov byte [ebp - 4], 0
mov dword [esi + 0x1c], eax
cmp byte [0x1004fd10], 0
je 0x1000f96b
push 0x80
mov dword [0x1004fd70], 0x10002610
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x80
push 0
push eax
mov byte [ebp - 4], 0xa
call fcn.10019200
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x1004fd10
push edi
call fcn.1000ef50
mov byte [ebp - 4], 0
mov dword [esi + 0x20], eax
cmp byte [0x1004f878], 0
je 0x1000f9d8
push 0x148
mov dword [0x1004f984], 0x100011d0
mov dword [0x1004f988], 0x10002660
mov dword [0x1004f974], 0x10002660
mov dword [0x1004f98c], 0x10002680
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x148
push 0
push eax
mov byte [ebp - 4], 0xb
call fcn.10019200
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x1004f878
push edi
call fcn.1000d820
mov byte [ebp - 4], 0
mov dword [esi + 0x24], eax
cmp byte [0x1004fc38], 0
je 0x1000fa31
push 0x80
mov dword [0x1004fc98], 0x10002660
mov dword [0x1004fc9c], 0x10002680
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x80
push 0
push eax
mov byte [ebp - 4], 0xc
call fcn.10019200
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x1004fc38
push edi
call fcn.1000ef50
mov byte [ebp - 4], 0
mov dword [esi + 0x28], eax
mov ecx, dword [0x1004f5e4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
call eax
test al, al
je 0x1000faf8
cmp byte [0x1004fab0], 0
je 0x1000faa9
push 0x148
mov dword [0x1004fbbc], 0x100011d0
mov dword [0x1004fbc0], 0x10002690
mov dword [0x1004fbac], 0x10002690
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x148
push 0
push eax
mov byte [ebp - 4], 0xd
call fcn.10019200
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x1004fab0
push edi
call fcn.1000d820
mov byte [ebp - 4], 0
mov dword [esi + 0x2c], eax
cmp byte [0x1004fca4], 0
je 0x1000faf8
push 0x80
mov dword [0x1004fd04], 0x10002690
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x80
push 0
push eax
mov byte [ebp - 4], 0xe
call fcn.10019200
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x1004fca4
push edi
call fcn.1000ef50
mov byte [ebp - 4], 0
mov dword [esi + 0x30], eax
cmp byte [0x1004fe94], 0
je 0x1000fb41
push 0x4c
mov dword [0x1004fea8], 0x10002720
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x4c
push 0
push eax
mov byte [ebp - 4], 0xf
call fcn.10019200
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x1004fe94
push edi
call fcn.1000e540
mov byte [ebp - 4], 0
mov dword [esi + 0x34], eax
mov ecx, dword [0x1004f5e4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
call eax
test al, al
je 0x1000fba5
cmp byte [0x1004fed0], 0
je 0x1000fba5
push 0x4c
mov dword [0x1004fee4], 0x10002670
mov dword [0x1004fee8], 0x10002680
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
push 0x4c
push 0
push eax
mov byte [ebp - 4], 0x10
call fcn.10019200
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push 0x1004fed0
push edi
call fcn.1000e540
mov byte [ebp - 4], 0
mov dword [esi + 0x38], eax
cmp byte [0x1004fe64], 0
je 0x1000fc99
push 0x40
call fcn.10017735
mov edi, eax
add esp, 4
mov dword [ebp - 0x24], edi
push 0x40
push 0
push edi
call fcn.10019200
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x20]
mov dword [edi + 4], eax
xorps xmm0, xmm0
mov dword [edi], vtable.HUD_Units.0
add esp, 0xc
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov byte [ebp - 4], 0x12
mov dword [edi + 0x3c], 0
movups xmm0, xmmword [0x1004fe64]
movups xmmword [edi + 0xc], xmm0
mov eax, dword [0x1004fe74]
mov dword [edi + 0x1c], eax
cmp ecx, 0x1004fe78
je 0x1000fc39
cmp dword [0x1004fe8c], 0x10
mov eax, 0x1004fe78
push dword [0x1004fe88]
cmovae eax, dword [0x1004fe78]
push eax
call fcn.1000ad30
mov al, byte [0x1004fe90]
mov byte [edi + 0x38], al
cmp dword [edi + 0x30], 0
je 0x1000fc92
push 0x78
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], eax
push 0x78
push 0
push eax
mov byte [ebp - 4], 0x13
call fcn.10019200
mov al, byte [edi + 0x38]
add esp, 0xc
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push eax
lea eax, [edi + 0x20]
push eax
push dword [ebp + 8]
call fcn.1000caf0
mov dword [edi + 0x3c], eax
mov byte [ebp - 4], 0
mov dword [esi + 0x3c], edi
cmp byte [0x1004ff0c], 0
je 0x1000fdbc
push 0x48
call fcn.10017735
mov edi, eax
add esp, 4
mov dword [ebp - 0x24], edi
push 0x48
push 0
push edi
call fcn.10019200
mov eax, dword [ebp + 8]
lea ecx, [edi + 0x20]
mov dword [edi + 4], eax
xorps xmm0, xmm0
mov dword [edi], vtable.HUD_ShiftIcon.0
add esp, 0xc
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
mov byte [ebp - 4], 0x15
mov dword [edi + 0x40], 0
movups xmm0, xmmword [0x1004ff0c]
movups xmmword [edi + 0xc], xmm0
mov eax, dword [0x1004ff1c]
mov dword [edi + 0x1c], eax
cmp ecx, 0x1004ff20
je 0x1000fd2d
cmp dword [0x1004ff34], 0x10
mov eax, 0x1004ff20
push dword [0x1004ff30]
cmovae eax, dword [0x1004ff20]
push eax
call fcn.1000ad30
mov eax, dword [0x1004ff38]
mov dword [edi + 0x38], eax
mov al, byte [0x1004ff3c]
mov byte [edi + 0x3c], al
cmp dword [edi + 0x30], 0
je 0x1000fd8e
push 0x78
call fcn.10017735
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], eax
push 0x78
push 0
push eax
mov byte [ebp - 4], 0x16
call fcn.10019200
mov al, byte [edi + 0x3c]
add esp, 0xc
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push eax
lea eax, [edi + 0x20]
push eax
push dword [ebp + 8]
call fcn.1000caf0
mov dword [edi + 0x40], eax
mov dword [esi + 0x40], edi
jmp 0x1000fdbc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4