Function at 0x10010970
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x1005bb4f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10140664]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, 0x101406a0
mov ecx, 0x1013f5e0
mov edx, 0x1013f60c
call fcn.10001700
xor ebx, ebx
test al, al
je 0x100109c1
cmp byte [0x10144bf8], bl
jne 0x100109c1
lea eax, [ebx + 5]
jmp 0x100109c3
xor eax, eax
push eax
mov eax, dword [esp + 0x28]
push 1
push eax
mov ecx, esi
call fcn.10003c20
fld dword [esi + 0xc]
fstp dword [esp + 0x24]
push ecx
fld dword [esp + 0x28]
lea ecx, [esi + 0xe8]
fstp dword [esp]
mov dword [esp + 0x20], ebx
mov dword [esi], vtable.CNomadVST.0
call fcn.1000d0f0
fld dword [esi + 0xc]
fstp dword [esp + 0x24]
sub esp, 8
fld dword [esp + 0x2c]
lea ecx, [esi + 0x228]
fstp qword [esp]
mov byte [esp + 0x24], 1
call fcn.1000e100
mov eax, 0x101406a0
mov ecx, 0x1013f5e0
mov edx, 0x1013f60c
mov byte [esp + 0x1c], 2
call fcn.10001700
test al, al
jne 0x10010a40
mov byte [0x10144bf8], 1
call fcn.10012800
lea ecx, [esi + 0x1458]
push ecx
call sub.MSVCR80.dll__time64
add esp, 4
push 1
mov ecx, esi
mov dword [esi + 0x29c], ebx
mov dword [esi + 0x298], ebx
call fcn.100036c0
mov eax, 2
push 1
mov ecx, esi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x68], 0x53423033
call fcn.10003700
push 1
mov ecx, esi
call fcn.100036a0
fld dword [esi + 0xc]
fstp dword [esp + 0x24]
fld dword [esp + 0x24]
fst dword [esi + 0x13dc]
fld dword [0x1005f0a8]
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x10010ab7
fcomp dword [0x1005f0a4]
fnstsw ax
test ah, 0x41
jne 0x10010ac5
jmp 0x10010ab9
fstp st(0)
fld dword [0x1005d9e4]
fstp dword [esi + 0x13dc]
push ebx
mov ecx, esi
call fcn.1000fb20
push 0x140
call fcn.1005a962
push 0x5a8
mov dword [esi + 0x2ac], eax
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 8
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x1c], 3
je 0x10010b01
push esi
mov ecx, eax
call fcn.10012550
jmp 0x10010b03
xor eax, eax
push 0x7000
mov byte [esp + 0x20], 2
mov dword [esi + 8], eax
call fcn.1005a962
mov ecx, dword [esi + 8]
mov dword [esi + 0x13d8], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x44]
add esp, 4
lea eax, [esi + 0x2b0]
push eax
push str.BBE_Mind_Bender
call edx
fldz
xor edx, edx
mov eax, 0x28
mov ecx, dword [esi + 0x13d8]
fst dword [ecx + eax - 4]
mov ecx, dword [esi + 0x13d8]
fst dword [eax + ecx]
mov ecx, dword [esi + 0x13d8]
fst dword [ecx + eax + 4]
mov ecx, dword [esi + 0x13d8]
fst dword [ecx + eax + 8]
mov ecx, dword [esi + 0x13d8]
fst dword [ecx + eax + 0xc]
mov ecx, dword [esi + 0x13d8]
mov edi, dword [str.Factory_Setting]
lea ecx, [ecx + edx + 4]
mov dword [ecx], edi
mov edi, dword [0x1005d688]
mov dword [ecx + 4], edi
mov edi, dword [0x1005d68c]
mov dword [ecx + 8], edi
mov edi, dword [0x1005d690]
add eax, 0x38
add edx, 0x38
cmp eax, 0x98
mov dword [ecx + 0xc], edi
jl 0x10010b3d
mov edx, dword [esi + 0x2ac]
mov dword [esi + 0x13b4], ebx
fst dword [edx + 0x24]
mov eax, dword [esi + 0x2ac]
mov dword [eax + 0x28], ebx
mov ecx, dword [esi + 0x2ac]
mov dword [ecx + 0x2c], ebx
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0x30]
mov eax, dword [esi + 0x2ac]
fst dword [eax + 0x34]
mov ecx, dword [esi + 0x2ac]
fst dword [ecx + 0x38]
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0x3c]
mov eax, dword [esi + 0x2ac]
mov byte [eax], bl
mov ecx, dword [esi + 0x2ac]
mov byte [ecx + 0x18], bl
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0x64]
mov eax, dword [esi + 0x2ac]
mov dword [eax + 0x68], ebx
mov ecx, dword [esi + 0x2ac]
mov dword [ecx + 0x6c], ebx
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0x70]
mov eax, dword [esi + 0x2ac]
fst dword [eax + 0x74]
mov ecx, dword [esi + 0x2ac]
fst dword [ecx + 0x78]
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0x7c]
mov eax, dword [esi + 0x2ac]
mov byte [eax + 0x40], bl
mov ecx, dword [esi + 0x2ac]
mov byte [ecx + 0x58], bl
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0xa4]
mov eax, dword [esi + 0x2ac]
mov dword [eax + 0xa8], ebx
mov ecx, dword [esi + 0x2ac]
mov dword [ecx + 0xac], ebx
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0xb0]
mov eax, dword [esi + 0x2ac]
fst dword [eax + 0xb4]
mov ecx, dword [esi + 0x2ac]
fst dword [ecx + 0xb8]
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0xbc]
mov eax, dword [esi + 0x2ac]
mov byte [eax + 0x80], bl
mov ecx, dword [esi + 0x2ac]
mov byte [ecx + 0x98], bl
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0xe4]
mov eax, dword [esi + 0x2ac]
mov dword [eax + 0xe8], ebx
mov ecx, dword [esi + 0x2ac]
mov dword [ecx + 0xec], ebx
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0xf0]
mov eax, dword [esi + 0x2ac]
fst dword [eax + 0xf4]
mov ecx, dword [esi + 0x2ac]
fst dword [ecx + 0xf8]
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0xfc]
mov eax, dword [esi + 0x2ac]
mov byte [eax + 0xc0], bl
mov ecx, dword [esi + 0x2ac]
mov byte [ecx + 0xd8], bl
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0x124]
mov eax, dword [esi + 0x2ac]
mov dword [eax + 0x128], ebx
mov ecx, dword [esi + 0x2ac]
mov dword [ecx + 0x12c], ebx
mov edx, dword [esi + 0x2ac]
fst dword [edx + 0x130]
mov eax, dword [esi + 0x2ac]
fst dword [eax + 0x134]
mov ecx, dword [esi + 0x2ac]
fst dword [ecx + 0x138]
mov edx, dword [esi + 0x2ac]
fstp dword [edx + 0x13c]
mov eax, dword [esi + 0x2ac]
mov byte [eax + 0x100], bl
mov ecx, dword [esi + 0x2ac]
mov byte [ecx + 0x118], bl
mov ecx, esi
call fcn.1000f120
mov eax, dword [esi + 0x13b4]
mov ecx, dword [str.Factory_Setting]
lea edx, [eax*8]
sub edx, eax
mov eax, dword [esi + 0x13d8]
mov dword [eax + edx*8 + 4], ecx
lea eax, [eax + edx*8 + 4]
mov edx, dword [0x1005d688]
mov dword [eax + 4], edx
mov ecx, dword [0x1005d68c]
mov dword [eax + 8], ecx
mov edx, dword [0x1005d690]
mov dword [eax + 0xc], edx
mov eax, dword [str.Factory_Setting]
mov dword [esi + 0xb0], eax
mov ecx, dword [0x1005d688]
mov dword [esi + 0xb4], ecx
mov edx, dword [0x1005d68c]
mov ecx, dword [esi + 0x13b4]
mov dword [esi + 0xb8], edx
mov eax, dword [0x1005d690]
push ecx
mov ecx, esi
mov dword [esi + 0xbc], eax
call fcn.10010490
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4