Function at 0x70e41fee
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70e6dadd
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], eax
xor edi, edi
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.70df39c7
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
lea eax, [ebx + 0x1c]
mov dword [eax], 0x70e08ee8
mov dword [ebp - 0x224], eax
mov dword [eax + 4], edi
push 1
mov byte [ebp - 4], 7
push eax
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
call fcn.70e260cf
mov dword [ebx + 0x2c], edi
mov dword [ebx + 0x30], edi
mov dword [ebx + 0x34], edi
mov dword [ebx + 0x38], edi
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0xc
cmp ebx, ecx
je 0x70e420bd
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x70e420ab
mov eax, dword [ebx + 4]
push eax
call fcn.70df3455
mov eax, dword [ebx]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov dword [ebx], edx
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
sub esp, 8
mov eax, 0x70e802f8
mov esi, esp
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x224], esp
call fcn.70e1ec37
mov eax, dword [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x224]
push ecx
call fcn.70df5841
mov ecx, dword [eax]
mov dword [eax], edi
mov esi, dword [ebx + 8]
mov dword [ebp - 0x228], ecx
cmp esi, ecx
je 0x70e42131
cmp esi, edi
je 0x70e42131
mov eax, dword [esi + 4]
cmp eax, edi
je 0x70e4210e
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], edi
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x70e42122
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0xffffffff
push esi
call fcn.70df3455
mov ecx, dword [ebp - 0x228]
add esp, 4
mov eax, dword [ebp - 0x224]
mov dword [ebx + 8], ecx
mov dword [ebp - 0x228], eax
cmp eax, edi
je 0x70e42185
lea esi, [eax + 4]
mov eax, dword [esi]
cmp eax, edi
je 0x70e42156
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi], edi
mov edx, dword [ebp - 0x228]
mov eax, dword [edx]
cmp eax, 0xffffffff
je 0x70e42176
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x228]
mov dword [eax], 0xffffffff
mov ecx, dword [ebp - 0x228]
push ecx
call fcn.70df3455
add esp, 4
cmp dword [ebx + 8], edi
jne 0x70e421b6
push 0x70e77870
lea edx, [ebp - 0x220]
push edx
mov dword [ebp - 0x21c], 0x80070002
mov dword [ebp - 0x220], 0x70e0795c
mov dword [ebp - 0x18], 2
call fcn.70e610ef
sub esp, 8
mov eax, 0x70e80300
mov esi, esp
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x224], esp
call fcn.70e1ec37
mov eax, dword [ebp - 0x22c]
push eax
mov ecx, 0x100002
lea edi, [ebp - 0x224]
call fcn.70df5631
mov edi, dword [eax]
mov dword [eax], 0
mov esi, dword [ebx + 0x14]
cmp esi, edi
je 0x70e42214
test esi, esi
je 0x70e42214
mov eax, dword [esi]
test eax, eax
je 0x70e4220b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push esi
call fcn.70df3455
add esp, 4
mov eax, dword [ebp - 0x224]
mov dword [ebx + 0x14], edi
mov esi, eax
test eax, eax
je 0x70e4223f
mov eax, dword [eax]
test eax, eax
je 0x70e42236
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push esi
call fcn.70df3455
add esp, 4
sub esp, 8
mov eax, 0x70e80308
mov esi, esp
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x224], esp
call fcn.70e1ec37
mov ecx, dword [ebp - 0x22c]
push ecx
mov ecx, 0x100002
lea edi, [ebp - 0x224]
call fcn.70df5631
mov edi, dword [eax]
mov dword [eax], 0
mov esi, dword [ebx + 0x18]
cmp esi, edi
je 0x70e4229d
test esi, esi
je 0x70e4229d
mov eax, dword [esi]
test eax, eax
je 0x70e42294
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push esi
call fcn.70df3455
add esp, 4
mov eax, dword [ebp - 0x224]
mov dword [ebx + 0x18], edi
mov esi, eax
test eax, eax
je 0x70e422c8
mov eax, dword [eax]
test eax, eax
je 0x70e422bf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push esi
call fcn.70df3455
add esp, 4
sub esp, 8
mov eax, 0x70e80310
mov esi, esp
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x224], esp
call fcn.70e1ec37
mov edx, dword [ebp - 0x22c]
push edx
mov ecx, 0x100002
lea edi, [ebp - 0x224]
call fcn.70df5631
mov esi, dword [eax]
mov dword [eax], 0
mov edi, dword [ebx + 0x2c]
cmp edi, esi
je 0x70e42326
test edi, edi
je 0x70e42326
mov eax, dword [edi]
test eax, eax
je 0x70e4231d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push edi
call fcn.70df3455
add esp, 4
mov eax, dword [ebp - 0x224]
mov dword [ebx + 0x2c], esi
mov esi, eax
test eax, eax
je 0x70e42351
mov eax, dword [eax]
test eax, eax
je 0x70e42348
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
push esi
call fcn.70df3455
add esp, 4
cmp dword [ebx + 0x14], 0
je 0x70e42579
cmp dword [ebx + 0x18], 0
je 0x70e42579
mov eax, dword [ebx + 8]
mov edi, dword [eax + 4]
mov eax, dword [edi]
mov dword [ebx + 0x3c], eax
mov ecx, dword [edi + 4]
push 0xc
mov dword [ebx + 0x40], ecx
call fcn.70df39ac
add esp, 4
test eax, eax
je 0x70e423b1
mov esi, dword [ebx + 8]
mov esi, dword [esi + 4]
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov dword [ebp - 0x224], esi
lea esi, [edi + 8]
mov dword [eax], esi
mov esi, dword [ebp - 0x224]
add esi, 0x1c
imul ecx, edx
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov esi, eax
jmp 0x70e423b3
xor esi, esi
mov eax, dword [ebx + 0xc]
cmp eax, esi
je 0x70e423c3
push eax
call fcn.70df3455
add esp, 4
push 0xc
mov dword [ebx + 0xc], esi
call fcn.70df39ac
add esp, 4
test eax, eax
je 0x70e423f5
mov esi, dword [ebx + 8]
mov esi, dword [esi + 4]
mov edx, dword [ebx + 0x40]
mov ecx, dword [ebx + 0x3c]
add edi, 0x10
add esi, 0x1c
imul ecx, edx
mov dword [eax], edi
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
mov edi, eax
jmp 0x70e423f7
xor edi, edi
mov eax, dword [ebx + 0x10]
cmp eax, edi
je 0x70e42407
push eax
call fcn.70df3455
add esp, 4
sub esp, 8
mov edx, esp
mov dword [ebp - 0x224], esp
push 0x70e425a8
lea eax, [ebp + 0x10]
push eax
push edx
mov dword [ebx + 0x10], edi
call fcn.70df42c0
mov ecx, dword [ebp - 0x22c]
push ecx
mov ecx, 0x100002
lea edi, [ebp - 0x224]
call fcn.70df5631
lea edi, [ebx + 0x30]
call fcn.70df3850
mov eax, dword [ebp - 0x224]
mov edi, eax
test eax, eax
je 0x70e4246b
mov eax, dword [eax]
test eax, eax
je 0x70e42462
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push edi
call fcn.70df3455
add esp, 4
sub esp, 8
mov edx, esp
mov dword [ebp - 0x224], esp
push 0x70e425c4
lea eax, [ebp + 0x10]
push eax
push edx
call fcn.70df42c0
mov ecx, dword [ebp - 0x22c]
push ecx
mov ecx, 0x100002
lea edi, [ebp - 0x224]
call fcn.70df5631
lea edi, [ebx + 0x34]
call fcn.70df3850
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x228], eax
test eax, eax
je 0x70e424dc
mov eax, dword [eax]
test eax, eax
je 0x70e424cd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x228]
mov dword [edx], 0
mov eax, dword [ebp - 0x228]
push eax
call fcn.70df3455
add esp, 4
cmp dword [ebx + 0x30], 0
je 0x70e4218a
cmp dword [edi], 0
je 0x70e4218a
push 0x14
call fcn.70df39ac
add esp, 4
test eax, eax
je 0x70e42535
mov esi, dword [ebx + 0x30]
mov edx, dword [ebx + 0x2c]
mov edi, dword [edi]
mov ecx, dword [ebp - 0x22c]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x224], esi
mov esi, dword [ebx + 8]
mov esi, dword [esi + 4]
add esi, 0x18
mov dword [eax], esi
mov esi, dword [ebp - 0x224]
mov dword [eax + 4], esi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov esi, eax
jmp 0x70e42537
xor esi, esi
mov eax, dword [ebx + 0x38]
cmp eax, esi
je 0x70e42547
push eax
call fcn.70df3455
add esp, 4
lea ecx, [ebp + 0x10]
mov dword [ebx + 0x38], esi
mov dword [ebp - 4], 0xffffffff
call fcn.70df342c
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.70df25ed
mov esp, ebp
pop ebp
ret 0x10
push 0x70e77870
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x21c], 0x80070002
mov dword [ebp - 0x220], 0x70e0795c
mov dword [ebp - 0x18], 2
call fcn.70e610ef
int3