Function at 0x100cd31
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1025050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
lea eax, [ebp - 0x30]
push eax
push dword [0x1025388]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
call fcn.010113c8
mov edi, eax
cmp edi, ebx
jge 0x100cd81
push 0xc1008005
call fcn.01010fbe
pop ecx
jmp 0x100d15e
push esi
push 0x1001424
call fcn.0100f401
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
jne 0x100cda4
mov edi, 0xc000000d
push 0xc1008019
jmp 0x100d11f
cmp dword [esi + 0xc], ebx
jbe 0x100cd95
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x10]
call fcn.010101f4
test eax, eax
jge 0x100cdca
mov esi, 0x1001df4
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x24]
jmp 0x100cdcd
xor ebx, ebx
inc ebx
cmp ebx, dword [esi + 0xc]
jae 0x100cd95
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x30]
call fcn.01018572
mov edi, eax
test edi, edi
jge 0x100cdf2
push 0xc100800e
jmp 0x100d11f
push 0
lea eax, [ebp - 0x48]
push eax
push 1
push dword [ebp - 0x2c]
call fcn.010183a0
mov edi, eax
test edi, edi
jl 0x100cde8
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
push dword [esi + ebx*4 + 0x10]
call fcn.0100c718
mov edi, eax
xor edx, edx
cmp edi, edx
jge 0x100ce2a
push 0xc100801a
jmp 0x100d11f
mov eax, dword [esi + 0xc]
inc ebx
cmp ebx, eax
jae 0x100cd95
mov ecx, dword [ebp - 0x20]
shr ecx, 0x18
and ecx, 0xf
dec ecx
je 0x100d0ba
dec ecx
je 0x100d05f
dec ecx
je 0x100d020
dec ecx
je 0x100cf8b
dec ecx
je 0x100cf5d
dec ecx
je 0x100cf35
dec ecx
jne 0x100cd95
sub eax, ebx
shl eax, 3
mov dword [ebp - 0x18], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100d09a
mov eax, dword [esi + 0xc]
and dword [ebp - 0x24], 0
sub eax, ebx
je 0x100cf0b
lea eax, [esi + ebx*4 + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
push dword [ebp - 0x44]
push dword [eax]
call fcn.0100c3f6
mov edi, eax
test edi, edi
jl 0x100cf81
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x24]
mov dword [edx + edi*8], ecx
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x1c]
push eax
mov eax, dword fs:[0x18]
mov dword [edx + edi*8 + 4], ecx
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [esi + 0xc]
add dword [ebp - 0x34], 4
inc edi
sub eax, ebx
mov dword [ebp - 0x24], edi
cmp edi, eax
jb 0x100ceab
push 0
call fcn.0100f401
mov dword [ebp - 0x3c], eax
test eax, eax
je 0x100d0e3
push dword [eax + 8]
push 0xc100803a
call fcn.01010fbe
pop ecx
mov edi, 0xc000000d
jmp 0x100d124
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [esi + ebx*4 + 0x10]
mov dword [ebp - 0x18], 2
call fcn.0100b80e
mov edi, eax
test edi, edi
jge 0x100cf0b
push 0xc100801f
jmp 0x100d11f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x18], 8
push dword [ebp - 0x44]
push dword [esi + ebx*4 + 0x10]
call fcn.0100c3f6
mov edi, eax
test edi, edi
jge 0x100cf0b
push 0xc100801e
jmp 0x100d11f
push 0x10014bc
call fcn.0100f401
push 0x10014ac
mov dword [ebp - 0x38], eax
call fcn.0100f401
push 0x100149c
mov dword [ebp - 0x24], eax
call fcn.0100f401
xor ecx, ecx
cmp dword [ebp - 0x38], ecx
je 0x100cfbe
inc ecx
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x24], 0
je 0x100cfcc
inc ecx
mov dword [ebp - 0x28], 3
test eax, eax
je 0x100cfd8
inc ecx
mov dword [ebp - 0x28], 1
mov eax, dword [esi + 0xc]
sub eax, ebx
mov dword [ebp - 0x18], eax
test ecx, ecx
jbe 0x100cff8
cmp ecx, 1
ja 0x100cfee
cmp eax, 1
je 0x100cff8
push 0xc1008033
jmp 0x100d11f
lea ecx, [ebp - 0x1c]
push ecx
push eax
lea eax, [esi + ebx*4 + 0x10]
push eax
call fcn.01011460
mov edi, eax
test edi, edi
jge 0x100d017
push 0xc100801d
jmp 0x100d11f
shl dword [ebp - 0x18], 4
jmp 0x100cf0b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x10
pop ecx
push ecx
push edx
push dword [eax + 0x18]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x100d09a
push eax
push dword [esi + ebx*4 + 0x10]
call fcn.010101f4
mov edi, eax
test edi, edi
jge 0x100cf0b
push 0xc100801c
jmp 0x100d11f
lea ebx, [esi + ebx*4 + 0x10]
mov eax, dword [ebx]
lea ecx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
cmp di, dx
jne 0x100d068
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0x18], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0x18]
mov eax, dword [eax + 0x30]
push edx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x100d0a4
mov edi, 0xc000009a
jmp 0x100d125
push dword [ebx]
mov ecx, dword [ebp - 0x18]
shr ecx, 1
push ecx
push eax
call fcn.0101296c
add esp, 0xc
jmp 0x100cf0b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x40]
push eax
push dword [esi + ebx*4 + 0x10]
push dword [ebp - 0x20]
call fcn.0100c954
mov edi, eax
test edi, edi
jge 0x100cf0b
push 0xc100801b
jmp 0x100d11f
cmp dword [ebp - 0x28], 0
jne 0x100d0ff
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x40]
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
call fcn.0101a6ea
jmp 0x100d114
push dword [ebp - 0x28]
lea eax, [ebp - 0x14]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push eax
push dword [ebp - 0x30]
call fcn.010114ff
mov edi, eax
test edi, edi
jge 0x100d125
push 0xc1008020
call fcn.01010fbe
pop ecx
test esi, esi
je 0x100d13e
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x3c], 0
pop esi
je 0x100d15c
push dword [ebp - 0x3c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor ebx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x100d179
push dword [ebp - 0x1c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x2c], ebx
je 0x100d186
push dword [ebp - 0x2c]
call fcn.01017e12
cmp dword [ebp - 0x30], ebx
je 0x100d199
push dword [ebp - 0x30]
call fcn.0101758e
cmp edi, ebx
jl 0x100d199
mov edi, eax
push edi
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push eax
call fcn.0101100e
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.010124d0
leave
ret