Function at 0x100ba5b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd0
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0x1000
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
movups xmm1, xmmword [esp + 8]
mov dword [esp + 0x18], 0x2000
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
movups xmm0, xmmword [esp + 0x18]
mov dword [esp + 0x28], 0x4000
mov dword [esp + 0x2c], 0
por xmm1, xmm0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
movups xmm0, xmmword [esp + 0x28]
mov dword [esp + 0x38], 0x8000
mov dword [esp + 0x3c], 0
por xmm1, xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
movups xmm0, xmmword [esp + 0x38]
mov dword [esp + 0x48], 0x10000
mov dword [esp + 0x4c], 0
por xmm1, xmm0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
movups xmm0, xmmword [esp + 0x48]
mov dword [esp + 0x58], 0x20000
mov dword [esp + 0x5c], 0
por xmm1, xmm0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
movups xmm0, xmmword [esp + 0x58]
mov dword [esp + 0x68], 0x40000
mov dword [esp + 0x6c], 0
por xmm1, xmm0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
movups xmm0, xmmword [esp + 0x68]
mov dword [esp + 0x78], 0x200
mov dword [esp + 0x7c], 0
por xmm1, xmm0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
movups xmm0, xmmword [esp + 0x78]
mov dword [esp + 0x88], 0x4000000
mov dword [esp + 0x8c], 0
por xmm1, xmm0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
movups xmm0, xmmword [esp + 0x88]
mov dword [esp + 0x98], 0x10000000
mov dword [esp + 0x9c], 0
por xmm1, xmm0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0
movups xmm0, xmmword [esp + 0x98]
mov dword [esp + 0xa8], 0x20000000
mov dword [esp + 0xac], 0
por xmm1, xmm0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0
movups xmm0, xmmword [esp + 0xa8]
mov dword [esp + 0xb8], 0
mov dword [esp + 0xbc], 0
por xmm1, xmm0
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 4
movups xmm0, xmmword [esp + 0xb8]
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd0], 0
por xmm1, xmm0
mov dword [esp + 0xd4], 0
movups xmm0, xmmword [esp + 0xc8]
por xmm1, xmm0
mov ecx, dword [0x11d0c5b8]
mov eax, dword fs:[0x2c]
movaps xmm0, xmm1
psrldq xmm0, 4
mov eax, dword [eax + ecx*4]
mov edx, dword [eax + 0x10]
movd eax, xmm0
movaps xmm0, xmm1
psrldq xmm0, 8
mov esi, dword [edx + 0x188]
mov ecx, dword [edx + 0x18c]
and esi, eax
movd eax, xmm0
movaps xmm0, xmm1
psrldq xmm0, 0xc
and ecx, eax
movd eax, xmm0
or esi, ecx
mov ecx, dword [edx + 0x190]
and ecx, eax
or esi, ecx
movd ecx, xmm1
mov eax, ecx
and eax, dword [edx + 0x184]
and eax, 0x7fffffff
or esi, eax
je 0x100ba8d8
shr ecx, 0x1f
test cl, cl
jne 0x100ba8d8
cmp dword [edi + 0x14], 0
je 0x100ba8a1
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, edi
mov dword [edi + 4], 0xff1fe034
call fcn.100ba9a0
mov esi, eax
test esi, esi
jns 0x100ba8c4
mov ecx, edi
call fcn.100ba8f0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x14]
mov byte [edi + 8], 1
call fcn.101d3920
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x80004005
pop esi
mov esp, ebp
pop ebp
ret