Function at 0x100b5110
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x100b60f0
mov edi, edx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], ecx
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
cmp word [edi + 0x10], 0
je 0x100b519a
mov eax, dword [edi + 0x14]
movzx edx, word [edi + 0x12]
mov esi, dword [edi + 0x20]
mov ebx, dword [edi + 0x1c]
mov dword [ebp - 0x20], eax
mov ax, 1
test esi, esi
mov word [ebp - 0x2c], dx
mov word [ebp - 0x28], ax
je 0x100b523c
cmp esi, ebx
jae 0x100b51cf
mov ecx, dword [ebp - 0x20]
cmp byte [ecx + esi], 0xbf
jg 0x100b51d1
mov dword [ebp - 0x10], 0
push 0x101b6ea4
push esi
push 0
push ebx
push dword [ebp - 0x20]
call fcn.101af790
add esp, 0x14
jmp 0x100b5344
mov eax, dword [edi + 0x20]
mov edx, dword [edi + 0x14]
mov esi, dword [edi + 0x1c]
test eax, eax
je 0x100b5206
cmp eax, esi
jae 0x100b5204
cmp byte [edx + eax], 0xbf
jg 0x100b5206
mov dword [ebp - 0x10], 0
push 0x101b6ea4
push eax
push 0
push esi
push edx
call fcn.101af790
add esp, 0x14
jmp 0x100b5344
jne 0x100b517a
xor ebx, ebx
test esi, esi
setns cl
js 0x100b5331
mov bl, cl
push ebx
push esi
call fcn.100985b0
add esp, 8
test eax, eax
jne 0x100b5241
mov dword [ebp - 0x10], 0
push esi
push ebx
call fcn.101aefe0
add esp, 8
jmp 0x100b5344
jne 0x100b51b1
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], eax
push eax
mov dword [ebp - 0x20], edx
push edx
call fcn.1011c0f0
add esp, 8
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
test esi, esi
mov word [ebp - 0x2c], dx
mov word [ebp - 0x28], ax
jne 0x100b516d
mov eax, 1
mov dword [ebp - 0x24], esi
push esi
push dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
push eax
call fcn.10193640
add esp, 0xc
mov dword [ebp - 0x10], 1
push edi
call fcn.1011bbf0
add esp, 4
mov esi, edx
test eax, eax
mov ebx, eax
cmove esi, eax
test esi, esi
je 0x100b52a1
setns al
js 0x100b533f
movzx eax, al
mov dword [ebp - 0x30], eax
push eax
push esi
call fcn.100985b0
add esp, 8
mov edi, eax
test eax, eax
jne 0x100b52a6
push esi
push dword [ebp - 0x30]
call fcn.101aefe0
add esp, 8
jmp 0x100b5344
mov edi, 1
test ebx, ebx
mov eax, 0x101b6e00
cmovne eax, ebx
push esi
push eax
push edi
call fcn.10193640
add esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x24]
movzx edx, word [ebp - 0x2c]
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
movsd xmm2, qword [eax + 0x10]
movsd xmm3, qword [eax + 0x18]
movsd xmm4, qword [eax + 0x20]
mov eax, dword [eax + 0x28]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp - 0x20]
movsd qword [ecx + 4], xmm0
movsd qword [ecx + 0xc], xmm1
movsd qword [ecx + 0x14], xmm2
movsd qword [ecx + 0x1c], xmm3
movsd qword [ecx + 0x24], xmm4
mov dword [ecx + 0x30], eax
mov dword [ecx + 0x34], ebx
mov dword [ecx + 0x38], ebx
mov dword [ecx + 0x3c], edi
mov dword [ecx + 0x40], esi
mov dword [ecx + 0x44], esi
movzx esi, word [ebp - 0x28]
mov word [ecx], si
mov word [ecx + 2], dx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
call fcn.10176df0
jmp 0x100b5344
call fcn.10176df0
ud2