Function at 0x10023ae0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10027cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1002baa4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 2
call fcn.10023860
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x28]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov edi, dword [ebx]
push eax
push 0x10005948
push ebx
mov edi, dword [edi]
mov ecx, edi
call dword [0x1002c1a8]
call edi
mov edi, eax
test edi, edi
jns 0x10023bd5
test byte [0x1002beb0], 2
je 0x10024196
cmp dword [0x1002d6ac], 0
jne 0x10024177
jmp 0x10024196
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x20]
push ecx
mov edi, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push eax
mov edi, dword [edi + 0xc]
mov ecx, edi
call dword [0x1002c1a8]
call edi
mov edi, eax
test edi, edi
jns 0x10023c2a
test byte [0x1002beb0], 2
je 0x10024196
cmp dword [0x1002d6c4], 0
je 0x10024196
mov eax, dword [0x1002d6c4]
push 0xdf
push edi
push eax
push 0x37c00
jmp 0x10024188
mov ecx, ebx
call fcn.10023970
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
add ecx, eax
mov eax, ecx
mov dword [ebp - 0x18], ecx
mov ecx, 0x34
mul ecx
seto bl
neg ebx
or ebx, eax
cmp ebx, 0xfffffe0
jbe 0x10023c5b
mov dword [esi], 0
jmp 0x10023c7a
lea eax, [ebx + 3]
and eax, 0xfffffffc
push eax
push 0
call dword [sym.imp.MSDART.DLL_MpGetHeapHandle]
push eax
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
add esp, 0xc
mov dword [esi], eax
test eax, eax
jne 0x10023cb9
test byte [0x1002beb0], 2
je 0x10023caf
cmp dword [0x1002d6b0], 0
je 0x10023caf
mov eax, dword [0x1002d6b0]
push 0xe8
push 0x8007000e
push eax
mov eax, dword [0x1002d110]
push 0x3a000
push eax
call fcn.100147d0
add esp, 0x14
mov ecx, 0x8007000e
jmp 0x10024198
mov edi, dword [ebp - 0x18]
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
cmp ecx, 0xfffffe0
jbe 0x10023cda
xor ecx, ecx
jmp 0x10023cf8
lea eax, [ecx + 3]
and eax, 0xfffffffc
push eax
push 0
call dword [sym.imp.MSDART.DLL_MpGetHeapHandle]
push eax
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
mov edi, dword [ebp - 0x18]
add esp, 0xc
mov ecx, eax
mov dword [esi + 0x10], ecx
test ecx, ecx
jne 0x10023d3d
test byte [0x1002beb0], 2
je 0x10023caf
cmp dword [0x1002d698], ecx
je 0x10023caf
mov eax, dword [0x1002d698]
push 0xef
push 0x8007000e
push eax
mov eax, dword [0x1002d110]
push 0x3bc00
push eax
call fcn.100147d0
add esp, 0x14
mov ecx, 0x8007000e
jmp 0x10024198
lea eax, [edi*4]
push eax
push 0
push ecx
call sub.msvcrt.dll_memset
xor eax, eax
xor ebx, ebx
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x18], eax
jbe 0x10023f1f
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], edi
lea ecx, [ecx]
mov edx, dword [ebp - 0x20]
add edx, ecx
cmp dword [edx + 8], 0
je 0x10023f09
test dword [edx + 0xc], 0x2000
jne 0x10023f09
mov eax, 0x88
cmp word [edx + 0x14], ax
je 0x10023f09
mov ecx, dword [esi]
add ecx, edi
mov byte [ebp - 0x11], 1
mov dword [ecx + 0x14], 0
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov dword [ecx + 0x1c], 5
mov eax, dword [esi + 0xc]
mov dword [ecx + 4], eax
movzx eax, word [edx + 0x14]
mov edi, dword [edx + 0x10]
cmp eax, 8
je 0x10023dd2
mov ebx, 0x82
cmp ax, bx
jne 0x10023de0
cmp edi, 0xff
ja 0x10023de0
add edi, edi
mov byte [ebp - 0x11], 2
mov dword [ecx + 0x28], edi
movzx eax, word [edx + 0x14]
mov word [ecx + 0x30], ax
mov ebx, eax
cmp edi, 0xff
ja 0x10023e2b
movzx eax, word [edx + 0x14]
cmp eax, 8
je 0x10023e1b
mov ebx, 0x82
cmp ax, bx
je 0x10023e1b
mov ebx, 0x81
cmp ax, bx
je 0x10023e1b
mov eax, dword [esi + 0xc]
mov ebx, edi
add eax, ebx
jmp 0x10023e3b
movzx ebx, byte [ebp - 0x11]
add ebx, edi
mov dword [ecx + 0x28], ebx
mov eax, dword [esi + 0xc]
add eax, ebx
jmp 0x10023e3b
or ebx, 0x4000
mov word [ecx + 0x30], bx
mov eax, dword [esi + 0xc]
add eax, 4
mov dword [esi + 0xc], eax
mov dword [esi + 0xc], eax
mov dword [ecx + 0xc], eax
add dword [esi + 0xc], 4
movzx eax, byte [edx + 0x16]
mov byte [ecx + 0x32], al
movzx eax, byte [edx + 0x17]
mov byte [ecx + 0x33], al
cmp edi, 0xff
ja 0x10023e93
movzx eax, word [edx + 0x14]
mov edx, 0x81
cmp ax, dx
je 0x10023e93
mov edx, 0x82
cmp ax, dx
je 0x10023e93
mov edx, 0x80
cmp ax, dx
je 0x10023e93
mov edx, 0x8b
cmp ax, dx
je 0x10023e93
mov dword [ecx + 8], 0
jmp 0x10023ea1
or dword [ecx + 0x1c], 2
mov eax, dword [esi + 0xc]
mov dword [ecx + 8], eax
add dword [esi + 0xc], 4
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x2c], 0
mov eax, dword [esi + 0x14]
mov ebx, dword [esi + 0x10]
mov ecx, dword [ebx + eax*4]
lea edx, [ebx + eax*4]
cmp edi, 0xff
jbe 0x10023eec
test ecx, ecx
je 0x10023ee0
inc eax
mov dword [esi + 0x14], eax
mov dword [ebx + eax*4], 1
inc dword [esi + 0x14]
jmp 0x10023ef1
lea eax, [ecx + 1]
mov dword [edx], eax
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x2c]
inc eax
mov ecx, dword [ebp - 0x24]
add edi, 0x34
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], edi
jmp 0x10023f0c
mov eax, dword [ebp - 0x1c]
inc ebx
add ecx, 0x30
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ecx
cmp ebx, dword [ebp - 0x18]
jb 0x10023d70
mov ecx, dword [esi + 0x14]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x10]
cmp dword [eax + ecx*4], 0
je 0x10023f34
lea eax, [ecx + 1]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0xc]
cmp eax, 0xfffffe0
jbe 0x10023f42
xor eax, eax
jmp 0x10023f5b
add eax, 3
and eax, 0xfffffffc
push eax
push 0
call dword [sym.imp.MSDART.DLL_MpGetHeapHandle]
push eax
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
add esp, 0xc
mov dword [esi + 8], eax
test eax, eax
jne 0x10023fa8
test byte [0x1002beb0], 2
je 0x10023caf
cmp dword [0x1002d6c8], eax
je 0x10023caf
mov eax, dword [0x1002d6c8]
push 0x119
push 0x8007000e
push eax
mov eax, dword [0x1002d110]
push 0x46400
push eax
call fcn.100147d0
add esp, 0x14
mov ecx, 0x8007000e
jmp 0x10024198
mov eax, dword [esi + 4]
xor ecx, ecx
mov edi, 4
mul edi
seto cl
neg ecx
or ecx, eax
cmp ecx, 0xfffffe0
jbe 0x10023fc7
xor eax, eax
jmp 0x10023fe0
lea eax, [ecx + 3]
and eax, 0xfffffffc
push eax
push 0
call dword [sym.imp.MSDART.DLL_MpGetHeapHandle]
push eax
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
add esp, 0xc
mov dword [esi + 0x30], eax
test eax, eax
jne 0x1002402d
test byte [0x1002beb0], 2
je 0x10023caf
cmp dword [0x1002d69c], eax
je 0x10023caf
mov eax, dword [0x1002d69c]
push 0x120
push 0x8007000e
push eax
mov eax, dword [0x1002d110]
push 0x48000
push eax
call fcn.100147d0
add esp, 0x14
mov ecx, 0x8007000e
jmp 0x10024198
mov eax, dword [esi + 4]
xor ecx, ecx
mul edi
seto cl
neg ecx
or ecx, eax
cmp ecx, 0xfffffe0
jbe 0x10024047
xor eax, eax
jmp 0x10024060
lea eax, [ecx + 3]
and eax, 0xfffffffc
push eax
push 0
call dword [sym.imp.MSDART.DLL_MpGetHeapHandle]
push eax
call dword [sym.imp.MSDART.DLL_MpHeapAlloc]
add esp, 0xc
mov dword [esi + 0x34], eax
test eax, eax
jne 0x100240ad
test byte [0x1002beb0], 2
je 0x10023caf
cmp dword [0x1002d694], eax
je 0x10023caf
mov eax, dword [0x1002d694]
push 0x125
push 0x8007000e
push eax
mov eax, dword [0x1002d110]
push 0x49400
push eax
call fcn.100147d0
add esp, 0x14
mov ecx, 0x8007000e
jmp 0x10024198
xor edx, edx
cmp dword [esi + 4], edx
jbe 0x100240d7
xor edi, edi
mov eax, dword [esi]
lea edi, [edi + 0x34]
mov ecx, dword [edi + eax - 0x34]
mov eax, dword [esi + 0x30]
mov dword [eax + edx*4], ecx
mov eax, dword [esi]
mov ecx, dword [edi + eax - 0x34]
mov eax, dword [esi + 0x34]
mov dword [eax + edx*4], ecx
inc edx
cmp edx, dword [esi + 4]
jb 0x100240b6
xor edx, edx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x18], edx
jbe 0x1002412c
xor ebx, ebx
mov eax, dword [ebp - 0x20]
cmp dword [ebx + eax + 8], 0
je 0x10024120
mov ecx, 0x88
cmp word [ebx + eax + 0x14], cx
jne 0x10024120
xor ecx, ecx
cmp dword [esi + 4], ecx
jbe 0x10024120
mov eax, dword [esi + 0x34]
mov edi, dword [eax + ecx*4]
lea edx, [eax + ecx*4]
mov eax, dword [ebp - 0x20]
cmp edi, dword [ebx + eax + 8]
jbe 0x10024117
lea eax, [edi - 1]
mov dword [edx], eax
inc ecx
cmp ecx, dword [esi + 4]
jb 0x10024100
mov edx, dword [ebp - 0x24]
inc edx
add ebx, 0x30
mov dword [ebp - 0x24], edx
cmp edx, dword [ebp - 0x18]
jb 0x100240e3
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x10024147
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x1002c1a8]
call esi
push dword [ebp - 0x34]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x20]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10026210
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x1002d6ac]
push 0xde
push edi
push eax
push 0x37800
mov eax, dword [0x1002d110]
push eax
call fcn.100147d0
add esp, 0x14
mov ecx, edi
call fcn.1001efb0
int3