Function at 0xbbdc32
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xafbf42
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0xc940a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 0xac]
mov dword [edi], 0x9d2734
mov dword [edi + 8], 0x9d2704
mov dword [edi + 0xc], 0x9d26f0
mov dword [edi + 0x10], 0x9d26e0
mov dword [edi + 0x14], 0x9d26c8
mov dword [edi + 0x18], 0x9d26a8
mov dword [edi + 0x1c], 0x9d2694
mov dword [edi + 0x20], 0x9d2680
mov dword [edi + 0x24], 0x9d25f0
mov dword [edi + 0x28], 0x9d258c
mov dword [edi + 0x2c], 0x9d2574
mov dword [edi + 0x30], 0x9d2560
mov dword [edi + 0x34], 0x9d2550
mov dword [edi + 0x38], 0x9d252c
mov dword [edi + 0x3c], 0x9d251c
mov dword [edi + 0x40], 0x9d2508
mov dword [edi + 0x44], 0x9d24f4
mov dword [edi + 0x48], 0x9d24e4
mov dword [edi + 0x4c], 0x9d24d4
mov dword [edi + 0x50], 0x9d24c0
call fcn.00a4f6ba
mov ecx, dword [edi + 0x84]
and dword [edi + 0x84], 0
test ecx, ecx
je 0xbbdd12
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [edi + 0x94]
and dword [edi + 0x94], 0
test ecx, ecx
je 0xbbdd33
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
lea ecx, [edi + 0xbc]
call fcn.00a3a1a5
lea ebx, [edi + 0xc0]
cmp dword [ebx], 0
je 0xbbdd5a
push 0
push 0xa3a880
push dword [ebx]
call fcn.00a382d4
and dword [ebx], 0
lea ecx, [edi + 0x19c]
mov dword [edi + 0x1b0], 0x9e6abc
call fcn.00bc1be1
lea ecx, [edi + 0x198]
call fcn.00a398c6
mov ecx, dword [edi + 0x194]
test ecx, ecx
je 0xbbdd9b
and dword [edi + 0x194], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
lea ecx, [edi + 0x190]
call fcn.00a39d42
lea ecx, [edi + 0x18c]
call fcn.00ab2d79
mov ecx, dword [edi + 0x188]
test ecx, ecx
je 0xbbddd2
and dword [edi + 0x188], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
lea ecx, [edi + 0x184]
call fcn.00a398c6
lea ecx, [edi + 0x180]
call fcn.00a398c6
lea ecx, [edi + 0x17c]
call fcn.00a398c6
lea ecx, [edi + 0x178]
call fcn.00a398c6
lea ecx, [edi + 0x174]
call fcn.00a398c6
lea ecx, [edi + 0x170]
call fcn.00a398c6
lea ecx, [edi + 0x16c]
call fcn.00a398c6
lea ecx, [edi + 0x168]
call fcn.00a39d42
mov ecx, dword [edi + 0x164]
test ecx, ecx
je 0xbbde4b
and dword [edi + 0x164], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
lea ecx, [edi + 0x160]
call fcn.00a39d42
mov ecx, dword [edi + 0x15c]
test ecx, ecx
je 0xbbde77
and dword [edi + 0x15c], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [edi + 0x158]
test ecx, ecx
je 0xbbde98
and dword [edi + 0x158], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [edi + 0x150]
test ecx, ecx
je 0xbbdeb9
and dword [edi + 0x150], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
lea esi, [edi + 0x140]
mov ecx, esi
call fcn.00bc68ee
lea ecx, [esi + 8]
call fcn.00a7c3fb
lea esi, [edi + 0x130]
mov ecx, esi
call fcn.00bc6859
lea ecx, [esi + 8]
call fcn.00a7c3fb
lea esi, [edi + 0x120]
mov ecx, esi
call fcn.00bc6859
lea ecx, [esi + 8]
call fcn.00a7c3fb
lea esi, [edi + 0x110]
mov ecx, esi
call fcn.00bc68ee
lea ecx, [esi + 8]
call fcn.00a7c3fb
lea ecx, [edi + 0xf0]
call fcn.00ab2d79
lea ecx, [edi + 0xec]
call fcn.00a39d42
lea ecx, [edi + 0xe8]
call fcn.00ab2d79
lea ecx, [edi + 0xe4]
call fcn.00ab2d79
lea ecx, [edi + 0xe0]
call fcn.00ab2d79
lea ecx, [edi + 0xdc]
call fcn.00ab2d79
lea ecx, [edi + 0xd8]
call fcn.00a398c6
lea ecx, [edi + 0xd4]
call fcn.00a398c6
lea ecx, [edi + 0xd0]
call fcn.00ab2d79
lea ecx, [edi + 0xcc]
call fcn.00ab2d79
and dword [ebp - 4], 0
cmp dword [ebx], 0
je 0xbbdf8b
mov ecx, ebx
call fcn.00a382aa
or dword [ebp - 4], 0xffffffff
mov ecx, dword [edi + 0xb0]
test ecx, ecx
je 0xbbdfb0
and dword [edi + 0xb0], 0
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
lea ecx, [edi + 0x80]
call fcn.00ab2d79
lea ecx, [edi + 0x7c]
call fcn.00aa9c5c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret