Function at 0x10008d6d
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1a1e
mov eax, dword fs:[0]
push eax
mov eax, 0x18bc
call fcn.100040cc
mov eax, dword [0x100b7c0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [ebp - 0x18c0], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi], 0x100b5c70
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov word [esi + 0x18], ax
mov dword [ebp - 4], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
push esi
lea ebx, [esi + 0x2c]
mov byte [ebp - 4], 1
push 1
mov dword [ebx], eax
mov byte [esi + 0x30], al
call fcn.10008f17
test eax, eax
jne 0x1000ca09
xorps xmm0, xmm0
movups xmmword [ebp - 0x18bc], xmm0
lea eax, [ebp - 0x18bc]
mov byte [ebp - 4], 2
push eax
push 0x100b5b2c
mov ecx, esi
call fcn.100090ce
test eax, eax
je 0x1000ca19
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x438], 0x200
xor ecx, ecx
mov dword [ebp - 0x43c], eax
xor eax, eax
mov byte [ebp - 0x434], cl
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x42c], ecx
mov word [ebp - 0x428], ax
lea eax, [ebp - 0x1898]
mov dword [ebp - 0x18a4], 0x825
mov dword [ebp - 0x18a8], eax
xor eax, eax
mov byte [ebp - 0x18a0], cl
mov dword [ebp - 0x189c], ecx
mov dword [ebp - 0x1898], ecx
mov word [ebp - 0x1894], ax
push 0x100b5b10
lea eax, [ebp - 0x43c]
mov byte [ebp - 4], 0x11
push eax
mov ecx, esi
call fcn.1000916c
mov ebx, eax
mov ecx, esi
push 0x100b5b20
lea eax, [ebp - 0x18a8]
neg ebx
push eax
sbb bl, bl
call fcn.1000916c
neg eax
mov edi, str.groovegrooveutildll_spfsfolderdescriptorbase.cpp
sbb al, al
inc al
mov dword [ebp - 0x14], eax
add bl, 1
jne 0x1000caee
test al, al
jne 0x1000cb7b
lea eax, [ebp - 0x18a8]
push eax
mov ecx, eax
call fcn.100073e8
lea eax, [ebp - 0x43c]
push eax
mov ecx, eax
call fcn.100073e8
cmp dword [ebp - 0x18bc], 0
mov byte [ebp - 4], 0x16
jne 0x1000cba9
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10001550
mov esp, ebp
pop ebp
ret
push eax
push 0x1615a1
call fcn.1003d368
jmp 0x10008df0
push 0x17
push 0x100d4fc8
push 0x100bf5a4
lea ecx, [ebp - 0x20]
call fcn.10007692
push dword [ebp - 0x18bc]
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x18c4]
push dword [ebp - 0x18b8]
mov byte [ebp - 4], 3
push eax
call fcn.10017ea7
mov ecx, dword [eax]
mov dword [ebp - 0x14], ecx
lea eax, [ebp - 0x18c8]
mov byte [ebp - 4], 4
push eax
call fcn.1001a042
push 0
push eax
push 0x100d5188
lea ecx, [ebp - 0x1c]
call fcn.10026b4d
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push ebx
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x18a9]
mov byte [ebp - 4], 5
call fcn.1002a795
xor ebx, ebx
cmp dword [ebp - 0x18], ebx
jbe 0x1000cac5
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
call fcn.1002a71d
push 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 6
push eax
push dword [esi + 0x20]
lea ecx, [esi + 0x1c]
call fcn.1003b672
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.1002b608
inc ebx
cmp ebx, dword [ebp - 0x18]
jb 0x1000ca93
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 9
call fcn.10026d23
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xc
call fcn.10026d23
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xf
call fcn.10026d23
jmp 0x10008ee8
test al, al
je 0x1000cb4e
mov ecx, dword [ebp - 0x43c]
xor eax, eax
cmp ax, word [ecx]
je 0x1000cb4e
mov eax, dword [ebp - 0x18a8]
xor edx, edx
cmp dx, word [eax]
je 0x1000cb4e
push edx
push ecx
lea ecx, [ebp - 0x84c]
call fcn.100093d6
push 0
push 1
push dword [ebp - 0x18a8]
lea eax, [ebp - 0x84c]
mov byte [ebp - 4], 0x12
push eax
mov ecx, esi
call fcn.1002c396
mov ecx, esi
call fcn.1003a974
lea eax, [ebp - 0x84c]
mov byte [ebp - 4], 0x11
push eax
mov ecx, eax
call fcn.100073e8
push 0x100b5b10
mov ecx, esi
call fcn.1002f03a
test eax, eax
je 0x1000cb73
push 0x1615c0
push str.ERROR_SUCCESS__m_RegistryKey.DeleteValue_COMMON_ATTRIBUTE_PATH_
push 0xcf
push edi
call fcn.10033a98
mov eax, dword [ebp - 0x14]
jmp 0x10008ec4
push 0x100b5b20
mov ecx, esi
call fcn.1002f03a
test eax, eax
je 0x10008ecc
push 0x1615c1
push str.ERROR_SUCCESS__m_RegistryKey.DeleteValue_COMMON_ATTRIBUTE_URL_
push 0xd2
push edi
call fcn.10033a98
jmp 0x10008ecc
push 0
push 0
lea ecx, [ebp - 0x18bc]
call fcn.1000e87f
jmp 0x10008ef9