Function at 0x10035660
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10165cf0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10438fc0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
lea ecx, [esp + 0x20]
xor ebx, ebx
push ecx
push edi
mov byte [esp + 0x18], bl
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], bl
mov byte [esp + 0x1b], bl
call edx
mov ecx, dword [esp + 0x20]
cmp ecx, 1
jge 0x100356da
push ebx
push 0x8004070a
push 0x1044ebe0
call fcn.10025150
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
mov dword [esp + 0x18], edx
xor eax, eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], eax
xor esi, esi
mov byte [esp + 0x38], 1
cmp ecx, ebx
jg 0x10035739
mov byte [esp + 0x38], bl
cmp eax, ebx
je 0x1003570d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x38], 0xffffffff
cmp edx, ebx
je 0x10035721
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push edx
call ecx
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
cmp edx, ebx
je 0x10035745
mov eax, dword [edx]
mov ecx, dword [eax + 8]
push edx
call ecx
mov edx, dword [edi]
mov ecx, dword [edx + 0x10]
lea eax, [esp + 0x18]
push eax
push esi
push edi
mov dword [esp + 0x24], ebx
call ecx
test eax, eax
js 0x100358bf
mov edx, dword [esp + 0x18]
push edx
call fcn.10035a30
mov edi, eax
add esp, 4
cmp edi, ebx
jl 0x10035907
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x38], 2
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
inc esi
mov edi, esi
cmp esi, dword [esp + 0x20]
jge 0x10035829
lea ecx, [ecx]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x100357b0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push edi
push eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x20], ebx
call eax
test eax, eax
js 0x1003594c
mov dword [esp + 0x24], ebx
mov byte [esp + 0x38], 3
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x24]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
je 0x1003580a
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x1003580e
push eax
push ecx
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
cmp eax, ebx
je 0x10035964
mov eax, dword [esp + 0x24]
mov byte [esp + 0x38], 2
cmp eax, ebx
je 0x1003581e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
inc edi
cmp edi, dword [esp + 0x20]
jl 0x100357a0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 0x28]
cmp eax, 6
jne 0x10035854
cmp byte [esp + 0x10], bl
jne 0x100359d9
mov byte [esp + 0x10], 1
jmp 0x10035894
cmp eax, 7
jne 0x1003586a
cmp byte [esp + 0x11], bl
jne 0x100359ed
mov byte [esp + 0x11], 1
jmp 0x10035894
cmp eax, 9
jne 0x10035880
cmp byte [esp + 0x12], bl
jne 0x10035a01
mov byte [esp + 0x12], 1
jmp 0x10035894
cmp eax, 0xb
jne 0x10035894
cmp byte [esp + 0x13], bl
jne 0x10035a18
mov byte [esp + 0x13], 1
mov byte [esp + 0x38], 1
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x100358a8
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edx, dword [esp + 0x18]
cmp esi, dword [esp + 0x20]
jl 0x10035736
mov eax, dword [esp + 0x14]
jmp 0x100356f5
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x100358d7
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x100358ef
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, 0x80004005
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x1003591f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x10035937
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x100358bf
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x100358bf
push ebx
push 0x80040654
push 0x1044ebe0
call fcn.10025150
mov esi, eax
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x10035985
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x10035994
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x100359ac
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x100359c4
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push 0x80040705
push 0x1044ebe0
call fcn.10025150
mov esi, eax
jmp 0x10035985
push ebx
push 0x80040706
push 0x1044ebe0
call fcn.10025150
mov esi, eax
jmp 0x10035985
push ebx
push 0x80040708
push 0x1044ebe0
call fcn.10025150
mov esi, eax
jmp 0x10035985
push ebx
push 0x80040709
push 0x1044ebe0
call fcn.10025150
mov esi, eax
jmp 0x10035985