Function at 0x1004bc10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101616a0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebx + 0x30]
push 0
mov dword [ebp - 0x18], 1
push dword [edi + 0x5c]
mov eax, dword [ecx]
push dword [edi + 0x58]
call dword [eax + 0x20]
push 0x6148
call fcn.101427a2
push 0x6148
mov esi, eax
push 0
push esi
mov dword [ebp - 0x1c], esi
call fcn.10143f10
push 0x6148
push 0
push esi
mov dword [esi], 0
mov dword [ebp - 0x1c], esi
call fcn.10143f10
mov eax, dword [ebx + 0x30]
add esp, 0x1c
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], eax
mov al, byte [edi + 0x2c]
sub al, 0x4c
mov byte [esi + 0xc], al
mov byte [esi + 0xd], 0
mov eax, dword [edi + 0x10]
mov dword [esi + 0x1c], eax
xor eax, eax
mov dword [esi + 0x20], eax
mov ax, word [edi + 0x28]
mov word [esi + 0x24], ax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
xor eax, eax
mov word [esi + 0x13e], ax
mov dword [esi + 0x138], eax
mov byte [esi + 0x13c], al
mov dword [ebp - 4], eax
mov dword [esi + 0x134], 0
mov dword [esi + 0x130], 0
mov eax, dword [edi + 0x2c]
add eax, 0xfffffbb3
cmp eax, 8
ja case.default.0x1004bcfd
jmp dword [eax*4 + 0x1004bebc]
cmp dword [esi], 0
jne 0x1004bd18
push 0x100000
call fcn.1015d6d9
add esp, 4
mov dword [esi], eax
mov ecx, dword [esi]
mov edi, dword [esi + 0x1c]
mov dword [ebp + 0x10], ecx
mov edx, 0x100000
test edi, edi
jle 0x1004be25
cmp edi, edx
mov eax, edi
cmovg eax, edx
push eax
push ecx
mov ecx, esi
call fcn.10074280
mov ebx, eax
test ebx, ebx
je 0x1004be25
cmp byte [esi + 0xc], 3
mov ecx, esi
push ebx
push dword [ebp + 0x10]
jne 0x1004bd5f
call fcn.10074020
mov ecx, dword [ebp + 0x10]
sub edi, ebx
jmp 0x1004bd20
call fcn.10073fb0
mov ecx, dword [ebp + 0x10]
sub edi, ebx
jmp 0x1004bd20
mov ecx, esi
call fcn.10074330
jmp 0x1004be2b
mov ecx, esi
call fcn.10074890
jmp 0x1004be2b
mov ecx, esi
call fcn.10074500
jmp 0x1004be2b
mov edx, dword [ebx + 4]
mov dword [ebx + 0x744], 0xa0000047
test edx, edx
je 0x1004bdb5
mov ecx, dword [edx]
lea eax, [ebx + 0x74c]
push eax
push 0
push edi
push 0xa0000047
push edx
call dword [ecx + 0x14]
cmp dword [ebx + 0x73c], 0
je 0x1004bdc8
mov dword [ebx + 0x740], 1
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1004be30
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x14]
mov eax, 1
mov dword [ebp - 4], 0xffffffff
cmp eax, 1
jne 0x1004be85
movzx eax, word [esi + 0x13e]
cmp eax, dword [edi + 0x28]
je 0x1004be85
mov edx, dword [ebx + 4]
mov dword [ebx + 0x744], 0xa0000018
test edx, edx
je 0x1004be6e
mov ecx, dword [edx]
lea eax, [ebx + 0x74c]
push eax
push 0
push edi
push 0xa0000018
push edx
call dword [ecx + 0x14]
cmp dword [ebx + 0x73c], 0
je 0x1004be81
mov dword [ebx + 0x740], 1
xor ebx, ebx
jmp 0x1004be88
mov ebx, dword [ebp - 0x18]
mov eax, dword [esi]
test eax, eax
je 0x1004be97
push eax
call fcn.10142e8f
add esp, 4
push 0x6148
push esi
call fcn.10142794
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc