Function at 0x100b6770
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10205205
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10283a3c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x44], 0
lea ebx, [esi + 0x30]
push eax
lea ecx, [ebp - 0x39]
mov dword [ebp - 0x50], ebx
call fcn.100b54c0
mov dword [ebp - 4], 0
mov ecx, ebx
push dword [eax]
call fcn.100fb600
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov edx, dword [ebp - 0x4c]
mov ecx, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100b67ec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x100b6809
cmp dword [esi + 0x368], 8
lea eax, [esi + 0x354]
jb 0x100b6801
mov eax, dword [eax]
push eax
mov ecx, ebx
call fcn.101220a0
mov dword [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x28], eax
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x20]
push 6
push eax
mov dword [ebp - 0x20], 0x740062
mov dword [ebp - 0x1c], 0x5f006e
mov dword [ebp - 0x18], 0x6b006f
mov dword [ebp - 0x24], 7
call fcn.10027e50
cmp dword [ebp - 0x24], 8
lea eax, [ebp - 0x38]
lea ecx, [esi + 0x30]
mov dword [ebp - 0x44], 4
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.100fb600
mov ebx, 4
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ebx
and ebx, 0xfffffffb
mov dword [ebp - 0x44], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10020960
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x100b691d
add esi, 0x36c
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x100b68a3
mov eax, dword [esi]
push eax
call fcn.101220a0
call fcn.10029e80
mov ecx, eax
test ecx, ecx
je 0x100b6cfd
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x48], eax
mov dword [ebp - 4], 4
mov edx, esi
cmp dword [esi + 0x14], 8
jb 0x100b68d4
mov edx, dword [esi]
mov ecx, esi
jb 0x100b68dc
mov ecx, dword [esi]
mov esi, ecx
push edx
push ecx
push esi
lea eax, [ebp - 0x48]
push str.normalimage_file_s_source0_0_400_42__hotimage_file_s_source400_0_800_42__pushedimage_file_s_source800_0_1200_42_
push eax
call fcn.10029c50
mov ecx, dword [ebp - 0x40]
add esp, 0x14
mov esi, dword [ebp - 0x48]
mov eax, dword [ecx]
push esi
call dword [eax + 0x184]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100b691d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x28], eax
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x1c]
push 4
push eax
mov dword [ebp - 0x1c], 0x6f006c
mov dword [ebp - 0x18], 0x6f0067
mov dword [ebp - 0x24], 7
call fcn.10027e50
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x38]
or ebx, 8
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x24], 8
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.100fb600
mov esi, eax
and ebx, 0xfffffff7
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10020960
lea eax, [ebp - 0x40]
push eax
call fcn.1004e340
add esp, 4
mov dword [ebp - 4], 7
test esi, esi
je 0x100b6a23
mov eax, dword [ebp - 0x40]
cmp dword [eax - 0xc], 0
je 0x100b6a23
mov eax, dword [esi]
lea ecx, [ebp - 0x39]
mov esi, dword [eax + 0x160]
lea eax, [ebp - 0x54]
push eax
call fcn.10067c50
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x40]
push ecx
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.1002d400
add esp, 0xc
mov byte [ebp - 4], 9
push dword [eax]
mov ecx, dword [ebp - 0x4c]
push str.bkimage
call esi
mov byte [ebp - 4], 8
mov eax, edi
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b6a05
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, edi
mov edx, dword [ebp - 0x54]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b6a23
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b6a44
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x50]
push str.title
call fcn.100fb600
mov esi, eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x18], esi
call fcn.1004f3b0
add esp, 4
mov dword [ebp - 4], 0xd
test esi, esi
je 0x100b6b62
mov eax, dword [ebp - 0x40]
cmp dword [eax - 0xc], 0
je 0x100b6b62
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x39]
call fcn.10061980
mov byte [ebp - 4], 0xe
mov ecx, dword [eax]
mov edx, ecx
mov eax, dword [ebp - 0x40]
sub edx, eax
sar edx, 1
mov dword [ebp - 0x54], edx
mov edx, dword [ecx - 0xc]
mov esi, dword [eax - 0xc]
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x4c], esi
test edx, edx
js 0x100b6d07
test ecx, ecx
jne 0x100b6ab8
xor edx, edx
jmp 0x100b6ac7
push edx
push ecx
call fcn.101ced3f
mov edx, eax
add esp, 8
mov eax, dword [ebp - 0x40]
mov ecx, SysReAllocString
mov dword [ebp - 0x48], edx
sub ecx, edx
cmp ecx, esi
jl 0x100b6d11
add esi, edx
js 0x100b6d1b
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x100b6afe
push esi
lea ecx, [ebp - 0x40]
call fcn.10025990
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x54]
lea edx, [eax + ecx*2]
cmp ecx, dword [ebp - 0x4c]
jbe 0x100b6b0c
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x48]
push ecx
push edx
push ecx
mov ecx, dword [ebp - 0x4c]
lea eax, [eax + ecx*2]
push eax
call fcn.10025410
mov eax, dword [ebp - 0x40]
add esp, 0x10
cmp esi, dword [eax - 8]
jg 0x100b6d07
mov dword [eax - 0xc], esi
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov word [eax + esi*2], cx
mov byte [ebp - 4], 0xd
mov eax, edi
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b6b57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x18]
push dword [ebp - 0x40]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov edx, dword [ebp - 0x40]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b6b83
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0x11
xor eax, eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x28], eax
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x18]
push 2
push eax
mov dword [ebp - 0x18], 0x640061
mov dword [ebp - 0x24], 7
call fcn.10027e50
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x38]
or ebx, 0x10
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x24], 8
cmovae eax, dword [ebp - 0x38]
push eax
call fcn.100fb600
mov esi, eax
and ebx, 0xffffffef
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x44], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.10020960
test esi, esi
je 0x100b6c66
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x39]
call fcn.1003f020
mov esi, eax
mov dword [ebp - 4], 0x12
lea eax, [ebp - 0x18]
push 1
or ebx, 1
push eax
mov dword [ebp - 0x44], ebx
call fcn.10041ac0
add esp, 8
mov dword [ebp - 4], 0x13
or ebx, 2
mov dword [ebp - 0x44], ebx
mov ecx, dword [esi]
test ecx, ecx
je 0x100b6d25
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100b6c59
test dx, dx
je 0x100b6c55
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100b6c59
add eax, 4
add ecx, 4
test dx, dx
jne 0x100b6c33
xor eax, eax
jmp 0x100b6c5e
sbb eax, eax
or eax, 1
mov byte [ebp - 0x39], 1
test eax, eax
jne 0x100b6c6a
mov byte [ebp - 0x39], 0
mov dword [ebp - 4], 0x12
test bl, 2
je 0x100b6c9d
and ebx, 0xfffffffd
mov dword [ebp - 0x44], ebx
mov dword [ebp - 4], 0x12
mov eax, edi
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100b6c9d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x100b6cce
and ebx, 0xfffffffe
mov dword [ebp - 0x44], ebx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x100b6cce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x39], 0
je 0x100b6ce1
mov ecx, dword [ebp - 0x58]
push 0
mov eax, dword [ecx]
call dword [eax + 0x114]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1017034a
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100253e0
push 0x80070057
call fcn.100253e0
push 0x80070057
call fcn.100253e0
push 0x80070057
call fcn.100253e0
push 0x80004005
call fcn.100253e0
int3