Function at 0x100bebd0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b1146
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10249010]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
mov eax, 0x7b1d9b4f
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov ecx, dword [esi + 4]
sub ecx, dword [esi]
imul ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x100bec74
cmp eax, 0x1ec76
ja 0x100beef9
push eax
mov ecx, edi
call fcn.100bf860
mov eax, dword [esi + 4]
mov esi, dword [esi]
mov edi, dword [edi]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x100bec69
nop dword [eax]
push esi
mov ecx, edi
call fcn.100bfae0
add esi, 0x8514
add edi, 0x8514
cmp esi, dword [ebp - 0x14]
jne 0x100bec50
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
mov dword [eax + 4], edi
mov edi, eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x20], al
movzx eax, byte [esi + 0x21]
mov byte [edi + 0x21], al
movzx eax, byte [esi + 0x22]
mov byte [edi + 0x22], al
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
movzx eax, byte [esi + 0x30]
mov byte [edi + 0x30], al
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
lea eax, [esi + 0x3c]
push 0x1800
push eax
lea eax, [edi + 0x3c]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esi + 0x183c]
lea ecx, [edi + 0x189c]
mov dword [edi + 0x183c], eax
add esp, 0xc
mov eax, dword [esi + 0x1840]
mov dword [edi + 0x1840], eax
mov eax, dword [esi + 0x1844]
mov dword [edi + 0x1844], eax
movzx eax, byte [esi + 0x1848]
mov byte [edi + 0x1848], al
movups xmm0, xmmword [esi + 0x184c]
movups xmmword [edi + 0x184c], xmm0
movups xmm0, xmmword [esi + 0x185c]
movups xmmword [edi + 0x185c], xmm0
movq xmm0, qword [esi + 0x186c]
movq qword [edi + 0x186c], xmm0
movzx eax, byte [esi + 0x1874]
mov byte [edi + 0x1874], al
mov eax, dword [esi + 0x1878]
mov dword [edi + 0x1878], eax
mov eax, dword [esi + 0x187c]
mov dword [edi + 0x187c], eax
mov eax, dword [esi + 0x1880]
mov dword [edi + 0x1880], eax
mov eax, dword [esi + 0x1884]
mov dword [edi + 0x1884], eax
mov eax, dword [esi + 0x1888]
mov dword [edi + 0x1888], eax
mov eax, dword [esi + 0x188c]
mov dword [edi + 0x188c], eax
mov eax, dword [esi + 0x1890]
mov dword [edi + 0x1890], eax
mov eax, dword [esi + 0x1894]
mov dword [edi + 0x1894], eax
mov eax, dword [esi + 0x1898]
mov dword [edi + 0x1898], eax
lea eax, [esi + 0x189c]
push eax
call fcn.100180b0
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x18b4]
mov dword [edi + 0x18b4], eax
mov eax, dword [esi + 0x18b8]
mov dword [edi + 0x18b8], eax
movzx eax, byte [esi + 0x18bc]
mov byte [edi + 0x18bc], al
movzx eax, byte [esi + 0x18bd]
mov byte [edi + 0x18bd], al
movzx eax, byte [esi + 0x18be]
mov byte [edi + 0x18be], al
movzx eax, byte [esi + 0x18bf]
mov edx, dword [ebp + 8]
mov byte [edi + 0x18bf], al
movzx eax, byte [esi + 0x18c0]
mov byte [edi + 0x18c0], al
movzx eax, byte [esi + 0x18c1]
mov byte [edi + 0x18c1], al
movzx eax, byte [esi + 0x18c2]
mov byte [edi + 0x18c2], al
movzx eax, byte [esi + 0x18c3]
mov byte [edi + 0x18c3], al
movzx eax, byte [esi + 0x18c4]
mov byte [edi + 0x18c4], al
movzx eax, byte [esi + 0x18c5]
mov byte [edi + 0x18c5], al
mov eax, dword [esi + 0x18c8]
mov dword [edi + 0x18c8], eax
mov eax, dword [esi + 0x18cc]
lea esi, [edi + 0x18d0]
mov dword [edi + 0x18cc], eax
lea ecx, [esi + 0x14]
movzx eax, byte [edx + 0x18d0]
mov byte [esi], al
mov eax, dword [edx + 0x18d4]
mov dword [esi + 4], eax
mov eax, dword [edx + 0x18d8]
mov dword [esi + 8], eax
movzx eax, byte [edx + 0x18dc]
mov byte [esi + 0xc], al
mov eax, dword [edx + 0x18e0]
mov dword [esi + 0x10], eax
lea eax, [edx + 0x18e4]
push eax
mov dword [ebp - 0x14], esi
call fcn.100180b0
mov eax, dword [ebp + 8]
lea ecx, [esi + 0x2c]
add eax, 0x18fc
mov byte [ebp - 4], 2
push eax
call fcn.100180b0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.100188b0
int3