Function at 0x10026420
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x10065a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x10c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0x10025e60
call fcn.10018670
mov edi, eax
test edi, edi
je 0x100267f7
push esi
push 0x10025ec0
push edi
call fcn.10001330
push 1
push 0x10004fa0
push 0x1004fd78
push edi
call fcn.10003830
push 0xfffffffffffffffe
push edi
call fcn.10002670
push 1
push 0x1001bd80
push str.string
push edi
call fcn.10003830
push 0xfffffffffffffffe
push edi
call fcn.10002670
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test ebx, ebx
je 0x100267ee
push ebx
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x110], esi
test esi, esi
je 0x100267ee
push ebx
push dword [ebp - 0x10c]
push esi
call fcn.100275a0
add esp, 0xc
push esi
push ebx
push dword [ebp - 0x10c]
call fcn.10025e10
push 0
push str.main
push ebx
push esi
push edi
call fcn.100035d0
push ebx
mov ebx, dword [ebp - 0x110]
mov esi, eax
push 0
push ebx
call fcn.10027d00
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jne 0x100267e4
push esi
push esi
push edi
call fcn.10001590
push esi
push 0x100263a0
push edi
call fcn.10001ec0
push esi
push 1
push 0xfffffffffffffffe
push edi
call fcn.10002380
push esi
push 0x100261a0
push edi
call fcn.10001ec0
push esi
push 2
push 0xfffffffffffffffe
push edi
call fcn.10002380
push esi
push 0x10026340
push edi
call fcn.10001ec0
push esi
push 3
push 0xfffffffffffffffe
push edi
call fcn.10002380
push esi
push 0x100260b0
push edi
call fcn.10001ec0
push esi
push 4
push 0xfffffffffffffffe
push edi
call fcn.10002380
push esi
push 0x10025ee0
push edi
call fcn.10001ec0
push esi
push 5
push 0xfffffffffffffffe
push edi
call fcn.10002380
push esi
push 0x10026310
push edi
call fcn.10001ec0
push esi
push 6
push 0xfffffffffffffffe
push edi
call fcn.10002380
push esi
push 0x10025fd0
push edi
call fcn.10001ec0
push esi
push 7
push 0xfffffffffffffffe
push edi
call fcn.10002380
mov eax, sym.imp.KERNEL32.dll_GetLastError
mov esi, 0x5a4d
mov eax, dword [eax]
and eax, 0xffff0000
cmp word [eax], si
je 0x100265ea
nop dword [eax + eax]
sub eax, 0x10000
cmp word [eax], si
jne 0x100265e0
push eax
push edi
call fcn.10001fc0
push 0
push 0x3c
push 0xfffffffffffffffe
push edi
call fcn.10002380
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
and eax, 0xffff0000
cmp word [eax], si
je 0x1002661d
sub eax, 0x10000
cmp word [eax], si
jne 0x10026613
push eax
push edi
call fcn.10001fc0
push 0
push 0x3d
push 0xfffffffffffffffe
push edi
call fcn.10002380
mov eax, 0xffff0000
and eax, dword [ebp + 4]
cmp word [eax], si
je 0x1002664a
nop dword [eax]
sub eax, 0x10000
cmp word [eax], si
jne 0x10026640
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push eax
push edi
call fcn.10002080
push 0
push 0xc8
push 0xfffffffffffffffe
push edi
call fcn.10002380
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
push dword [ebp - 0x10c]
push edi
call fcn.10001e90
push 0
push 0xc9
push 0xfffffffffffffffe
push edi
call fcn.10002380
push 0
push edi
call fcn.10001e90
push 0
push 0xca
push 0xfffffffffffffffe
push edi
call fcn.10002380
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0x7be6ca1
push 0
push 0x12
push edi
mov dword [ebp - 0x90], 0xaa2feff7
mov dword [ebp - 0x8c], 0x2e27bc62
mov dword [ebp - 0x88], 0xdaf166f6
mov dword [ebp - 0x84], 0xfbdcfa66
mov dword [ebp - 0x80], 0x7100da0e
mov dword [ebp - 0x7c], 0x1d209657
mov dword [ebp - 0x78], 0xa4e017bf
movlpd qword [ebp - 0x74], xmm0
movlpd qword [ebp - 0x6c], xmm0
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x14], 0xe2b65793
mov dword [ebp - 0x10], 0xdcf6787a
mov dword [ebp - 0xc], 0x24fdc394
mov dword [ebp - 8], 0xc4ffda0f
call fcn.10001590
xor esi, esi
nop word [eax + eax]
mov edx, dword [ebp + esi*8 - 0x94]
mov eax, edx
mov ecx, dword [ebp + esi*8 - 0x90]
inc esi
or eax, ecx
je 0x100267aa
push ecx
push edx
push edi
call fcn.10001f90
mov eax, esi
cdq
push edx
push eax
push 0xfffffffffffffffe
push edi
call fcn.10002380
cmp esi, 0x12
jb 0x10026780
push 0
push 0x78
push 0xfffffffffffffffe
push edi
call fcn.10002380
push 0
push 0
push 0
push 1
push 1
push edi
call fcn.10001db0
test eax, eax
jne 0x100267e4
pop esi
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004cd7e
mov esp, ebp
pop ebp
ret 8
push 0
push 0xffffffffffffffff
push edi
call fcn.100028a0
push edi
call fcn.100185c0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1004cd7e
mov esp, ebp
pop ebp
ret 8