Function at 0x10006980
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009b538
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x10129180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 8]
call fcn.10007d70
lea eax, [esi + 0x37c8]
mov dword [ebp - 4], 0
push 0x74
push 0
push eax
mov dword [eax + 0x60], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x6c], 0
mov dword [eax + 0x68], 0
mov dword [eax + 0x70], 0
call fcn.10076ef0
add esp, 0xc
mov dword [esi + 0x3840], 0
mov dword [esi + 0x383c], 0
mov dword [esi + 0x3844], 0
mov dword [esi + 0x384c], 0
mov dword [esi + 0x3848], 0
mov dword [esi + 0x3850], 0
lea ecx, [esi + 0x3854]
mov byte [ebp - 4], 3
call fcn.10008010
lea ecx, [esi + 0x3ca0]
call fcn.1002a4d0
mov dword [esi + 0x3ec0], 0
mov dword [esi + 0x3ebc], 0
mov dword [esi + 0x3ec4], 0
mov dword [esi + 0x3ecc], 0
mov dword [esi + 0x3ec8], 0
mov dword [esi + 0x3ed0], 0
mov dword [esi + 0x3ed8], 0
mov dword [esi + 0x3ed4], 0
mov dword [esi + 0x3edc], 0
mov dword [esi + 0x3ee4], 0
mov dword [esi + 0x3ee0], 0
mov dword [esi + 0x3ee8], 0
mov dword [esi + 0x3ef0], 0
mov dword [esi + 0x3eec], 0
mov dword [esi + 0x3ef4], 0
mov dword [esi + 0x3efc], 0
lea eax, [esi + 0x3fb4]
mov dword [esi + 0x3f00], 0
xorps xmm0, xmm0
mov dword [esi + 0x3f1c], 0
mov dword [esi + 0x3f20], 0
mov dword [esi + 0x3f54], 0
mov dword [esi + 0x3f58], 0
movups xmmword [esi + 0x3f88], xmm0
mov dword [esi + 0x3f98], 0
movups xmmword [esi + 0x3fa0], xmm0
mov dword [esi + 0x3fb0], 0
push 0x3c
push 0
push eax
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
call fcn.10076ef0
lea eax, [esi + 0x3ff0]
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
xorps xmm0, xmm0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
movups xmmword [eax + 0x64], xmm0
push 0x88
movq qword [eax + 0x74], xmm0
mov dword [eax + 0x7c], 0
mov dword [eax + 0x68], 0xffffffff
mov byte [eax + 0x7d], 1
push 0
push eax
mov dword [eax + 0x80], 0
mov dword [eax + 0x84], 0
call fcn.10076ef0
mov dword [esi + 0x407c], 0
mov dword [esi + 0x4078], 0
mov dword [esi + 0x4080], 0
mov dword [esi + 0x4088], 0
mov dword [esi + 0x4084], 0
mov dword [esi + 0x408c], 0
mov dword [esi + 0x4094], 0
mov dword [esi + 0x4090], 0
mov dword [esi + 0x4098], 0
mov dword [esi + 0x40a0], 0
mov dword [esi + 0x409c], 0
mov dword [esi + 0x40a4], 0
mov dword [esi + 0x40ac], 0
mov dword [esi + 0x40a8], 0
mov dword [esi + 0x40b0], 0
mov dword [esi + 0x40b8], 0
mov dword [esi + 0x40b4], 0
mov dword [esi + 0x40bc], 0
mov dword [esi + 0x40c4], 0
mov dword [esi + 0x40c0], 0
mov dword [esi + 0x40c8], 0
mov dword [esi + 0x40d0], 0
mov dword [esi + 0x40cc], 0
mov dword [esi + 0x40d4], 0
mov dword [esi + 0x40e0], 0
mov dword [esi + 0x40dc], 0
mov dword [esi + 0x40e4], 0
mov dword [esi + 0x40fc], 0
mov dword [esi + 0x4100], 0
mov dword [esi + 0x4104], 0
mov eax, dword [esi + 0x4104]
mov dword [esi + 0x4108], 0
mov ecx, dword [esi + 0x4108]
mov dword [esi + 0x4114], 0
mov dword [esi + 0x4118], 0
mov dword [esi + 0x410c], 0
mov dword [esi + 0x4110], 0
mov dword [esi + 0x40fc], eax
mov dword [esi + 0x4100], ecx
mov dword [esi + 0x411c], 0x3f800000
mov dword [esi + 0x416c], 0
mov dword [esi + 0x4170], 0
mov dword [esi + 0x4174], 0
mov dword [esi + 0x4178], 0
mov dword [esi + 0x4198], 0
mov dword [esi + 0x419c], 0
mov dword [esi + 0x41a0], 0
mov dword [esi + 0x41a4], 0
mov dword [esi + 0x41a8], 0
xorps xmm0, xmm0
mov dword [esi + 0x41ac], 0
mov dword [esi + 0x41b0], 0
mov dword [esi + 0x41b4], 0
mov dword [esi + 0x41d0], 0
mov dword [esi + 0x41d4], 0
mov dword [esi + 0x41d8], 0
mov dword [esi + 0x41dc], 0
mov dword [esi + 0x41c4], 0
mov dword [esi + 0x41cc], 0
mov dword [esi + 0x41c8], 0
mov dword [esi + 0x41e0], 0
mov dword [esi + 0x41ec], 0x7f7fffff
mov dword [esi + 0x41e8], 0x7f7fffff
mov dword [esi + 0x41e4], 0x7f7fffff
mov dword [esi + 0x41fc], 0
mov dword [esi + 0x4200], 0
mov dword [esi + 0x4204], 0
mov dword [esi + 0x4208], 0
mov dword [esi + 0x41f0], 0
mov dword [esi + 0x41f8], 0
mov dword [esi + 0x41f4], 0
mov dword [esi + 0x420c], 0
mov dword [esi + 0x4218], 0x7f7fffff
mov dword [esi + 0x4214], 0x7f7fffff
mov dword [esi + 0x4210], 0x7f7fffff
mov dword [esi + 0x4228], 0
mov dword [esi + 0x422c], 0
mov dword [esi + 0x4230], 0
mov dword [esi + 0x4234], 0
mov dword [esi + 0x421c], 0
mov dword [esi + 0x4224], 0
mov dword [esi + 0x4220], 0
mov dword [esi + 0x4238], 0
mov dword [esi + 0x4244], 0x7f7fffff
mov dword [esi + 0x4240], 0x7f7fffff
mov dword [esi + 0x423c], 0x7f7fffff
mov dword [esi + 0x4254], 0
mov dword [esi + 0x4258], 0
mov dword [esi + 0x425c], 0
mov dword [esi + 0x4260], 0
mov dword [esi + 0x4248], 0
mov dword [esi + 0x4250], 0
mov dword [esi + 0x424c], 0
mov dword [esi + 0x4264], 0
mov dword [esi + 0x4270], 0x7f7fffff
mov dword [esi + 0x426c], 0x7f7fffff
mov dword [esi + 0x4268], 0x7f7fffff
mov dword [esi + 0x42b0], 0
mov dword [esi + 0x42ac], 0
mov dword [esi + 0x42a4], 0
mov dword [esi + 0x42a8], 0
movups xmmword [esi + 0x42b8], xmm0
movups xmmword [esi + 0x42c8], xmm0
mov word [esi + 0x42d8], 0
mov dword [esi + 0x42b4], 0xffffffff
mov byte [esi + 0x42da], 0
mov dword [esi + 0x42dc], 0
mov dword [esi + 0x42e0], 0
mov dword [esi + 0x42e4], 0
mov dword [esi + 0x42e8], 0
mov dword [esi + 0x430c], 0
mov dword [esi + 0x4308], 0
mov dword [esi + 0x4310], 0
mov dword [esi + 0x432c], 0
mov dword [esi + 0x4328], 0
mov dword [esi + 0x4330], 0
mov dword [esi + 0x4340], 0
mov dword [esi + 0x433c], 0
mov dword [esi + 0x4344], 0
mov dword [esi + 0x434c], 0
mov dword [esi + 0x4348], 0
mov dword [esi + 0x4350], 0
mov dword [esi + 0x4358], 0
mov dword [esi + 0x4354], 0
mov dword [esi + 0x435c], 0
mov dword [esi + 0x4364], 0
mov dword [esi + 0x4360], 0
mov dword [esi + 0x436c], 0
mov dword [esi + 0x4368], 0
mov dword [esi + 0x4370], 0
mov dword [esi + 0x4378], 0
mov dword [esi + 0x4374], 0
mov dword [esi + 0x437c], 0
mov dword [esi + 0x4388], 0
mov dword [esi + 0x4384], 0
mov dword [esi + 0x438c], 0
mov dword [esi + 0x4394], 0
mov dword [esi + 0x4390], 0
mov dword [esi + 0x4398], 0
mov dword [esi + 0x43a0], 0
mov dword [esi + 0x439c], 0
mov dword [esi + 0x43a8], 0
mov dword [esi + 0x43a4], 0
mov dword [esi + 0x43ac], 0
mov dword [esi + 0x43b4], 0
mov dword [esi + 0x43b0], 0
mov dword [esi + 0x43b8], 0
lea eax, [esi + 0x43c4]
mov dword [esi + 0x43bc], 0
mov dword [esi + 0x43c0], 0
push 0xe74
push 0
push eax
mov dword [eax + 0x10], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x2c], 0
call fcn.10076ef0
add esp, 0x24
lea ecx, [esi + 0x5238]
mov byte [ebp - 4], 0x1b
call fcn.1002a5c0
lea eax, [esi + 0x52b4]
mov dword [esi + 0x52a4], 0
mov dword [esi + 0x52a8], 0
mov dword [esi + 0x52ac], 0
mov dword [esi + 0x52b0], 0
push 0x30
push 0
push eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
call fcn.10076ef0
add esp, 0xc
mov dword [esi + 0x5308], 0
mov dword [esi + 0x5304], 0
mov dword [esi + 0x530c], 0
mov dword [esi + 0x5314], 0
mov dword [esi + 0x5310], 0
mov dword [esi + 0x5318], 0
xorps xmm0, xmm0
mov dword [esi + 0x5320], 0
mov dword [esi + 0x5324], 0
movups xmmword [esi + 0x531c], xmm0
mov dword [esi + 0x5330], 0
mov dword [esi + 0x5334], 0
movups xmmword [esi + 0x532c], xmm0
mov dword [esi + 0x5348], 0
mov dword [esi + 0x5344], 0
mov dword [esi + 0x534c], 0
mov dword [esi + 0x5354], 0
mov dword [esi + 0x5350], 0
mov dword [esi + 0x5358], 0
mov dword [esi + 0x5360], 0
mov dword [esi + 0x535c], 0
mov dword [esi + 0x5364], 0
movups xmmword [esi + 0x5344], xmm0
movups xmmword [esi + 0x5354], xmm0
movq qword [esi + 0x5364], xmm0
mov dword [esi + 0x5378], 0
mov dword [esi + 0x5374], 0
mov dword [esi + 0x537c], 0
mov dword [esi + 0x5384], 0
mov dword [esi + 0x5380], 0
mov dword [esi + 0x5388], 0
mov dword [esi + 0x5390], 0
mov dword [esi + 0x538c], 0
mov dword [esi + 0x5394], 0
mov dword [esi + 0x539c], 0
mov dword [esi + 0x5398], 0
mov dword [esi + 0x53a0], 0
mov dword [esi + 0x53a8], 0
mov dword [esi + 0x53a4], 0
mov dword [esi + 0x53ac], 0
mov dword [esi + 0x53c4], 0
mov dword [esi + 0x53c0], 0
mov dword [esi + 0x53c8], 0
mov dword [esi + 0x53f0], 0
mov dword [esi + 0x53ec], 0
mov dword [esi + 0x53f4], 0
mov dword [esi + 0x5401], 0
mov byte [esi + 0x5400], 0
mov word [esi + 0x5405], 0x101
mov byte [esi + 0x5407], 0
mov dword [esi + 0x540c], 0xffffffff
mov dword [esi + 0x5408], 0xffffffff
mov dword [esi + 0x5420], 0
mov dword [esi + 0x541c], 0
mov dword [esi + 0x5424], 0
movups xmmword [esi + 0x5410], xmm0
movups xmmword [esi + 0x5420], xmm0
mov dword [esi + 0x542c], 0xff7fffff
mov dword [esi + 0x562c], 0
mov dword [esi + 0x5628], 0
mov dword [esi + 0x5630], 0
mov ecx, dword [ebp + 8]
test ecx, ecx
mov byte [ebp - 4], 0x28
sete al
mov byte [esi], 0
mov dword [esi + 0x3c90], 0
mov dword [esi + 0x3c8c], 0
mov byte [esi + 1], al
mov dword [esi + 0x3c94], 0
mov dword [esi + 0x3c9c], 0
mov dword [esi + 0x3c98], 0
test ecx, ecx
jne 0x100075b0
mov eax, dword [0x1012ab58]
test eax, eax
je 0x1000757b
inc dword [eax + 0xb0]
push dword [0x1012ab60]
push 0x468
call dword [0x10129058]
mov dword [ebp - 0x14], eax
lea ecx, [ebp + 0xb]
add esp, 8
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0x29
test eax, eax
je 0x100075ac
mov ecx, eax
call fcn.1002a660
jmp 0x100075ae
xor eax, eax
mov ecx, eax
mov dword [esi + 0x40], ecx
xorps xmm0, xmm0
movsd qword [esi + 0x3e98], xmm0
mov dword [esi + 0x3ea0], 0
mov dword [esi + 0x3eac], 0xffffffff
mov dword [esi + 0x3ea8], 0xffffffff
mov dword [esi + 0x3ea4], 0xffffffff
mov dword [esi + 0x3eb1], 0
mov byte [esi + 0x3eb0], 0
mov dword [esi + 0x3eb8], 0
mov dword [esi + 0x3ef8], 0
mov dword [esi + 0x3f04], 0
mov dword [esi + 0x3f08], 0
mov dword [esi + 0x3f0c], 0
mov dword [esi + 0x3f10], 0
mov dword [esi + 0x3f14], 0
mov dword [esi + 0x3f18], 0
mov dword [esi + 0x3f24], 0
mov dword [esi + 0x3f28], 0
mov dword [esi + 0x3f30], 0
mov dword [esi + 0x3f2c], 0
mov dword [esi + 0x3f34], 0
mov dword [esi + 0x3f3c], 0
mov dword [esi + 0x3f38], 0
mov dword [esi + 0x3f40], 0
mov dword [esi + 0x3f44], 0
mov dword [esi + 0x3f48], 0
mov dword [esi + 0x3f4c], 0
mov word [esi + 0x3f50], 0
mov dword [esi + 0x3f54], 0xbf800000
mov dword [esi + 0x3f58], 0xbf800000
mov dword [esi + 0x3f5c], 0
mov dword [esi + 0x3f60], 0
mov dword [esi + 0x3f64], 0xffffffff
mov dword [esi + 0x3f68], 0
mov word [esi + 0x3f6c], 0
mov dword [esi + 0x3f70], 0
mov dword [esi + 0x3f74], 0
mov dword [esi + 0x3f78], 0
mov byte [esi + 0x3f7c], 0
mov dword [esi + 0x3f80], 0
mov dword [esi + 0x3f84], 0
movups xmmword [esi + 0x3f88], xmm0
mov dword [esi + 0x3f98], 0
mov dword [esi + 0x3f9c], 0
mov dword [esi + 0x40d8], 0
mov dword [esi + 0x40e8], 0
mov dword [esi + 0x40ec], 0
mov dword [esi + 0x40f4], 0
mov dword [esi + 0x40f0], 0
mov dword [esi + 0x40f8], 0
mov dword [esi + 0x4120], 0
mov dword [esi + 0x4124], 0
mov dword [esi + 0x413c], 0
mov dword [esi + 0x4138], 0
mov dword [esi + 0x4134], 0
mov dword [esi + 0x4130], 0
mov dword [esi + 0x412c], 0
mov dword [esi + 0x4128], 0
mov dword [esi + 0x4150], 0
mov dword [esi + 0x4148], 0
mov dword [esi + 0x4144], 0
mov dword [esi + 0x4154], 0
mov dword [esi + 0x4140], 0
mov dword [esi + 0x414c], 0
mov dword [esi + 0x4158], 0
mov dword [esi + 0x415c], 0
mov dword [esi + 0x4160], 0x10000
mov word [esi + 0x4164], 0
mov byte [esi + 0x4166], 0
mov dword [esi + 0x4168], 0
mov word [esi + 0x417c], 0
mov byte [esi + 0x417e], 0
mov dword [esi + 0x4180], 0
mov dword [esi + 0x4184], 0
mov dword [esi + 0x4188], 0
mov dword [esi + 0x4194], 0xffffffff
mov dword [esi + 0x4190], 0xffffffff
mov dword [esi + 0x418c], 0xffffffff
mov dword [esi + 0x41b8], 0
mov dword [esi + 0x41bc], 0
mov dword [esi + 0x41c0], 0
xor eax, eax
mov dword [esi + 0x427c], 0
mov dword [esi + 0x4278], 0
mov dword [esi + 0x4274], 0
mov dword [esi + 0x4284], 0
mov dword [esi + 0x4280], 0
mov byte [esi + 0x4288], 0
mov dword [esi + 0x428c], 0
mov dword [esi + 0x4290], 0
mov word [esi + 0x4295], 0
mov byte [esi + 0x4294], 0
mov dword [esi + 0x4298], 0
mov dword [esi + 0x429c], 0xffffffff
mov dword [esi + 0x42a0], 0xffffffff
mov dword [esi + 0x42ec], 0
mov dword [esi + 0x42f0], 0
mov dword [esi + 0x42f4], 0
mov dword [esi + 0x42f8], 0
mov dword [esi + 0x42fc], 0
mov dword [esi + 0x4300], 0xffffffff
mov dword [esi + 0x4304], 0
movups xmmword [esi + 0x4314], xmm0
mov dword [esi + 0x4324], 0
mov dword [esi + 0x4334], 0
mov dword [esi + 0x4338], 0
mov dword [esi + 0x4380], 0
mov dword [esi + 0x5290], 0
mov dword [esi + 0x5294], 0xa900000
mov dword [esi + 0x529c], 0
mov dword [esi + 0x5298], 0
mov dword [esi + 0x52a0], 0
mov dword [esi + 0x52e4], 0
mov word [esi + 0x52e8], 0
mov dword [esi + 0x52ec], 0
mov dword [esi + 0x52f0], 0x3c23d70a
mov dword [esi + 0x52f8], 0
mov dword [esi + 0x52fc], eax
mov dword [esi + 0x52f4], eax
mov dword [esi + 0x5300], 0x3f000000
mov dword [esi + 0x5320], eax
mov dword [esi + 0x5324], eax
mov dword [esi + 0x5330], 0xbf800000
mov dword [esi + 0x5334], 0xbf800000
mov dword [esi + 0x533c], eax
mov byte [esi + 0x5340], 0x2e
mov byte [esi + 0x536c], al
mov dword [esi + 0x5370], eax
mov dword [esi + 0x53b0], eax
mov byte [esi + 0x53b4], al
mov dword [esi + 0x53b8], eax
mov dword [esi + 0x53d0], eax
mov dword [esi + 0x53cc], eax
mov dword [esi + 0x53bc], eax
mov dword [esi + 0x53d4], 0x7f7fffff
mov byte [esi + 0x53d8], al
mov dword [esi + 0x53dc], eax
mov dword [esi + 0x53e4], 2
mov dword [esi + 0x53e0], 2
mov dword [esi + 0x53e8], 0x400
mov byte [esi + 0x53f8], al
push 0x1e0
push eax
mov dword [esi + 0x53fc], eax
lea eax, [esi + 0x5430]
push eax
call fcn.10076ef0
mov dword [esi + 0x5614], 0
add esp, 0xc
mov dword [esi + 0x5610], 0
mov eax, esi
mov dword [esi + 0x5618], 0
mov dword [esi + 0x5624], 0xffffffff
mov dword [esi + 0x5620], 0xffffffff
mov dword [esi + 0x561c], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4