Function at 0x1008f224
Capabilities:
Check for software breakpoints
Enumerate pe sections

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x40
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x58]
lea eax, [esp + 0xc]
push 0x1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1008f32c
mov ebp, dword [esp + 0x10]
movzx eax, word [ebp]
cmp eax, 0x5a4d
jne 0x1008f32c
mov ecx, dword [ebp + 0x3c]
movzx eax, word [ecx + ebp + 0x14]
movzx ebx, word [ecx + ebp + 6]
lea edx, [ebp + ecx + 0x18]
add edx, eax
test ebx, ebx
mov dword [esp + 0x30], edx
jbe 0x1008f32c
mov edi, edx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ecx
xor edx, edx
mov dword [esp + 0x34], edx
mov esi, edx
xor ebx, ebx
mov dword [esp + 0x3c], edx
mov dword [esp], edx
mov ebp, edx
jmp 0x1008f2a2
mov dword [esp + 0x3c], ebx
mov ebx, dword [esp + 0x38]
push 7
push str..trace
push edi
call fcn.100949e0
add esp, 0xc
test eax, eax
jne 0x1008f2d8
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
movzx ecx, word [eax + edx + 6]
mov ebx, edi
add esi, 1
add edi, 0x28
cmp esi, ecx
jae 0x1008f363
mov ebp, 1
mov dword [esp + 0x38], ebx
mov ebx, dword [esp + 0x3c]
test ebx, ebx
jne 0x1008f308
push 6
push str..text
push edi
call fcn.100949e0
add esp, 0xc
test eax, eax
jne 0x1008f308
mov dword [esp], edi
add edi, 0x28
add esi, 1
mov ebx, 1
jmp 0x1008f30e
add edi, 0x28
add esi, 1
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
movzx eax, word [eax + ecx + 6]
cmp esi, eax
jae 0x1008f94e
test ebp, ebp
jne 0x1008f2e0
jmp 0x1008f29a
push str.Unknown
push edi
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x104]
push eax
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x208]
push eax
call fcn.100947a0
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
mov ebp, edx
mov eax, dword [esp]
mov esi, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
mov edx, dword [eax + 0xc]
add edx, ebp
mov dword [esp + 0x30], edx
movzx edx, byte [edx]
cmp edx, 0xcc
je 0x1008f38b
mov ecx, dword [eax + 8]
xor eax, eax
jmp 0x1008f3b1
mov edi, dword [esp + 0x30]
mov ecx, dword [eax + 8]
xor eax, eax
cmp eax, ecx
jae 0x1008f945
add edi, 1
movzx edx, byte [edi]
add eax, 1
cmp edx, 0xcc
je 0x1008f394
mov edi, dword [esp + 0x54]
cmp eax, ecx
jae 0x1008f3c1
cmp edx, 0xe9
je 0x1008f32c
mov eax, dword [ebx + 8]
cmp eax, 0x16
jb 0x1008f32c
add ebp, dword [ebx + 0xc]
mov dword [esp + 0x34], ebp
xor ebx, ebx
jmp 0x1008f3da
add ebp, edi
movzx edx, byte [ebp]
test edx, edx
jne 0x1008f3ec
mov edi, 1
jmp 0x1008f4b9
cmp edx, 0xa
jne 0x1008f4c8
movzx edx, word [ebp + 1]
cmp edx, 2
jne 0x1008f90a
movzx edx, byte [ebp + 3]
test edx, edx
jg 0x1008f90a
mov edi, dword [ebp + 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
add edx, ecx
cmp esi, edx
jae 0x1008f4b9
cmp esi, ecx
jb 0x1008f4b9
mov edi, dword [esp + 0x54]
mov dword [esp + 8], 0
movzx eax, byte [ebp]
cmp eax, 0xa
jne 0x1008f482
movzx eax, word [ebp + 1]
cmp eax, 2
je 0x1008f503
push str.Unknown
push edi
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x104]
push eax
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x208]
push eax
call fcn.100947a0
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
push str.Unknown
push edi
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x104]
push eax
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x208]
push eax
call fcn.100947a0
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
add ebx, edi
cmp ebx, eax
jae 0x1008f8cf
jmp 0x1008f3d8
mov edi, dword [esp + 0x54]
push str.Unknown
push edi
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x104]
push eax
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x208]
push eax
call fcn.100947a0
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
movzx eax, byte [ebp + 3]
test eax, eax
jg 0x1008f44b
mov eax, dword [ebp + 4]
movzx edx, word [ebp + 0x16]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
lea edx, [esp + 8]
lea ecx, [ebp + 0x18]
mov dword [esp + 0x3c], ecx
lea eax, [ebp + 0xc]
push 4
push eax
push edx
call fcn.10094370
add esp, 0xc
mov ecx, dword [esp + 8]
test ecx, ecx
ja 0x1008f547
mov eax, 0x16
jmp 0x1008f571
lea eax, [ebp + 0x16]
mov dword [esp + 0x38], eax
mov edi, eax
mov eax, 0x16
xor edx, edx
movzx esi, word [edi]
lea eax, [eax + esi + 2]
lea edi, [esi + edi + 2]
add edx, 1
cmp edx, ecx
jb 0x1008f557
mov esi, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
lea edx, [ebp + eax]
add eax, ebx
xor ebx, ebx
mov dword [esp + 0x38], ebx
xor ecx, ecx
mov dword [esp], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
mov esi, dword [esp + 0x2c]
cmp eax, esi
je 0x1008f894
movzx edi, byte [edx]
mov esi, edi
and esi, 0xc0
cmp esi, 0x80
jne 0x1008f5c6
mov esi, dword [esp + 0x58]
movzx eax, byte [edx]
add ebx, 1
and eax, 0x3f
lea ecx, [eax + ecx + 1]
cmp ecx, esi
jae 0x1008f6b9
jmp 0x1008f824
cmp esi, 0xc0
jne 0x1008f5ef
mov edi, dword [esp + 0x58]
movsx eax, byte [edx + 1]
movzx esi, byte [edx]
add ebx, eax
and esi, 0x3f
lea ecx, [esi + ecx + 1]
cmp ecx, edi
jae 0x1008f6b9
jmp 0x1008f725
cmp edi, 0xd
ja case.default.0x1008f5ff
mov esi, dword [edi*4 + 0x100c1c08]
jmp esi
mov edi, dword [esp + 0x54]
push str.Unknown
push edi
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x104]
push eax
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x208]
push eax
call fcn.100947a0
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
mov edi, dword [esp + 0x54]
push str.Unknown
push edi
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x104]
push eax
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x208]
push eax
call fcn.100947a0
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
mov esi, dword [esp + 0x58]
mov eax, dword [edx + 1]
lea ecx, [eax + ecx + 1]
cmp ecx, esi
jae 0x1008f6b9
jmp 0x1008f79f
mov esi, dword [esp + 0x58]
movzx eax, word [edx + 1]
lea ecx, [eax + ecx + 1]
cmp ecx, esi
jae 0x1008f6b9
add edx, 3
mov eax, edx
sub eax, dword [esp + 0x34]
jmp 0x1008f589
mov esi, dword [esp + 0x58]
movzx eax, byte [edx + 1]
lea ecx, [eax + ecx + 1]
cmp ecx, esi
jb 0x1008f725
mov edi, dword [esp + 0x54]
push ebx
push 0x100bcca0
lea eax, [edi + 0x208]
push eax
call fcn.100907f2
add esp, 0xc
mov eax, dword [esp + 0x38]
test eax, eax
je 0x1008f832
mov eax, dword [esp + 4]
push eax
mov edx, dword [esp + 0x3c]
push edx
push edi
call fcn.10094370
add esp, 0xc
mov eax, dword [esp + 4]
mov byte [edi + eax], 0
mov eax, dword [esp + 0x30]
push eax
mov edx, dword [esp + 0x40]
lea ecx, [edi + 0x104]
push edx
push ecx
call fcn.10094370
mov edx, dword [esp + 0x3c]
mov byte [edi + edx + 0x104], 0
xor eax, eax
add esp, 0x4c
pop ebx
pop ebp
pop esi
pop edi
ret
add edx, 2
mov eax, edx
sub eax, dword [esp + 0x34]
jmp 0x1008f589
add ebx, dword [edx + 1]
add edx, 5
mov eax, edx
sub eax, dword [esp + 0x34]
jmp 0x1008f589
movsx eax, word [edx + 1]
add ebx, eax
add edx, 3
mov eax, edx
sub eax, dword [esp + 0x34]
jmp 0x1008f589
movsx eax, byte [edx + 1]
add ebx, eax
add edx, 2
mov eax, edx
sub eax, dword [esp + 0x34]
jmp 0x1008f589
mov edi, dword [edx + 1]
lea esi, [ebp + 0x16]
test edi, edi
jb 0x1008f79f
mov dword [esp], edx
mov dword [esp + 0x28], ebp
xor eax, eax
movzx ebp, word [esi]
lea edx, [esi + 2]
lea esi, [esi + ebp + 2]
add eax, 1
cmp eax, edi
jbe 0x1008f77f
mov dword [esp + 0x3c], edx
mov edx, dword [esp]
mov dword [esp + 0x30], ebp
mov ebp, dword [esp + 0x28]
add edx, 5
mov eax, edx
sub eax, dword [esp + 0x34]
jmp 0x1008f589
mov eax, dword [esp + 0x58]
mov ecx, dword [edx + 4]
cmp eax, ecx
jb 0x1008f850
movzx esi, word [edx + 2]
mov dword [esp + 4], esi
lea eax, [edx + 8]
test esi, esi
lea edx, [edx + esi + 8]
je 0x1008f7d3
mov dword [esp + 0x38], eax
mov eax, edx
sub eax, dword [esp + 0x34]
jmp 0x1008f589
mov edi, dword [esp + 0x54]
push str.Unknown
push edi
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x104]
push eax
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x208]
push eax
call fcn.100947a0
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
add edx, 1
add eax, 1
jmp 0x1008f589
add edx, 1
mov eax, edx
sub eax, dword [esp + 0x34]
jmp 0x1008f589
push str.Unknown
call fcn.10094710
push eax
push str.Unknown
push edi
call fcn.10094370
add esp, 0x10
jmp 0x1008f6f9
mov edi, dword [esp + 0x54]
push str.Unknown
push edi
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x104]
push eax
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x208]
push eax
call fcn.100947a0
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
mov edi, dword [esp + 0x54]
jmp 0x1008f7e2
mov edi, dword [esp + 0x54]
push str.Unknown
push edi
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x104]
push eax
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x208]
push eax
call fcn.100947a0
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
mov edi, dword [esp + 0x54]
push str.Unknown
push edi
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x104]
push eax
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x208]
push eax
call fcn.100947a0
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
mov edi, dword [esp + 0x54]
push str.Unknown
push edi
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x104]
push eax
call fcn.100947a0
push str.Unknown
lea eax, [edi + 0x208]
push eax
call fcn.100947a0
xor eax, eax
add esp, 0x58
pop ebx
pop ebp
pop esi
pop edi
ret
mov edi, dword [esp + 0x54]
jmp 0x1008f3c1
mov ebx, dword [esp + 0x38]
mov eax, dword [esp]
mov esi, dword [esp + 0x58]
mov edi, dword [esp + 0x54]
mov edx, ebp
test edx, edx
mov ebp, ecx
jne 0x1008f370
jmp 0x1008f32c