Function at 0x119f600
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11b6dc1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x103a8
call sub.ntdll.dll__chkstk
push esi
mov dword [ebp - 0x10380], ecx
mov word [ebp - 0xc354], 0
push 0x1fe
push 0
lea eax, [ebp - 0xc352]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10384], ecx
lea edx, [ebp - 0xc354]
mov dword [ebp - 0x10388], edx
mov eax, dword [ebp - 0x10388]
mov dword [ebp - 0x1038c], eax
mov ecx, dword [ebp - 0x10384]
mov dx, word [ecx]
mov word [ebp - 0x1038e], dx
mov eax, dword [ebp - 0x10388]
mov cx, word [ebp - 0x1038e]
mov word [eax], cx
mov edx, dword [ebp - 0x10384]
add edx, 2
mov dword [ebp - 0x10384], edx
mov eax, dword [ebp - 0x10388]
add eax, 2
mov dword [ebp - 0x10388], eax
cmp word [ebp - 0x1038e], 0
jne 0x119f66b
mov ecx, dword [ebp - 0x10380]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ecx + 8]
push eax
mov ecx, dword [ebp - 0x10380]
mov edx, dword [ecx]
push edx
call fcn.011771b0
mov dword [ebp - 0x408c], eax
push 1
push 0
mov eax, dword [ebp - 0x10380]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [eax + 8]
push edx
mov eax, dword [ebp - 0x10380]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x4074]
call fcn.01195a00
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x80f4]
call fcn.0117ac90
mov byte [ebp - 4], 1
push 0
lea edx, [ebp - 0x80f4]
push edx
push 0
push 3
lea ecx, [ebp - 0x4074]
call fcn.01197550
test eax, eax
jne 0x119f7a1
call fcn.010947d0
mov dword [ebp - 0x10394], eax
push 0x5a
push 0x1016e34
call fcn.0119f4e0
push eax
push 0x1016e04
mov eax, dword [ebp - 0x10394]
push eax
mov ecx, dword [ebp - 0x10394]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
mov dword [ebp - 0x10368], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80f4]
call fcn.0117aea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4074]
call fcn.01195a90
mov eax, dword [ebp - 0x10368]
jmp 0x119fe19
push 0x60
lea ecx, [ebp - 0x80f4]
call fcn.0117ba20
mov dword [ebp - 0x4080], eax
cmp dword [ebp - 0x4080], 0
jne 0x119f951
mov byte [ebp - 0x1035c], 0
push 0x3fff
push 0
lea ecx, [ebp - 0x1035b]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x10380]
mov eax, dword [edx]
push eax
call fcn.0118a250
mov dword [ebp - 0xc35c], eax
cmp dword [ebp - 0xc35c], 0x200
jne 0x119f81e
mov ecx, dword [ebp - 0x408c]
push ecx
push 0x10169a0
lea edx, [ebp - 0x1035c]
push edx
call sub.ntdll.dll_memcpy
add esp, 0xc
jmp 0x119f8b1
cmp dword [ebp - 0xc35c], 0x1000
jne 0x119f847
mov eax, dword [ebp - 0x408c]
push eax
push 0x10159a0
lea ecx, [ebp - 0x1035c]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
jmp 0x119f8b1
call fcn.010947d0
mov dword [ebp - 0x10398], eax
push 0x6e
push 0x1016e34
call fcn.0119f4e0
push eax
push 0x1016ea0
mov edx, dword [ebp - 0x10398]
push edx
mov eax, dword [ebp - 0x10398]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
add esp, 0xc
mov dword [ebp - 0x1036c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80f4]
call fcn.0117aea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4074]
call fcn.01195a90
mov eax, dword [ebp - 0x1036c]
jmp 0x119fe19
push 0
push 0
push 3
mov eax, dword [ebp - 0x408c]
push eax
lea ecx, [ebp - 0x1035c]
push ecx
lea ecx, [ebp - 0x80f4]
call fcn.0117b2a0
test eax, eax
jne 0x119f93e
call fcn.010947d0
mov dword [ebp - 0x1039c], eax
push 0x74
push 0x1016e34
call fcn.0119f4e0
push eax
push 0x1016dc8
mov edx, dword [ebp - 0x1039c]
push edx
mov eax, dword [ebp - 0x1039c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
add esp, 0xc
mov dword [ebp - 0x10370], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80f4]
call fcn.0117aea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4074]
call fcn.01195a90
mov eax, dword [ebp - 0x10370]
jmp 0x119fe19
push 0x60
lea ecx, [ebp - 0x80f4]
call fcn.0117ba20
mov dword [ebp - 0x4080], eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xc154]
call fcn.0117ac90
mov byte [ebp - 4], 2
lea eax, [ebp - 0xc154]
push eax
lea ecx, [ebp - 0x80f4]
call fcn.0117b6f0
mov ecx, dword [ebp - 0x4080]
mov dword [ebp - 0x4090], ecx
mov edx, dword [ebp - 0x4090]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x4088], eax
lea ecx, [ebp - 0xc354]
mov dword [ebp - 0x103a0], ecx
mov edx, dword [ebp - 0x103a0]
add edx, 2
mov dword [ebp - 0x103a4], edx
mov eax, dword [ebp - 0x103a0]
mov cx, word [eax]
mov word [ebp - 0x103a6], cx
add dword [ebp - 0x103a0], 2
cmp word [ebp - 0x103a6], 0
jne 0x119f9b2
mov edx, dword [ebp - 0x103a0]
sub edx, dword [ebp - 0x103a4]
sar edx, 1
mov dword [ebp - 0x103ac], edx
mov eax, dword [ebp - 0x103ac]
shl eax, 1
mov ecx, dword [ebp - 0x4090]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x4090]
mov dword [edx + 4], 0x18
mov eax, dword [ebp - 0x4090]
cmp dword [eax + 0x10], 0
jbe 0x119fa44
mov ecx, dword [ebp - 0x4090]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x4090]
add edx, dword [eax + 0x10]
mov ecx, dword [ebp - 0x4090]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x4090]
mov eax, dword [edx + 4]
add eax, 7
and eax, 0xfffffff8
mov ecx, dword [ebp - 0x4090]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x4090]
movzx eax, word [edx + 0x14]
add eax, dword [ebp - 0x4080]
mov dword [ebp - 0x4084], eax
mov ecx, dword [ebp - 0x4090]
mov edx, dword [ecx + 0x10]
push edx
lea eax, [ebp - 0xc354]
push eax
mov ecx, dword [ebp - 0x4084]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
push 0x60
lea ecx, [ebp - 0xc154]
call fcn.0117ba20
mov dword [ebp - 0x409c], eax
mov edx, dword [ebp - 0x4090]
mov eax, dword [ebp - 0x409c]
mov ecx, dword [edx + 4]
sub ecx, dword [eax + 4]
mov dword [ebp - 0x4078], ecx
lea ecx, [ebp - 0x80f4]
call fcn.01173bc0
mov dword [ebp - 0x407c], eax
mov edx, dword [ebp - 0x407c]
mov eax, dword [edx + 0x18]
add eax, dword [ebp - 0x4078]
mov ecx, dword [ebp - 0x407c]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 0x409c]
mov dword [ebp - 0x4014], edx
mov eax, dword [ebp - 0x4090]
mov dword [ebp - 0xc358], eax
mov ecx, dword [ebp - 0x4090]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x4098], edx
mov eax, dword [ebp - 0x409c]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x80fc], ecx
mov edx, dword [ebp - 0x4014]
add edx, dword [ebp - 0x80fc]
mov eax, dword [edx]
mov dword [ebp - 0x4010], eax
cmp dword [ebp - 0x4010], 0xffffffff
je 0x119fb9c
mov ecx, dword [ebp - 0x4014]
add ecx, dword [ebp - 0x80fc]
mov dword [ebp - 0x10360], ecx
mov edx, dword [ebp - 0x10360]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x10360]
push ecx
mov edx, dword [ebp - 0xc358]
add edx, dword [ebp - 0x4098]
push edx
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x10360]
mov ecx, dword [ebp - 0x4098]
add ecx, dword [eax + 4]
mov dword [ebp - 0x4098], ecx
mov edx, dword [ebp - 0x10360]
mov eax, dword [ebp - 0x80fc]
add eax, dword [edx + 4]
mov dword [ebp - 0x80fc], eax
mov ecx, dword [ebp - 0x4014]
add ecx, dword [ebp - 0x80fc]
mov edx, dword [ecx]
mov dword [ebp - 0x4010], edx
jmp 0x119fb18
mov eax, dword [ebp - 0xc358]
add eax, dword [ebp - 0x4098]
mov dword [ebp - 0x4094], eax
mov ecx, dword [ebp - 0x4094]
mov dword [ecx], 0xffffffff
mov dword [ecx + 4], 0
mov byte [ebp - 0x400c], 0
push 0x3fff
push 0
lea edx, [ebp - 0x400b]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x408c]
push eax
lea ecx, [ebp - 0x80f4]
call fcn.01173bc0
push eax
lea ecx, [ebp - 0x400c]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
lea edx, [ebp - 0x400c]
mov dword [ebp - 0x80f8], edx
mov dword [ebp - 0x10364], 0
jmp 0x119fc27
mov eax, dword [ebp - 0x10364]
add eax, 1
mov dword [ebp - 0x10364], eax
mov ecx, dword [ebp - 0x80f8]
movzx edx, word [ecx + 6]
sub edx, 1
cmp dword [ebp - 0x10364], edx
jge 0x119fc9e
mov eax, dword [ebp - 0x10364]
add eax, 1
shl eax, 9
mov ecx, dword [ebp - 0x80f8]
movzx edx, word [ecx + 4]
add edx, dword [ebp - 0x80f8]
mov ecx, dword [ebp - 0x10364]
mov esi, dword [ebp - 0x80f8]
mov ax, word [esi + eax - 2]
mov word [edx + ecx*2 + 2], ax
mov ecx, dword [ebp - 0x80f8]
movzx edx, word [ecx + 4]
mov eax, dword [ebp - 0x10364]
add eax, 1
shl eax, 9
mov ecx, dword [ebp - 0x80f8]
mov esi, dword [ebp - 0x80f8]
mov dx, word [esi + edx]
mov word [ecx + eax - 2], dx
jmp 0x119fc18
push 0
mov eax, dword [ebp - 0x408c]
push eax
lea ecx, [ebp - 0x400c]
push ecx
push 0
push 3
lea ecx, [ebp - 0x4074]
call fcn.011977c0
test eax, eax
jne 0x119fd3d
call fcn.010947d0
mov dword [ebp - 0x103b0], eax
push 0xc3
push 0x1016e34
call fcn.0119f4e0
push eax
push 0x1016e80
mov edx, dword [ebp - 0x103b0]
push edx
mov eax, dword [ebp - 0x103b0]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
add esp, 0xc
mov dword [ebp - 0x10374], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc154]
call fcn.0117aea0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80f4]
call fcn.0117aea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4074]
call fcn.01195a90
mov eax, dword [ebp - 0x10374]
jmp 0x119fe19
push 1
mov eax, dword [ebp - 0x408c]
push eax
lea ecx, [ebp - 0x400c]
push ecx
push 0
push 3
lea ecx, [ebp - 0x4074]
call fcn.011977c0
test eax, eax
jne 0x119fdd9
call fcn.010947d0
mov dword [ebp - 0x103b4], eax
push 0xca
push 0x1016e34
call fcn.0119f4e0
push eax
push 0x1016e58
mov edx, dword [ebp - 0x103b4]
push edx
mov eax, dword [ebp - 0x103b4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
add esp, 0xc
mov dword [ebp - 0x10378], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc154]
call fcn.0117aea0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80f4]
call fcn.0117aea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4074]
call fcn.01195a90
mov eax, dword [ebp - 0x10378]
jmp 0x119fe19
mov dword [ebp - 0x1037c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc154]
call fcn.0117aea0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80f4]
call fcn.0117aea0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4074]
call fcn.01195a90
mov eax, dword [ebp - 0x1037c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4