Function at 0x1001ef60
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x124
mov eax, dword [0x1004f8f4]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
mov ebx, dword [esp + 0x12c]
xor eax, eax
push ebp
mov word [esp + 0x28], ax
mov eax, dword [esp + 0x138]
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
push esi
push edi
test eax, eax
jle 0x1001f053
cmp dword [ebx + 0x28], 0
je 0x1001efb5
mov eax, 0xffffffe4
jmp 0x1001f3fd
push eax
push 0
push dword [ebx + 0x14]
mov dword [ebx + 0x3c], eax
call fcn.1002b800
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.1001c5e0
test eax, eax
jne 0x1001f3ab
mov eax, 0x8f
cmp word [esp + 0x10], ax
je 0x1001efea
or esi, 0xffffffff
jmp 0x1001f3b0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.1001c650
test eax, eax
jne 0x1001f3ab
mov eax, dword [esp + 0x14]
mov esi, 0x1f
push 0x3e
movzx ecx, byte [eax + 4]
add eax, 5
cmp ecx, esi
cmovl esi, ecx
mov ecx, dword [ebx + 0x18]
cmp ecx, 0x4b0
je 0x1001f030
lea edx, [esp + 0x34]
push edx
push esi
push eax
push 0
push ecx
jmp 0x1001f03b
lea ecx, [esp + 0x34]
push ecx
push esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add esi, esi
cmp esi, 0x7e
jae 0x1001f73b
xor eax, eax
mov word [esp + esi + 0x30], ax
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.1001c5e0
test eax, eax
jne 0x1001f3ab
mov eax, dword [esp + 0x10]
mov edx, 0x209
mov esi, 0x409
mov ecx, 0x809
cmp ax, 9
je 0x1001f092
cmp ax, dx
je 0x1001f0ab
cmp ax, si
je 0x1001f092
cmp ax, cx
jne 0x1001f3ab
cmp ax, dx
je 0x1001f0ab
cmp ax, si
je 0x1001f0ab
cmp ax, cx
je 0x1001f0ab
mov esi, 0xfffffff3
jmp 0x1001f3b0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.1001c650
mov esi, eax
test esi, esi
jne 0x1001f3b0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x2c]
push eax
movsx eax, word [esp + 0x1c]
lea edi, [ebx + 4]
push edi
push dword [esp + 0x24]
push eax
push ebx
call fcn.1001f9b0
mov eax, dword [edi]
cmp eax, 8
jl 0x1001f103
cmp dword [esp + 0x18], 0x967
jge 0x1001f103
mov esi, 0xfffffff3
jmp 0x1001f3b0
mov ebp, dword [esp + 0x13c]
cmp eax, 5
jge 0x1001f118
and ebp, 0xfffff7ff
mov dword [ebx + 0x38], ebp
cmp dword [esp + 0x24], 0x20
mov dword [esp + 0x1c], ebp
jne 0x1001f12d
mov esi, 0xffffffe8
jmp 0x1001f3b0
push eax
call fcn.1001ab80
push dword [edi]
mov dword [ebx + 8], eax
call fcn.1001ab40
mov dword [ebx + 0xc], eax
call fcn.10030da0
mov dword [ebx + 0x10], eax
test eax, eax
jne 0x1001f156
mov esi, 0xfffffffe
jmp 0x1001f3b0
lea eax, [ebx + 0x58]
push eax
push dword [ebx + 0x14]
call fcn.1002b1b0
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.1001c5e0
mov esi, eax
test esi, esi
jne 0x1001f213
mov dword [esp + 0x24], 0xff
mov dword [esp + 0x2c], 0x1ae
mov eax, dword [esp + 0x10]
mov esi, 0x85
cmp ax, 0x2f
je 0x1001f5f3
cmp ax, 0x42
jne 0x1001f1e4
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.1001c650
mov esi, eax
test esi, esi
jne 0x1001f213
mov eax, dword [esp + 0x14]
movsx eax, word [eax]
push eax
mov dword [ebx + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1001f1d6
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x18], eax
jmp 0x1001f5c9
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebx + 0x18], eax
jmp 0x1001f5c9
mov edx, ebp
xor ecx, ecx
shr edx, 0xc
and edx, 1
cmp ax, word [esp + 0x24]
sete cl
test cl, dl
je 0x1001f299
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.1001e780
mov esi, eax
test esi, esi
je 0x1001f5c9
js 0x1001f3b0
mov ebp, dword [esp + 0x1c]
cmp dword [edi], 4
jg 0x1001f66a
cmp word [esp + 0x30], 0
jne 0x1001f256
push 0x1f
lea eax, [esp + 0xf4]
push eax
push 0x1f
lea eax, [esp + 0xbc]
push eax
push 0
push 0
push 0
push 0
lea eax, [ebx + 0x84]
push eax
call fcn.10033150
lea ecx, [esp + 0x30]
mov edx, 0x3f
lea esi, [esp + 0xb0]
mov eax, ecx
sub esi, eax
lea ebx, [ebx]
lea eax, [edx + 0x7fffffbf]
test eax, eax
je 0x1001f5fd
movzx eax, word [ecx + esi]
test ax, ax
je 0x1001f5fd
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x1001f270
jmp 0x1001f601
mov edx, ebp
xor ecx, ecx
shr edx, 0xd
and edx, 1
cmp ax, word [esp + 0x2c]
sete cl
test cl, dl
je 0x1001f302
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.1001c650
mov esi, eax
test esi, esi
jne 0x1001f213
cmp word [esp + 0x12], 4
jne 0x1001f2f4
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
and eax, 0xffff0000
cmp eax, 0x4010000
mov eax, dword [esp + 0x20]
jne 0x1001f2f8
mov dword [ebx + 0x4c], eax
inc eax
mov dword [esp + 0x20], eax
jmp 0x1001f5c9
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
jmp 0x1001f5c9
mov ecx, dword [edi]
cmp ecx, 8
jl 0x1001f418
cmp ax, 0x17
jne 0x1001f418
test ebp, 0x2000
je 0x1001f4fa
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.1001c650
mov esi, eax
test esi, esi
jne 0x1001f213
movsx eax, word [esp + 0x12]
push eax
call fcn.10032330
mov dword [ebx + 0x50], eax
test eax, eax
je 0x1001f14c
movsx ecx, word [esp + 0x12]
push ecx
push dword [esp + 0x18]
push eax
call fcn.1003abb0
add esp, 0xc
mov dword [esp + 0x18], esi
lea eax, [esp + 0x18]
push eax
mov eax, dword [ebx + 0x50]
push 6
movsx eax, word [eax]
push eax
call fcn.1003a4b0
test eax, eax
je 0x1001f3ab
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
push 2
call fcn.1003a540
test eax, eax
je 0x1001f3ab
push dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
call fcn.1001df90
test eax, eax
jne 0x1001f5c9
mov esi, 0xfffffff6
push dword [ebx + 0x14]
call fcn.1002ae20
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x1001f3ce
nop
mov edi, dword [eax]
push eax
call fcn.100324b0
mov eax, edi
test edi, edi
jne 0x1001f3c0
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x1001f3db
push eax
call fcn.10030e40
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x1001f3e8
push eax
call fcn.100324b0
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x1001f3f5
push eax
call fcn.100324b0
push ebx
call fcn.100324b0
mov eax, esi
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003a853
add esp, 0x124
ret 0xc
cmp ax, 0xa
je 0x1001f21d
cmp ax, 0x38
je 0x1001f21d
mov edx, 0x204
cmp ax, dx
je 0x1001f21d
mov edx, 0x27e
cmp ax, dx
je 0x1001f21d
mov edx, 0x203
cmp ax, dx
je 0x1001f21d
mov edx, 0xbd
cmp ax, dx
je 0x1001f21d
mov edx, 0xbe
cmp ax, dx
je 0x1001f21d
mov edx, 0x201
cmp ax, dx
je 0x1001f21d
mov edx, 0x205
cmp ax, dx
je 0x1001f21d
mov edx, 0xd6
cmp ax, dx
je 0x1001f21d
mov edx, 0xfd
cmp ax, dx
je 0x1001f21d
mov edx, 0x206
cmp ax, dx
je 0x1001f21d
mov edx, 0x406
cmp ax, dx
je 0x1001f21d
cmp ax, 6
je 0x1001f21d
mov edx, 0x207
cmp ax, dx
je 0x1001f21d
mov edx, 0x221
cmp ax, dx
je 0x1001f21d
mov edx, 0x4bc
cmp ax, dx
je 0x1001f21d
cmp ecx, 5
jl 0x1001f5be
cmp ax, si
jne 0x1001f5be
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.1001c650
mov esi, eax
test esi, esi
jne 0x1001f213
mov eax, dword [esp + 0x14]
movzx ebp, byte [eax + 6]
lea eax, [ebp*2 + 0x3e]
push eax
call fcn.10032330
mov edi, eax
test edi, edi
je 0x1001f14c
mov ecx, dword [esp + 0x14]
lea esi, [edi + 0x38]
push ebp
mov ecx, dword [ecx]
mov dword [edi + 8], ecx
mov dword [edi + 4], ecx
mov ecx, dword [ebx + 0x58]
mov dword [edi + 0xc], ecx
lea ecx, [ebp*2]
mov eax, dword [esp + 0x18]
movsx eax, word [eax + 4]
mov dword [edi + 0x20], eax
mov eax, dword [esp + 0x18]
add eax, 7
push eax
push ecx
push esi
push dword [ebx + 0x18]
push dword [ebx + 4]
call fcn.1001b740
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1001f585
sub esi, ecx
sar esi, 1
cmp esi, 0x1f
jbe 0x1001f59f
xor eax, eax
mov word [edi + 0x76], ax
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x1001f5b3
mov dword [ebx + 0x40], edi
mov dword [esp + 0x28], edi
lea edi, [ebx + 4]
jmp 0x1001f5c9
mov dword [eax], edi
mov dword [esp + 0x28], edi
lea edi, [ebx + 4]
jmp 0x1001f5c9
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.1001d580
lea eax, [ebx + 0x58]
push eax
push dword [ebx + 0x14]
call fcn.1002b1b0
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.1001c5e0
mov esi, eax
test esi, esi
jne 0x1001f213
mov ebp, dword [esp + 0x1c]
jmp 0x1001f187
mov esi, 0xfffffff4
jmp 0x1001f3b0
test edx, edx
jne 0x1001f604
sub ecx, 2
xor eax, eax
mov word [ecx], ax
lea ecx, [esp + 0x30]
mov word [esp + 0x6e], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f615
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 0x3e]
push eax
call fcn.10032330
mov esi, eax
test esi, esi
jne 0x1001f63f
lea esi, [eax - 2]
jmp 0x1001f3b0
lea ecx, [esp + 0x30]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f646
sub ecx, edx
lea eax, [esp + 0x30]
sar ecx, 1
push eax
lea eax, [ecx + 1]
push eax
lea eax, [esi + 0x38]
push eax
call fcn.10018eb0
mov dword [ebx + 0x40], esi
mov edi, dword [ebx + 0x40]
test edi, edi
je 0x1001f689
push ebp
push edi
push ebx
call fcn.1001eb20
mov esi, eax
test esi, esi
jne 0x1001f3b0
mov edi, dword [edi]
test edi, edi
jne 0x1001f671
test ebp, 0x800
je 0x1001f734
lea ebp, [ebx + 0x28]
push ebp
push dword [ebx + 0x10]
push ebx
call fcn.100275e0
mov esi, eax
test esi, esi
jne 0x1001f3b0
cmp dword [ebx + 0x30], eax
je 0x1001f717
push dword [ebx + 0x14]
call fcn.1002aea0
push dword [esp + 0x1c]
push 0x10002060
push dword [ebx + 0x14]
call fcn.1002b520
mov esi, eax
test esi, esi
jne 0x1001f3b0
mov edi, dword [ebp]
mov dword [ebp], eax
lea eax, [ebx + 0x34]
push eax
push dword [ebx + 0x10]
push ebx
call fcn.100275e0
mov esi, eax
mov dword [ebp], edi
test esi, esi
jne 0x1001f3b0
push dword [ebx + 0x14]
call fcn.1002aea0
push dword [esp + 0x1c]
push 0x1000206c
push dword [ebx + 0x14]
call fcn.1002b520
mov esi, eax
test esi, esi
jne 0x1001f3b0
mov eax, dword [ebp]
mov ecx, dword [ebx + 0x40]
mov edx, dword [eax]
test ecx, ecx
je 0x1001f734
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov dword [ecx + 0x14], edx
mov ecx, dword [ecx]
mov edx, dword [edx]
test ecx, ecx
jne 0x1001f723
xor eax, eax
jmp 0x1001f3fd
call fcn.1003b3c8
int3