Function at 0x11c9ded
Capabilities:
Check for peb ntglobalflag flag
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
jmp 0x11c9c92
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
mov eax, dword [esi]
mov ebx, dword [eax + 8]
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x78]
add eax, ebx
mov edx, 0
mov eax, dword [eax + 0x20]
add eax, ebx
mov esi, dword [eax]
add esi, ebx
call 0x11c9ccf
inc edi
je 0x11c9d14
jb 0x11c9d35
arpl word [ecx + 0x64], ax
jb 0x11c9d31
jae 0x11c9d41
add byte [edi - 0x47], bl
sldt word [eax]
add bl, dh
cmpsb byte [esi], byte es:[edi]
je 0x11c9cdf
add eax, 4
inc edx
jne 0x11c9cb7
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x78]
add eax, ebx
mov eax, dword [eax + 0x24]
add eax, ebx
movzx edx, word [eax + edx*2]
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x78]
add eax, ebx
mov eax, dword [eax + 0x1c]
add eax, ebx
mov esi, dword [eax + edx*4]
add esi, ebx
call 0x11c9d18
push esi
imul esi, dword [edx + 0x74], 0x416c6175
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
push ebx
call esi
call 0x11c9d20
pop edi
cmp dword [edi - 0x1bdc], 1
je 0x11c9d7e
mov dword [edi - 0x1bd8], eax
push 0x40
inc eax
push 0x1000
add byte [eax], al
push dword [edi - 0x1c5b]
push 0
call dword [edi - 0x1bd8]
mov dword [edi - 0x1bc4], eax
push eax
push edi
push esi
push ebx
add esp, 0xc
pop dword [edi - 0x1bcc]
test eax, eax
jne 0x11c9d74
sub ah, ah
invalid
call 0x11c9d6d
inc ebp
js 0x11c9dcd
je 0x11c9db6
jb 0x11c9dd7
arpl word [ebp + 0x73], sp
jae 0x11c9d6d
push ebx
call esi
push 0
call eax
mov dword [edi - 0x1bdc], 1
call 0x11c9d9e
inc ebx
push 0x526b6365
insd dword es:[edi], dx
outsd dx, dword [esi]
je 0x11c9df3
inc esp
bound esi, qword gs:[ebp + 0x67]
jb 0x11c9de7
jb 0x11c9dfe
jae 0x11c9e00
outsb dx, byte [esi]
je 0x11c9d9e
push ebx
call esi
mov edi, eax
test edi, edi
je 0x11c9df4
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], 0
call 0x11c9dc9
inc edi
je 0x11c9dfe
add byte [edi + 0x65], al
je 0x11c9dfe
jne 0x11c9e2f
jb 0x11c9e24
outsb dx, byte [esi]
je 0x11c9e12
jb 0x11c9e33
arpl word [ebp + 0x73], sp
jae 0x11c9dc9
push ebx
call esi
call eax
push eax
call edi
rcl byte [eax - 1]
xlatb
test eax, eax
je 0x11c9e2c
mov eax, dword [ebp - 4]
cld
test eax, eax
je 0x11c9e2c
call 0x11c9ded
inc ebp
js 0x11c9e4d
je 0x11c9e36
jb 0x11c9e57
outsd dx, dword [esi]
arpl word [ebp + 0x73], sp
jae 0x11c9ded
push ebx
call esi
push 0
call eax
shr al, 1
adc al, byte [eax]
add byte [eax], al
call 0x11c9e0b
dec ecx
jae 0x11c9e40
bound esi, qword gs:[ebp + 0x67]
jne 0x11c9e67
jb 0x11c9e54
jb 0x11c9e6b
jae 0x11c9e6d
outsb dx, byte [esi]
je 0x11c9e0b
push ebx
call esi
call eax
test eax, eax
je 0x11c9e2c
call 0x11c9e25
inc ebp
js 0x11c9e85
je 0x11c9e6e
jb 0x11c9e8f
arpl word [ebp + 0x73], sp
jae 0x11c9e25
add byte [ebx - 1], dl
salc
push ebx
call esi
push 0
call eax
jmp 0x11c9e3c
dec ebp
push eax
jb 0x11c9ea2
je 0x11c9e9a
arpl word [eax + 0x65], si
outsb dx, byte [esi]
je 0x11c9e58
outsb dx, byte gs:[esi]
add byte fs:[esi - 0x75], bl
in eax, 0x5d
pop esi
mov esp, ebp
pop ebp
ret 0xc
jb 0x11c9ebe
je 0x11c9eb6
arpl word [eax + 0x62], si
imul ebp, dword gs:[bp + 3], 0xfc45c7
bound esp, qword [ebp + 0x67]
imul ebp, dword [esi + 3], 0xfc45c7
outsb dx, byte [esi]
add eax, edi
inc ebp
cld
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx + 0x30], ah
add byte [eax], al
add byte [eax + 0x40], al
mov eax, dword fs:[0x30]
inc eax
inc eax
mov eax, dword [eax]
and eax, 0xff
add byte [eax], al
add byte [ecx + 0x458bfc45], cl
cld
add byte [eax], al
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 1
jne 0x11c9e93
call 0x11c9e8c
inc ebp
js 0x11c9eec
je 0x11c9ed5
jb 0x11c9ef6
arpl word [ebp + 0x73], sp
jae 0x11c9e8c
push ebx
call esi
push 0
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
inc eax
or al, 0x8b
jo 0x11c9ebb
mov eax, dword [esi]
mov ebx, dword [eax + 8]
mov eax, dword [ebx + 0x3c]
add eax, ebx
pop eax
or byte [ebx - 0x3cfcc3bd], cl
mov eax, dword [eax + 0x78]
add eax, ebx
mov edx, 0
mov eax, dword [eax + 0x20]
add eax, ebx
mov esi, dword [eax]
add esi, ebx
call 0x11c9ed0
call 0x11c9ed0
add byte [eax], al
add byte [edi + 0x65], al
je 0x11c9f15
inc edi
je 0x11c9f15
jb 0x11c9f36
arpl word [ecx + 0x64], ax
jb 0x11c9f32
jae 0x11c9f42
add byte [edi - 0x47], bl
sldt word [eax]
add bl, dh
cmpsb byte [esi], byte es:[edi]
je 0x11c9ee0
add eax, 4
inc edx
jne 0x11c9eb8
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x78]
add eax, ebx
mov eax, dword [eax + 0x24]
add eax, ebx
movzx edx, word [eax + edx*2]
mov eax, dword [ebx + 0x3c]
and al, 3
ret
add eax, ebx
mov eax, dword [eax + 0x78]
add eax, ebx
mov eax, dword [eax + 0x1c]
add eax, ebx
mov esi, dword [eax + edx*4]
add esi, ebx
jmp 0x11c9f17
add byte fs:[esi - 0x75], bl
in eax, 0x5d
pop esi
mov esp, ebp
pop ebp
ret 0xc
imul ebp, dword [esi + 3], 0xfc45c7
add byte [eax], al
add byte [ecx + 0x30], ah
add byte [eax], al
add byte [ebx - 0x1f7c97c0], cl
jo 0x11c9ed2
inc ebp
cld
add byte [eax], al
add byte [eax], al
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x68]
and eax, 0x70
mov dword [ebp - 4], eax
inc ebp
cld
mov eax, dword [ebp - 4]
cmp eax, 1
jne 0x11c9f6b
call 0x11c9f64
inc ebp
js 0x11c9fc4
je 0x11c9fad
jb 0x11c9fce
arpl word [ebp + 0x73], sp
jae 0x11c9f64
push ebx
call esi
push 0
call eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
mov eax, dword [esi]
mov ebx, dword [eax + 8]
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x78]
add eax, ebx
mov edx, 0
mov eax, dword [eax + 0x20]
add eax, ebx
mov esi, dword [eax]
add esi, ebx
call 0x11c9fa8
inc edi
je 0x11c9fed
jb 0x11ca00e
arpl word [ecx + 0x64], ax
jb 0x11ca00a
jae 0x11ca01a
add byte [edi - 0x47], bl
sldt word [eax]
add bl, dh
cmpsb byte [esi], byte es:[edi]
je 0x11c9fb8
add eax, 4
inc edx
jne 0x11c9f90
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x78]
add eax, ebx
mov eax, dword [eax + 0x24]
add eax, ebx
movzx edx, word [eax + edx*2]
mov eax, dword [ebx + 0x3c]
and al, 3
ret
add eax, ebx
mov eax, dword [eax + 0x78]
add eax, ebx
mov eax, dword [eax + 0x1c]
add eax, ebx
mov esi, dword [eax + edx*4]
add esi, ebx
jmp 0x11c9fef
add byte fs:[esi - 0x75], bl
in eax, 0x5d
pop esi
mov esp, ebp
pop ebp
ret 0xc
add byte [eax + eax], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax], 0
add byte [eax + 0x800080], al
add byte [eax], al
add byte [eax], 0x80
add byte [eax - 0x7fffff80], al
add byte [eax - 0x3f3f4000], 0
add byte [eax], al
inc dword [eax]
add bh, bh
add byte [eax], al
add bh, bh
inc dword [eax]
inc dword [eax]
add byte [eax], al
inc dword [eax]
inc dword [eax]
invalid