Function at 0x1000719d
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x38
mov eax, dword [esp + 0x40]
push ebx
xor ebx, ebx
push ebp
mov dword [eax], ebx
mov eax, dword [esp + 0x4c]
push esi
mov esi, dword [0x1000f5a8]
mov dword [eax], ebx
push edi
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x28]
push eax
mov ecx, edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call fcn.100065a6
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
push 0x69
add ecx, esi
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
call fcn.10005fa3
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1000610d
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.100065a6
mov ecx, dword [esp + 0x14]
call fcn.1000ad9b
push 0x18
pop edx
lea ecx, [esp + 0x3c]
call fcn.1000653a
lea ecx, [esp + 0x30]
push 3
pop edx
mov ebp, eax
call fcn.1000653a
mov esi, eax
test esi, esi
je 0x1000725c
push esi
call fcn.1000aea6
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
push 0xe
pop edx
lea ecx, [esp + 0x30]
call fcn.1000653a
mov esi, eax
test esi, esi
je 0x1000727c
push esi
call fcn.1000aea6
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
push 0x10
pop edx
lea ecx, [esp + 0x30]
call fcn.1000653a
mov edi, eax
test edi, edi
je 0x1000729c
push edi
call fcn.1000aea6
mov esi, dword [edi]
push 1
mov ecx, edi
call dword [esi]
push 0x18
pop edx
lea ecx, [esp + 0x30]
call fcn.1000653a
mov esi, eax
test esi, esi
je 0x100072bc
push esi
call fcn.1000aea6
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
push ecx
lea ecx, [esp + 0x34]
call fcn.10006556
mov ecx, eax
test ecx, ecx
je 0x100072ed
mov edx, 0x2328
call fcn.10006589
mov esi, eax
test esi, esi
je 0x100072ed
push esi
add ecx, 0x14
call fcn.1000aea6
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
test ebp, ebp
je 0x10007305
push ebp
lea ecx, [esp + 0x40]
call fcn.1000aea6
lea ecx, [esp + 0x30]
push ebp
call fcn.1000aed5
lea ecx, [esp + 0x3c]
call fcn.1000ae8d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x18], eax
push ecx
lea ecx, [esp + 0x34]
call fcn.10006556
mov ebp, dword [eax + 0x14]
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x1000739b
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x20], eax
test eax, eax
je 0x1000738e
mov ebp, eax
mov ebx, dword [ebp + 0x28]
mov edi, dword [ebp + 0x2c]
push 0
push dword [edi + ebx - 4]
lea edx, [edi - 8]
push dword [edi + ebx - 8]
mov ecx, ebx
call fcn.1000b235
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlRandom]
mov dword [edi + ebx - 8], eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlRandom]
lea edx, [edi - 8]
push 1
push eax
push dword [edi + ebx - 8]
mov ecx, ebx
mov dword [edi + ebx - 4], eax
call fcn.1000b235
mov ebp, dword [ebp + 8]
test ebp, ebp
jne 0x1000733a
mov ebp, dword [esp + 0x14]
mov ebp, dword [ebp + 8]
mov dword [esp + 0x14], ebp
test ebp, ebp
jne 0x1000732d
xor ebx, ebx
lea edx, [esp + 0x14]
lea ecx, [esp + 0x30]
call fcn.10006959
mov ecx, dword [esp + 0x14]
call fcn.1000ad8b
push dword [esp + 0x14]
mov esi, eax
xor dl, dl
mov ecx, esi
call fcn.1000ad73
mov edx, esi
push dword [esp + 0x24]
push ecx
lea ecx, [esp + 0x38]
call fcn.10006b09
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
push esi
call fcn.10006e9c
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x50]
mov dword [ecx], eax
mov eax, dword [esp + 0x20]
mov ecx, esi
mov dword [edi], eax
call fcn.1000ad9b
mov edi, dword [edi]
mov ecx, 0x14c
mov eax, dword [edi + 0x3c]
add eax, edi
cmp word [eax + 4], cx
jne 0x10007470
movzx esi, word [eax + 6]
mov edx, dword [eax + 0x28]
movzx ecx, word [eax + 0x14]
test esi, esi
je 0x10007470
add ecx, 0x24
add ecx, eax
cmp dword [ecx], edx
ja 0x10007436
mov eax, dword [ecx - 4]
add eax, dword [ecx]
cmp eax, edx
ja 0x10007440
inc ebx
add ecx, 0x28
cmp ebx, esi
jb 0x10007429
jmp 0x10007470
mov esi, dword [ecx + 8]
sub esi, dword [ecx]
lea eax, [esp + 0x18]
add esi, edx
add esi, edi
push eax
mov bl, byte [esi]
call dword [sym.imp.ntdll.dll_RtlRandom]
cmp bl, 0x53
jne 0x10007470
mov cl, byte [esi + 1]
add esi, 2
jmp 0x1000746b
mov dword [esi], eax
mov cl, byte [esi + 4]
lea esi, [esi + 5]
cmp cl, 0xb8
je 0x10007463
lea ecx, [esp + 0x30]
call fcn.1000ae8d
xor eax, eax
pop edi
pop esi
pop ebp
inc eax
pop ebx
add esp, 0x38
ret 0xc