Function at 0x1119a3f0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x111ea62b
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x11279148]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.111998b0
push str.Kernel32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 0x244], ebx
test ebx, ebx
je 0x1119a50b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push ebx
call edi
push str.Process32First
push ebx
mov dword [ebp - 0x250], eax
call edi
mov ebx, eax
mov eax, dword [ebp - 0x244]
push str.Process32Next
push eax
call edi
mov ecx, dword [ebp - 0x244]
push str.Heap32ListFirst
push ecx
mov dword [ebp - 0x254], eax
call edi
mov edx, dword [ebp - 0x244]
push str.Heap32ListNext
push edx
mov dword [ebp - 0x268], eax
call edi
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x244]
push str.Heap32First
push eax
call edi
mov ecx, dword [ebp - 0x244]
push str.Heap32Next
push ecx
mov dword [ebp - 0x260], eax
call edi
cmp dword [ebp - 0x254], 0
mov dword [ebp - 0x25c], eax
je 0x1119a4fe
test ebx, ebx
je 0x1119a4fe
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x1119a4fe
push 0
push 0xf
call eax
mov dword [ebp - 0x24c], eax
cmp eax, 0xffffffff
jne 0x1119a529
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateToolhelp32Snapshot_failed___d__r_n
call fcn.111bd7b0
add esp, 8
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.111d9022
mov esp, ebp
pop ebp
ret
push 0x10c00
call fcn.11170a40
mov ecx, dword [ebp - 0x24c]
mov dword [esi + 8], eax
mov byte [eax], 0
mov edi, dword [esi + 8]
add esp, 4
lea eax, [ebp - 0x23c]
mov dword [edi], 1
push eax
add edi, 0xc
push ecx
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x23c], 0x22c
call ebx
test eax, eax
je 0x1119a755
mov edx, dword [ebp - 0x234]
mov ecx, dword [esi + 8]
push 0x10c00
push edx
lea eax, [ebp - 0x240]
push eax
push ecx
mov ebx, edi
mov ecx, esi
mov dword [ebp - 0x258], ebx
call fcn.111991e0
test eax, eax
je 0x1119a6dd
lea edx, [ebp - 0x218]
push 0x5c
push edx
call dword [sym.imp.MSVCR100.dll_wcsrchr]
add esp, 8
test eax, eax
jne 0x1119a5bc
lea eax, [ebp - 0x218]
jmp 0x1119a5bf
add eax, 2
mov ecx, dword [esi + 0xc]
push ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.111bb8e0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 4], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1119a5e0
mov ecx, dword [esi + 8]
push 0x10c00
sub eax, edx
push eax
lea eax, [ebp - 0x240]
push eax
push ecx
mov ecx, esi
call fcn.111991e0
test eax, eax
je 0x1119a6f5
mov edx, dword [ebp - 0x248]
mov ecx, dword [esi + 8]
push 0x10c00
push edx
lea eax, [ebp - 0x240]
push eax
push ecx
mov ecx, esi
call fcn.11199210
test eax, eax
je 0x1119a711
mov edx, dword [ebp - 0x234]
push edx
push 1
call dword [ebp - 0x250]
mov edi, eax
xor ebx, ebx
cmp edi, 0xffffffff
je 0x1119a65d
lea ecx, [ebp - 0x268]
call fcn.11198e30
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1119a671
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateToolhelp32Snapshot_failed___d__r_n
call fcn.111bd7b0
add esp, 8
mov ecx, dword [esi + 8]
push 0x10c00
push ebx
lea eax, [ebp - 0x240]
push eax
push ecx
mov ecx, esi
call fcn.111991e0
test eax, eax
je 0x1119a72d
mov eax, dword [ebp - 0x24c]
inc dword [esi + 4]
lea edx, [ebp - 0x23c]
push edx
push eax
mov dword [ebp - 0x23c], 0x22c
call dword [ebp - 0x254]
mov ecx, dword [ebp - 0x248]
push ecx
mov edi, eax
mov dword [ebp - 4], 0xffffffff
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
test edi, edi
mov edi, dword [ebp - 0x240]
jne 0x1119a570
jmp 0x1119a755
mov edi, dword [ebp - 0x240]
mov edx, ebx
sub edx, edi
push edx
push 0
push ebx
call sub.MSVCR100.dll_memset
add esp, 0xc
jmp 0x1119a755
mov edi, dword [ebp - 0x240]
mov eax, ebx
sub eax, edi
push eax
push 0
push ebx
call sub.MSVCR100.dll_memset
mov ecx, dword [ebp - 0x248]
push ecx
jmp 0x1119a74d
mov edi, dword [ebp - 0x240]
mov edx, ebx
sub edx, edi
push edx
push 0
push ebx
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0x248]
push eax
jmp 0x1119a74d
mov eax, dword [ebp - 0x258]
mov edi, dword [ebp - 0x240]
mov ecx, eax
sub ecx, edi
push ecx
push 0
push eax
call sub.MSVCR100.dll_memset
mov edx, dword [ebp - 0x248]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 0x10
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp dword [esi + 4], ebx
jle 0x1119a799
lea esp, [esp]
mov edx, dword [esi + 8]
push 0x10c00
push 0xffffffffffffffff
lea ecx, [ebp - 0x240]
push ecx
push edx
mov ecx, esi
call fcn.111991e0
test eax, eax
je 0x1119a793
inc ebx
cmp ebx, dword [esi + 4]
jl 0x1119a770
mov edi, dword [ebp - 0x240]
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esi + 8]
sub edi, eax
mov dword [eax + 4], edi
mov ecx, dword [esi + 4]
mov dword [eax + 8], ecx
mov eax, 1
jmp 0x1119a50d