Function at 0x12eb7c90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x130650a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x30]
push ebx
push esi
mov esi, ecx
push 1
mov dword [esp + 0x18], esi
lea ecx, [esi + 0x10]
mov dword [eax], 0
push ecx
lea ecx, [esp + 0x20]
call fcn.12f560a0
mov ebx, dword [esi + 4]
mov esi, dword [esi + 8]
test ebx, ebx
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], esi
je 0x12eb7ffd
test esi, esi
jle 0x12eb7ffd
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov eax, dword [0x13198f68]
test eax, eax
mov dword [esp + 0x18], ebp
je 0x12eb7d17
push esi
push 0x1313ac70
push str.PrintRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
cmp esi, 0x270
jb 0x12eb7fdc
jmp 0x12eb7d29
mov ebp, dword [esp + 0x18]
mov ecx, dword [ebx]
mov eax, dword [0x13198f68]
xor edx, edx
cmp ecx, 0x50505632
sete dl
test eax, eax
mov esi, edx
je 0x12eb7d56
push esi
push 0x1313ac2c
push str.PrintRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
test esi, esi
je 0x12eb7fdc
mov eax, dword [0x13198f68]
xor edi, edi
test eax, eax
je 0x12eb7d88
mov eax, dword [ebx + 4]
cmp eax, ebp
sbb ecx, ecx
neg ecx
push ecx
push eax
push 0x1313abe0
push str.PrintRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov eax, dword [ebx + 4]
test eax, eax
je 0x12eb7d97
cmp eax, ebp
jb 0x12eb7f0c
call fcn.12e6ef90
mov esi, eax
mov eax, dword [0x13198f68]
test eax, eax
je 0x12eb7dc0
mov edx, dword [ebx + 8]
push edx
push esi
push 0x1313ab94
push str.PrintRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
mov eax, dword [ebx + 8]
test eax, eax
je 0x12eb7dcf
test esi, esi
je 0x12eb7f0c
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1c]
lea esi, [eax + 4]
add eax, 0x414
push eax
push esi
push ebx
call fcn.12eb7b80
mov ebp, eax
mov eax, dword [0x13198f68]
test eax, eax
je 0x12eb7e09
push esi
push ebx
push ebp
push 0x1313ab40
push str.PrintRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x18
test ebp, ebp
je 0x12eb7f0c
mov eax, dword [ebx + 0xc]
mov ecx, dword [0x13198f68]
mov esi, eax
and esi, 3
test ecx, ecx
je 0x12eb7e39
push eax
push esi
push 0x1313aaf4
push str.PrintRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x14
cmp esi, 3
je 0x12eb7f0c
cmp esi, 2
mov dword [esp + 0x10], 1
je 0x12eb7f08
mov ecx, ebx
call fcn.12eb8090
mov edx, dword [ebx + 0x248]
mov ebp, dword [ebx + 0x24c]
mov ecx, dword [ebx + 0x1bc]
mov edi, dword [ebx + 0x1e8]
mov esi, dword [ebx + 0x1ec]
add edx, ebp
mov ebp, dword [ebx + 0x21c]
add edx, edi
lea eax, [eax + ecx*2 + 2]
mov ecx, dword [ebx + 0x218]
add edx, esi
add edx, ecx
add edx, ebp
lea ecx, [edx + edx + 0xc]
sub ecx, ebx
add ecx, eax
push ecx
call fcn.12f5bf8b
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x12eb7f08
mov ecx, ebx
call fcn.12eb8090
mov edx, dword [ebx + 0x1bc]
mov ecx, dword [ebx + 0x248]
mov edi, dword [ebx + 0x1e8]
mov esi, dword [ebx + 0x1ec]
lea eax, [eax + edx*2 + 2]
mov edx, dword [ebx + 0x24c]
add ecx, edx
mov edx, dword [ebx + 0x218]
add ecx, edi
mov edi, dword [ebx + 0x21c]
add ecx, esi
mov esi, ebx
add ecx, edx
add ecx, edi
mov edi, ebp
lea ecx, [ecx + ecx + 0xc]
sub ecx, ebx
add ecx, eax
mov eax, dword [esp + 0x40]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [eax], ebp
mov edi, dword [esp + 0x10]
mov eax, dword [0x13198f68]
test eax, eax
je 0x12eb7f2a
push edi
push 0x1313aaac
push str.PrintRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
test edi, edi
jne 0x12eb7fdc
mov ecx, ebx
call fcn.12eb8090
mov ecx, dword [ebx + 0x1bc]
mov edx, dword [ebx + 0x248]
mov edi, dword [ebx + 0x21c]
mov esi, dword [ebx + 0x218]
lea eax, [eax + ecx*2 + 2]
mov ecx, dword [ebx + 0x24c]
mov ebp, dword [ebx + 0x1e8]
lea edx, [edx + ecx + 6]
mov ecx, dword [ebx + 0x1ec]
add edx, edi
add edx, esi
mov esi, dword [esp + 0x14]
add edx, ecx
mov ecx, ebx
add edx, ebp
shl edx, 1
sub ecx, edx
sub ecx, eax
add esi, ecx
mov ecx, ebx
mov dword [esp + 0x14], esi
call fcn.12eb8030
mov edx, dword [ebx + 0x1b8]
mov ecx, dword [ebx + 0x248]
mov ebp, dword [ebx + 0x24c]
mov edi, dword [ebx + 0x1e8]
add ecx, ebp
mov ebp, dword [ebx + 0x218]
lea eax, [eax + edx*2 + 2]
mov edx, dword [ebx + 0x1ec]
add ecx, edi
mov edi, dword [ebx + 0x21c]
add ecx, edx
mov edx, dword [ebx + 0x1bc]
add ecx, ebp
add ecx, edi
add ecx, edx
cmp esi, 0x270
lea ebx, [eax + ecx*2 + 0xe]
jae 0x12eb7d25
mov eax, dword [0x13198f68]
pop edi
test eax, eax
pop ebp
je 0x12eb7ffd
push 0
push 0x1313aa64
push str.PrintRule
push 0xffffffffffffffff
call fcn.12dad750
add esp, 0x10
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xffffffff
call fcn.12f56100
mov ecx, dword [esp + 0x24]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8