Function at 0x516db4
Capabilities:
Delete file
Enumerate pe sections
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], eax
xor eax, eax
push ebp
push 0x517299
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
cmp dword [ebp + 8], 0
je 0x51727e
xor edx, edx
push ebp
push 0x517272
push dword fs:[edx]
mov dword fs:[edx], esp
mov edi, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
jne 0x51721e
xor ebx, ebx
mov eax, dword [edi + 0xc]
add eax, 0xf8
mov esi, eax
mov eax, dword [edi + 0xc]
movzx eax, word [eax + 6]
dec eax
test eax, eax
jl 0x51720a
inc eax
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
mov edx, dword [esi + edx*8 + 0xc]
mov ecx, dword [edi + 0xc]
cmp edx, dword [ecx + 0x88]
jne 0x517200
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, dword [edi + 0x10]
call fcn.00516678
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
mov edx, dword [edi + 0x10]
mov eax, dword [edi + 0xc]
mov eax, dword [eax + 0x88]
call fcn.00516918
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.005160c0
add eax, dword [ebp - 0xc]
mov edx, dword [edi + 0xc]
mov edx, dword [edx + 0x3c]
call fcn.005160c0
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
sub eax, dword [esi + edx*8 + 0x10]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x516eb8
cmp byte [0x600200], 0
je 0x516eb8
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x516eec
lea eax, [edi + 4]
push eax
lea eax, [edi + 8]
push eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*4]
mov edx, dword [esi + eax*8 + 0x14]
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*4]
add edx, dword [esi + eax*8 + 0x10]
mov eax, dword [edi]
mov ecx, dword [ebp - 0x18]
call fcn.0051624c
test al, al
je 0x51720a
mov eax, dword [edi + 8]
call fcn.005173e4
mov ebx, eax
mov dword [edi + 0xc], ebx
mov eax, dword [edi + 0xc]
add eax, 0xf8
mov esi, eax
lea eax, [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add eax, 0x70
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
add dword [ebx + 0x20], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.005160c0
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 0x20]
call fcn.005160c0
mov ebx, eax
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
call fcn.005160c0
sub ebx, eax
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.005160c0
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
mov edx, dword [edx + 0x24]
call fcn.005160c0
mov ebx, dword [ebp - 0x14]
lea ebx, [ebx + ebx*4]
mov dword [esi + ebx*8 + 0x10], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.005160c0
add eax, dword [ebp - 0xc]
mov dword [esi + ebx*8 + 8], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.005160c0
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
add dword [eax + 0x38], edx
mov eax, dword [edi + 0xc]
movzx eax, word [eax + 6]
dec eax
test eax, eax
jl 0x517023
inc eax
mov dword [ebp - 0x2c], eax
xor ebx, ebx
lea eax, [ebx + ebx*4]
mov eax, dword [esi + eax*8 + 0xc]
mov edx, dword [ebp - 0x28]
cmp eax, dword [edx]
jbe 0x51701d
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 0x1c]
add dword [esi + eax*8 + 0xc], edx
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 0x18]
add dword [esi + eax*8 + 0x14], edx
lea eax, [ebx + ebx*4]
mov eax, dword [esi + eax*8 + 0x1c]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
cmp eax, dword [esi + edx*8 + 0x14]
jbe 0x517000
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 0x18]
add dword [esi + eax*8 + 0x1c], edx
lea eax, [ebx + ebx*4]
mov eax, dword [esi + eax*8 + 0x18]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
cmp eax, dword [esi + edx*8 + 0x14]
jbe 0x51701d
lea eax, [ebx + ebx*4]
mov edx, dword [ebp - 0x18]
add dword [esi + eax*8 + 0x18], edx
inc ebx
dec dword [ebp - 0x2c]
jne 0x516fc1
xor ebx, ebx
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + ebx*8 + 0x60]
mov edx, dword [ebp - 0x28]
cmp eax, dword [edx]
jbe 0x51703d
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
add dword [eax + ebx*8 + 0x60], edx
inc ebx
cmp ebx, 0x10
jne 0x517025
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x94], 0
jbe 0x5170bb
mov eax, dword [edi + 0xc]
movzx eax, word [eax + 6]
dec eax
test eax, eax
jl 0x5170bb
inc eax
mov dword [ebp - 0x2c], eax
xor ebx, ebx
lea eax, [ebx + ebx*4]
mov eax, dword [esi + eax*8 + 0xc]
mov edx, dword [ebp - 0x24]
cmp eax, dword [edx + 0x90]
ja 0x5170b5
mov eax, dword [edi + 0xc]
movzx eax, word [eax + 6]
dec eax
cmp ebx, eax
je 0x517096
lea eax, [ebx + ebx*4]
mov eax, dword [esi + eax*8 + 0x34]
mov edx, dword [ebp - 0x24]
cmp eax, dword [edx + 0x90]
jbe 0x5170b5
lea eax, [ebx + ebx*4]
mov eax, dword [esi + eax*8 + 0x14]
add eax, dword [edi + 8]
mov edx, dword [ebp - 0x24]
add eax, dword [edx + 0x90]
lea edx, [ebx + ebx*4]
sub eax, dword [esi + edx*8 + 0xc]
mov dword [ebp - 0x20], eax
jmp 0x5170bb
inc ebx
dec dword [ebp - 0x2c]
jne 0x517066
cmp dword [ebp - 0x20], 0
je 0x517127
mov eax, dword [ebp - 0x24]
mov ebx, dword [eax + 0x94]
mov eax, ebx
mov ecx, 0x1c
cdq
idiv ecx
test edx, edx
jne 0x5170e4
mov ecx, 0x1c
mov eax, ebx
cdq
idiv ecx
mov ebx, eax
test ebx, ebx
jle 0x517127
mov dword [ebp - 0x2c], ebx
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
mov edx, dword [esi + edx*8 + 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x18]
cmp edx, eax
jae 0x51711e
test eax, eax
je 0x51710c
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
add dword [eax + 0x18], edx
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x14], 0
je 0x51711e
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
add dword [eax + 0x14], edx
add dword [ebp - 0x20], 0x1c
dec dword [ebp - 0x2c]
jne 0x5170eb
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.005160c0
mov ecx, eax
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*4]
mov edx, dword [esi + eax*8 + 0x14]
add edx, dword [edi + 8]
mov eax, dword [ebp - 0x10]
call fcn.00403230
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_UnmapViewOfFile
lea edx, [ebp - 0x34]
mov eax, dword [edi + 0x10]
call fcn.00516498
mov eax, dword [ebp - 0x34]
call fcn.004053ec
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.00405154
mov ebx, dword [ebp - 0x30]
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x38]
call fcn.004053ec
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.005160c0
add eax, dword [ebp - 0xc]
mov edx, dword [edi + 0xc]
mov edx, dword [edx + 0x3c]
call fcn.005160c0
mov ebx, eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.005160c0
add eax, dword [ebp - 0xc]
sub ebx, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0
jle 0x5171fb
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.005160c0
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
mov edx, dword [esi + edx*8 + 0x14]
add edx, dword [edi + 8]
add eax, edx
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
xor ecx, ecx
call fcn.00403830
or ebx, 0xffffffff
jmp 0x51720a
inc dword [ebp - 0x14]
dec eax
jne 0x516e1f
push 0
mov eax, dword [edi]
push eax
call sub.kernel32.dll_GetFileSize
mov edx, eax
mov eax, dword [edi + 8]
call fcn.00516d58
lea eax, [edi + 0x10]
call fcn.005165b8
mov eax, dword [edi + 8]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [edi + 4]
push eax
call sub.kernel32.dll_CloseHandle
push 2
push 0
push 0
mov eax, dword [edi]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x517253
mov eax, dword [edi]
push eax
call sub.kernel32.dll_SetEndOfFile
mov eax, dword [edi]
push eax
call sub.kernel32.dll_CloseHandle
mov edx, 0x14
mov eax, dword [ebp + 8]
call fcn.0040302c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51727e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5172a0
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00404f80
ret