Function at 0x556c15
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xd8
mov esi, ecx
test dl, dl
je 0x556f0b
mov eax, dword [esi + 0xd4]
and dword [esp + 0x70], 0
and dword [esp + 0x34], 0
and dword [esp + 0x3c], 0
and dword [esp + 0x78], 0
and dword [esp + 0x80], 0
and dword [esp + 0xa0], 0
and dword [esp + 0x74], 0
and dword [esp + 0x38], 0
and dword [esp + 0x40], 0
and dword [esp + 0x7c], 0
and dword [esp + 0x84], 0
and dword [esp + 0xa4], 0
mov dword [esp + 0x24], edx
test eax, eax
je 0x556c9c
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x34]
lea edi, [esp + 0x70]
push ecx
push edx
push edi
push edi
push dword [eax + 8]
call sub.KERNEL32.DLL_GetProcessTimes
lea ebx, [esp + 0xa0]
lea edi, [esp + 0x80]
lea eax, [esp + 0x78]
push ebx
push edi
push eax
call sub.KERNEL32.DLL_GetSystemTimes
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [esi + 0x60]
mov edi, dword [esi + 0x64]
mov dword [esp + 0x5c], eax
cmp eax, edx
mov eax, ecx
mov dword [esp + 0x60], ecx
mov ecx, dword [esi + 0x6c]
sbb eax, edi
mov eax, dword [ebx]
mov ebx, dword [ebx + 4]
mov dword [esp + 0x54], ecx
mov ecx, dword [esi + 0x68]
mov dword [esp + 0x30], eax
mov eax, 0
mov dword [esp + 0x2c], ebx
cmovb edx, eax
cmovb edi, eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x58], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x50], ecx
mov ecx, dword [esi + 0x58]
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], ecx
mov ecx, dword [esi + 0x50]
mov dword [esp + 0x44], ecx
mov ecx, dword [esi + 0x54]
mov dword [esi + 0x58], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x48], ecx
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x4c], eax
mov dword [esi + 0x5c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], eax
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x60]
mov dword [esi + 0x54], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x5c]
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x68], edx
mov ebx, dword [esp + 0x50]
mov dword [esi + 0x64], ecx
mov dword [esi + 0x60], eax
sub eax, dword [esp + 0x58]
sbb ecx, edi
cmp edx, ebx
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x54]
sbb edi, edx
mov edi, 0
cmovb edx, edi
cmovb ebx, edi
mov edi, dword [esp + 0x30]
sub edi, ebx
mov ebx, dword [esp + 0x2c]
sbb ebx, edx
xor edx, edx
dec edx
add edi, eax
adc ebx, ecx
cmovb edi, edx
cmovb ebx, edx
mov eax, edi
or eax, ebx
je 0x556efc
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x48]
movd xmm0, edi
movd xmm1, ebx
punpckldq xmm0, xmm1
cmp dword [esp + 0x10], ecx
sbb eax, edx
mov eax, 0
cmovb ecx, eax
cmovb edx, eax
mov eax, dword [esp + 0x28]
sub dword [esp + 0x10], ecx
mov ecx, dword [esp + 0xc]
sbb dword [esp + 0x14], edx
mov edx, dword [esp + 0x4c]
cmp dword [esp + 0x18], eax
mov eax, edx
sbb eax, dword [esp + 0xc]
mov eax, 0
cmovb ecx, eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x28]
cmovb ecx, eax
sub dword [esp + 0x18], ecx
mov ecx, 0xffffffff
sbb edx, dword [esp + 0xc]
movq qword [esp + 0x90], xmm0
shr ebx, 0x1f
fild qword [esp + 0x90]
fnstcw word [esp + 0xa]
movzx eax, word [esp + 0xa]
or eax, 0x300
mov word [esp + 0x22], ax
fldcw word [esp + 0x22]
fadd dword [ebx*4 + 0x593610]
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x10]
adc edx, dword [esp + 0x14]
fldcw word [esp + 0xa]
cmovb edx, ecx
cmovb eax, ecx
fstp dword [esp + 0x6c]
mov ecx, dword [ebp + 8]
movd xmm0, edx
movd xmm1, eax
shr edx, 0x1f
punpckldq xmm1, xmm0
movq qword [esp + 0x98], xmm1
fild qword [esp + 0x98]
fnstcw word [esp + 8]
movd xmm1, ecx
movzx eax, word [esp + 8]
or eax, 0x300
mov word [esp + 0x20], ax
mov eax, dword [ebp + 0xc]
fldcw word [esp + 0x20]
movd xmm2, eax
shr eax, 0x1f
fadd dword [edx*4 + 0x593610]
fldcw word [esp + 8]
punpckldq xmm1, xmm2
fstp dword [esp + 0x64]
movss xmm0, dword [esp + 0x64]
divss xmm0, dword [esp + 0x6c]
movq qword [esp + 0x88], xmm1
fild qword [esp + 0x88]
fnstcw word [esp + 6]
movzx ecx, word [esp + 6]
mulss xmm0, dword [0x593618]
or ecx, 0x300
mov word [esp + 0x1e], cx
fldcw word [esp + 0x1e]
fadd dword [eax*4 + 0x593610]
fldcw word [esp + 6]
fstp dword [esp + 0x68]
mulss xmm0, dword [esp + 0x68]
jmp 0x556eff
xorps xmm0, xmm0
mov edx, dword [esp + 0x24]
movss dword [esi + 0xd8], xmm0
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
test dx, 0xff00
je 0x556f80
mov eax, dword [esi + 0xd4]
test eax, eax
je 0x556f80
lea ecx, [esp + 0xa0]
push ecx
push dword [eax + 8]
call sub.KERNEL32.DLL_GetProcessIoCounters
test eax, eax
je 0x556f80
mov eax, dword [esi + 0x90]
mov ecx, dword [esi + 0x94]
movsd xmm0, qword [esp + 0xb8]
movq xmm1, qword [esp + 0xc0]
mov dword [esi + 0x84], ecx
mov dword [esi + 0x80], eax
movq xmm2, qword [esi + 0x98]
movq qword [esi + 0x88], xmm2
movsd qword [esi + 0x90], xmm0
movq qword [esi + 0x98], xmm1
xor eax, eax
sub edi, dword [esi + 0x70]
sbb ebx, dword [esi + 0x74]
cmovb edi, eax
cmovb ebx, eax
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x78], edi
mov byte [esi + 0xdc], 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret