Function at 0x493d60
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov eax, 1
push esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
xor eax, eax
push edi
mov al, byte [esi]
mov dword [esp + 0x10], 0
mov ax, word [eax*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov eax, dword [eax + esi]
push eax
call sub.WSOCK32.dll_ntohl
xor ecx, ecx
mov edi, eax
mov cl, byte [esi]
mov ax, word [ecx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 4]
push eax
call sub.WSOCK32.dll_ntohs
xor edx, edx
mov ebx, eax
mov dl, byte [esi]
mov ax, word [edx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 6]
push eax
call sub.WSOCK32.dll_ntohs
mov ebp, eax
xor eax, eax
mov al, byte [esi]
mov ax, word [eax*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 8]
push eax
call sub.WSOCK32.dll_ntohs
xor ecx, ecx
mov dword [esp + 0x14], eax
mov cl, byte [esi]
mov ax, word [ecx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 0xa]
push eax
call sub.WSOCK32.dll_ntohs
xor edx, edx
mov dword [esp + 0x30], eax
mov dl, byte [esi]
mov ax, word [edx*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 0xc]
push eax
call sub.WSOCK32.dll_ntohs
mov dword [esp + 0x18], eax
xor eax, eax
mov al, byte [esi]
mov ax, word [eax*8 + 0x54901c]
and eax, 0x8000
or ah, 0x40
shr eax, 0xe
and eax, 0xffff
mov ax, word [eax + esi + 0xe]
push eax
call sub.WSOCK32.dll_ntohs
mov esi, eax
push edi
mov dword [esp + 0x28], esi
call fcn.00488740
mov edi, eax
add esp, 4
test edi, edi
je 0x494061
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x24]
test eax, eax
je 0x494061
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x28]
test eax, eax
je 0x493f2f
mov eax, dword [esp + 0x14]
mov ecx, ebx
mov edx, ebp
and ecx, 0xffff
and edx, 0xffff
mov dword [edi + 0x1e4], ecx
mov ecx, dword [esp + 0x30]
mov dword [edi + 0x1e0], edx
mov edx, dword [esp + 0x18]
and eax, 0xffff
and ecx, 0xffff
and edx, 0xffff
and esi, 0xffff
mov dword [edi + 0x1ec], eax
mov dword [edi + 0x1e8], ecx
mov dword [edi + 0x1f4], edx
mov dword [edi + 0x1f0], esi
mov esi, dword [0xb6614c]
test esi, esi
je 0x493f76
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xec]
test eax, eax
je 0x493f6f
mov ecx, dword [esi + 0xa8]
mov eax, dword [edi + 0x7c]
cmp ecx, eax
jne 0x493f6f
mov edx, ebp
mov eax, ebx
and edx, 0xffff
and eax, 0xffff
mov dword [esi + 0xa4], edx
mov dword [esi + 0xa0], eax
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x493f39
mov esi, dword [0xb6614c]
test esi, esi
je 0x494061
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xe8]
test eax, eax
je 0x493f97
cmp dword [esi + 0x38], edi
je 0x493fa6
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x493f84
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
xor edx, edx
cmp esi, edx
je 0x494061
cmp word [esi + 0xca], bp
jne 0x493fbd
mov dword [esp + 0x20], edx
mov ax, word [esp + 0x30]
cmp word [esi + 0xd2], ax
jne 0x493fcf
mov dword [esp + 0x1c], edx
mov edi, dword [esp + 0x24]
cmp word [esi + 0xce], di
je 0x493fe0
mov edx, dword [esp + 0x28]
cmp word [esi + 0xcc], bx
je 0x493ff1
mov dword [esp + 0x10], 1
mov ecx, dword [esp + 0x14]
cmp word [esi + 0xd4], cx
je 0x494006
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x18]
cmp word [esi + 0xd0], ax
jne 0x49401b
mov dword [esp + 0x10], 1
mov word [esi + 0xd4], cx
mov cx, word [esp + 0x30]
push edx
mov edx, dword [esp + 0x20]
mov word [esi + 0xd0], ax
mov eax, dword [esp + 0x24]
mov word [esi + 0xd2], cx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
mov ecx, esi
mov word [esi + 0xcc], bx
mov word [esi + 0xca], bp
mov word [esi + 0xce], di
call fcn.004ab830
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret