Function at 0x1feb1000
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x40
push ebx
push esi
mov ebx, dword [esp + 0x4c]
push edi
push ebp
push 0
push 0
mov eax, dword [ebx + 4]
push eax
call sub.LTKRN13N.dll_Ordinal_191
lea edi, [esp + 0x10]
xor eax, eax
mov ecx, 0x10
push 0x40
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 4]
push eax
push ecx
call sub.LTKRN13N.dll_Ordinal_190
test eax, eax
jg 0x1feb1048
mov eax, 0xfffffff9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
cmp word [esp + 0x10], 0
jne 0x1feb11e2
cmp word [esp + 0x12], 1
je 0x1feb1068
cmp word [esp + 0x12], 2
jne 0x1feb11e2
cmp word [esp + 0x14], 0
jbe 0x1feb11e2
mov bp, word [esp + 0x12]
mov ax, word [esp + 0x14]
cmp ax, 1
ja 0x1feb1088
mov ax, 1
lea esi, [ebx + 8]
movzx ecx, ax
mov eax, dword [esi]
mov dword [eax + 0x48], ecx
mov eax, dword [ebx + 0x114]
test eax, eax
jle 0x1feb10a8
cmp ecx, eax
jl 0x1feb10ac
mov ecx, dword [esi]
mov dword [ecx + 0x44], eax
jmp 0x1feb10cc
cmp ecx, eax
jge 0x1feb10b9
mov eax, dword [esi]
mov dword [ebx + 0x114], ecx
mov dword [eax + 0x44], ecx
jmp 0x1feb10cc
mov eax, dword [esi]
mov dword [ebx + 0x114], 1
mov dword [eax + 0x44], 1
push 0
mov eax, dword [ebx + 0x114]
shl eax, 4
mov ecx, dword [ebx + 4]
sub eax, 0xa
push eax
push ecx
call sub.LTKRN13N.dll_Ordinal_191
lea edi, [esp + 0x10]
xor eax, eax
mov ecx, 0x10
push 0x10
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov edx, dword [ebx + 4]
push ecx
push edx
call sub.LTKRN13N.dll_Ordinal_190
test eax, eax
jg 0x1feb1114
mov eax, 0xfffffff9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
mov eax, dword [esp + 0x1c]
push 0
push eax
mov ecx, dword [ebx + 4]
push ecx
call sub.LTKRN13N.dll_Ordinal_191
lea ecx, [esp + 0x10]
push 0x28
push ecx
mov edx, dword [ebx + 4]
push edx
call sub.LTKRN13N.dll_Ordinal_190
cmp eax, 0x28
je 0x1feb1148
mov eax, 0xfffffff9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
cmp dword [esp + 0x10], 0x28
je 0x1feb115b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
mov dword [ecx + 0x14], eax
mov eax, dword [esp + 0x18]
cdq
sub eax, edx
mov ecx, dword [esi]
sar eax, 1
dec bp
mov dword [ecx + 0x18], eax
xor eax, eax
mov ecx, dword [esi]
mov ax, word [esp + 0x1e]
cmp bp, 1
mov dword [ecx + 0x1c], eax
sbb eax, eax
mov ecx, dword [esp + 0x20]
add eax, 0x5c
mov edx, dword [esi]
mov dword [edx], eax
cmp dword [esp + 0x28], 0
je 0x1feb11b8
mov eax, dword [esp + 0x28]
mov edi, 0x2710
mov edx, eax
shl eax, 8
sub eax, edx
sub eax, edx
add eax, 0x1388
cdq
idiv edi
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
cmp dword [esp + 0x2c], 0
je 0x1feb1386
mov eax, dword [esp + 0x2c]
mov edi, 0x2710
mov edx, eax
shl eax, 8
sub eax, edx
sub eax, edx
add eax, 0x1388
cdq
idiv edi
jmp 0x1feb1381
cmp word [esp + 0x10], 0x4d42
lea edi, [esp + 0x10]
je 0x1feb1207
cmp word [esp + 0x10], 0x4142
je 0x1feb1210
mov eax, 0xfffffff7
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
cmp word [esp + 0x10], 0x4142
jne 0x1feb122c
cmp word [esp + 0x1e], 0x4d42
lea edi, [esp + 0x1e]
je 0x1feb122c
mov eax, 0xfffffff7
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
mov eax, dword [edi + 0xe]
add edi, 0xe
cmp eax, 0xc
jae 0x1feb1246
mov eax, 0xfffffff7
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
cmp eax, 0x28
jne 0x1feb12d3
lea esi, [ebx + 8]
mov ecx, dword [edi + 4]
mov eax, dword [esi]
mov dword [eax + 0x14], ecx
mov eax, dword [esi]
mov edx, dword [edi + 8]
mov dword [eax + 0x18], edx
xor eax, eax
mov ax, word [edi + 0xe]
mov ecx, dword [esi]
mov dword [ecx + 0x1c], eax
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x1feb1283
cmp ecx, 3
je 0x1feb1283
mov eax, dword [esi]
mov dword [eax], 0x54
jmp 0x1feb128b
mov eax, dword [esi]
mov dword [eax], 6
mov edx, dword [edi + 0x18]
test edx, edx
je 0x1feb12ad
mov eax, edx
mov ebx, 0x2710
shl eax, 8
sub eax, edx
sub eax, edx
add eax, 0x1388
cdq
idiv ebx
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x1feb1386
mov eax, edx
mov edi, 0x2710
shl eax, 8
sub eax, edx
sub eax, edx
add eax, 0x1388
cdq
idiv edi
jmp 0x1feb1381
lea esi, [ebx + 8]
cmp eax, 0xc
mov eax, dword [esi]
jne 0x1feb1308
mov dword [eax], 0xe
xor eax, eax
mov ax, word [edi + 4]
mov ecx, dword [esi]
mov dword [ecx + 0x14], eax
xor eax, eax
mov ax, word [edi + 6]
mov ecx, dword [esi]
mov dword [ecx + 0x18], eax
xor ecx, ecx
mov cx, word [edi + 0xa]
mov eax, dword [esi]
mov dword [eax + 0x1c], ecx
xor ecx, ecx
jmp 0x1feb1386
mov dword [eax], 0x4a
mov eax, dword [esi]
mov edx, dword [edi + 4]
mov dword [eax + 0x14], edx
mov eax, dword [esi]
mov ebx, dword [edi + 8]
mov dword [eax + 0x18], ebx
cmp dword [edi], 0x10
jae 0x1feb132f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
xor eax, eax
mov ecx, dword [esi]
mov ax, word [edi + 0xe]
mov dword [ecx + 0x1c], eax
mov eax, dword [edi]
cmp eax, 0x14
jb 0x1feb1346
mov ecx, dword [edi + 0x10]
jmp 0x1feb134a
mov ecx, dword [esp + 0x10]
cmp eax, 0x20
jb 0x1feb1386
mov eax, dword [edi + 0x18]
mov ebx, 0x2710
mov edx, eax
shl eax, 8
sub eax, edx
sub eax, edx
add eax, 0x1388
cdq
idiv ebx
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
mov eax, dword [edi + 0x1c]
mov edx, eax
shl eax, 8
sub eax, edx
sub eax, edx
add eax, 0x1388
cdq
idiv ebx
mov edx, dword [esi]
mov dword [edx + 0x50], eax
mov edi, dword [esi]
mov eax, dword [edi + 0x1c]
dec eax
cmp eax, 0x1f
ja case.0x1feb1399.7
xor edx, edx
mov dl, byte [eax + 0x1feb1444]
jmp dword [edx*4 + 0x1feb1428]
mov eax, 0xfffffff7
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
mov eax, dword [edi + 0x18]
test eax, eax
jge 0x1feb13c6
neg eax
mov dword [edi + 0x18], eax
mov edx, dword [esi]
mov dword [edx + 0x3c], 0
jmp 0x1feb13cd
mov dword [edi + 0x3c], 2
mov eax, dword [esi]
cmp dword [eax + 0x1c], 8
mov dword [eax + 0x40], 1
jg 0x1feb13e3
mov dword [eax + 0x40], 0
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
imul edx, dword [eax + 0x1c]
add edx, 0x1f
shr edx, 3
and edx, 0xfffffffc
imul edx, dword [eax + 0x18]
mov dword [eax + 0x24], edx
test ecx, ecx
je 0x1feb1416
cmp ecx, 3
je 0x1feb1416
push str.Run_Length
mov eax, dword [esi]
add eax, 0x28
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4