Function at 0x10019000
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x104b1c94]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x104b0c3c]
sub eax, dword [0x104b0c4c]
mov dword [0x104b0c60], eax
mov ecx, dword [0x104b0dd4]
add ecx, dword [0x104b0e74]
mov dword [0x104b0d30], ecx
mov edx, dword [0x104b0c64]
sub edx, dword [0x104b0e28]
mov dword [0x104b0c54], edx
mov eax, dword [0x104b0d54]
sub eax, dword [0x104b0e24]
mov dword [0x104b0be8], eax
mov ecx, dword [0x104b0c98]
add ecx, dword [0x104b0be4]
mov dword [0x104b0d58], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
movzx ecx, word [edx + 0x14]
lea edx, [eax + ecx + 0x18]
mov dword [ebp - 0xc], edx
mov eax, dword [0x104b0e88]
add eax, dword [0x104b0dd8]
mov dword [0x104b0d70], eax
mov ecx, dword [0x104b0c74]
sub ecx, dword [0x104b0df8]
mov dword [0x104b0dcc], ecx
mov edx, dword [0x104b0dac]
imul edx, dword [0x104b0c98]
mov dword [0x104b0bec], edx
mov eax, dword [0x104b0d04]
and eax, dword [0x104b0d24]
mov dword [0x104b0e90], eax
mov ecx, dword [0x104b0bd8]
and ecx, dword [0x104b0c58]
mov dword [0x104b0c44], ecx
mov edx, dword [0x104b0ddc]
and edx, dword [0x104b0d6c]
mov dword [0x104b0e60], edx
mov eax, dword [0x104b0db8]
sub eax, dword [0x104b0cd0]
mov dword [0x104b0cb0], eax
mov ecx, dword [0x104b0e44]
add ecx, dword [0x104b0d8c]
mov dword [0x104b0c28], ecx
mov dword [ebp - 0x14], 0
jmp 0x10019121
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
add eax, 0x28
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
movzx eax, word [edx + 6]
cmp dword [ebp - 0x14], eax
jge 0x100195f0
mov ecx, dword [0x104b0bf8]
imul ecx, dword [0x104b0c78]
mov dword [0x104b0d4c], ecx
mov edx, dword [0x104b0c30]
add edx, dword [0x104b0d74]
mov dword [0x104b0dd8], edx
mov eax, dword [0x104b0dc0]
add eax, dword [0x104b0d94]
mov dword [0x104b0cdc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
and edx, 0x20000000
je 0x1001917f
mov dword [ebp - 0x1c], 1
jmp 0x10019186
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov ecx, dword [0x104b0d34]
add ecx, dword [0x104b0ccc]
mov dword [0x104b0db0], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
and eax, 0x40000000
je 0x100191b4
mov dword [ebp - 0x20], 1
jmp 0x100191bb
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], ecx
mov edx, dword [0x104b0e00]
imul edx, dword [0x104b0e08]
mov dword [0x104b0dc4], edx
mov eax, dword [0x104b0df0]
and eax, dword [0x104b0d98]
mov dword [0x104b0c50], eax
mov ecx, dword [0x104b0e98]
sub ecx, dword [0x104b0d38]
mov dword [0x104b0d7c], ecx
mov edx, dword [0x104b0dcc]
add edx, dword [0x104b0cb4]
mov dword [0x104b0e50], edx
mov eax, dword [0x104b0cc8]
add eax, dword [0x104b0bf4]
mov dword [0x104b0e70], eax
mov ecx, dword [0x104b0e18]
sub ecx, dword [0x104b0c98]
mov dword [0x104b0d30], ecx
mov edx, dword [0x104b0c8c]
imul edx, dword [0x104b0cf4]
mov dword [0x104b0d08], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
and ecx, 0x80000000
je 0x10019254
mov dword [ebp - 0x24], 1
jmp 0x1001925b
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edx
mov eax, dword [0x104b0db8]
add eax, dword [0x104b0dd0]
mov dword [0x104b0d54], eax
mov ecx, dword [0x104b0db0]
imul ecx, dword [0x104b0bec]
mov dword [0x104b0bec], ecx
mov edx, dword [0x104b0e48]
add edx, dword [0x104b0d28]
mov dword [0x104b0e44], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
and ecx, 0x2000000
je 0x10019363
push 0x4000
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [0x104b0d80]
add eax, dword [0x104b0d54]
mov dword [0x104b0d58], eax
mov ecx, dword [0x104b0e6c]
add ecx, dword [0x104b0e74]
mov dword [0x104b0e10], ecx
mov edx, dword [0x104b0c40]
add edx, dword [0x104b0cac]
mov dword [0x104b0de4], edx
mov eax, dword [0x104b0e4c]
sub eax, dword [0x104b0d3c]
mov dword [0x104b0c74], eax
mov ecx, dword [0x104b0e68]
add ecx, dword [0x104b0cd0]
mov dword [0x104b0c78], ecx
mov edx, dword [0x104b0bfc]
and edx, dword [0x104b0cb4]
mov dword [0x104b0d80], edx
mov eax, dword [0x104b0e3c]
sub eax, dword [0x104b0bf0]
mov dword [0x104b0ca4], eax
mov ecx, dword [0x104b0c00]
imul ecx, dword [0x104b0d24]
mov dword [0x104b0d6c], ecx
jmp 0x1001910f
mov eax, dword [ebp - 0x28]
shl eax, 4
mov ecx, dword [ebp - 0x2c]
lea edx, [eax + ecx*8 + 0x104b0ea8]
mov eax, dword [ebp - 0x30]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x18], ecx
mov edx, dword [0x104b0d2c]
add edx, dword [0x104b0dc4]
mov dword [0x104b0d1c], edx
mov eax, dword [0x104b0d50]
and eax, dword [0x104b0cf8]
mov dword [0x104b0e14], eax
mov ecx, dword [0x104b0e04]
add ecx, dword [0x104b0d50]
mov dword [0x104b0e1c], ecx
mov edx, dword [0x104b0e80]
add edx, dword [0x104b0c30]
mov dword [0x104b0da4], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
and ecx, 0x4000000
je 0x10019411
mov edx, dword [ebp - 0x18]
or edx, 0x200
mov dword [ebp - 0x18], edx
mov eax, dword [0x104b0ca0]
imul eax, dword [0x104b0de8]
mov dword [0x104b0d30], eax
mov ecx, dword [0x104b0e50]
sub ecx, dword [0x104b0dac]
mov dword [0x104b0e78], ecx
mov edx, dword [0x104b0dbc]
and edx, dword [0x104b0de4]
mov dword [0x104b0db8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x10], ecx
mov edx, dword [0x104b0e20]
and edx, dword [0x104b0d74]
mov dword [0x104b0d8c], edx
mov eax, dword [0x104b0e48]
sub eax, dword [0x104b0cb4]
mov dword [0x104b0d20], eax
mov ecx, dword [0x104b0e08]
sub ecx, dword [0x104b0ce8]
mov dword [0x104b0c8c], ecx
mov edx, dword [0x104b0c90]
sub edx, dword [0x104b0dec]
mov dword [0x104b0bf4], edx
mov eax, dword [0x104b0d44]
add eax, dword [0x104b0d14]
mov dword [0x104b0cfc], eax
mov ecx, dword [0x104b0e0c]
add ecx, dword [0x104b0cf4]
mov dword [0x104b0cc4], ecx
cmp dword [ebp - 0x10], 0
jne 0x100195cc
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
and eax, 0x40
je 0x10019511
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x104b0d7c]
and ecx, dword [0x104b0bf0]
mov dword [0x104b0d48], ecx
mov edx, dword [0x104b0e34]
add edx, dword [0x104b0db4]
mov dword [0x104b0c30], edx
mov eax, dword [0x104b0c50]
imul eax, dword [0x104b0dd4]
mov dword [0x104b0c68], eax
mov ecx, dword [0x104b0d38]
imul ecx, dword [0x104b0c88]
mov dword [0x104b0e1c], ecx
mov edx, dword [0x104b0c78]
sub edx, dword [0x104b0d38]
mov dword [0x104b0e6c], edx
mov eax, dword [0x104b0e58]
and eax, dword [0x104b0d98]
mov dword [0x104b0d18], eax
jmp 0x100195cc
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
and edx, 0x80
je 0x100195cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x10], edx
mov eax, dword [0x104b0c50]
and eax, dword [0x104b0ca4]
mov dword [0x104b0c94], eax
mov ecx, dword [0x104b0e24]
sub ecx, dword [0x104b0d04]
mov dword [0x104b0ca0], ecx
mov edx, dword [0x104b0e78]
sub edx, dword [0x104b0ca0]
mov dword [0x104b0c60], edx
mov eax, dword [0x104b0c34]
imul eax, dword [0x104b0e78]
mov dword [0x104b0d60], eax
mov ecx, dword [0x104b0e30]
add ecx, dword [0x104b0c18]
mov dword [0x104b0c90], ecx
mov edx, dword [0x104b0d84]
add edx, dword [0x104b0be4]
mov dword [0x104b0e8c], edx
mov eax, dword [0x104b0cf8]
and eax, dword [0x104b0d68]
mov dword [0x104b0ca4], eax
mov ecx, dword [0x104b0c5c]
and ecx, dword [0x104b0d94]
mov dword [0x104b0de8], ecx
mov edx, dword [0x104b0e30]
imul edx, dword [0x104b0e40]
mov dword [0x104b0c30], edx
cmp dword [ebp - 0x10], 0
jbe 0x100195eb
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1001910f
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101503f7
mov esp, ebp
pop ebp
ret