Function at 0x6ecc6010
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
lea esi, [ebp - 0x218]
push ebx
sub esp, 0x25c
mov dword [ebp - 0x21c], ecx
mov dword [esp], esi
mov ecx, dword [ecx]
mov dword [ebp - 0x228], eax
call fcn.6ecc53f0
test eax, eax
je 0x6ecc6330
lea ebx, [eax + 0xa]
mov esi, eax
mov edx, 0x251e
mov dword [ebp - 0x22c], ebx
cmp edi, ebx
jb 0x6ecc6260
movzx eax, byte [eax + 8]
movzx ecx, byte [esi + 9]
mov dword [ebp - 0x23c], ebx
shl eax, 8
add eax, ecx
mov ecx, ebx
mov word [ebp - 0x22e], ax
movzx eax, ax
add ecx, eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], ecx
cmp ecx, edi
ja 0x6ecc6260
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
shl ebx, 8
add ebx, eax
movzx eax, byte [esi + 4]
mov byte [ebp - 0x234], al
movzx eax, byte [esi + 5]
mov byte [ebp - 0x22f], al
movzx eax, byte [esi + 6]
mov byte [ebp - 0x230], al
movzx eax, byte [esi + 7]
mov byte [ebp - 0x235], al
mov eax, dword [ebp - 0x21c]
mov dword [eax], ecx
cmp bx, 0x14
jbe 0x6ecc62a0
cmp bx, 0x1e
je 0x6ecc6350
ja 0x6ecc6270
mov edx, dword [ebp - 0x224]
lea eax, [edx + 0x30]
cmp bx, 0x18
je 0x6ecc6103
lea eax, [edx + 0x20]
cmp bx, 0x19
mov edx, 0x40
cmovne eax, edx
mov dword [esp + 4], eax
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll_calloc]
test eax, eax
je 0x6ecc6342
movzx ecx, byte [ebp + 8]
movzx edx, byte [ebp + 0xc]
mov word [eax + 8], bx
mov dword [ebp - 0x21c], eax
movzx eax, byte [eax + 0xc]
and ecx, 3
and edx, 3
mov byte [ebp - 0x236], al
and eax, 0xffffffe4
shl edx, 3
or eax, ecx
mov ecx, dword [ebp - 0x234]
or eax, edx
mov edx, dword [ebp - 0x21c]
shl ecx, 0x18
mov byte [edx + 0xc], al
movzx eax, byte [ebp - 0x22f]
shl eax, 0x10
lea edx, [ecx + eax]
movzx eax, byte [ebp - 0x230]
mov ecx, dword [ebp + 0xc]
shl eax, 8
add eax, edx
movzx edx, byte [ebp - 0x235]
add eax, edx
mov edx, dword [ebp - 0x21c]
mov dword [edx + 0x10], eax
mov edx, 2
lea eax, [ebp - 0x218]
call fcn.6ecc5650
mov edx, dword [ebp - 0x21c]
mov dword [edx + 4], eax
test eax, eax
je 0x6ecc6a20
mov edx, dword [ebp - 0x21c]
movzx ecx, byte [edx + 0xc]
mov edx, ecx
shr dl, 3
and edx, 3
mov dword [ebp - 0x234], edx
cmp bx, 0x29
ja case.0x6ecc61ce.0
movzx edx, bx
jmp dword [edx*4 + 0x6eccb914]
lea edx, [esi + 0xe]
cmp dword [ebp - 0x220], edx
jb 0x6ecc6a10
mov eax, dword [esi + 0xa]
mov edi, dword [ebp - 0x21c]
mov ebx, 4
mov dword [edi + 0x18], eax
mov word [edi + 0xa], bx
lea esi, [esi]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp - 0x21c]
xor edx, edx
mov dword [eax], edi
test byte [0x6ecc9048], 8
je 0x6ecc6260
mov eax, dword [ebp + 8]
mov ebx, dword [eax*4 + 0x6eccbb6c]
mov eax, dword [ebp - 0x21c]
movzx eax, word [eax + 8]
mov dword [esp], eax
call fcn.6ecc5c10
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.found__s_record_in__s_section_n
mov dword [esp + 8], str.extract_record
mov dword [esp + 4], 0x6ecc9048
mov dword [esp], 3
call fcn.6ecc55a0
xor edx, edx
add esp, 0x25c
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp bx, 0x29
je 0x6ecc6316
cmp bx, 0xff01
jne 0x6ecc6324
movzx eax, word [ebp - 0x22e]
shr ax, 2
movzx eax, ax
lea eax, [eax*4 + 0x28]
jmp 0x6ecc6103
cmp bx, 0x13
jae 0x6ecc62be
cmp bx, 0xb
je 0x6ecc6361
jbe 0x6ecc6310
cmp bx, 0xd
je 0x6ecc62be
cmp bx, 0x10
jne 0x6ecc6324
mov ecx, dword [ebp - 0x22c]
xor edx, edx
mov eax, ecx
cmp dword [ebp - 0x220], ecx
jbe 0x6ecc6a01
mov word [ebp - 0x21c], bx
mov ebx, dword [ebp - 0x220]
jmp 0x6ecc62e5
mov edx, ecx
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
lea ecx, [edx + 1]
cmp ebx, eax
ja 0x6ecc62e3
movzx ebx, word [ebp - 0x21c]
lea eax, [edx*4 + 0x20]
jmp 0x6ecc6103
cmp bx, 0xa
jne 0x6ecc6324
mov eax, dword [ebp - 0x224]
add eax, 0x1c
jmp 0x6ecc6103
mov eax, 0x40
jmp 0x6ecc6103
add esp, 0x25c
mov edx, 0x251e
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov edx, 8
jmp 0x6ecc6260
mov eax, dword [ebp - 0x224]
shl eax, 4
add eax, 0x1e
jmp 0x6ecc6103
movzx eax, word [ebp - 0x22e]
shr ax, 3
movzx eax, ax
add eax, 0x1d
jmp 0x6ecc6103
lea ebx, [ebp - 0x118]
mov ecx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x228]
mov edx, edi
mov dword [esp], ebx
call fcn.6ecc53f0
test eax, eax
je 0x6ecc6a33
mov ecx, dword [ebp - 0x234]
mov edx, 2
mov eax, ebx
call fcn.6ecc5650
mov edi, dword [ebp - 0x21c]
mov dword [edi + 0x18], eax
test eax, eax
je 0x6ecc6a50
mov ebx, 8
mov word [edi + 0xa], bx
jmp 0x6ecc6200
lea esi, [ebp - 0x118]
mov ecx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x228]
mov edx, edi
mov dword [esp], esi
call fcn.6ecc53f0
mov ebx, eax
test eax, eax
je 0x6ecc6a33
mov ecx, dword [ebp - 0x234]
mov edx, 2
mov eax, esi
call fcn.6ecc5650
mov edx, dword [ebp - 0x21c]
mov dword [edx + 0x18], eax
test eax, eax
je 0x6ecc6a50
mov dword [esp], esi
mov eax, dword [ebp - 0x228]
mov ecx, ebx
mov edx, edi
call fcn.6ecc53f0
mov ebx, eax
test eax, eax
je 0x6ecc6a33
mov ecx, dword [ebp - 0x234]
mov edx, 2
mov eax, esi
call fcn.6ecc5650
mov edx, dword [ebp - 0x21c]
mov dword [edx + 0x1c], eax
test eax, eax
je 0x6ecc6b4c
lea eax, [ebx + 0x14]
cmp dword [ebp - 0x220], eax
jb 0x6ecc6a33
movzx edx, byte [ebx]
movzx eax, byte [ebx + 1]
mov ecx, 0x1c
mov edi, dword [ebp - 0x21c]
shl eax, 0x10
shl edx, 0x18
lea edx, [edx + eax]
movzx eax, byte [ebx + 2]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 3]
add eax, edx
mov dword [edi + 0x20], eax
movzx edx, byte [ebx + 4]
movzx eax, byte [ebx + 5]
shl edx, 0x18
shl eax, 0x10
lea edx, [edx + eax]
movzx eax, byte [ebx + 6]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 7]
add eax, edx
mov dword [edi + 0x24], eax
movzx edx, byte [ebx + 8]
movzx eax, byte [ebx + 9]
shl edx, 0x18
shl eax, 0x10
lea edx, [edx + eax]
movzx eax, byte [ebx + 0xa]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 0xb]
add eax, edx
mov dword [edi + 0x28], eax
movzx edx, byte [ebx + 0xc]
movzx eax, byte [ebx + 0xd]
shl edx, 0x18
shl eax, 0x10
lea edx, [edx + eax]
movzx eax, byte [ebx + 0xe]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 0xf]
add eax, edx
mov dword [edi + 0x2c], eax
movzx edx, byte [ebx + 0x10]
movzx eax, byte [ebx + 0x11]
shl edx, 0x18
shl eax, 0x10
lea edx, [edx + eax]
movzx eax, byte [ebx + 0x12]
shl eax, 8
add eax, edx
movzx edx, byte [ebx + 0x13]
mov word [edi + 0xa], cx
add eax, edx
mov dword [edi + 0x30], eax
jmp 0x6ecc6200
mov edi, dword [ebp - 0x21c]
mov esi, dword [ebp - 0x224]
mov dword [edi + 0x18], esi
lea eax, [edi + 0x1c]
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x22c]
mov dword [esp], eax
mov dword [esp + 4], esi
call sub.ucrtbase.dll_memcpy
movzx eax, word [ebp - 0x22e]
add eax, 4
mov word [edi + 0xa], ax
jmp 0x6ecc6200
mov edi, dword [ebp - 0x220]
mov ebx, dword [ebp - 0x22c]
cmp edi, ebx
jbe 0x6ecc6a69
movzx eax, byte [esi + 0xa]
lea ebx, [ebx + eax + 1]
cmp edi, ebx
jb 0x6ecc6a92
mov dword [ebp - 0x224], 0
mov esi, dword [ebp - 0x23c]
jmp 0x6ecc6625
test eax, eax
je 0x6ecc65c5
movzx edx, byte [esi]
mov byte [ebp - 0x118], dl
test al, 2
jne 0x6ecc6b3a
mov ecx, dword [ebp - 0x234]
mov byte [ebp + eax - 0x118], 0
mov edx, 2
lea eax, [ebp - 0x118]
call fcn.6ecc5650
mov edi, dword [ebp - 0x21c]
mov esi, dword [ebp - 0x224]
mov dword [edi + esi*4 + 0x1c], eax
test eax, eax
je 0x6ecc6afd
add dword [ebp - 0x224], 1
cmp dword [ebp - 0x220], ebx
jbe 0x6ecc6a73
movzx eax, byte [ebx]
mov esi, ebx
lea edx, [ebx + eax + 1]
cmp dword [ebp - 0x220], edx
jb 0x6ecc6a92
mov ebx, edx
add esi, 1
cmp eax, 4
jb 0x6ecc65b0
mov edx, dword [esi + eax - 4]
lea ecx, [eax - 1]
lea edi, [ebp - 0x118]
shr ecx, 2
mov dword [ebp + eax - 0x11c], edx
rep movsd dword es:[edi], dword [esi]
jmp 0x6ecc65c5
lea ebx, [ebp - 0x118]
mov ecx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x228]
mov edx, edi
mov dword [esp], ebx
call fcn.6ecc53f0
mov esi, eax
test eax, eax
je 0x6ecc6a33
mov ecx, dword [ebp - 0x234]
mov edx, 2
mov eax, ebx
call fcn.6ecc5650
mov edx, dword [ebp - 0x21c]
mov dword [edx + 0x18], eax
test eax, eax
je 0x6ecc6a50
mov dword [esp], ebx
mov eax, dword [ebp - 0x228]
mov ecx, esi
mov edx, edi
call fcn.6ecc53f0
test eax, eax
je 0x6ecc6a33
mov ecx, dword [ebp - 0x234]
mov edx, 2
mov eax, ebx
call fcn.6ecc5650
mov edx, dword [ebp - 0x21c]
mov dword [edx + 0x1c], eax
test eax, eax
je 0x6ecc6b4c
mov eax, dword [ebp - 0x21c]
mov edx, 8
mov word [eax + 0xa], dx
jmp 0x6ecc6200
lea ecx, [esi + 0xc]
cmp dword [ebp - 0x220], ecx
jb 0x6ecc6a10
movzx eax, byte [esi + 0xa]
movzx edx, byte [esi + 0xb]
mov esi, dword [ebp - 0x21c]
shl eax, 8
add eax, edx
mov word [esi + 0x1c], ax
lea ebx, [ebp - 0x118]
mov eax, dword [ebp - 0x228]
mov edx, edi
mov dword [esp], ebx
call fcn.6ecc53f0
test eax, eax
je 0x6ecc6a33
mov ecx, dword [ebp - 0x234]
mov edx, 2
mov eax, ebx
call fcn.6ecc5650
mov dword [esi + 0x18], eax
test eax, eax
je 0x6ecc6a50
mov edx, 0xc
mov word [esi + 0xa], dx
jmp 0x6ecc6200
lea ecx, [esi + 0x1c]
cmp dword [ebp - 0x220], ecx
jb 0x6ecc6a10
movzx eax, byte [esi + 0xa]
movzx edx, byte [esi + 0xb]
mov ebx, dword [ebp - 0x21c]
shl eax, 8
add eax, edx
mov word [ebx + 0x18], ax
movzx eax, byte [esi + 0xc]
mov byte [ebx + 0x1a], al
movzx eax, byte [esi + 0xd]
mov byte [ebx + 0x1b], al
movzx edx, byte [esi + 0xe]
movzx eax, byte [esi + 0xf]
mov ebx, dword [ebp - 0x21c]
shl edx, 0x18
shl eax, 0x10
lea edx, [edx + eax]
movzx eax, byte [esi + 0x10]
shl eax, 8
add eax, edx
movzx edx, byte [esi + 0x11]
add eax, edx
mov dword [ebx + 0x1c], eax
movzx edx, byte [esi + 0x12]
movzx eax, byte [esi + 0x13]
mov ebx, dword [ebp - 0x21c]
shl edx, 0x18
shl eax, 0x10
lea edx, [edx + eax]
movzx eax, byte [esi + 0x14]
shl eax, 8
add eax, edx
movzx edx, byte [esi + 0x15]
add eax, edx
mov dword [ebx + 0x20], eax
movzx edx, byte [esi + 0x16]
movzx eax, byte [esi + 0x17]
mov ebx, dword [ebp - 0x21c]
shl edx, 0x18
shl eax, 0x10
lea edx, [edx + eax]
movzx eax, byte [esi + 0x18]
shl eax, 8
add eax, edx
movzx edx, byte [esi + 0x19]
add eax, edx
mov dword [ebx + 0x24], eax
movzx eax, byte [esi + 0x1a]
movzx edx, byte [esi + 0x1b]
shl eax, 8
add eax, edx
mov edx, edi
mov word [ebx + 0x28], ax
lea ebx, [ebp - 0x118]
mov eax, dword [ebp - 0x228]
mov dword [esp], ebx
call fcn.6ecc53f0
mov esi, eax
test eax, eax
je 0x6ecc6a33
mov ecx, dword [ebp - 0x234]
mov edx, 2
mov eax, ebx
call fcn.6ecc5650
mov edi, dword [ebp - 0x21c]
mov dword [edi + 0x2c], eax
test eax, eax
je 0x6ecc6a50
mov ebx, dword [ebp - 0x220]
lea eax, [edi + 0x30]
sub ebx, esi
movzx edx, bx
mov word [edi + 0x2a], bx
add ebx, 0x18
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
mov word [edi + 0xa], bx
jmp 0x6ecc6200
mov ebx, dword [ebp - 0x220]
lea edx, [esi + 0xe]
cmp ebx, edx
jb 0x6ecc6a10
movzx eax, byte [esi + 0xa]
movzx ecx, byte [esi + 0xb]
sub ebx, edx
mov edi, dword [ebp - 0x21c]
shl eax, 8
add eax, ecx
movzx ecx, bx
mov word [edi + 0x18], ax
movzx eax, byte [esi + 0xc]
mov byte [edi + 0x1a], al
movzx eax, byte [esi + 0xd]
mov word [edi + 0x1c], bx
add ebx, 8
mov byte [edi + 0x1b], al
lea eax, [edi + 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
mov word [edi + 0xa], bx
jmp 0x6ecc6200
lea edx, [esi + 0x1a]
cmp dword [ebp - 0x220], edx
jb 0x6ecc6a10
mov ecx, dword [ebp - 0x21c]
xor eax, eax
mov edx, dword [esi + eax*4 + 0xa]
mov dword [ecx + eax*4 + 0x18], edx
add eax, 1
cmp eax, 4
jne 0x6ecc6907
mov eax, dword [ebp - 0x21c]
mov ecx, 0x10
mov word [eax + 0xa], cx
jmp 0x6ecc6200
lea ecx, [esi + 0x10]
cmp dword [ebp - 0x220], ecx
jb 0x6ecc6a10
movzx eax, byte [esi + 0xa]
movzx edx, byte [esi + 0xb]
mov ebx, dword [ebp - 0x21c]
shl eax, 8
add eax, edx
mov word [ebx + 0x1c], ax
movzx eax, byte [esi + 0xc]
movzx edx, byte [esi + 0xd]
shl eax, 8
add eax, edx
mov word [ebx + 0x1e], ax
movzx eax, byte [esi + 0xe]
movzx edx, byte [esi + 0xf]
mov esi, ebx
shl eax, 8
add eax, edx
mov word [ebx + 0x20], ax
jmp 0x6ecc6716
mov edi, dword [ebp - 0x21c]
movzx esi, word [ebp - 0x22e]
xor eax, eax
mov ebx, dword [ebp - 0x224]
mov word [edi + 0x1a], ax
lea eax, [edi + 0x1c]
mov word [edi + 0x18], si
mov dword [esp + 8], ebx
mov ebx, dword [ebp - 0x22c]
mov dword [esp], eax
mov dword [esp + 4], ebx
call sub.ucrtbase.dll_memcpy
lea eax, [esi + 4]
mov word [edi + 0xa], ax
jmp 0x6ecc6200
mov edx, 0x232c
mov esi, dword [sym.imp.ucrtbase.dll_free]
test byte [0x6ecc9048], 1
jne 0x6ecc6ab0
lea esi, [esi]
mov dword [ebp - 0x220], edx
mov dword [esp], eax
call esi
mov eax, dword [ebp - 0x21c]
mov dword [esp], eax
call esi
mov edx, dword [ebp - 0x220]
jmp 0x6ecc6260
mov eax, 0x1c
jmp 0x6ecc6103
mov edx, 0x251e
mov esi, dword [sym.imp.ucrtbase.dll_free]
jmp 0x6ecc69e0
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
mov edx, 8
jmp 0x6ecc6260
mov eax, dword [ebp - 0x21c]
mov edx, 0x251e
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [eax + 4]
jmp 0x6ecc69e0
mov eax, dword [ebp - 0x21c]
mov edx, 8
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [eax + 4]
jmp 0x6ecc69e0
mov dword [ebp - 0x224], 0
mov edi, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x224]
mov dword [edi + 0x18], eax
lea eax, [eax*4 + 4]
mov word [edi + 0xa], ax
jmp 0x6ecc6200
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov edx, 0x251e
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax + 4]
jmp 0x6ecc69e0
movzx ebx, bx
mov dword [ebp - 0x220], edx
mov dword [esp], ebx
call fcn.6ecc5c10
mov dword [esp + 0xc], str.unhandled_type:__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x6eccbb7c
mov dword [esp + 4], 0x6ecc9048
mov dword [esp], 0
call fcn.6ecc55a0
mov eax, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x220]
mov eax, dword [eax + 4]
jmp 0x6ecc69e0
mov eax, dword [ebp - 0x224]
mov esi, dword [sym.imp.ucrtbase.dll_free]
test eax, eax
je 0x6ecc6b30
mov edi, dword [ebp - 0x21c]
mov ebx, dword [ebp - 0x224]
lea esi, [esi]
sub ebx, 1
mov eax, dword [edi + ebx*4 + 0x1c]
mov dword [esp], eax
call esi
test ebx, ebx
jne 0x6ecc6b20
mov edx, 8
jmp 0x6ecc6a9d
movzx edx, word [esi + eax - 2]
mov word [ebp + eax - 0x11a], dx
jmp 0x6ecc65c5
mov eax, dword [edx + 0x18]
mov edi, edx
mov esi, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], eax
call esi
mov eax, dword [edi + 4]
mov edx, 8
jmp 0x6ecc69e0