Function at 0x6a81e76c
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x9c
mov dword [esp + 0x34], eax
mov ecx, dword [eax + 0x17b8]
mov ebp, dword [eax + 0x17b0]
mov edi, ebp
neg edi
lea eax, [ecx + edi]
mov ebx, dword [esp + 0x34]
mov edx, dword [ebx + 0x17bc]
add edi, edx
mov esi, ebx
mov ebx, dword [ebx + 0xa68]
mov ebx, dword [ebx]
mov esi, dword [esi + 0xa6c]
add ebx, esi
mov dword [esp + 0x20], ebx
mov esi, dword [esp + 0x34]
mov ebx, dword [esi + 0xb28]
mov ebx, dword [ebx]
mov esi, dword [esi + 0xb2c]
add ebx, esi
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x34]
mov ebx, dword [ebx + 0xa70]
mov dword [esp + 0x78], ebx
mov bl, byte [eax - 1]
mov byte [esp + 8], bl
mov bl, byte [edi - 1]
mov byte [esp + 0x28], bl
mov bl, byte [ecx - 1]
mov byte [esp + 0x7c], bl
mov bl, byte [edx - 1]
mov byte [esp + 0x84], bl
mov bl, byte [ecx + ebp - 1]
mov byte [esp + 0x7d], bl
mov bl, byte [edx + ebp - 1]
mov byte [esp + 0x85], bl
lea esi, [ebp + ebp]
mov dword [esp + 4], esi
mov bl, byte [ecx + esi - 1]
mov byte [esp + 0x7e], bl
mov bl, byte [edx + esi - 1]
mov byte [esp + 0x86], bl
mov esi, dword [esp + 4]
add esi, ebp
mov dword [esp + 4], esi
mov bl, byte [ecx + esi - 1]
mov byte [esp + 0x7f], bl
mov bl, byte [edx + esi - 1]
mov byte [esp + 0x87], bl
lea esi, [ebp*4]
mov dword [esp + 0xc], esi
mov bl, byte [ecx + esi - 1]
mov byte [esp + 0x80], bl
mov bl, byte [edx + esi - 1]
mov byte [esp + 0x88], bl
mov ebx, dword [esp + 0xc]
lea esi, [ebp + ebx - 1]
mov bl, byte [ecx + esi]
mov byte [esp + 0x81], bl
mov bl, byte [edx + esi]
mov byte [esp + 0x89], bl
mov esi, dword [esp + 4]
lea esi, [esi + esi - 1]
mov bl, byte [ecx + esi]
mov byte [esp + 0x82], bl
mov bl, byte [edx + esi]
mov byte [esp + 0x8a], bl
mov ebx, ebp
not ebx
lea ebx, [ebx + ebp*8]
mov cl, byte [ecx + ebx]
mov byte [esp + 0x83], cl
mov bl, byte [edx + ebx]
mov byte [esp + 4], bl
mov byte [esp + 0x8b], bl
mov esi, dword [esp + 0x34]
mov ebp, dword [esi + 0x17f0]
test ebp, ebp
jne 0x6a81e978
mov ebx, dword [esi + 0x17f4]
test ebx, ebx
je 0x6a81f0c4
mov ebp, 4
mov esi, 3
xor edx, edx
xor ebx, ebx
movzx ecx, byte [esp + 0x7c]
add ecx, ebx
movzx ebx, byte [esp + 0x84]
add ebx, edx
movzx edx, byte [esp + 0x7d]
add ecx, edx
movzx edx, byte [esp + 0x85]
add ebx, edx
movzx edx, byte [esp + 0x7e]
add ecx, edx
movzx edx, byte [esp + 0x86]
add ebx, edx
movzx edx, byte [esp + 0x7f]
add ecx, edx
movzx edx, byte [esp + 0x87]
add ebx, edx
movzx edx, byte [esp + 0x80]
add ecx, edx
movzx edx, byte [esp + 0x88]
add ebx, edx
movzx edx, byte [esp + 0x81]
add ecx, edx
movzx edx, byte [esp + 0x89]
add ebx, edx
movzx edx, byte [esp + 0x82]
add ecx, edx
movzx edx, byte [esp + 0x8a]
add edx, ebx
movzx ebx, byte [esp + 0x83]
add ebx, ecx
movzx ecx, byte [esp + 4]
add edx, ecx
jmp 0x6a81e9ee
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
add ecx, edx
movzx ebx, byte [edi]
movzx edx, byte [edi + 1]
add ebx, edx
movzx edx, byte [eax + 2]
add ecx, edx
movzx edx, byte [edi + 2]
add ebx, edx
movzx edx, byte [eax + 3]
add ecx, edx
movzx edx, byte [edi + 3]
add ebx, edx
movzx edx, byte [eax + 4]
add ecx, edx
movzx edx, byte [edi + 4]
add ebx, edx
movzx edx, byte [eax + 5]
add ecx, edx
movzx edx, byte [edi + 5]
add ebx, edx
movzx edx, byte [eax + 6]
add ecx, edx
movzx edx, byte [edi + 6]
add edx, ebx
movzx ebx, byte [eax + 7]
add ebx, ecx
movzx ecx, byte [edi + 7]
add edx, ecx
mov ecx, dword [esp + 0x34]
mov ecx, dword [ecx + 0x17f4]
test ecx, ecx
jne 0x6a81f1d4
mov ebp, 4
mov esi, 3
add ebx, ebp
mov ecx, esi
sar ebx, cl
mov dword [esp + 0x24], ebx
add ebp, edx
mov dword [esp + 0x2c], ebp
sar dword [esp + 0x2c], cl
movzx ebx, byte [eax]
mov dword [esp + 0x38], ebx
movzx esi, byte [esp + 8]
mov dword [esp + 8], esi
movzx edx, byte [edi]
mov dword [esp + 0x3c], edx
movzx ecx, byte [esp + 0x28]
mov dword [esp + 0x28], ecx
movzx ebx, byte [eax + 1]
mov dword [esp + 0x40], ebx
movzx esi, byte [edi + 1]
mov dword [esp + 0x44], esi
movzx edx, byte [eax + 2]
mov dword [esp + 0x48], edx
movzx ecx, byte [edi + 2]
mov dword [esp + 0x4c], ecx
movzx ebx, byte [eax + 3]
mov dword [esp + 0x50], ebx
movzx esi, byte [edi + 3]
mov dword [esp + 0x54], esi
movzx edx, byte [eax + 4]
mov dword [esp + 0x58], edx
movzx ecx, byte [edi + 4]
mov dword [esp + 0x5c], ecx
movzx ebx, byte [eax + 5]
mov dword [esp + 0x60], ebx
movzx esi, byte [edi + 5]
mov dword [esp + 0x64], esi
movzx edx, byte [eax + 6]
mov dword [esp + 0x68], edx
movzx ecx, byte [edi + 6]
mov dword [esp + 0x6c], ecx
movzx eax, byte [eax + 7]
mov dword [esp + 0x70], eax
movzx edi, byte [edi + 7]
mov dword [esp + 0x74], edi
mov dword [esp + 0x30], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
jmp 0x6a81ead7
mov ebx, dword [esp + 0x78]
add dword [esp + 0x20], ebx
add dword [esp + 0x1c], ebx
cmp dword [esp + 0x30], 8
je 0x6a81f168
inc dword [esp + 0x30]
mov esi, dword [esp + 0x30]
movzx eax, byte [esp + esi + 0x7b]
mov edi, dword [esp + 0x38]
add edi, eax
movzx edx, byte [esp + esi + 0x83]
mov dword [esp + 4], edx
add edx, dword [esp + 0x3c]
sub edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
movzx ecx, byte [ebx]
mov esi, dword [esp + 0x1c]
movzx ebx, byte [esi]
sub edi, dword [esp + 8]
js 0x6a81f0dc
cmp edi, 0xff
jle 0x6a81eb1f
mov edi, 0xff
test edx, edx
js 0x6a81f0e6
cmp edx, 0xff
jle 0x6a81eb34
mov edx, 0xff
mov esi, ecx
sub esi, dword [esp + 0x24]
imul esi, esi
add esi, dword [esp + 0x14]
mov ebp, ebx
sub ebp, dword [esp + 0x2c]
imul ebp, ebp
add ebp, esi
mov dword [esp + 0x14], ebp
mov esi, ecx
sub esi, dword [esp + 0x38]
imul esi, esi
add esi, dword [esp + 0xc]
mov ebp, ebx
sub ebp, dword [esp + 0x3c]
imul ebp, ebp
add ebp, esi
mov dword [esp + 0xc], ebp
mov ebp, ecx
sub ebp, eax
imul ebp, ebp
add ebp, dword [esp + 0x18]
mov esi, ebx
sub esi, dword [esp + 4]
imul esi, esi
add esi, ebp
mov dword [esp + 0x18], esi
sub ecx, edi
imul ecx, ecx
add ecx, dword [esp + 0x10]
sub ebx, edx
imul ebx, ebx
add ebx, ecx
mov dword [esp + 0x10], ebx
mov edi, dword [esp + 0x40]
add edi, eax
mov edx, dword [esp + 4]
add edx, dword [esp + 0x44]
sub edx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
movzx ebx, byte [esi + 1]
mov esi, dword [esp + 0x1c]
movzx ecx, byte [esi + 1]
sub edi, dword [esp + 8]
js 0x6a81f128
cmp edi, 0xff
jle 0x6a81ebd3
mov edi, 0xff
test edx, edx
js 0x6a81f120
cmp edx, 0xff
jle 0x6a81ebe8
mov edx, 0xff
mov ebp, ebx
sub ebp, dword [esp + 0x24]
imul ebp, ebp
add ebp, dword [esp + 0x14]
mov esi, ecx
sub esi, dword [esp + 0x2c]
imul esi, esi
add esi, ebp
mov dword [esp + 0x14], esi
mov ebp, ebx
sub ebp, dword [esp + 0x40]
imul ebp, ebp
add ebp, dword [esp + 0xc]
mov esi, ecx
sub esi, dword [esp + 0x44]
imul esi, esi
add esi, ebp
mov dword [esp + 0xc], esi
mov ebp, ebx
sub ebp, eax
imul ebp, ebp
add ebp, dword [esp + 0x18]
mov esi, ecx
sub esi, dword [esp + 4]
imul esi, esi
add esi, ebp
mov dword [esp + 0x18], esi
sub ebx, edi
imul ebx, ebx
add ebx, dword [esp + 0x10]
sub ecx, edx
imul ecx, ecx
add ecx, ebx
mov dword [esp + 0x10], ecx
mov edi, dword [esp + 0x48]
add edi, eax
mov edx, dword [esp + 4]
add edx, dword [esp + 0x4c]
sub edx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
movzx ebx, byte [esi + 2]
mov esi, dword [esp + 0x1c]
movzx ecx, byte [esi + 2]
sub edi, dword [esp + 8]
js 0x6a81f10c
cmp edi, 0xff
jle 0x6a81ec87
mov edi, 0xff
test edx, edx
js 0x6a81f116
cmp edx, 0xff
jle 0x6a81ec9c
mov edx, 0xff
mov ebp, ebx
sub ebp, dword [esp + 0x24]
imul ebp, ebp
add ebp, dword [esp + 0x14]
mov esi, ecx
sub esi, dword [esp + 0x2c]
imul esi, esi
add esi, ebp
mov dword [esp + 0x14], esi
mov ebp, ebx
sub ebp, dword [esp + 0x48]
imul ebp, ebp
add ebp, dword [esp + 0xc]
mov esi, ecx
sub esi, dword [esp + 0x4c]
imul esi, esi
add esi, ebp
mov dword [esp + 0xc], esi
mov ebp, ebx
sub ebp, eax
imul ebp, ebp
add ebp, dword [esp + 0x18]
mov esi, ecx
sub esi, dword [esp + 4]
imul esi, esi
add esi, ebp
mov dword [esp + 0x18], esi
sub ebx, edi
imul ebx, ebx
add ebx, dword [esp + 0x10]
sub ecx, edx
imul ecx, ecx
add ecx, ebx
mov dword [esp + 0x10], ecx
mov edi, dword [esp + 0x50]
add edi, eax
mov edx, dword [esp + 4]
add edx, dword [esp + 0x54]
sub edx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
movzx ebx, byte [esi + 3]
mov esi, dword [esp + 0x1c]
movzx ecx, byte [esi + 3]
sub edi, dword [esp + 8]
js 0x6a81f160
cmp edi, 0xff
jle 0x6a81ed3b
mov edi, 0xff
test edx, edx
js 0x6a81f158
cmp edx, 0xff
jle 0x6a81ed50
mov edx, 0xff
mov ebp, ebx
sub ebp, dword [esp + 0x24]
imul ebp, ebp
add ebp, dword [esp + 0x14]
mov esi, ecx
sub esi, dword [esp + 0x2c]
imul esi, esi
add esi, ebp
mov dword [esp + 0x14], esi
mov ebp, ebx
sub ebp, dword [esp + 0x50]
imul ebp, ebp
add ebp, dword [esp + 0xc]
mov esi, ecx
sub esi, dword [esp + 0x54]
imul esi, esi
add esi, ebp
mov dword [esp + 0xc], esi
mov ebp, ebx
sub ebp, eax
imul ebp, ebp
add ebp, dword [esp + 0x18]
mov esi, ecx
sub esi, dword [esp + 4]
imul esi, esi
add esi, ebp
mov dword [esp + 0x18], esi
sub ebx, edi
imul ebx, ebx
add ebx, dword [esp + 0x10]
sub ecx, edx
imul ecx, ecx
add ecx, ebx
mov dword [esp + 0x10], ecx
mov edi, dword [esp + 0x58]
add edi, eax
mov edx, dword [esp + 4]
add edx, dword [esp + 0x5c]
sub edx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
movzx ebx, byte [esi + 4]
mov esi, dword [esp + 0x1c]
movzx ecx, byte [esi + 4]
sub edi, dword [esp + 8]
js 0x6a81f150
cmp edi, 0xff
jle 0x6a81edef
mov edi, 0xff
test edx, edx
js 0x6a81f148
cmp edx, 0xff
jle 0x6a81ee04
mov edx, 0xff
mov ebp, ebx
sub ebp, dword [esp + 0x24]
imul ebp, ebp
add ebp, dword [esp + 0x14]
mov esi, ecx
sub esi, dword [esp + 0x2c]
imul esi, esi
add esi, ebp
mov dword [esp + 0x14], esi
mov ebp, ebx
sub ebp, dword [esp + 0x58]
imul ebp, ebp
add ebp, dword [esp + 0xc]
mov esi, ecx
sub esi, dword [esp + 0x5c]
imul esi, esi
add esi, ebp
mov dword [esp + 0xc], esi
mov ebp, ebx
sub ebp, eax
imul ebp, ebp
add ebp, dword [esp + 0x18]
mov esi, ecx
sub esi, dword [esp + 4]
imul esi, esi
add esi, ebp
mov dword [esp + 0x18], esi
sub ebx, edi
imul ebx, ebx
add ebx, dword [esp + 0x10]
sub ecx, edx
imul ecx, ecx
add ecx, ebx
mov dword [esp + 0x10], ecx
mov edi, dword [esp + 0x60]
add edi, eax
mov edx, dword [esp + 4]
add edx, dword [esp + 0x64]
sub edx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
movzx ebx, byte [esi + 5]
mov esi, dword [esp + 0x1c]
movzx ecx, byte [esi + 5]
sub edi, dword [esp + 8]
js 0x6a81f140
cmp edi, 0xff
jle 0x6a81eea3
mov edi, 0xff
test edx, edx
js 0x6a81f138
cmp edx, 0xff
jle 0x6a81eeb8
mov edx, 0xff
mov ebp, ebx
sub ebp, dword [esp + 0x24]
imul ebp, ebp
add ebp, dword [esp + 0x14]
mov esi, ecx
sub esi, dword [esp + 0x2c]
imul esi, esi
add esi, ebp
mov dword [esp + 0x14], esi
mov ebp, ebx
sub ebp, dword [esp + 0x60]
imul ebp, ebp
add ebp, dword [esp + 0xc]
mov esi, ecx
sub esi, dword [esp + 0x64]
imul esi, esi
add esi, ebp
mov dword [esp + 0xc], esi
mov ebp, ebx
sub ebp, eax
imul ebp, ebp
add ebp, dword [esp + 0x18]
mov esi, ecx
sub esi, dword [esp + 4]
imul esi, esi
add esi, ebp
mov dword [esp + 0x18], esi
sub ebx, edi
imul ebx, ebx
add ebx, dword [esp + 0x10]
sub ecx, edx
imul ecx, ecx
add ecx, ebx
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x68]
add ebp, eax
mov edx, dword [esp + 4]
add edx, dword [esp + 0x6c]
sub edx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
movzx ebx, byte [esi + 6]
mov esi, dword [esp + 0x1c]
movzx ecx, byte [esi + 6]
sub ebp, dword [esp + 8]
js 0x6a81f130
cmp ebp, 0xff
jle 0x6a81ef57
mov ebp, 0xff
test edx, edx
js 0x6a81f104
cmp edx, 0xff
jle 0x6a81ef6c
mov edx, 0xff
mov edi, ebx
sub edi, dword [esp + 0x24]
imul edi, edi
add edi, dword [esp + 0x14]
mov esi, ecx
sub esi, dword [esp + 0x2c]
imul esi, esi
add esi, edi
mov dword [esp + 0x14], esi
mov edi, ebx
sub edi, dword [esp + 0x68]
imul edi, edi
add edi, dword [esp + 0xc]
mov esi, ecx
sub esi, dword [esp + 0x6c]
imul esi, esi
add esi, edi
mov dword [esp + 0xc], esi
mov edi, ebx
sub edi, eax
imul edi, edi
add edi, dword [esp + 0x18]
mov esi, ecx
sub esi, dword [esp + 4]
imul esi, esi
add esi, edi
mov dword [esp + 0x18], esi
sub ebx, ebp
imul ebx, ebx
add ebx, dword [esp + 0x10]
sub ecx, edx
imul ecx, ecx
add ecx, ebx
mov dword [esp + 0x10], ecx
mov ebp, dword [esp + 0x70]
add ebp, eax
mov edx, dword [esp + 4]
add edx, dword [esp + 0x74]
sub edx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
movzx ebx, byte [esi + 7]
mov esi, dword [esp + 0x1c]
movzx ecx, byte [esi + 7]
sub ebp, dword [esp + 8]
js 0x6a81f0f0
cmp ebp, 0xff
jle 0x6a81f00b
mov ebp, 0xff
test edx, edx
js 0x6a81f0fa
cmp edx, 0xff
jle 0x6a81f020
mov edx, 0xff
mov edi, ebx
sub edi, dword [esp + 0x24]
mov esi, ecx
sub esi, dword [esp + 0x2c]
imul edi, edi
add edi, dword [esp + 0x14]
imul esi, esi
add esi, edi
mov dword [esp + 0x14], esi
mov edi, ebx
sub edi, dword [esp + 0x70]
mov esi, ecx
sub esi, dword [esp + 0x74]
imul edi, edi
add edi, dword [esp + 0xc]
imul esi, esi
add esi, edi
mov dword [esp + 0xc], esi
mov esi, ebx
sub esi, eax
mov eax, ecx
sub eax, dword [esp + 4]
imul esi, esi
add esi, dword [esp + 0x18]
imul eax, eax
add eax, esi
mov dword [esp + 0x18], eax
sub ebx, ebp
sub ecx, edx
imul ebx, ebx
add ebx, dword [esp + 0x10]
imul ecx, ecx
add ecx, ebx
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x30], 4
jne 0x6a81eabc
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx + 0xac8]
mov eax, dword [eax]
mov esi, dword [ebx + 0xacc]
add eax, esi
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0xb88]
mov eax, dword [eax]
mov edx, dword [ebx + 0xb8c]
add eax, edx
mov dword [esp + 0x1c], eax
jmp 0x6a81ead3
mov dword [esp + 0x2c], pe_nt_image_headers32
mov dword [esp + 0x24], pe_nt_image_headers32
jmp 0x6a81ea02
xor edi, edi
test edx, edx
jns 0x6a81eb27
xor edx, edx
jmp 0x6a81eb34
xor ebp, ebp
test edx, edx
jns 0x6a81f013
xor edx, edx
jmp 0x6a81f020
xor edx, edx
jmp 0x6a81ef6c
xor edi, edi
test edx, edx
jns 0x6a81ec8f
xor edx, edx
jmp 0x6a81ec9c
xor edx, edx
jmp 0x6a81ebe8
xor edi, edi
jmp 0x6a81ebd3
xor ebp, ebp
jmp 0x6a81ef57
xor edx, edx
jmp 0x6a81eeb8
xor edi, edi
jmp 0x6a81eea3
xor edx, edx
jmp 0x6a81ee04
xor edi, edi
jmp 0x6a81edef
xor edx, edx
jmp 0x6a81ed50
xor edi, edi
jmp 0x6a81ed3b
mov eax, dword [esp + 0x18]
mov dword [esp + 0x94], eax
mov ebp, dword [esp + 0x14]
cmp ebp, dword [esp + 0xc]
jle 0x6a81f1bc
mov ebp, dword [esp + 0xc]
mov ecx, 1
mov eax, dword [esp + 0x94]
cmp ebp, eax
jle 0x6a81f196
mov ecx, 2
mov ebx, dword [esp + 0x34]
mov edx, dword [ebx + 0x17d8]
cmp eax, ebp
jle 0x6a81f1a6
mov eax, ebp
cmp dword [esp + 0x10], eax
jl 0x6a81f1c0
mov eax, ecx
mov byte [edx + 1], al
add esp, 0x9c
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
jmp 0x6a81f186
mov eax, 3
mov byte [edx + 1], al
add esp, 0x9c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, 8
mov esi, 4
jmp 0x6a81e8e5