Function at 0x413485
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
sub esp, 0x94
mov eax, dword fs:[0x18]
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov eax, dword [eax + 0x30]
push esi
mov dword [esp + 0xc], eax
lea eax, [ebx + 0x348]
push edi
push eax
call dword [ebx + 0x38]
mov ebp, eax
xor eax, eax
mov edx, dword [ebp + 0x3c]
add edx, ebp
movzx edi, word [edx + 0x14]
movzx esi, word [edx + 6]
add edi, edx
lea ecx, [edi + 0x18]
test esi, esi
je 0x4134d9
mov edx, dword [ebx + 0x340]
cmp dword [ecx], edx
je 0x413506
inc eax
add ecx, 0x28
cmp eax, esi
jb 0x4134cd
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
call dword [ebx + 0x78]
xor ecx, ecx
mov ebp, eax
test esi, esi
je 0x41352c
mov edx, edi
lea eax, [edx + 4]
mov dword [esp + 0x18], edx
mov edx, eax
cmp dword [eax], ebp
je 0x413518
inc ecx
cmp ecx, esi
jb 0x4134ee
mov ebp, dword [esp + 0x18]
jmp 0x413534
imul eax, eax, 0x28
add eax, edi
mov edi, dword [eax + 0x24]
mov esi, dword [eax + 0x20]
add edi, ebp
shr esi, 2
jmp 0x4134e1
push dword [esp + 0xac]
mov ebp, dword [esp + 0x1c]
push ebp
call dword [ebx + 0x110]
jmp 0x413534
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x18], ebp
call dword [ebx + 0x74]
xor ecx, ecx
mov edx, eax
test esi, esi
je 0x41356c
cmp dword [edi + 4], edx
je 0x41354e
inc ecx
add edi, 4
cmp ecx, esi
jb 0x41353f
jmp 0x41356c
push 1
push ebp
lea eax, [esp + 0x24]
push eax
call dword [ebx + 0x100]
push 8
lea eax, [esp + 0x20]
push eax
push edi
call fcn.00413d40
add esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0xc]
cmp dword [edi + 0x18], 0
je 0x41369f
lea eax, [ebx + 0x370]
mov edx, eax
mov dword [esp + 0x14], edx
mov al, byte [edx]
xor ebp, ebp
and dword [esp + 0x10], 0
inc ebp
xor ecx, ecx
test al, al
je 0x41368d
lea ebx, [esp + 0x24]
mov esi, edx
sub ebx, edx
mov edx, ebp
cmp al, 0x3b
je 0x4135d7
cmp ecx, 0x80
jae 0x4135d7
cmp al, 0x77
jne 0x4135be
xor ebp, ebp
jmp 0x4135cc
mov ebp, edx
cmp al, 0x70
jne 0x4135cc
mov dword [esp + 0x10], 1
mov byte [esi + ebx], al
inc ecx
inc esi
mov al, byte [esi]
test al, al
jne 0x4135a8
mov ebx, dword [esp + 0xa8]
test ecx, ecx
je 0x41368d
mov eax, dword [esp + 0x14]
inc eax
mov byte [esp + ecx + 0x24], 0
add eax, ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
push 0
push eax
push dword [edi + 0x18]
push ebx
call fcn.00413770
mov edx, dword [esp + 0x24]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41358c
test ebp, ebp
je 0x41364e
cmp dword [esp + 0x10], 0
je 0x413632
call esi
mov edx, dword [esp + 0x14]
mov esi, eax
test esi, esi
je 0x41358c
push dword [esi]
push ebx
call fcn.004120d4
mov edx, dword [esp + 0x1c]
pop ecx
pop ecx
test eax, eax
je 0x41358c
mov eax, dword [esp + 0x20]
jmp 0x413682
cmp dword [esp + 0x10], 0
je 0x413665
call esi
mov edx, dword [esp + 0x14]
mov esi, eax
test esi, esi
je 0x41358c
push dword [esi]
push ebx
call fcn.004120d4
mov edx, dword [esp + 0x1c]
pop ecx
pop ecx
test eax, eax
je 0x41358c
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x14]
mov dword [esi], eax
jmp 0x41358c
mov edi, dword [edi]
lea eax, [ebx + 0x370]
cmp dword [edi + 0x18], 0
jne 0x413586
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x94
ret