Function at 0x133f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x16170
push 0x15588
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffb68
push ebx
push esi
push edi
jmp 0x13428
mov eax, dword [ebp + 8]
cmp dword [eax], 0x8163
je 0x13448
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0x42a8
je 0x13448
mov eax, 0xc000000d
jmp 0x13cae
mov edx, dword [ebp + 8]
cmp dword [edx], 0x42a8
jne 0x1350f
mov eax, 0x200
mov word [ebp - 0x13e], ax
xor ecx, ecx
mov word [ebp - 0x140], cx
lea edx, [ebp - 0x348]
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp + 8]
add eax, 8
push eax
call dword [sym.imp.ntoskrnl.exe_wcslen]
add esp, 4
shl eax, 1
mov dword [ebp - 0x144], eax
mov cx, word [ebp - 0x144]
mov word [ebp - 0x140], cx
movzx edx, word [ebp - 0x13e]
cmp dword [ebp - 0x144], edx
jbe 0x134b7
mov eax, 0xc000000d
jmp 0x13cae
movzx eax, word [ebp - 0x140]
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
mov edx, dword [ebp - 0x13c]
push edx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push 0
lea eax, [ebp - 0x140]
push eax
call fcn.00014920
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x134fc
mov eax, 0xc000000d
jmp 0x13cae
push 1
mov ecx, dword [ebp - 0x34c]
push ecx
call fcn.000147e0
jmp 0x13cae
push 0x17868
call dword [sym.imp.ntoskrnl.exe_wcslen]
add esp, 4
lea edx, [eax + eax + 2]
push edx
push str.__C:WindowsSystem32_
lea eax, [ebp - 0x348]
push eax
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
cmp dword [0x17ad8], 0
je 0x13546
xor eax, eax
jmp 0x13cae
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [0x17a68], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [0x17a7c], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov dword [0x17a90], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [0x17aa4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [0x17ab8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
mov dword [0x17acc], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
mov dword [0x17648], edx
push str.KeServiceDescriptorTable
call fcn.000145b0
mov dword [0x17af8], eax
cmp dword [0x17af8], 0
jne 0x135ba
mov eax, 0xc000000d
jmp 0x13cae
mov eax, 0x200
mov word [ebp - 0x13e], ax
lea ecx, [ebp - 0x348]
push ecx
call dword [sym.imp.ntoskrnl.exe_wcslen]
add esp, 4
shl eax, 1
mov word [ebp - 0x140], ax
lea edx, [ebp - 0x348]
mov dword [ebp - 0x13c], edx
push 0x11c
push 0
lea eax, [ebp - 0x470]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp - 0x468], 0xffffffff
lea ecx, [ebp - 0x470]
push ecx
call fcn.000141c0
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
jge 0x13630
mov eax, 0xc000000d
jmp 0x13cae
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x454]
push eax
call fcn.00014460
lea ecx, [ebp - 0x138]
push ecx
lea edx, [ebp - 0x4a4]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x4a4]
push eax
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
jge 0x13686
mov eax, 0xc000000d
jmp 0x13cae
lea edx, [ebp - 0x490]
push edx
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
push 0x10
push 0
lea edx, [ebp - 0x488]
push edx
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x140]
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x468]
push ecx
lea edx, [ebp - 0x140]
push edx
call fcn.00014920
mov dword [0x17ad8], eax
cmp dword [0x17ad8], 0
jne 0x136f1
mov eax, 0xc000000d
jmp 0x13cae
mov dword [ebp - 0x478], 0xc000000d
mov dword [ebp - 4], 0
lea eax, [ebp - 0x488]
push eax
call fcn.00014670
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
jne 0x13722
jmp 0x13c7d
mov ecx, dword [ebp - 0x498]
mov edx, dword [ecx + 0x3c]
add edx, dword [ebp - 0x498]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, 0xf8
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x498]
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x1375b
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0x4550
je 0x13760
jmp 0x13c7d
mov ecx, dword [ebp - 0x2c]
add ecx, 0x18
mov dword [ebp - 0x494], ecx
mov edx, dword [ebp - 0x494]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x34], eax
push str.NtOpenProcess
call fcn.000145b0
mov dword [0x17a54], eax
mov ecx, dword [0x17a54]
add ecx, 5
mov dword [0x17a5c], ecx
mov edx, dword [0x17a54]
add edx, 1
sub edx, dword [ebp - 0x468]
push edx
push 1
mov eax, dword [ebp - 0x498]
push eax
call fcn.00013fd0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x137c2
jmp 0x13c7d
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov dword [0x17a58], edx
mov eax, dword [0x17af8]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x468]
push ecx
push 1
mov edx, dword [ebp - 0x498]
push edx
call fcn.00013fd0
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0xffffffff
jne 0x13803
jmp 0x13c7d
mov eax, dword [0x17a7c]
mov ecx, dword [ebp - 0x474]
lea edx, [ecx + eax*4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov dword [0x17a6c], ecx
mov edx, dword [0x17a6c]
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x468]
mov dword [0x17a6c], edx
mov eax, dword [0x17a6c]
add eax, 7
mov dword [0x17a70], eax
mov ecx, dword [0x17a6c]
add ecx, 1
sub ecx, dword [ebp - 0x468]
push ecx
push 1
mov edx, dword [ebp - 0x498]
push edx
call fcn.00013fd0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x13873
jmp 0x13c7d
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
movzx ecx, byte [eax]
mov dword [0x17a74], ecx
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx + 2]
mov dword [0x17a78], eax
mov ecx, dword [0x17a78]
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x468]
mov dword [0x17a78], ecx
mov edx, dword [0x17a90]
mov eax, dword [ebp - 0x474]
lea ecx, [eax + edx*4]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov dword [0x17a80], eax
mov ecx, dword [0x17a80]
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x468]
mov dword [0x17a80], ecx
mov edx, dword [0x17a80]
add edx, 7
mov dword [0x17a84], edx
mov eax, dword [0x17a80]
add eax, 1
sub eax, dword [ebp - 0x468]
push eax
push 1
mov ecx, dword [ebp - 0x498]
push ecx
call fcn.00013fd0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x1391c
jmp 0x13c7d
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
movzx eax, byte [edx]
mov dword [0x17a88], eax
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 2]
mov dword [0x17a8c], edx
mov eax, dword [0x17a8c]
sub eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x468]
mov dword [0x17a8c], eax
mov ecx, dword [0x17aa4]
mov edx, dword [ebp - 0x474]
lea eax, [edx + ecx*4]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov dword [0x17a94], edx
mov eax, dword [0x17a94]
sub eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x468]
mov dword [0x17a94], eax
mov ecx, dword [0x17a94]
add ecx, 0xa
mov dword [0x17a98], ecx
mov edx, dword [0x17a94]
add edx, 1
sub edx, dword [ebp - 0x468]
push edx
push 1
mov eax, dword [ebp - 0x498]
push eax
call fcn.00013fd0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x139c3
jmp 0x13c7d
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov dword [0x17a9c], edx
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
mov ecx, dword [eax + 6]
mov dword [0x17aa0], ecx
mov edx, dword [0x17aa0]
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x468]
mov dword [0x17aa0], edx
mov eax, dword [0x17ab8]
mov ecx, dword [ebp - 0x474]
lea edx, [ecx + eax*4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov dword [0x17aa8], ecx
mov edx, dword [0x17aa8]
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x468]
mov dword [0x17aa8], edx
mov eax, dword [0x17aa8]
add eax, 7
mov dword [0x17aac], eax
mov ecx, dword [0x17aa8]
add ecx, 1
sub ecx, dword [ebp - 0x468]
push ecx
push 1
mov edx, dword [ebp - 0x498]
push edx
call fcn.00013fd0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x13a6b
jmp 0x13c7d
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
movzx ecx, byte [eax]
mov dword [0x17ab0], ecx
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx + 2]
mov dword [0x17ab4], eax
mov ecx, dword [0x17ab4]
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x468]
mov dword [0x17ab4], ecx
mov edx, dword [0x17acc]
mov eax, dword [ebp - 0x474]
lea ecx, [eax + edx*4]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov dword [0x17abc], eax
mov ecx, dword [0x17abc]
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x468]
mov dword [0x17abc], ecx
mov edx, dword [0x17abc]
add edx, 0xa
mov dword [0x17ac0], edx
mov eax, dword [0x17abc]
add eax, 1
sub eax, dword [ebp - 0x468]
push eax
push 1
mov ecx, dword [ebp - 0x498]
push ecx
call fcn.00013fd0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x13b14
jmp 0x13c7d
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov dword [0x17ac4], eax
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 6]
mov dword [0x17ac8], edx
mov eax, dword [0x17ac8]
sub eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x468]
mov dword [0x17ac8], eax
push str.ObOpenObjectByPointer
call fcn.000145b0
mov dword [0x17ad0], eax
mov ecx, dword [0x17ad0]
sub ecx, dword [ebp - 0x468]
add ecx, dword [0x17ad8]
mov dword [0x17afc], ecx
push str.PsLookupProcessByProcessId
call fcn.000145b0
mov dword [0x17ad0], eax
mov edx, dword [0x17ad0]
sub edx, dword [ebp - 0x468]
add edx, dword [0x17ad8]
mov dword [0x17af4], edx
mov eax, dword [0x17ad0]
add eax, 5
mov dword [0x17ad4], eax
mov ecx, dword [0x17a5c]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x28], 0
jmp 0x13bbf
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0x400
jae 0x13be7
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x28]
movzx ecx, byte [eax]
cmp ecx, 0xe8
jne 0x13be5
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x28]
mov eax, dword [edx + 1]
mov dword [ebp - 0x20], eax
jmp 0x13bb6
mov eax, dword [0x17a54]
sub eax, dword [ebp - 0x468]
add eax, dword [0x17ad8]
mov dword [0x17a54], eax
mov ecx, dword [0x17a6c]
sub ecx, dword [ebp - 0x468]
add ecx, dword [0x17ad8]
mov dword [0x17a6c], ecx
mov edx, dword [0x17a80]
sub edx, dword [ebp - 0x468]
add edx, dword [0x17ad8]
mov dword [0x17a80], edx
mov eax, dword [0x17a94]
sub eax, dword [ebp - 0x468]
add eax, dword [0x17ad8]
mov dword [0x17a94], eax
mov ecx, dword [0x17aa8]
sub ecx, dword [ebp - 0x468]
add ecx, dword [0x17ad8]
mov dword [0x17aa8], ecx
mov edx, dword [0x17abc]
sub edx, dword [ebp - 0x468]
add edx, dword [0x17ad8]
mov dword [0x17abc], edx
mov dword [ebp - 0x478], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00013c8b
jmp 0x13c98
jmp 0x13ca8
mov eax, dword [ebp - 0x478]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4