Function at 0x48095d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
cmp esi, 6
jae 0x480972
mov eax, dword [esi*4 + 0x4d1090]
jmp 0x480977
mov eax, str.unknown
push eax
push str._n___s_n
call fcn.00409cda
xor ebp, ebp
pop ecx
pop ecx
sub esi, ebp
je 0x480b16
sub esi, 1
je 0x480b01
sub esi, 1
je 0x480ab8
sub esi, 1
je 0x480a6e
sub esi, 1
je 0x4809fb
sub esi, 1
je 0x4809d4
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 1
call fcn.0040f762
mov dword [esp], 0x4c75d0
call fcn.00409cda
pop ecx
jmp 0x480bdd
push str.____Random_Value_:
call fcn.00409cda
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push ebp
call fcn.0040f762
push 0x4c75d0
call fcn.00409cda
jmp 0x480bda
mov esi, dword [esp + 0x10]
push dword [esi + 0x14]
mov eax, dword [esi + 0x10]
add eax, esi
push eax
movzx eax, word [esi + 0xc]
shr eax, 1
push eax
push str.____Default_Salt_:__.s_n____Default_Iterations_:__u_n
call fcn.00409cda
movzx eax, word [esi + 4]
lea edx, [esi + 0x18]
push str.Credentials
push eax
mov ecx, esi
call fcn.00480c6c
movzx ecx, word [esi + 6]
mov edx, eax
push str.ServiceCredentials
push ecx
mov ecx, esi
call fcn.00480c6c
movzx ecx, word [esi + 8]
mov edx, eax
push str.OldCredentials
push ecx
mov ecx, esi
call fcn.00480c6c
movzx edx, word [esi + 0xa]
mov ecx, esi
push str.OlderCredentials
push edx
mov edx, eax
call fcn.00480c6c
add esp, 0x30
jmp 0x480bdd
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0xc]
add eax, esi
push eax
movzx eax, word [esi + 8]
shr eax, 1
push eax
push str.____Default_Salt_:__.s_n
call fcn.00409cda
movzx eax, word [esi + 4]
lea edx, [esi + 0x10]
push str.Credentials
push eax
mov ecx, esi
call fcn.00480be1
movzx edx, word [esi + 6]
mov ecx, esi
push str.OldCredentials
push edx
mov edx, eax
call fcn.00480be1
add esp, 0x1c
jmp 0x480bdd
mov edi, dword [esp + 0x10]
mov esi, ebp
cmp byte [edi + 3], 0
jbe 0x480bdd
push ebx
lea ebx, [edi + 0x10]
inc esi
push esi
push str._____02u
call fcn.00409cda
push ebp
push 0x10
pop edx
mov ecx, ebx
call fcn.0040f762
push 0x4c75d0
call fcn.00409cda
movzx eax, byte [edi + 3]
add esp, 0x10
add ebx, 0x10
cmp esi, eax
jb 0x480acc
pop ebx
jmp 0x480bdd
push dword [esp + 0x10]
mov eax, dword [esp + 0x18]
shr eax, 1
push eax
push str._____.s_n
jmp 0x4809f1
push str.____NTLM_:
call fcn.00409cda
mov esi, dword [esp + 0x14]
pop ecx
cmp byte [esi + 0x20], 0
je 0x480b37
push ebp
push 0x10
pop edx
mov ecx, esi
call fcn.0040f762
pop ecx
push str._n____LM___:
call fcn.00409cda
cmp byte [esi + 0x21], 0
pop ecx
je 0x480b55
push ebp
push 0x10
lea ecx, [esi + 0x10]
pop edx
call fcn.0040f762
pop ecx
push 0x4c75d0
call fcn.00409cda
pop ecx
cmp dword [esi + 0x24], ebp
je 0x480bdd
cmp word [esi + 0x44], bp
je 0x480b80
push ebp
push str.NTLM
push edi
push 0x10
lea ecx, [esi + 0x4c]
pop edx
call fcn.00490001
add esp, 0xc
movzx eax, word [esi + 0x64]
test ax, ax
je 0x480b9e
push 1
push str.ntlm
push edi
mov edx, eax
lea ecx, [esi + 0x6c]
call fcn.00490001
add esp, 0xc
cmp word [esi + 0x2c], bp
je 0x480bb9
push ebp
push str.LM
push edi
push 0x10
lea ecx, [esi + 0x34]
pop edx
call fcn.00490001
add esp, 0xc
movzx eax, word [esi + 0x5c]
test ax, ax
je 0x480bdd
push 1
mov edx, eax
lea ecx, [esi + 0x6c]
movzx eax, word [esi + 0x64]
push str.lm
push edi
add ecx, eax
call fcn.00490001
add esp, 0xc
pop edi
pop esi
pop ebp
ret