Function at 0x116b730
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1183001
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x103a8
call sub.ntdll.dll__chkstk
push esi
mov dword [ebp - 0x10380], ecx
mov word [ebp - 0xc354], 0
push 0x1fe
push 0
lea eax, [ebp - 0xc352]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10384], ecx
lea edx, [ebp - 0xc354]
mov dword [ebp - 0x10388], edx
mov eax, dword [ebp - 0x10388]
mov dword [ebp - 0x1038c], eax
mov ecx, dword [ebp - 0x10384]
mov dx, word [ecx]
mov word [ebp - 0x1038e], dx
mov eax, dword [ebp - 0x10388]
mov cx, word [ebp - 0x1038e]
mov word [eax], cx
mov edx, dword [ebp - 0x10384]
add edx, 2
mov dword [ebp - 0x10384], edx
mov eax, dword [ebp - 0x10388]
add eax, 2
mov dword [ebp - 0x10388], eax
cmp word [ebp - 0x1038e], 0
jne 0x116b79b
mov ecx, dword [ebp - 0x10380]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ecx + 8]
push eax
mov ecx, dword [ebp - 0x10380]
mov edx, dword [ecx]
push edx
call fcn.011434f0
mov dword [ebp - 0x408c], eax
push 1
push 0
mov eax, dword [ebp - 0x10380]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [eax + 8]
push edx
mov eax, dword [ebp - 0x10380]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x4074]
call fcn.01161ac0
mov dword [ebp - 4], 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x80f4]
call fcn.01146fd0
mov byte [ebp - 4], 1
push 0
lea edx, [ebp - 0x80f4]
push edx
push 0
push 3
lea ecx, [ebp - 0x4074]
call fcn.01163660
test eax, eax
jne 0x116b8d1
call fcn.010906a0
mov dword [ebp - 0x10394], eax
push 0x5a
push 0x1014bdc
call fcn.0116b610
push eax
push 0x1014bac
mov eax, dword [ebp - 0x10394]
push eax
mov ecx, dword [ebp - 0x10394]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
mov dword [ebp - 0x10368], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80f4]
call fcn.011471e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4074]
call fcn.01161b50
mov eax, dword [ebp - 0x10368]
jmp 0x116bf49
push 0x60
lea ecx, [ebp - 0x80f4]
call fcn.01147d80
mov dword [ebp - 0x4080], eax
cmp dword [ebp - 0x4080], 0
jne 0x116ba81
mov byte [ebp - 0x1035c], 0
push 0x3fff
push 0
lea ecx, [ebp - 0x1035b]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x10380]
mov eax, dword [edx]
push eax
call fcn.01165ea0
mov dword [ebp - 0xc35c], eax
cmp dword [ebp - 0xc35c], 0x200
jne 0x116b94e
mov ecx, dword [ebp - 0x408c]
push ecx
push 0x1014748
lea edx, [ebp - 0x1035c]
push edx
call sub.ntdll.dll_memcpy
add esp, 0xc
jmp 0x116b9e1
cmp dword [ebp - 0xc35c], 0x1000
jne 0x116b977
mov eax, dword [ebp - 0x408c]
push eax
push 0x1013748
lea ecx, [ebp - 0x1035c]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
jmp 0x116b9e1
call fcn.010906a0
mov dword [ebp - 0x10398], eax
push 0x6e
push 0x1014bdc
call fcn.0116b610
push eax
push 0x1014c48
mov edx, dword [ebp - 0x10398]
push edx
mov eax, dword [ebp - 0x10398]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
add esp, 0xc
mov dword [ebp - 0x1036c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80f4]
call fcn.011471e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4074]
call fcn.01161b50
mov eax, dword [ebp - 0x1036c]
jmp 0x116bf49
push 0
push 0
push 3
mov eax, dword [ebp - 0x408c]
push eax
lea ecx, [ebp - 0x1035c]
push ecx
lea ecx, [ebp - 0x80f4]
call fcn.011475e0
test eax, eax
jne 0x116ba6e
call fcn.010906a0
mov dword [ebp - 0x1039c], eax
push 0x74
push 0x1014bdc
call fcn.0116b610
push eax
push 0x1014b70
mov edx, dword [ebp - 0x1039c]
push edx
mov eax, dword [ebp - 0x1039c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
add esp, 0xc
mov dword [ebp - 0x10370], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80f4]
call fcn.011471e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4074]
call fcn.01161b50
mov eax, dword [ebp - 0x10370]
jmp 0x116bf49
push 0x60
lea ecx, [ebp - 0x80f4]
call fcn.01147d80
mov dword [ebp - 0x4080], eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xc154]
call fcn.01146fd0
mov byte [ebp - 4], 2
lea eax, [ebp - 0xc154]
push eax
lea ecx, [ebp - 0x80f4]
call fcn.01147a30
mov ecx, dword [ebp - 0x4080]
mov dword [ebp - 0x4090], ecx
mov edx, dword [ebp - 0x4090]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x4088], eax
lea ecx, [ebp - 0xc354]
mov dword [ebp - 0x103a0], ecx
mov edx, dword [ebp - 0x103a0]
add edx, 2
mov dword [ebp - 0x103a4], edx
mov eax, dword [ebp - 0x103a0]
mov cx, word [eax]
mov word [ebp - 0x103a6], cx
add dword [ebp - 0x103a0], 2
cmp word [ebp - 0x103a6], 0
jne 0x116bae2
mov edx, dword [ebp - 0x103a0]
sub edx, dword [ebp - 0x103a4]
sar edx, 1
mov dword [ebp - 0x103ac], edx
mov eax, dword [ebp - 0x103ac]
shl eax, 1
mov ecx, dword [ebp - 0x4090]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp - 0x4090]
mov dword [edx + 4], 0x18
mov eax, dword [ebp - 0x4090]
cmp dword [eax + 0x10], 0
jbe 0x116bb74
mov ecx, dword [ebp - 0x4090]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x4090]
add edx, dword [eax + 0x10]
mov ecx, dword [ebp - 0x4090]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x4090]
mov eax, dword [edx + 4]
add eax, 7
and eax, 0xfffffff8
mov ecx, dword [ebp - 0x4090]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x4090]
movzx eax, word [edx + 0x14]
add eax, dword [ebp - 0x4080]
mov dword [ebp - 0x4084], eax
mov ecx, dword [ebp - 0x4090]
mov edx, dword [ecx + 0x10]
push edx
lea eax, [ebp - 0xc354]
push eax
mov ecx, dword [ebp - 0x4084]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
push 0x60
lea ecx, [ebp - 0xc154]
call fcn.01147d80
mov dword [ebp - 0x409c], eax
mov edx, dword [ebp - 0x4090]
mov eax, dword [ebp - 0x409c]
mov ecx, dword [edx + 4]
sub ecx, dword [eax + 4]
mov dword [ebp - 0x4078], ecx
lea ecx, [ebp - 0x80f4]
call fcn.011814c0
mov dword [ebp - 0x407c], eax
mov edx, dword [ebp - 0x407c]
mov eax, dword [edx + 0x18]
add eax, dword [ebp - 0x4078]
mov ecx, dword [ebp - 0x407c]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 0x409c]
mov dword [ebp - 0x4014], edx
mov eax, dword [ebp - 0x4090]
mov dword [ebp - 0xc358], eax
mov ecx, dword [ebp - 0x4090]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x4098], edx
mov eax, dword [ebp - 0x409c]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x80fc], ecx
mov edx, dword [ebp - 0x4014]
add edx, dword [ebp - 0x80fc]
mov eax, dword [edx]
mov dword [ebp - 0x4010], eax
cmp dword [ebp - 0x4010], 0xffffffff
je 0x116bccc
mov ecx, dword [ebp - 0x4014]
add ecx, dword [ebp - 0x80fc]
mov dword [ebp - 0x10360], ecx
mov edx, dword [ebp - 0x10360]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x10360]
push ecx
mov edx, dword [ebp - 0xc358]
add edx, dword [ebp - 0x4098]
push edx
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x10360]
mov ecx, dword [ebp - 0x4098]
add ecx, dword [eax + 4]
mov dword [ebp - 0x4098], ecx
mov edx, dword [ebp - 0x10360]
mov eax, dword [ebp - 0x80fc]
add eax, dword [edx + 4]
mov dword [ebp - 0x80fc], eax
mov ecx, dword [ebp - 0x4014]
add ecx, dword [ebp - 0x80fc]
mov edx, dword [ecx]
mov dword [ebp - 0x4010], edx
jmp 0x116bc48
mov eax, dword [ebp - 0xc358]
add eax, dword [ebp - 0x4098]
mov dword [ebp - 0x4094], eax
mov ecx, dword [ebp - 0x4094]
mov dword [ecx], 0xffffffff
mov dword [ecx + 4], 0
mov byte [ebp - 0x400c], 0
push 0x3fff
push 0
lea edx, [ebp - 0x400b]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x408c]
push eax
lea ecx, [ebp - 0x80f4]
call fcn.011814c0
push eax
lea ecx, [ebp - 0x400c]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
lea edx, [ebp - 0x400c]
mov dword [ebp - 0x80f8], edx
mov dword [ebp - 0x10364], 0
jmp 0x116bd57
mov eax, dword [ebp - 0x10364]
add eax, 1
mov dword [ebp - 0x10364], eax
mov ecx, dword [ebp - 0x80f8]
movzx edx, word [ecx + 6]
sub edx, 1
cmp dword [ebp - 0x10364], edx
jge 0x116bdce
mov eax, dword [ebp - 0x10364]
add eax, 1
shl eax, 9
mov ecx, dword [ebp - 0x80f8]
movzx edx, word [ecx + 4]
add edx, dword [ebp - 0x80f8]
mov ecx, dword [ebp - 0x10364]
mov esi, dword [ebp - 0x80f8]
mov ax, word [esi + eax - 2]
mov word [edx + ecx*2 + 2], ax
mov ecx, dword [ebp - 0x80f8]
movzx edx, word [ecx + 4]
mov eax, dword [ebp - 0x10364]
add eax, 1
shl eax, 9
mov ecx, dword [ebp - 0x80f8]
mov esi, dword [ebp - 0x80f8]
mov dx, word [esi + edx]
mov word [ecx + eax - 2], dx
jmp 0x116bd48
push 0
mov eax, dword [ebp - 0x408c]
push eax
lea ecx, [ebp - 0x400c]
push ecx
push 0
push 3
lea ecx, [ebp - 0x4074]
call fcn.011638d0
test eax, eax
jne 0x116be6d
call fcn.010906a0
mov dword [ebp - 0x103b0], eax
push 0xc3
push 0x1014bdc
call fcn.0116b610
push eax
push 0x1014c28
mov edx, dword [ebp - 0x103b0]
push edx
mov eax, dword [ebp - 0x103b0]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
add esp, 0xc
mov dword [ebp - 0x10374], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc154]
call fcn.011471e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80f4]
call fcn.011471e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4074]
call fcn.01161b50
mov eax, dword [ebp - 0x10374]
jmp 0x116bf49
push 1
mov eax, dword [ebp - 0x408c]
push eax
lea ecx, [ebp - 0x400c]
push ecx
push 0
push 3
lea ecx, [ebp - 0x4074]
call fcn.011638d0
test eax, eax
jne 0x116bf09
call fcn.010906a0
mov dword [ebp - 0x103b4], eax
push 0xca
push 0x1014bdc
call fcn.0116b610
push eax
push 0x1014c00
mov edx, dword [ebp - 0x103b4]
push edx
mov eax, dword [ebp - 0x103b4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
add esp, 0xc
mov dword [ebp - 0x10378], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc154]
call fcn.011471e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80f4]
call fcn.011471e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4074]
call fcn.01161b50
mov eax, dword [ebp - 0x10378]
jmp 0x116bf49
mov dword [ebp - 0x1037c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc154]
call fcn.011471e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80f4]
call fcn.011471e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4074]
call fcn.01161b50
mov eax, dword [ebp - 0x1037c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4