Function at 0x10009bd0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, 0xbb40e64e
xor eax, ebp
mov dword [ebp - 4], eax
movsx eax, byte [str.expand_32_byte_k0]
movsx ecx, byte [0x101d2f81]
shl ecx, 8
or eax, ecx
movsx ecx, byte [0x101d2f82]
shl ecx, 0x10
or eax, ecx
movsx ecx, byte [0x101d2f83]
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 1]
shl ecx, 8
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 2]
shl ecx, 0x10
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 3]
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 4]
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 5]
shl ecx, 8
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 6]
shl ecx, 0x10
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 7]
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 8]
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 9]
shl ecx, 8
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0xa]
shl ecx, 0x10
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0xb]
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0xc]
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0xd]
shl ecx, 8
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0xe]
shl ecx, 0x10
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0xf]
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x78], eax
movsx eax, byte [0x101d2f84]
movsx ecx, byte [0x101d2f85]
shl ecx, 8
or eax, ecx
movsx ecx, byte [0x101d2f86]
shl ecx, 0x10
or eax, ecx
movsx ecx, byte [0x101d2f87]
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x74], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
and ecx, 0
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov cl, 0x20
call fcn.10009bb0
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
and ecx, 0
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
mov cl, 0x20
call fcn.10009bb0
mov dword [ebp - 0x64], eax
movsx eax, byte [0x101d2f88]
movsx ecx, byte [0x101d2f89]
shl ecx, 8
or eax, ecx
movsx ecx, byte [0x101d2f8a]
shl ecx, 0x10
or eax, ecx
movsx ecx, byte [0x101d2f8b]
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0x10]
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x11]
shl ecx, 8
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x12]
shl ecx, 0x10
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x13]
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0x14]
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x15]
shl ecx, 8
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x16]
shl ecx, 0x10
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x17]
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0x18]
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x19]
shl ecx, 8
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x1a]
shl ecx, 0x10
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x1b]
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + 0x1c]
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x1d]
shl ecx, 8
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x1e]
shl ecx, 0x10
or eax, ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx + 0x1f]
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x50], eax
movsx eax, byte [0x101d2f8c]
movsx ecx, byte [0x101d2f8d]
shl ecx, 8
or eax, ecx
movsx ecx, byte [0x101d2f8e]
shl ecx, 0x10
or eax, ecx
movsx ecx, byte [0x101d2f8f]
shl ecx, 0x18
or eax, ecx
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10009780
pop ecx
pop ecx
and dword [ebp - 0x8c], 0
jmp 0x10009e70
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x40
jge 0x10009eb6
mov eax, dword [ebp - 0x8c]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, dword [ebp - 0x8c]
and ecx, 0x80000003
jns 0x10009e9b
dec ecx
or ecx, 0xfffffffc
inc ecx
shl ecx, 3
mov eax, dword [ebp + eax*4 - 0x48]
shr eax, cl
and eax, 0xff
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x8c]
mov byte [ecx], al
jmp 0x10009e63
mov ecx, dword [ebp - 4]
xor ecx, ebp
leave
ret