Function at 0x133c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x16168
push 0x15598
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffb68
push ebx
push esi
push edi
jmp 0x133f8
mov eax, dword [ebp + 8]
cmp dword [eax], 0x8163
je 0x13418
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0x42a8
je 0x13418
mov eax, 0xc000000d
jmp 0x13c7e
mov edx, dword [ebp + 8]
cmp dword [edx], 0x42a8
jne 0x134df
mov eax, 0x200
mov word [ebp - 0x13e], ax
xor ecx, ecx
mov word [ebp - 0x140], cx
lea edx, [ebp - 0x348]
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp + 8]
add eax, 8
push eax
call dword [sym.imp.ntoskrnl.exe_wcslen]
add esp, 4
shl eax, 1
mov dword [ebp - 0x144], eax
mov cx, word [ebp - 0x144]
mov word [ebp - 0x140], cx
movzx edx, word [ebp - 0x13e]
cmp dword [ebp - 0x144], edx
jbe 0x13487
mov eax, 0xc000000d
jmp 0x13c7e
movzx eax, word [ebp - 0x140]
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
mov edx, dword [ebp - 0x13c]
push edx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push 0
lea eax, [ebp - 0x140]
push eax
call fcn.000148f0
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x134cc
mov eax, 0xc000000d
jmp 0x13c7e
push 1
mov ecx, dword [ebp - 0x34c]
push ecx
call fcn.000147b0
jmp 0x13c7e
push 0x18630
call dword [sym.imp.ntoskrnl.exe_wcslen]
add esp, 4
lea edx, [eax + eax + 2]
push edx
push str.__C:WindowsSystem32_
lea eax, [ebp - 0x348]
push eax
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
cmp dword [0x188b0], 0
je 0x13516
xor eax, eax
jmp 0x13c7e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [0x18840], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [0x18854], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov dword [0x18868], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [0x1887c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [0x18890], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
mov dword [0x188a4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
mov dword [0x18410], edx
push str.KeServiceDescriptorTable
call fcn.00014580
mov dword [0x188d0], eax
cmp dword [0x188d0], 0
jne 0x1358a
mov eax, 0xc000000d
jmp 0x13c7e
mov eax, 0x200
mov word [ebp - 0x13e], ax
lea ecx, [ebp - 0x348]
push ecx
call dword [sym.imp.ntoskrnl.exe_wcslen]
add esp, 4
shl eax, 1
mov word [ebp - 0x140], ax
lea edx, [ebp - 0x348]
mov dword [ebp - 0x13c], edx
push 0x11c
push 0
lea eax, [ebp - 0x470]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp - 0x468], 0xffffffff
lea ecx, [ebp - 0x470]
push ecx
call fcn.00014190
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
jge 0x13600
mov eax, 0xc000000d
jmp 0x13c7e
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x454]
push eax
call fcn.00014430
lea ecx, [ebp - 0x138]
push ecx
lea edx, [ebp - 0x4a4]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x4a4]
push eax
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
jge 0x13656
mov eax, 0xc000000d
jmp 0x13c7e
lea edx, [ebp - 0x490]
push edx
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
push 0x10
push 0
lea edx, [ebp - 0x488]
push edx
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x140]
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x468]
push ecx
lea edx, [ebp - 0x140]
push edx
call fcn.000148f0
mov dword [0x188b0], eax
cmp dword [0x188b0], 0
jne 0x136c1
mov eax, 0xc000000d
jmp 0x13c7e
mov dword [ebp - 0x478], 0xc000000d
mov dword [ebp - 4], 0
lea eax, [ebp - 0x488]
push eax
call fcn.00014640
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
jne 0x136f2
jmp 0x13c4d
mov ecx, dword [ebp - 0x498]
mov edx, dword [ecx + 0x3c]
add edx, dword [ebp - 0x498]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, 0xf8
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x498]
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x1372b
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0x4550
je 0x13730
jmp 0x13c4d
mov ecx, dword [ebp - 0x2c]
add ecx, 0x18
mov dword [ebp - 0x494], ecx
mov edx, dword [ebp - 0x494]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x34], eax
push str.NtOpenProcess
call fcn.00014580
mov dword [0x1882c], eax
mov ecx, dword [0x1882c]
add ecx, 5
mov dword [0x18834], ecx
mov edx, dword [0x1882c]
add edx, 1
sub edx, dword [ebp - 0x468]
push edx
push 1
mov eax, dword [ebp - 0x498]
push eax
call fcn.00013fa0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x13792
jmp 0x13c4d
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov dword [0x18830], edx
mov eax, dword [0x188d0]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x468]
push ecx
push 1
mov edx, dword [ebp - 0x498]
push edx
call fcn.00013fa0
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0xffffffff
jne 0x137d3
jmp 0x13c4d
mov eax, dword [0x18854]
mov ecx, dword [ebp - 0x474]
lea edx, [ecx + eax*4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov dword [0x18844], ecx
mov edx, dword [0x18844]
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x468]
mov dword [0x18844], edx
mov eax, dword [0x18844]
add eax, 7
mov dword [0x18848], eax
mov ecx, dword [0x18844]
add ecx, 1
sub ecx, dword [ebp - 0x468]
push ecx
push 1
mov edx, dword [ebp - 0x498]
push edx
call fcn.00013fa0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x13843
jmp 0x13c4d
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
movzx ecx, byte [eax]
mov dword [0x1884c], ecx
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx + 2]
mov dword [0x18850], eax
mov ecx, dword [0x18850]
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x468]
mov dword [0x18850], ecx
mov edx, dword [0x18868]
mov eax, dword [ebp - 0x474]
lea ecx, [eax + edx*4]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov dword [0x18858], eax
mov ecx, dword [0x18858]
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x468]
mov dword [0x18858], ecx
mov edx, dword [0x18858]
add edx, 7
mov dword [0x1885c], edx
mov eax, dword [0x18858]
add eax, 1
sub eax, dword [ebp - 0x468]
push eax
push 1
mov ecx, dword [ebp - 0x498]
push ecx
call fcn.00013fa0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x138ec
jmp 0x13c4d
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
movzx eax, byte [edx]
mov dword [0x18860], eax
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 2]
mov dword [0x18864], edx
mov eax, dword [0x18864]
sub eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x468]
mov dword [0x18864], eax
mov ecx, dword [0x1887c]
mov edx, dword [ebp - 0x474]
lea eax, [edx + ecx*4]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov dword [0x1886c], edx
mov eax, dword [0x1886c]
sub eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x468]
mov dword [0x1886c], eax
mov ecx, dword [0x1886c]
add ecx, 0xa
mov dword [0x18870], ecx
mov edx, dword [0x1886c]
add edx, 1
sub edx, dword [ebp - 0x468]
push edx
push 1
mov eax, dword [ebp - 0x498]
push eax
call fcn.00013fa0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x13993
jmp 0x13c4d
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov dword [0x18874], edx
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
mov ecx, dword [eax + 6]
mov dword [0x18878], ecx
mov edx, dword [0x18878]
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x468]
mov dword [0x18878], edx
mov eax, dword [0x18890]
mov ecx, dword [ebp - 0x474]
lea edx, [ecx + eax*4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov dword [0x18880], ecx
mov edx, dword [0x18880]
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x468]
mov dword [0x18880], edx
mov eax, dword [0x18880]
add eax, 7
mov dword [0x18884], eax
mov ecx, dword [0x18880]
add ecx, 1
sub ecx, dword [ebp - 0x468]
push ecx
push 1
mov edx, dword [ebp - 0x498]
push edx
call fcn.00013fa0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x13a3b
jmp 0x13c4d
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
movzx ecx, byte [eax]
mov dword [0x18888], ecx
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx + 2]
mov dword [0x1888c], eax
mov ecx, dword [0x1888c]
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x468]
mov dword [0x1888c], ecx
mov edx, dword [0x188a4]
mov eax, dword [ebp - 0x474]
lea ecx, [eax + edx*4]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov dword [0x18894], eax
mov ecx, dword [0x18894]
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x468]
mov dword [0x18894], ecx
mov edx, dword [0x18894]
add edx, 0xa
mov dword [0x18898], edx
mov eax, dword [0x18894]
add eax, 1
sub eax, dword [ebp - 0x468]
push eax
push 1
mov ecx, dword [ebp - 0x498]
push ecx
call fcn.00013fa0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x13ae4
jmp 0x13c4d
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov dword [0x1889c], eax
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 6]
mov dword [0x188a0], edx
mov eax, dword [0x188a0]
sub eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x468]
mov dword [0x188a0], eax
push str.ObOpenObjectByPointer
call fcn.00014580
mov dword [0x188a8], eax
mov ecx, dword [0x188a8]
sub ecx, dword [ebp - 0x468]
add ecx, dword [0x188b0]
mov dword [0x188d4], ecx
push str.PsLookupProcessByProcessId
call fcn.00014580
mov dword [0x188a8], eax
mov edx, dword [0x188a8]
sub edx, dword [ebp - 0x468]
add edx, dword [0x188b0]
mov dword [0x188cc], edx
mov eax, dword [0x188a8]
add eax, 5
mov dword [0x188ac], eax
mov ecx, dword [0x18834]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x28], 0
jmp 0x13b8f
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0x400
jae 0x13bb7
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x28]
movzx ecx, byte [eax]
cmp ecx, 0xe8
jne 0x13bb5
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x28]
mov eax, dword [edx + 1]
mov dword [ebp - 0x20], eax
jmp 0x13b86
mov eax, dword [0x1882c]
sub eax, dword [ebp - 0x468]
add eax, dword [0x188b0]
mov dword [0x1882c], eax
mov ecx, dword [0x18844]
sub ecx, dword [ebp - 0x468]
add ecx, dword [0x188b0]
mov dword [0x18844], ecx
mov edx, dword [0x18858]
sub edx, dword [ebp - 0x468]
add edx, dword [0x188b0]
mov dword [0x18858], edx
mov eax, dword [0x1886c]
sub eax, dword [ebp - 0x468]
add eax, dword [0x188b0]
mov dword [0x1886c], eax
mov ecx, dword [0x18880]
sub ecx, dword [ebp - 0x468]
add ecx, dword [0x188b0]
mov dword [0x18880], ecx
mov edx, dword [0x18894]
sub edx, dword [ebp - 0x468]
add edx, dword [0x188b0]
mov dword [0x18894], edx
mov dword [ebp - 0x478], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00013c5b
jmp 0x13c68
jmp 0x13c78
mov eax, dword [ebp - 0x478]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4