Function at 0x13150
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x16180
push 0x152dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffb68
push ebx
push esi
push edi
jmp 0x13188
mov eax, dword [ebp + 8]
cmp dword [eax], 0x8163
je 0x131a8
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0x42a8
je 0x131a8
mov eax, 0xc000000d
jmp 0x13a0e
mov edx, dword [ebp + 8]
cmp dword [edx], 0x42a8
jne 0x1326f
mov eax, 0x200
mov word [ebp - 0x13e], ax
xor ecx, ecx
mov word [ebp - 0x140], cx
lea edx, [ebp - 0x348]
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp + 8]
add eax, 8
push eax
call dword [sym.imp.ntoskrnl.exe_wcslen]
add esp, 4
shl eax, 1
mov dword [ebp - 0x144], eax
mov cx, word [ebp - 0x144]
mov word [ebp - 0x140], cx
movzx edx, word [ebp - 0x13e]
cmp dword [ebp - 0x144], edx
jbe 0x13217
mov eax, 0xc000000d
jmp 0x13a0e
movzx eax, word [ebp - 0x140]
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
mov edx, dword [ebp - 0x13c]
push edx
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
push 0
lea eax, [ebp - 0x140]
push eax
call fcn.00014680
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x1325c
mov eax, 0xc000000d
jmp 0x13a0e
push 1
mov ecx, dword [ebp - 0x34c]
push ecx
call fcn.00014540
jmp 0x13a0e
push 0x17498
call dword [sym.imp.ntoskrnl.exe_wcslen]
add esp, 4
lea edx, [eax + eax + 2]
push edx
push str.__C:WindowsSystem32_
lea eax, [ebp - 0x348]
push eax
call sub.ntoskrnl.exe_memcpy
add esp, 0xc
cmp dword [0x17718], 0
je 0x132a6
xor eax, eax
jmp 0x13a0e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [0x176a8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
mov dword [0x176bc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov dword [0x176d0], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
mov dword [0x176e4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [0x176f8], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
mov dword [0x1770c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
mov dword [0x17278], edx
push str.KeServiceDescriptorTable
call fcn.00014310
mov dword [0x17738], eax
cmp dword [0x17738], 0
jne 0x1331a
mov eax, 0xc000000d
jmp 0x13a0e
mov eax, 0x200
mov word [ebp - 0x13e], ax
lea ecx, [ebp - 0x348]
push ecx
call dword [sym.imp.ntoskrnl.exe_wcslen]
add esp, 4
shl eax, 1
mov word [ebp - 0x140], ax
lea edx, [ebp - 0x348]
mov dword [ebp - 0x13c], edx
push 0x11c
push 0
lea eax, [ebp - 0x470]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp - 0x468], 0xffffffff
lea ecx, [ebp - 0x470]
push ecx
call fcn.00013f20
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
jge 0x13390
mov eax, 0xc000000d
jmp 0x13a0e
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x454]
push eax
call fcn.000141c0
lea ecx, [ebp - 0x138]
push ecx
lea edx, [ebp - 0x4a4]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x4a4]
push eax
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0
jge 0x133e6
mov eax, 0xc000000d
jmp 0x13a0e
lea edx, [ebp - 0x490]
push edx
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
push 0x10
push 0
lea edx, [ebp - 0x488]
push edx
call sub.ntoskrnl.exe_memset
add esp, 0xc
lea eax, [ebp - 0x140]
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x468]
push ecx
lea edx, [ebp - 0x140]
push edx
call fcn.00014680
mov dword [0x17718], eax
cmp dword [0x17718], 0
jne 0x13451
mov eax, 0xc000000d
jmp 0x13a0e
mov dword [ebp - 0x478], 0xc000000d
mov dword [ebp - 4], 0
lea eax, [ebp - 0x488]
push eax
call fcn.000143d0
mov dword [ebp - 0x498], eax
cmp dword [ebp - 0x498], 0
jne 0x13482
jmp 0x139dd
mov ecx, dword [ebp - 0x498]
mov edx, dword [ecx + 0x3c]
add edx, dword [ebp - 0x498]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, 0xf8
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x498]
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x134bb
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0x4550
je 0x134c0
jmp 0x139dd
mov ecx, dword [ebp - 0x2c]
add ecx, 0x18
mov dword [ebp - 0x494], ecx
mov edx, dword [ebp - 0x494]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x34], eax
push str.NtOpenProcess
call fcn.00014310
mov dword [0x17694], eax
mov ecx, dword [0x17694]
add ecx, 5
mov dword [0x1769c], ecx
mov edx, dword [0x17694]
add edx, 1
sub edx, dword [ebp - 0x468]
push edx
push 1
mov eax, dword [ebp - 0x498]
push eax
call fcn.00013d30
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x13522
jmp 0x139dd
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov dword [0x17698], edx
mov eax, dword [0x17738]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x468]
push ecx
push 1
mov edx, dword [ebp - 0x498]
push edx
call fcn.00013d30
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0xffffffff
jne 0x13563
jmp 0x139dd
mov eax, dword [0x176bc]
mov ecx, dword [ebp - 0x474]
lea edx, [ecx + eax*4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov dword [0x176ac], ecx
mov edx, dword [0x176ac]
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x468]
mov dword [0x176ac], edx
mov eax, dword [0x176ac]
add eax, 7
mov dword [0x176b0], eax
mov ecx, dword [0x176ac]
add ecx, 1
sub ecx, dword [ebp - 0x468]
push ecx
push 1
mov edx, dword [ebp - 0x498]
push edx
call fcn.00013d30
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x135d3
jmp 0x139dd
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
movzx ecx, byte [eax]
mov dword [0x176b4], ecx
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx + 2]
mov dword [0x176b8], eax
mov ecx, dword [0x176b8]
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x468]
mov dword [0x176b8], ecx
mov edx, dword [0x176d0]
mov eax, dword [ebp - 0x474]
lea ecx, [eax + edx*4]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov dword [0x176c0], eax
mov ecx, dword [0x176c0]
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x468]
mov dword [0x176c0], ecx
mov edx, dword [0x176c0]
add edx, 7
mov dword [0x176c4], edx
mov eax, dword [0x176c0]
add eax, 1
sub eax, dword [ebp - 0x468]
push eax
push 1
mov ecx, dword [ebp - 0x498]
push ecx
call fcn.00013d30
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x1367c
jmp 0x139dd
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
movzx eax, byte [edx]
mov dword [0x176c8], eax
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 2]
mov dword [0x176cc], edx
mov eax, dword [0x176cc]
sub eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x468]
mov dword [0x176cc], eax
mov ecx, dword [0x176e4]
mov edx, dword [ebp - 0x474]
lea eax, [edx + ecx*4]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov dword [0x176d4], edx
mov eax, dword [0x176d4]
sub eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x468]
mov dword [0x176d4], eax
mov ecx, dword [0x176d4]
add ecx, 0xa
mov dword [0x176d8], ecx
mov edx, dword [0x176d4]
add edx, 1
sub edx, dword [ebp - 0x468]
push edx
push 1
mov eax, dword [ebp - 0x498]
push eax
call fcn.00013d30
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x13723
jmp 0x139dd
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx]
mov dword [0x176dc], edx
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
mov ecx, dword [eax + 6]
mov dword [0x176e0], ecx
mov edx, dword [0x176e0]
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x468]
mov dword [0x176e0], edx
mov eax, dword [0x176f8]
mov ecx, dword [ebp - 0x474]
lea edx, [ecx + eax*4]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov dword [0x176e8], ecx
mov edx, dword [0x176e8]
sub edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x468]
mov dword [0x176e8], edx
mov eax, dword [0x176e8]
add eax, 7
mov dword [0x176ec], eax
mov ecx, dword [0x176e8]
add ecx, 1
sub ecx, dword [ebp - 0x468]
push ecx
push 1
mov edx, dword [ebp - 0x498]
push edx
call fcn.00013d30
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x137cb
jmp 0x139dd
mov eax, dword [ebp - 0x498]
add eax, dword [ebp - 0x30]
movzx ecx, byte [eax]
mov dword [0x176f0], ecx
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx + 2]
mov dword [0x176f4], eax
mov ecx, dword [0x176f4]
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x468]
mov dword [0x176f4], ecx
mov edx, dword [0x1770c]
mov eax, dword [ebp - 0x474]
lea ecx, [eax + edx*4]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov dword [0x176fc], eax
mov ecx, dword [0x176fc]
sub ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x468]
mov dword [0x176fc], ecx
mov edx, dword [0x176fc]
add edx, 0xa
mov dword [0x17700], edx
mov eax, dword [0x176fc]
add eax, 1
sub eax, dword [ebp - 0x468]
push eax
push 1
mov ecx, dword [ebp - 0x498]
push ecx
call fcn.00013d30
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
jne 0x13874
jmp 0x139dd
mov edx, dword [ebp - 0x498]
add edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov dword [0x17704], eax
mov ecx, dword [ebp - 0x498]
add ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 6]
mov dword [0x17708], edx
mov eax, dword [0x17708]
sub eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x468]
mov dword [0x17708], eax
push str.ObOpenObjectByPointer
call fcn.00014310
mov dword [0x17710], eax
mov ecx, dword [0x17710]
sub ecx, dword [ebp - 0x468]
add ecx, dword [0x17718]
mov dword [0x1773c], ecx
push str.PsLookupProcessByProcessId
call fcn.00014310
mov dword [0x17710], eax
mov edx, dword [0x17710]
sub edx, dword [ebp - 0x468]
add edx, dword [0x17718]
mov dword [0x17734], edx
mov eax, dword [0x17710]
add eax, 5
mov dword [0x17714], eax
mov ecx, dword [0x1769c]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x28], 0
jmp 0x1391f
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0x400
jae 0x13947
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x28]
movzx ecx, byte [eax]
cmp ecx, 0xe8
jne 0x13945
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x28]
mov eax, dword [edx + 1]
mov dword [ebp - 0x20], eax
jmp 0x13916
mov eax, dword [0x17694]
sub eax, dword [ebp - 0x468]
add eax, dword [0x17718]
mov dword [0x17694], eax
mov ecx, dword [0x176ac]
sub ecx, dword [ebp - 0x468]
add ecx, dword [0x17718]
mov dword [0x176ac], ecx
mov edx, dword [0x176c0]
sub edx, dword [ebp - 0x468]
add edx, dword [0x17718]
mov dword [0x176c0], edx
mov eax, dword [0x176d4]
sub eax, dword [ebp - 0x468]
add eax, dword [0x17718]
mov dword [0x176d4], eax
mov ecx, dword [0x176e8]
sub ecx, dword [ebp - 0x468]
add ecx, dword [0x17718]
mov dword [0x176e8], ecx
mov edx, dword [0x176fc]
sub edx, dword [ebp - 0x468]
add edx, dword [0x17718]
mov dword [0x176fc], edx
mov dword [ebp - 0x478], 0
mov dword [ebp - 4], 0xffffffff
call fcn.000139eb
jmp 0x139f8
jmp 0x13a08
mov eax, dword [ebp - 0x478]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4