Function at 0x1feb1000
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x40
push ebx
push esi
mov ebx, dword [esp + 0x4c]
push edi
push ebp
push 0
push 0
mov eax, dword [ebx + 4]
push eax
call sub.LTKRN11n.dll_Ordinal_191
lea edi, [esp + 0x1c]
add esp, 0xc
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push 0x40
push eax
mov ecx, dword [ebx + 4]
push ecx
call sub.LTKRN11n.dll_Ordinal_190
add esp, 0xc
test eax, eax
jg 0x1feb104b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
cmp word [esp + 0x10], 0
jne 0x1feb11df
cmp word [esp + 0x12], 1
je 0x1feb106b
cmp word [esp + 0x12], 2
jne 0x1feb11df
cmp word [esp + 0x14], 0
jbe 0x1feb11df
mov bp, word [esp + 0x12]
mov ax, word [esp + 0x14]
cmp ax, 1
ja 0x1feb108b
mov ax, 1
lea esi, [ebx + 8]
movzx ecx, ax
mov eax, dword [esi]
mov dword [eax + 0x48], ecx
mov eax, dword [ebx + 0x20]
test eax, eax
jle 0x1feb10a8
cmp ecx, eax
jl 0x1feb10ac
mov ecx, dword [esi]
mov dword [ecx + 0x44], eax
jmp 0x1feb10c6
cmp ecx, eax
jge 0x1feb10b6
mov eax, dword [esi]
mov dword [ebx + 0x20], ecx
mov dword [eax + 0x44], ecx
jmp 0x1feb10c6
mov eax, dword [esi]
mov dword [ebx + 0x20], 1
mov dword [eax + 0x44], 1
push 0
mov eax, dword [ebx + 0x20]
shl eax, 4
mov ecx, dword [ebx + 4]
sub eax, 0xa
push eax
push ecx
call sub.LTKRN11n.dll_Ordinal_191
lea edi, [esp + 0x1c]
add esp, 0xc
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push 0x10
push ecx
mov edx, dword [ebx + 4]
push edx
call sub.LTKRN11n.dll_Ordinal_190
add esp, 0xc
test eax, eax
jg 0x1feb110e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
mov eax, dword [esp + 0x1c]
push 0
push eax
mov ecx, dword [ebx + 4]
push ecx
call sub.LTKRN11n.dll_Ordinal_191
lea ecx, [esp + 0x1c]
add esp, 0xc
mov edx, dword [ebx + 4]
push 0x28
push ecx
push edx
call sub.LTKRN11n.dll_Ordinal_190
add esp, 0xc
cmp eax, 0x28
je 0x1feb1145
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
cmp dword [esp + 0x10], 0x28
je 0x1feb1158
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
mov dword [ecx + 0x14], eax
mov eax, dword [esp + 0x18]
cdq
sub eax, edx
mov ecx, dword [esi]
sar eax, 1
dec bp
mov dword [ecx + 0x18], eax
xor eax, eax
mov ecx, dword [esi]
mov ax, word [esp + 0x1e]
cmp bp, 1
mov dword [ecx + 0x1c], eax
sbb eax, eax
mov ecx, dword [esp + 0x20]
add eax, 0x5c
mov edx, dword [esi]
mov dword [edx], eax
cmp dword [esp + 0x28], 0
je 0x1feb11b5
mov eax, dword [esp + 0x28]
mov edi, 0x2710
mov edx, eax
shl eax, 8
sub eax, edx
sub eax, edx
add eax, 0x1388
cdq
idiv edi
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
cmp dword [esp + 0x2c], 0
je 0x1feb136a
mov eax, dword [esp + 0x2c]
mov edi, 0x2710
mov edx, eax
shl eax, 8
sub eax, edx
sub eax, edx
add eax, 0x1388
cdq
idiv edi
jmp 0x1feb1365
cmp word [esp + 0x10], 0x4d42
lea edi, [esp + 0x10]
je 0x1feb1201
cmp word [esp + 0x10], 0x4142
je 0x1feb120a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
cmp word [esp + 0x10], 0x4142
jne 0x1feb1223
cmp word [esp + 0x1e], 0x4d42
lea edi, [esp + 0x1e]
je 0x1feb1223
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
mov eax, dword [edi + 0xe]
add edi, 0xe
cmp eax, 0xc
jae 0x1feb123a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
cmp eax, 0x28
jne 0x1feb12b7
lea esi, [ebx + 8]
mov ecx, dword [edi + 4]
mov eax, dword [esi]
mov dword [eax + 0x14], ecx
mov eax, dword [esi]
mov edx, dword [edi + 8]
mov dword [eax + 0x18], edx
xor eax, eax
mov ax, word [edi + 0xe]
mov ecx, dword [esi]
mov dword [ecx + 0x1c], eax
mov ecx, dword [edi + 0x10]
mov edx, dword [esi]
cmp ecx, 1
sbb eax, eax
and eax, 0xffffffb2
add eax, 0x54
mov dword [edx], eax
mov edx, dword [edi + 0x18]
test edx, edx
je 0x1feb1291
mov eax, edx
mov ebx, 0x2710
shl eax, 8
sub eax, edx
sub eax, edx
add eax, 0x1388
cdq
idiv ebx
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x1feb136a
mov eax, edx
mov edi, 0x2710
shl eax, 8
sub eax, edx
sub eax, edx
add eax, 0x1388
cdq
idiv edi
jmp 0x1feb1365
lea esi, [ebx + 8]
cmp eax, 0xc
mov eax, dword [esi]
jne 0x1feb12ec
mov dword [eax], 0xe
xor eax, eax
mov ax, word [edi + 4]
mov ecx, dword [esi]
mov dword [ecx + 0x14], eax
xor eax, eax
mov ax, word [edi + 6]
mov ecx, dword [esi]
mov dword [ecx + 0x18], eax
xor ecx, ecx
mov cx, word [edi + 0xa]
mov eax, dword [esi]
mov dword [eax + 0x1c], ecx
xor ecx, ecx
jmp 0x1feb136a
mov dword [eax], 0x4a
mov eax, dword [esi]
mov edx, dword [edi + 4]
mov dword [eax + 0x14], edx
mov eax, dword [esi]
mov ebx, dword [edi + 8]
mov dword [eax + 0x18], ebx
cmp dword [edi], 0x10
jae 0x1feb1313
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
xor eax, eax
mov ecx, dword [esi]
mov ax, word [edi + 0xe]
mov dword [ecx + 0x1c], eax
mov eax, dword [edi]
cmp eax, 0x14
jb 0x1feb132a
mov ecx, dword [edi + 0x10]
jmp 0x1feb132e
mov ecx, dword [esp + 0x10]
cmp eax, 0x20
jb 0x1feb136a
mov eax, dword [edi + 0x18]
mov ebx, 0x2710
mov edx, eax
shl eax, 8
sub eax, edx
sub eax, edx
add eax, 0x1388
cdq
idiv ebx
mov edx, dword [esi]
mov dword [edx + 0x4c], eax
mov eax, dword [edi + 0x1c]
mov edx, eax
shl eax, 8
sub eax, edx
sub eax, edx
add eax, 0x1388
cdq
idiv ebx
mov edx, dword [esi]
mov dword [edx + 0x50], eax
mov edi, dword [esi]
mov eax, dword [edi + 0x1c]
dec eax
cmp eax, 0x1f
ja case.0x1feb137d.7
xor edx, edx
mov dl, byte [eax + 0x1feb1424]
jmp dword [edx*4 + 0x1feb1408]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4
mov eax, dword [edi + 0x18]
test eax, eax
jge 0x1feb13a7
neg eax
mov dword [edi + 0x18], eax
mov edx, dword [esi]
mov dword [edx + 0x3c], 0
jmp 0x1feb13ae
mov dword [edi + 0x3c], 2
mov eax, dword [esi]
cmp dword [eax + 0x1c], 8
mov dword [eax + 0x40], 1
jg 0x1feb13c4
mov dword [eax + 0x40], 0
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
imul edx, dword [eax + 0x1c]
add edx, 0x1f
shr edx, 3
and edx, 0xfffffffc
imul edx, dword [eax + 0x18]
mov dword [eax + 0x24], edx
test ecx, ecx
je 0x1feb13f7
cmp ecx, 3
je 0x1feb13f7
push str.Run_Length
mov eax, dword [esi]
add eax, 0x28
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret 4