Function at 0x491760
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x72b4db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
xor edi, edi
cmp esi, edi
jne 0x491795
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
push 0x14
mov dword [0x7c952c], 0x78a7b0
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 8], eax
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x4917c2
mov ecx, eax
call fcn.0047e1e0
mov dword [esp + 8], eax
jmp 0x4917c6
mov dword [esp + 8], edi
push ebp
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
call fcn.0047e710
mov ebp, eax
cmp ebp, edi
je 0x491a34
mov esi, dword [esp + 0xc]
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
dec eax
cmp eax, 4
ja case.default.0x4917f4
jmp dword [eax*4 + 0x491a4c]
push 0x14
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [eax], 1
mov ebp, dword [ebp + 8]
mov ecx, dword [ebp + 4]
add esp, 4
add ebp, 4
mov dword [eax + 4], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 8], edx
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov byte [eax + 0x10], 1
push eax
jmp 0x491a05
push 0x14
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov dword [eax], 2
mov edx, dword [ebp + 8]
mov cx, word [edx + 4]
mov word [eax + 4], cx
mov edx, dword [ebp + 8]
mov cl, byte [edx + 6]
mov byte [eax + 6], cl
mov edx, dword [ebp + 8]
mov cl, byte [edx + 7]
add esp, 4
mov byte [eax + 7], cl
mov byte [eax + 0x10], 1
xor ecx, ecx
mov edx, dword [ebp + 8]
mov dl, byte [edx + ecx + 8]
mov byte [eax + ecx + 8], dl
inc ecx
cmp ecx, 8
jl 0x491860
push eax
jmp 0x491a05
push 0x20
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov dword [ebx], 3
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
add eax, 4
mov dword [ebx + 4], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 8], edx
mov eax, dword [eax + 8]
mov dword [ebx + 0xc], eax
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x10]
mov al, byte [esp + 0x2c]
add esp, 4
test al, al
mov byte [ebx + 0x10], dl
mov byte [ebx + 0x1c], 1
jne 0x491948
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 0x14]
cmp esi, edi
je 0x49195f
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
or ecx, 0xffffffff
mov edx, eax
mov edi, esi
xor eax, eax
mov dword [ebx + 0x14], edx
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
jmp 0x491962
push 0x20
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov dword [ebx], 4
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
add eax, 4
mov dword [ebx + 4], ecx
mov edx, dword [eax + 4]
mov dword [ebx + 8], edx
mov eax, dword [eax + 8]
mov dword [ebx + 0xc], eax
mov ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x10]
mov al, byte [esp + 0x2c]
add esp, 4
test al, al
mov byte [ebx + 0x10], dl
mov byte [ebx + 0x1c], 1
je 0x4918ba
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [ebx + 0x14], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
mov dword [ebx + 0x18], eax
jmp 0x491a00
mov dword [ebx + 0x14], edi
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 0x18]
cmp esi, edi
je 0x4919a9
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, eax
add esp, 4
mov dword [ebx + 0x18], edx
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
jmp 0x491a00
mov dword [ebx + 0x18], edi
jmp 0x491a00
push 0xc
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov al, byte [esp + 0x2c]
add esp, 4
test al, al
mov dword [ebx], 5
mov byte [ebx + 8], 1
je 0x4919d7
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebx + 4], edx
jmp 0x491a00
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
cmp esi, edi
je 0x4919fd
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, eax
add esp, 4
mov dword [ebx + 4], edx
jmp 0x491986
mov dword [ebx + 4], edi
mov esi, dword [esp + 0x10]
push ebx
mov ecx, esi
call fcn.0047e360
mov ecx, dword [esp + 0x24]
call fcn.0047e720
mov ebp, eax
cmp ebp, edi
jne 0x4917e5
pop ebx
pop ebp
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
pop ebp
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret