Function at 0x488230
Capabilities:
Enumerate pe sections
Get file size

Disassembly:
sub esp, 0xb0
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
push esi
push edi
mov dword [ebp + 0x72e64], ebx
mov ecx, dword [ebp + 0x6ea9c]
call fcn.004949d0
mov word [ebp + 0x725cc], bx
push 7
mov ecx, ebp
mov dword [ebp + 0x725c8], ebx
call fcn.00439d10
push 0xb
mov ecx, ebp
call fcn.00439d10
push 0xd
mov ecx, ebp
call fcn.00439d10
push 0xe
mov ecx, ebp
call fcn.00439d10
push 0x10
mov ecx, ebp
call fcn.00439d10
push 0x16
mov ecx, ebp
call fcn.00439d10
push 0x14
mov ecx, ebp
call fcn.00439d10
push 0x15
mov ecx, ebp
call fcn.00439d10
push 0x17
mov ecx, ebp
call fcn.00439d10
push ebx
push ebx
push ebx
push ebx
push 9
mov ecx, ebp
call fcn.00438f60
lea eax, [esp + 0x10]
mov byte [ebp + 0x733ea], bl
push eax
lea ecx, [ebp + 0x72ab0]
mov byte [ebp + 0x735ad], bl
mov dword [esp + 0x14], ebx
call fcn.004a6fb0
lea ecx, [esp + 0x10]
mov dword [ebp + 0x72efc], 0xffffffff
mov dword [ebp + 0x72da0], ebx
push ecx
mov dword [ebp + 0x72f30], ebx
lea ecx, [ebp + 0x72e3c]
mov byte [ebp + 0x7359e], bl
mov dword [esp + 0x14], ebx
call fcn.004a6fb0
lea edx, [esp + 0x10]
mov dword [ebp + 0x72dfc], ebx
push edx
lea ecx, [ebp + 0x72dc4]
mov dword [ebp + 0x72e00], ebx
mov dword [esp + 0x14], ebx
call fcn.004a6fb0
lea eax, [esp + 0x10]
lea ecx, [ebp + 0x72dd0]
push eax
mov dword [esp + 0x14], ebx
call fcn.004a6fb0
mov dword [ebp + 0x72dc0], ebx
mov byte [ebp + 0x731c4], 0xff
mov dword [ebp + 0x725a8], ebx
lea esi, [ebp + 0x6f3cc]
mov edi, 0x12c
mov ecx, dword [esi]
cmp ecx, ebx
je 0x488368
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi], ebx
add esi, 4
dec edi
jne 0x48835c
lea eax, [ebp + 0x42da]
mov ecx, 0x258
mov word [eax - 2], bx
mov word [eax], bx
mov byte [eax + 2], 0
add eax, 6
dec ecx
jne 0x48837b
lea edx, [ebp + 0x58f4]
mov esi, 0x64
lea ecx, [edx + 4]
mov dword [edx - 4], ebx
xor eax, eax
mov dword [edx], 0xffffffff
mov dword [ecx], eax
lea edi, [edx + 0x10]
add edx, 0x2c
dec esi
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov ecx, 6
rep stosd dword es:[edi], eax
jne 0x488397
lea esi, [ebp + 0x6eaa8]
mov edi, 0x1f4
mov ecx, dword [esi]
cmp ecx, ebx
je 0x4883d4
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esi], ebx
add esi, 4
dec edi
jne 0x4883c8
mov eax, dword [esp + 0xc4]
lea esi, [ebp + 0x733c8]
mov edi, esi
push esi
mov cx, word [eax + 6]
lea ebx, [eax + 6]
add ebx, 2
mov word [ebp + 0x72fda], cx
mov dx, word [ebx]
mov ax, word [ebx + 2]
add ebx, 2
mov word [esp + 0x1c], dx
add ebx, 2
mov word [esp + 0x18], ax
mov cx, word [ebx]
add ebx, 2
mov word [ebp + 0x72fdc], cx
mov dx, word [ebx]
add ebx, 2
mov word [ebp + 0x72fde], dx
mov ax, word [ebx]
add ebx, 2
mov word [ebp + 0x72fe0], ax
mov cx, word [ebx]
add ebx, 2
mov word [ebp + 0x72fe2], cx
mov dx, word [ebx]
add ebx, 2
mov word [ebp + 0x72fe4], dx
lea edx, [ebp + 0x733bc]
mov eax, dword [ebx]
add ebx, 4
mov dword [ebp + 0x72e84], eax
xor eax, eax
mov ecx, dword [ebx]
add ebx, 4
mov dword [ebp + 0x72fe8], ecx
mov ecx, edx
push edx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov ecx, 8
rep stosd dword es:[edi], eax
mov eax, ebx
mov ecx, edx
mov edi, dword [eax]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [ecx + 4], edi
mov ax, word [eax + 8]
mov word [ecx + 8], ax
mov ecx, ebp
call fcn.0045dee0
test al, al
mov byte [ebp + 0x733e8], al
jge 0x4884b1
or eax, 0xffffffff
jmp 0x4884b6
mov eax, 0x80
lea edx, [ebp + 0x7338e]
mov word [ebp + 0x8a8], ax
mov word [ebp + 0x8aa], ax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
add ebx, 0xa
lea esi, [esp + 0x3c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov ecx, ebx
add ebx, 0xa
mov eax, dword [ecx]
inc ebx
mov dword [edx], eax
inc ebx
mov eax, dword [ecx + 4]
add ebx, 4
mov dword [edx + 4], eax
add ebx, 5
mov cx, word [ecx + 8]
push ebx
mov word [edx + 8], cx
mov dl, byte [ebx - 0xb]
mov byte [0x56bd64], dl
mov al, byte [ebx - 0xa]
mov byte [ebp + 0x7359d], al
mov ecx, dword [ebx - 9]
mov dword [ebp + 0x72ed4], ecx
lea ecx, [ebp + 0x72e88]
movsx edx, byte [ebx - 5]
mov dword [esp + 0x14], edx
call fcn.004a6fb0
mov al, byte [ebx + 4]
add ebx, 4
mov byte [ebp + 0x735af], al
mov al, byte [ebp + 0x7359d]
inc ebx
test al, al
je 0x48856c
push eax
push 1
jmp 0x488570
push 0
push 0
mov ecx, ebp
call fcn.00447ad0
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x1c]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
mov edi, 0x4c6c84
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp + 0x733bc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4c6c7c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x6ea9c]
call fcn.00494b00
mov ecx, dword [ebp + 0x6ea9c]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov word [ecx + 0x93ab80], si
mov edx, dword [ebp + 0x6ea9c]
lea eax, [esi + 0x13]
lea ecx, [edi + 0x11]
mov word [edx + 0x93ab82], di
mov edx, dword [esp + 0x10]
test edx, edx
mov word [ebp + 0x72fd6], ax
mov word [ebp + 0x72fd8], cx
mov byte [ebp + 0x732b9], 5
jne 0x4886c3
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp + 0x732ad]
push 0
push edx
mov edx, dword [ebp + 0x72fe8]
push edx
mov edx, dword [ebp + 0x72e84]
push edx
mov dx, word [ebp + 0x72fe4]
push edx
mov dx, word [ebp + 0x72fe2]
push edx
mov dx, word [ebp + 0x72fe0]
push edx
mov dx, word [ebp + 0x72fde]
push edx
push 5
movsx edx, word [ebp + 0x72fdc]
push edx
movsx ecx, cx
movsx edx, ax
push ecx
mov ecx, dword [ebp + 0x6ea9c]
push edx
mov dx, word [ebp + 0x72fda]
call fcn.00495160
lea ecx, [esi + 9]
lea edx, [edi + 0xa]
mov eax, ecx
push ebx
shl eax, 5
mov word [ebp + 0x73010], ax
mov word [ebp + 0x7300c], ax
mov eax, edx
push edx
shl eax, 5
push ecx
mov ecx, ebp
mov word [ebp + 0x73012], ax
mov word [ebp + 0x7300e], ax
call fcn.0042f190
lea eax, [ebp + 0x733c8]
mov ebx, 1
push eax
lea eax, [esp + 0x4c]
push 0x4c6c70
push eax
mov dword [ebp + 0x72e04], ebx
call dword [sym.imp.user32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x48]
push ebx
push 0xa
push ecx
mov ecx, ebp
call fcn.004117a0
lea eax, [ebp + 0x7338e]
mov ecx, 5
mov edi, 0x4bdaa0
mov esi, eax
xor edx, edx
mov word [ebp + 0x61c], 0x96
mov word [ebp + 0x61e], 0x82
repe cmpsw word [esi], word es:[edi]
je 0x48877c
mov ecx, 5
mov edi, 0x4c1cbc
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x48877c
mov esi, eax
mov ecx, 9
mov edi, 0x4c1bc8
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x48878d
push 0
push 0
push 0
push 0
push 6
mov ecx, ebp
call fcn.00438f60
mov ecx, dword [ebp + 0x72578]
mov byte [ebp + 0x731c5], 4
mov dword [ebp + 0x72584], ecx
lea ecx, [ebp + 0x7f1c]
mov byte [ebp + 0x7316d], 0
call fcn.004025f0
test byte [ebp + 0x72fe1], 0xf0
je 0x4887c3
mov dword [ebp + 0x72db8], ebx
jmp 0x4887cd
mov dword [ebp + 0x72db8], 0
cmp dword [ebp + 0x72df8], ebx
jne 0x488824
xor edi, edi
push edi
push edi
push 3
push edi
push edi
push closesocket
push 0x4bca1c
mov dword [ebp + 0x72df8], edi
call dword [sym.imp.kernel32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x48880b
push edi
push esi
call dword [sym.imp.kernel32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0
push 0
push 0
push 0
push edi
push 0
push 0
push 0x220b2f00
mov ecx, ebp
call fcn.00405900
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 4