Function at 0x100049b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
mov eax, dword [ebx + 0x84]
push edi
test eax, eax
jbe 0x10004a9b
mov ebp, dword [ebx + 0x80]
mov esi, dword [esp + 0x34]
add ebp, esi
push 0x14
push ebp
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10004a7b
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x10004a7b
add edx, esi
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, edx
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edx, dword [ebp]
test edx, edx
jne 0x10004a19
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + esi]
add edx, esi
test eax, eax
je 0x10004a67
test eax, 0x80000000
je 0x10004a31
mov dword [edx], 0
jmp 0x10004a5d
add esi, eax
or ecx, 0xffffffff
xor eax, eax
mov dword [edx], 0
lea edi, [esi + 2]
mov ebx, dword [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
mov edi, esi
mov esi, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
mov esi, dword [esp + 0x34]
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [edx + 4]
add edx, 4
test eax, eax
jne 0x10004a22
add ebp, 0x14
push 0x14
push ebp
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x100049e6
mov ecx, dword [ebx + 0x84]
mov edi, dword [ebx + 0x80]
mov edx, ecx
xor eax, eax
add edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x10004a9f
mov esi, dword [esp + 0x34]
mov eax, dword [ebx + 0x7c]
test eax, eax
jbe 0x10004b16
mov ebp, dword [ebx + 0x78]
add ebp, esi
mov eax, dword [ebp + 0x18]
test eax, eax
jbe 0x10004aee
mov edx, dword [ebp + 0x20]
xor ebx, ebx
add edx, esi
test eax, eax
jbe 0x10004aea
mov eax, dword [edx]
or ecx, 0xffffffff
add esi, eax
xor eax, eax
mov edi, esi
add edx, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
mov esi, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
mov esi, dword [esp + 0x34]
and ecx, 3
inc ebx
rep stosb byte es:[edi], al
cmp ebx, dword [ebp + 0x18]
jb 0x10004abd
mov ebx, dword [esp + 0x38]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jbe 0x10004afe
mov edi, dword [ebp + 0x1c]
xor eax, eax
add edi, esi
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 0x7c]
mov edi, dword [ebx + 0x78]
mov edx, ecx
xor eax, eax
add edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebx + 0xa4]
test ecx, ecx
jbe 0x10004b38
mov edi, dword [ebx + 0xa0]
mov edx, ecx
xor eax, eax
add edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor eax, eax
xor ebp, ebp
mov ax, word [ebx + 0x14]
mov bp, word [ebx + 6]
xor edx, edx
test ebp, ebp
lea edi, [eax + ebx + 0x18]
jbe 0x10004bd6
mov byte [esp + 0x10], 0x2e
mov byte [esp + 0x11], 0x72
mov byte [esp + 0x12], 0x65
mov byte [esp + 0x13], 0x6c
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x15], 0x63
mov byte [esp + 0x16], 0
mov esi, edi
lea eax, [esp + 0x10]
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x10004b9f
test cl, cl
je 0x10004b9b
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x10004b9f
add eax, 2
add esi, 2
test cl, cl
jne 0x10004b7b
xor eax, eax
jmp 0x10004ba4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10004bb2
inc edx
add edi, 0x28
cmp edx, ebp
jb 0x10004b52
jmp 0x10004bce
mov ecx, dword [edi + 0x10]
mov edi, dword [edi + 0xc]
mov ebx, dword [esp + 0x34]
mov edx, ecx
xor eax, eax
add edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov ecx, dword [ebx + 0x8c]
test ecx, ecx
jbe 0x10004bfa
mov ebp, dword [ebx + 0x88]
mov edi, esi
mov edx, ecx
xor eax, eax
add edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret