Function at 0x10276de
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x338
mov eax, dword [0x1030118]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
cmp dword [esi + 0x5344], 0xffffffff
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x32c], edi
jne 0x1026d95
push esi
push 0xd
call fcn.01023f4c
push eax
call fcn.01026256
mov eax, dword [esi]
jmp 0x10277f8
or dword [esi + 8], 0xffffffff
push ebx
xor ebx, ebx
mov dword [esi + 0x512c], ebx
mov eax, dword [edi + 4]
dec eax
dec eax
push 1
pop ecx
je 0x1026dbb
dec eax
dec eax
je 0x1026db3
dec eax
jne 0x1026dc1
mov dword [esi + 0x5120], ecx
jmp 0x1026dc1
mov dword [esi + 0x5120], ebx
push esi
call fcn.01028557
cmp eax, ebx
je 0x1026dd7
push esi
push eax
call fcn.01026256
jmp 0x10277f5
mov eax, dword [edi + 0x24]
cmp eax, 5
je 0x1026df5
cmp eax, 0xf
je 0x1026de9
push esi
push 0x10
jmp 0x1026dcd
mov dword [esi + 0x1348], 9
jmp 0x1026dfc
or dword [esi + 0x1348], 0xffffffff
cmp dword [edi + 0x20], ebx
je 0x1026e0b
mov dword [esi + 0x1344], 1
cmp dword [edi + 0x30], ebx
je 0x1026e16
mov dword [esi + 0x134c], ebx
cmp dword [edi + 0x28], ebx
je 0x1026e7c
cmp dword [edi + 0x2c], ebx
je 0x1026e7c
mov eax, dword [ebp - 0x32c]
mov dword [esi + 0x5124], 1
push dword [eax + 0x2c]
lea edi, [esi + 0x9f8]
push 0x824
push edi
push ebx
call fcn.01024ebd
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
push edi
call fcn.0101be72
pop ecx
mov dword [esi + 0x1354], eax
cmp eax, ebx
jne 0x1026e68
push esi
push 4
jmp 0x1026dcd
lea ecx, [esi + 0x9f8]
push ecx
push edi
push eax
call fcn.01022b69
mov edi, dword [ebp - 0x32c]
push ebx
lea eax, [esi + 0x5130]
push ebx
push eax
call fcn.010242d1
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x320], ebx
cmp edi, ebx
je 0x1026ff8
mov al, byte [edi]
mov dword [ebp - 0x31c], edi
mov dword [ebp - 0x318], edi
jmp 0x1026fb2
cmp al, 0x22
jne 0x1026ebf
xor dword [ebp - 0x328], 1
cmp dword [ebp - 0x328], ebx
jne 0x1026f9e
cmp al, 0x20
jne 0x1026f9e
mov edi, dword [ebp - 0x31c]
sub edi, dword [ebp - 0x318]
mov eax, 0x207
cmp edi, eax
mov ecx, edi
jl 0x1026eec
mov ecx, eax
cmp ecx, ebx
jge 0x1026ef4
xor edi, edi
jmp 0x1026efa
cmp edi, eax
jl 0x1026efa
mov edi, eax
push edi
push dword [ebp - 0x318]
lea eax, [ebp - 0x310]
push eax
call fcn.0102caae
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push 0x104
lea eax, [ebp - 0x108]
push eax
push 1
mov byte [ebp + edi - 0x310], bl
call fcn.01024ebd
cmp dword [esi + 0x9c], ebx
je 0x1026f62
cmp dword [ebp - 0x320], ebx
jne 0x1026f62
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01026c3d
cmp eax, ebx
jne 0x1026dcb
mov dword [ebp - 0x320], 1
jmp 0x1026f8c
cmp dword [esi + 0x5120], 1
push esi
lea eax, [ebp - 0x108]
push eax
jne 0x1026f7a
call fcn.01026828
jmp 0x1026f7f
call fcn.01025bfa
cmp eax, ebx
je 0x1026f8c
cmp eax, 0xffffffff
jne 0x1026dcb
push dword [ebp - 0x31c]
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x318], eax
push dword [ebp - 0x31c]
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x31c], eax
mov al, byte [eax]
cmp al, bl
jne 0x1026eb4
push dword [ebp - 0x318]
lea eax, [ebp - 0x108]
push 0x104
push eax
push 1
call fcn.01024ebd
cmp dword [esi + 0x9c], ebx
je 0x102700b
cmp dword [ebp - 0x320], ebx
jne 0x102700b
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01026c3d
cmp eax, ebx
jne 0x1026dcb
push esi
call fcn.01023eaa
push esi
cmp eax, 1
jne 0x1027031
push 9
jmp 0x1026dcd
cmp dword [esi + 0x5120], 1
push esi
lea eax, [ebp - 0x108]
push eax
jne 0x1027023
call fcn.01026828
jmp 0x1027028
call fcn.01025bfa
cmp eax, ebx
je 0x1026ff8
cmp eax, 0xffffffff
jmp 0x1026ff2
call fcn.01024fd8
cmp eax, ebx
je 0x1027051
cmp eax, 9
jne 0x1027042
push esi
jmp 0x1027004
push esi
cmp eax, 0x10
jne 0x1026dcc
jmp 0x1026de5
cmp dword [esi + 0x1374], ebx
je 0x1027065
push dword [esi + 0x1378]
call fcn.0101be7e
pop ecx
cmp dword [esi + 0x5120], ebx
jne 0x1027085
cmp dword [esi + 0x1348], ebx
je 0x1026de4
cmp dword [esi + 0x1344], ebx
jne 0x1026de4
cmp dword [esi + 0x1354], ebx
jne 0x1027121
push 0x2f
push dword [esi + 0x1358]
push ebx
call fcn.0102c654
mov edi, eax
cmp edi, ebx
jne 0x10270cd
push reloc.SHLWAPI.dll_SHAnsiToUnicode
push dword [esi + 0x1358]
push ebx
call fcn.0102c654
mov edi, eax
cmp edi, ebx
jne 0x10270cd
push 0x3a
push dword [esi + 0x1358]
push ebx
call fcn.0102c654
mov edi, eax
cmp edi, ebx
je 0x1027121
cmp byte [edi], 0x3a
jne 0x10270d3
inc edi
mov eax, edi
sub eax, dword [esi + 0x1358]
inc eax
push eax
mov dword [ebp - 0x330], eax
call fcn.0101be72
pop ecx
mov dword [esi + 0x1354], eax
cmp eax, ebx
je 0x1026e60
movsx eax, byte [edi]
mov byte [edi], bl
push dword [esi + 0x1358]
mov dword [ebp - 0x318], eax
push dword [ebp - 0x330]
push dword [esi + 0x1354]
call fcn.01022b69
mov al, byte [ebp - 0x318]
mov byte [edi], al
mov edi, dword [esi + 0x1370]
mov dword [ebp - 0x31c], ebx
jmp 0x1027167
push esi
call fcn.01023eaa
test eax, eax
jne 0x102716b
cmp word [edi + 0x5c], bx
je 0x1027164
cmp dword [esi + 0x5120], ebx
je 0x102715e
push esi
push ebx
push ebx
push dword [edi + 0x48]
push 1
call fcn.01025c61
test eax, eax
jne 0x102715e
mov word [edi + 0x5c], ax
jmp 0x1027164
inc dword [ebp - 0x31c]
mov edi, dword [edi + 0x68]
cmp edi, ebx
jne 0x102712f
push esi
call fcn.01023eaa
cmp eax, 1
je 0x102703f
mov edi, dword [esi + 0x1388]
jmp 0x10271a2
push esi
call fcn.01023eaa
test eax, eax
jne 0x10271a6
cmp dword [esi + 0x5120], ebx
jne 0x102719f
push esi
push edi
call fcn.01024f38
mov edi, eax
jmp 0x10271a2
mov edi, dword [edi + 0x14]
cmp edi, ebx
jne 0x1027182
push esi
call fcn.01023eaa
cmp eax, 1
je 0x102703f
cmp dword [ebp - 0x31c], ebx
jne 0x10271cd
cmp dword [esi + 0x1388], ebx
jne 0x10271cd
push esi
push 0xc
jmp 0x1026dcd
mov eax, dword [ebp - 0x32c]
cmp dword [eax + 0x28], ebx
je 0x10271f6
cmp dword [esi + 0x1370], ebx
jne 0x10271f6
mov eax, dword [esi + 0x1360]
or eax, dword [esi + 0x1364]
jne 0x10271f6
mov dword [ebp - 0x328], ebx
jmp 0x102720a
push dword [esi + 0x1358]
call fcn.0102542b
movzx eax, ax
mov dword [ebp - 0x328], eax
push esi
push dword [esi + 0x1358]
mov dword [esi + 0x1380], ebx
mov dword [esi + 0x1384], ebx
call fcn.01025e74
mov dword [esi + 0x512c], eax
cmp eax, ebx
je 0x1026e60
push eax
call fcn.01025f49
test eax, eax
je 0x1027246
push 0xf
call fcn.01023f4c
jmp 0x10277f7
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
push dword [esi + 0x512c]
call fcn.01025354
mov dword [ebp - 0x314], eax
mov dword [esi + 8], eax
cmp eax, 0xffffffff
jne 0x102727b
push esi
push 0xf
call fcn.01023f4c
jmp 0x1026dcc
mov ecx, dword [esi + 0x1360]
mov edx, dword [esi + 0x1364]
mov edi, ecx
or edi, edx
je 0x10272c7
push esi
push edx
push ecx
push eax
push dword [esi + 0x5344]
call fcn.01025109
mov edi, eax
cmp edi, ebx
je 0x10272c7
mov eax, dword [ebp - 0x314]
cmp eax, 0xffffffff
je 0x10272c0
cmp dword [esi + 8], eax
je 0x10272c0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x314], 0xffffffff
push esi
push edi
jmp 0x1026dcd
mov eax, dword [esi + 0x1360]
mov dword [esi + 0x1380], eax
mov eax, dword [esi + 0x1364]
push 0x2000
mov dword [esi + 0x1384], eax
call fcn.0101be72
pop ecx
mov dword [esi + 0x5128], eax
cmp eax, ebx
jne 0x102731f
mov eax, dword [ebp - 0x314]
cmp eax, 0xffffffff
je 0x1026e60
cmp dword [esi + 8], eax
je 0x1026e60
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x314], 0xffffffff
jmp 0x1026e60
mov eax, dword [esi + 0x1370]
mov dword [ebp - 0x330], ebx
mov dword [esi + 0x1394], ebx
jmp 0x1027342
cmp word [eax + 0x5c], bx
je 0x102733f
inc dword [esi + 0x1394]
mov eax, dword [eax + 0x68]
cmp eax, ebx
jne 0x1027333
mov eax, dword [esi + 0x1390]
add dword [esi + 0x1394], eax
lea eax, [esi + 0x1370]
mov dword [ebp - 0x31c], eax
jmp 0x10274c1
mov dword [esi + 0xa0], ebx
cmp dword [esi + 0x9c], ebx
je 0x1027386
mov eax, dword [edi + 0x48]
cmp eax, dword [esi + 0xc0]
jne 0x1027386
mov dword [esi + 0xa0], 1
cmp word [edi + 0x5c], bx
jne 0x10273e0
cmp dword [esi + 0xa0], ebx
jne 0x10273e0
push esi
lea eax, [ebp - 0x314]
push eax
push dword [esi + 0x5344]
push edi
call fcn.0102437a
mov dword [ebp - 0x318], eax
cmp eax, ebx
je 0x1027444
mov eax, dword [ebp - 0x314]
cmp eax, 0xffffffff
je 0x10273d4
cmp dword [esi + 8], eax
je 0x10273d4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x314], 0xffffffff
push esi
push dword [ebp - 0x318]
jmp 0x1026dcd
cmp dword [esi + 0x5120], ebx
je 0x102744f
push esi
lea eax, [ebp - 0x314]
push eax
push edi
call fcn.01024622
mov dword [ebp - 0x318], eax
cmp eax, ebx
je 0x1027409
cmp eax, 0x12
jne 0x10274d6
cmp dword [ebp - 0x318], 0x12
jne 0x1027444
push esi
lea eax, [ebp - 0x314]
push eax
push dword [esi + 0x5344]
mov dword [ebp - 0x330], 1
push edi
call fcn.0102437a
mov dword [ebp - 0x318], eax
cmp eax, ebx
jne 0x10273b6
xor eax, eax
mov word [edi + 0x5c], ax
add edi, 0x68
mov dword [ebp - 0x31c], edi
jmp 0x10274b5
mov eax, dword [edi + 0x68]
push dword [edi + 0x48]
mov dword [ebp - 0x320], eax
call fcn.0101be7e
push dword [edi + 0x58]
call fcn.0101be7e
pop ecx
pop ecx
cmp dword [edi + 0x24], ebx
je 0x1027478
push dword [edi + 0x4c]
call fcn.0101be7e
pop ecx
cmp dword [edi + 0x28], ebx
je 0x102748c
mov eax, dword [edi + 0x50]
cmp eax, dword [edi + 0x4c]
je 0x102748c
push eax
call fcn.0101be7e
pop ecx
cmp dword [edi + 0x2c], ebx
je 0x102749a
push dword [edi + 0x54]
call fcn.0101be7e
pop ecx
push edi
call fcn.0101be7e
mov eax, dword [ebp - 0x320]
pop ecx
mov ecx, dword [ebp - 0x31c]
mov dword [ecx], eax
dec dword [esi + 0x1374]
mov eax, dword [ebp - 0x31c]
mov dword [esi + 0xa0], ebx
mov edi, dword [eax]
cmp edi, ebx
jne 0x1027363
mov eax, dword [esi + 0x1388]
jmp 0x10275b9
mov eax, dword [ebp - 0x314]
cmp eax, 0xffffffff
je 0x10274f4
cmp dword [esi + 8], eax
je 0x10274f4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x314], 0xffffffff
push esi
push dword [ebp - 0x318]
call fcn.01026256
push esi
push dword [esi]
jmp 0x10277f0
push 0x70
call fcn.0101be72
mov edi, eax
pop ecx
cmp edi, ebx
je 0x10275c9
push 0x70
push ebx
push edi
call fcn.0101bc52
mov eax, dword [ebp - 0x320]
mov ecx, dword [eax]
mov dword [edi + 0x48], ecx
mov ecx, dword [eax + 4]
mov dword [eax], ebx
mov dword [edi + 0x58], ecx
mov dword [eax + 4], ebx
xor eax, eax
inc eax
mov word [edi + 0x5c], ax
add esp, 0xc
mov dword [esi + 0xa0], ebx
cmp dword [esi + 0x9c], ebx
je 0x1027566
mov eax, dword [edi + 0x48]
cmp eax, dword [esi + 0xc0]
jne 0x1027566
mov dword [esi + 0xa0], 1
push esi
lea eax, [ebp - 0x314]
push eax
push edi
call fcn.01024622
mov dword [ebp - 0x318], eax
cmp eax, ebx
je 0x1027587
cmp eax, 0x12
jne 0x10274d6
cmp dword [ebp - 0x318], 0x12
mov dword [esi + 0xa0], ebx
je 0x10275ef
mov eax, dword [ebp - 0x31c]
mov dword [eax], edi
push esi
push dword [ebp - 0x320]
add edi, 0x68
inc dword [esi + 0x1374]
mov dword [ebp - 0x31c], edi
call fcn.01024f38
mov dword [ebp - 0x320], eax
cmp eax, ebx
jne 0x1027508
jmp 0x1027612
mov eax, dword [ebp - 0x314]
cmp eax, 0xffffffff
je 0x10275e7
cmp dword [esi + 8], eax
je 0x10275e7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x314], 0xffffffff
push esi
push 4
jmp 0x10274fb
push dword [edi + 0x48]
mov dword [ebp - 0x330], 1
call fcn.0101be7e
push dword [edi + 0x58]
call fcn.0101be7e
push edi
call fcn.0101be7e
add esp, 0xc
cmp dword [esi], ebx
je 0x1027641
mov eax, dword [ebp - 0x314]
cmp eax, 0xffffffff
je 0x1027500
cmp dword [esi + 8], eax
je 0x1027500
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0x314], 0xffffffff
jmp 0x1027500
mov eax, dword [esi + 0x1380]
mov edi, dword [esi + 0x1370]
mov dword [ebp - 0x338], eax
mov eax, dword [esi + 0x1384]
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x324], ebx
mov dword [ebp - 0x320], ebx
jmp 0x10276b8
push edi
call fcn.01027bee
mov dword [ebp - 0x318], eax
cmp eax, ebx
jne 0x10273b6
mov eax, dword [edi + 0x64]
add eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x20]
add eax, dword [edi + 0x28]
lea eax, [eax + ecx + 0x2e]
add dword [ebp - 0x324], eax
adc dword [ebp - 0x320], ebx
add dword [esi + 0x1380], eax
adc dword [esi + 0x1384], ebx
inc dword [ebp - 0x31c]
mov edi, dword [edi + 0x68]
push esi
lea eax, [ebp - 0x314]
push eax
cmp edi, ebx
jne 0x1027673
mov eax, dword [ebp - 0x31c]
push ebx
push ebx
push dword [ebp - 0x334]
cdq
push dword [ebp - 0x338]
push dword [ebp - 0x320]
push dword [ebp - 0x324]
push edx
push eax
call fcn.0102810b
mov edi, eax
cmp edi, ebx
jne 0x10272a2
or dword [esi + 8], 0xffffffff
cmp dword [ebp - 0x314], 0xffffffff
je 0x1027722
push dword [ebp - 0x314]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1027722
or dword [ebp - 0x314], 0xffffffff
push esi
push 0xa
jmp 0x1026dcd
push esi
call fcn.0102ba11
push esi
call fcn.010296b4
cmp dword [ebp - 0x328], ebx
je 0x1027747
push dword [ebp - 0x328]
push dword [esi + 0x1358]
call fcn.010253c9
push dword [esi + 0x1340]
lea eax, [esi + 0x5130]
push dword [esi + 0x1394]
push eax
call fcn.010242d1
push esi
push dword [esi + 0x512c]
push dword [esi + 0x1358]
call fcn.010255a4
mov edi, eax
cmp edi, ebx
je 0x10277ac
push dword [esi + 0x512c]
call fcn.0101be7e
mov eax, dword [esi + 0x512c]
pop ecx
cmp eax, dword [esi + 0x1358]
jne 0x1027797
mov dword [esi + 0x1358], ebx
mov eax, dword [ebp - 0x32c]
mov dword [esi + 0x512c], ebx
or dword [eax + 0x4c], 0xffffffff
jmp 0x10272c0
mov eax, dword [esi + 0x5344]
mov ecx, dword [ebp - 0x32c]
mov dword [ecx + 0x4c], eax
push dword [esi + 0x512c]
call fcn.0101be7e
mov eax, dword [esi + 0x512c]
pop ecx
cmp eax, dword [esi + 0x1358]
jne 0x10277db
mov dword [esi + 0x1358], ebx
mov eax, dword [ebp - 0x330]
neg eax
sbb eax, eax
push esi
and eax, 0x12
mov dword [esi + 0x512c], ebx
push eax
call fcn.01026205
mov eax, dword [esi]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0101bc5d
leave
ret 8