Function at 0x6ab02318
Capabilities:
Enumerate pe sections
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xbc
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x98], sym.___gxx_personality_sj0
mov dword [ebp - 0x94], 0x6ab18396
lea eax, [ebp - 0x90]
lea ebx, [ebp - 0x18]
mov dword [eax], ebx
mov edx, 0x6ab0295b
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0xb0]
mov dword [esp], eax
call dbg._Unwind_SjLj_Register
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], 0x40
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [ebp - 0xac], 1
mov ecx, eax
call method.CWin32PE.CheckSize_unsigned_int__unsigned_int_
sub esp, 8
test eax, eax
sete al
test al, al
je 0x6ab023a5
mov eax, 0
jmp 0x6ab02953
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x6ab023dc
mov dword [esp], 0xc1
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0xac], 1
call eax
sub esp, 4
mov eax, 0
jmp 0x6ab02953
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x3c]
lea edx, [eax + 0xf8]
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], edx
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [ebp - 0xac], 1
mov ecx, eax
call method.CWin32PE.CheckSize_unsigned_int__unsigned_int_
sub esp, 8
test eax, eax
sete al
test al, al
je 0x6ab0241c
mov eax, 0
jmp 0x6ab02953
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x6ab0245d
mov dword [esp], 0xc1
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0xac], 1
call eax
sub esp, 4
mov eax, 0
jmp 0x6ab02953
mov eax, dword [ebp - 0x38]
movzx eax, word [eax + 4]
cmp ax, 0x14c
je 0x6ab0248f
mov dword [esp], 0xc1
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0xac], 1
call eax
sub esp, 4
mov eax, 0
jmp 0x6ab02953
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x38]
and eax, 1
test eax, eax
je 0x6ab024c1
mov dword [esp], 0xc1
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0xac], 1
call eax
sub esp, 4
mov eax, 0
jmp 0x6ab02953
mov eax, dword [ebp - 0x38]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0x38]
add eax, edx
add eax, 0x18
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 0
jmp 0x6ab02529
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x6ab02502
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x3c]
add eax, edx
mov dword [ebp - 0x2c], eax
jmp 0x6ab02513
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x10]
add eax, edx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x28]
jbe 0x6ab02521
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
add dword [ebp - 0x24], 1
add dword [ebp - 0x20], 0x28
mov eax, dword [ebp - 0x38]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x24]
ja 0x6ab024e8
lea eax, [ebp - 0x74]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov dword [ebp - 0xac], 1
call eax
sub esp, 4
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x50]
mov eax, dword [ebp - 0x70]
add eax, edx
lea edx, [eax - 1]
mov eax, dword [ebp - 0x70]
neg eax
and eax, edx
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x28]
add eax, edx
lea edx, [eax - 1]
mov eax, dword [ebp - 0x70]
neg eax
and eax, edx
cmp eax, dword [ebp - 0x40]
je 0x6ab0259c
mov dword [esp], 0xc1
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
sub esp, 4
mov eax, 0
jmp 0x6ab02953
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x34]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov edx, dword [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xac], 1
call eax
sub esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x6ab02625
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x40]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x6ab02625
mov dword [esp], 0xe
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
sub esp, 4
mov eax, 0
jmp 0x6ab02953
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0xac], 1
call eax
mov dword [esp + 8], 0x34
mov dword [esp + 4], 8
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call eax
sub esp, 0xc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x6ab02697
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [esp], 0xe
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
sub esp, 4
mov eax, 0
jmp 0x6ab02953
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x38]
movzx eax, word [eax + 0x16]
movzx eax, ax
and eax, 0x2000
test eax, eax
setne al
movzx edx, al
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + 0x10]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + 0x14]
mov dword [eax + 0x20], edx
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + 0x18]
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp + 0x1c]
mov dword [eax + 0x28], edx
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x30], edx
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x54]
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], edx
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [ebp - 0xac], 1
mov ecx, eax
call method.CWin32PE.CheckSize_unsigned_int__unsigned_int_
sub esp, 8
test eax, eax
sete al
test al, al
je 0x6ab0271f
jmp 0x6ab02931
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x54]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xac], 1
call eax
sub esp, 0x10
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x54]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call sym.myMemCpy_void__void__unsigned_int_
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 0x44]
add edx, eax
mov eax, dword [ebp - 0x30]
mov dword [eax], edx
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x34], edx
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x30]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x38]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call method.CWin32PE.CopySections_unsigned_char_const__unsigned_int___IMAGE_NT_HEADERS__MEMORYMODULE_
sub esp, 0x10
test eax, eax
sete al
test al, al
je 0x6ab027c5
jmp 0x6ab02931
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x34]
sub edx, eax
mov eax, edx
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x6ab02802
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x48]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
mov ecx, eax
call method.CWin32PE.PerformBaseRelocation_MEMORYMODULE__int_
sub esp, 8
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x18], eax
jmp 0x6ab0280c
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x18], 1
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
mov dword [ebp - 0xac], 1
mov ecx, eax
call method.CWin32PE.BuildImportTable_MEMORYMODULE_
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6ab02837
jmp 0x6ab02931
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
mov dword [ebp - 0xac], 1
mov ecx, eax
call method.CWin32PE.FinalizeSections_MEMORYMODULE_
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6ab02862
jmp 0x6ab02931
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
mov dword [ebp - 0xac], 1
mov ecx, eax
call method.CWin32PE.ExecuteTLS_MEMORYMODULE_
sub esp, 4
test eax, eax
sete al
test al, al
je 0x6ab0288d
jmp 0x6ab02931
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x6ab02922
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x14]
test eax, eax
je 0x6ab0290d
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
add eax, edx
mov dword [ebp - 0x4c], eax
mov ecx, dword [0x6ab4400c]
mov edx, dword [0x6ab44008]
mov eax, dword [0x6ab44004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xac], 1
call eax
sub esp, 0xc
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jne 0x6ab02901
mov dword [esp], 0x45a
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
sub esp, 4
jmp 0x6ab02931
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x10], 1
jmp 0x6ab0292c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
add edx, eax
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x2c], edx
jmp 0x6ab0292c
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp - 0x30]
jmp 0x6ab02953
mov eax, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x30]
mov dword [esp], edx
mov dword [ebp - 0xac], 1
mov ecx, eax
call method.CLoad.FreeLibraryFromMemory_void_
sub esp, 4
mov eax, 0
mov dword [ebp - 0xb4], eax
jmp 0x6ab02976
lea eax, [ebp - 0xb0]
mov dword [esp], eax
call sym.__Unwind_SjLj_Unregister
mov eax, dword [ebp - 0xb4]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x18