Function at 0x10001883
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], edx
xor edi, edi
and dword [ebp - 0x20], edi
push 2
mov eax, dword [esi + 0x10]
pop edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], edi
call fcn.1000107a
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
test eax, eax
je 0x100018c4
push ecx
push 0x1004a83c
push edx
push esi
call fcn.1000102c
mov ecx, dword [ebp - 0x1c]
add esp, 0x10
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x10001c4f
cmp ecx, 0x18
jl 0x10001c4f
mov bl, byte [eax + 5]
sub ecx, 0x18
mov edi, dword [eax + 0x10]
mov edx, dword [esi]
mov byte [ebp - 2], bl
movzx ebx, word [eax + 6]
mov dword [ebp - 0x14], ebx
mov ebx, dword [eax + 8]
mov dword [ebp - 0x30], edx
mov dl, byte [eax + 4]
mov dword [ebp - 0xc], ebx
mov ebx, dword [eax + 0xc]
mov dword [ebp - 0x24], edi
mov edi, dword [eax + 0x14]
add eax, 0x18
mov byte [ebp - 1], dl
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], ecx
cmp ecx, edi
jl 0x10001c4a
test edi, edi
js 0x10001c4a
cmp dl, 0x51
je 0x1000193c
cmp dl, 0x52
je 0x1000193c
cmp dl, 0x53
je 0x1000193c
cmp dl, 0x54
jne 0x10001c46
mov eax, dword [ebp - 0x14]
lea edi, [esi + 0x94]
mov ecx, dword [edi]
movzx eax, ax
mov dword [esi + 0x40], eax
cmp ecx, edi
je 0x1000198b
mov ebx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov eax, ebx
sub eax, dword [ecx + 0x1c]
mov dword [ebp - 0x28], edx
test eax, eax
jle 0x10001985
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [edx], eax
and dword [ecx], 0
and dword [ecx + 4], 0
call fcn.10001016
dec dword [esi + 0x60]
mov ecx, dword [ebp - 0x28]
cmp ecx, edi
jne 0x10001954
mov ebx, dword [ebp - 0x2c]
mov dl, byte [ebp - 1]
mov ecx, dword [edi]
cmp ecx, edi
je 0x10001996
mov eax, dword [ecx + 0x1c]
jmp 0x10001999
mov eax, dword [esi + 0x14]
mov dword [esi + 0x10], eax
cmp dl, 0x52
jne 0x10001a66
mov eax, dword [esi + 0x4c]
sub eax, dword [ebp - 0xc]
js 0x100019bf
lfence
mov edx, dword [esi + 0x4c]
mov ecx, esi
sub edx, dword [ebp - 0xc]
call fcn.10001681
mov ecx, dword [edi]
mov eax, ebx
sub eax, dword [esi + 0x10]
js 0x10001a01
mov eax, ebx
sub eax, dword [esi + 0x14]
jns 0x10001a01
jmp 0x100019dd
cmp ebx, dword [ecx + 0x1c]
je 0x100019e3
mov eax, ebx
sub eax, dword [ecx + 0x1c]
js 0x10001a01
mov ecx, dword [ecx]
cmp ecx, edi
jne 0x100019cf
jmp 0x10001a01
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
mov dword [edx], eax
and dword [ecx], 0
and dword [ecx + 4], 0
call fcn.10001016
dec dword [esi + 0x60]
mov eax, dword [edi]
cmp eax, edi
je 0x10001a0c
mov eax, dword [eax + 0x1c]
jmp 0x10001a0f
mov eax, dword [esi + 0x14]
cmp dword [ebp - 0x20], 0
mov dword [esi + 0x10], eax
jne 0x10001a26
mov edi, ebx
mov dword [ebp - 0x20], 1
mov dword [ebp - 8], edi
jmp 0x10001a35
mov edi, dword [ebp - 8]
mov eax, ebx
sub eax, edi
test eax, eax
cmovg edi, ebx
mov dword [ebp - 8], edi
push 0x20
pop edx
mov ecx, esi
call fcn.1000107a
test eax, eax
je 0x10001b74
push dword [esi + 0x30]
mov eax, dword [esi + 0x4c]
sub eax, dword [ebp - 0xc]
push eax
push ebx
push 0x1004a83c
push edx
push esi
call fcn.1000102c
add esp, 0x18
jmp 0x10001b74
cmp dl, 0x51
jne 0x10001b1a
push 0x10
pop edx
mov ecx, esi
call fcn.1000107a
mov edi, dword [ebp - 0xc]
test eax, eax
je 0x10001a91
push edi
push ebx
push 0x1004a83c
push edx
push esi
call fcn.1000102c
add esp, 0x14
mov eax, ebx
sub eax, dword [esi + 0x3c]
sub eax, dword [esi + 0x18]
jns 0x10001b71
push edi
mov edx, ebx
mov ecx, esi
lfence
call fcn.10001700
mov eax, ebx
sub eax, dword [esi + 0x18]
pop ecx
js 0x10001b71
mov ecx, dword [ebp - 0x18]
lfence
lea ecx, [ecx + 0x3c]
call fcn.10001000
movzx ecx, byte [ebp - 2]
mov edi, eax
mov eax, dword [ebp - 0x30]
mov dword [edi + 8], eax
mov dword [edi + 0x10], ecx
mov ecx, dword [ebp - 0x14]
movzx eax, cx
mov dword [edi + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x24]
mov dword [edi + 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 0xc], 0x51
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x24], eax
test eax, eax
je 0x10001b0f
mov edx, dword [ebp - 0x10]
push eax
push edx
lea eax, [edi + 0x38]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov edx, edi
mov ecx, esi
call fcn.100017b4
jmp 0x10001b71
cmp dl, 0x53
jne 0x10001b42
or dword [esi + 0x48], 2
mov ecx, esi
push 0x40
pop edx
call fcn.1000107a
test eax, eax
je 0x10001b71
push 0x1004a83c
push edx
push esi
call fcn.1000102c
add esp, 0xc
jmp 0x10001b71
cmp dl, 0x54
jne 0x10001c46
mov edx, 0x80
mov ecx, esi
call fcn.1000107a
test eax, eax
je 0x10001b71
mov ecx, dword [ebp - 0x14]
movzx eax, cx
push eax
push 0x1004a83c
push edx
push esi
call fcn.1000102c
add esp, 0x10
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
cmp ecx, 0x18
jge 0x100018d8
cmp dword [ebp - 0x20], 0
je 0x10001bc0
mov eax, edi
sub eax, dword [esi + 0x10]
js 0x10001bc0
mov eax, edi
sub eax, dword [esi + 0x14]
jns 0x10001bc0
lea edx, [esi + 0x94]
mov ecx, dword [edx]
cmp ecx, edx
je 0x10001bc0
mov ebx, dword [ecx]
mov eax, edi
sub eax, dword [ecx + 0x1c]
js 0x10001bc0
cmp edi, dword [ecx + 0x1c]
je 0x10001bba
inc dword [ecx + 0x30]
mov ecx, ebx
cmp ebx, edx
jne 0x10001ba9
mov eax, dword [esi + 0x10]
sub eax, dword [ebp - 0x34]
test eax, eax
jle 0x10001c42
mov eax, dword [esi + 0x44]
mov ebx, dword [esi + 0x40]
cmp eax, ebx
jae 0x10001c42
mov edi, dword [esi + 8]
mov ecx, dword [esi + 0x80]
cmp eax, dword [esi + 0x24]
jae 0x10001bf0
lea edx, [eax + 1]
lea eax, [ecx + edi]
mov dword [esi + 0x80], eax
jmp 0x10001c2f
cmp ecx, edi
mov eax, edi
cmovb ecx, edi
imul eax, edi
xor edx, edx
mov dword [ebp - 0x34], ecx
div ecx
mov ecx, edi
add eax, dword [ebp - 0x34]
shr ecx, 4
add ecx, eax
mov eax, dword [esi + 0x44]
inc eax
mov dword [esi + 0x80], ecx
imul eax, edi
cmp eax, ecx
ja 0x10001c42
lea eax, [edi - 1]
add eax, ecx
test edi, edi
push 1
pop ecx
cmovne ecx, edi
xor edx, edx
div ecx
mov edx, eax
mov dword [esi + 0x44], edx
cmp edx, ebx
jbe 0x10001c42
mov dword [esi + 0x44], ebx
imul ebx, edi
mov dword [esi + 0x80], ebx
xor eax, eax
jmp 0x10001c52
push 0xfffffffffffffffd
jmp 0x10001c4c
push 0xfffffffffffffffe
pop eax
jmp 0x10001c52
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret