Function at 0x6c824c10
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x5c
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
lea ebx, [esi + eax]
add eax, 0x40
cmp eax, edx
ja 0x6c824e88
movzx eax, word [ebx]
cmp ax, 0x4550
je 0x6c824f00
cmp ax, 0x584c
je 0x6c825150
cmp ax, 0x454e
jne 0x6c824e88
movzx eax, byte [ebx + 0x36]
sub eax, 2
test al, 0xfd
jne 0x6c824e88
mov eax, dword [ebp - 0x24]
movzx edi, word [ebx + 6]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_strlen]
mov dword [ebp - 0x38], eax
call eax
movzx edx, word [ebx + 0x28]
mov dword [ebp - 0x1c], eax
movzx eax, word [ebx + 4]
movzx ecx, word [ebx + 0x1c]
lea eax, [edx + eax + 0x67]
movzx edx, di
lea ecx, [ecx + ecx*4]
add eax, edx
lea eax, [eax + ecx*2]
movzx ecx, word [ebx + 0x1e]
lea eax, [eax + ecx*2]
movzx ecx, word [ebx + 0x24]
sub eax, ecx
movzx ecx, word [ebx + 0x2a]
sub eax, ecx
movzx ecx, word [ebx + 0x30]
mov dword [esp], 0x40
lea edi, [ecx*4]
sub ecx, edi
lea edx, [edx + ecx*2]
lea eax, [eax + edx*2]
add eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
call sym.krnl386.exe16_GlobalAlloc16
sub esp, 8
mov word [ebp - 0x1c], ax
test ax, ax
je 0x6c824e78
movzx eax, word [ebp - 0x1c]
mov dword [esp + 4], eax
mov edi, eax
mov dword [esp], eax
mov dword [ebp - 0x2c], eax
call sym.krnl386.exe16_FarSetOwner16
sub esp, 8
mov dword [esp], edi
call sym.krnl386.exe16_GlobalLock16
xor ecx, ecx
mov edi, eax
mov eax, dword [ebx]
sub esp, 4
mov dword [edi], eax
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [ebx + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [ebx + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [ebx + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [ebx + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [ebx + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [ebx + 0x3c]
mov dword [edi + 0x3c], eax
mov word [edi + 2], cx
movzx eax, word [edi + 0xc]
test ax, ax
js 0x6c824d80
cmp word [edi + 0x12], 0x13ff
ja 0x6c824d80
mov edx, 0x1400
mov word [edi + 0x12], dx
movzx ecx, word [ebp - 0x1c]
lea edx, [edi + 0x58]
and eax, 0xffffffcf
mov dword [edi + 0x50], esi
mov word [edi + 0xc], ax
mov dword [ebp - 0x28], edx
mov word [edi + 0x48], cx
mov ecx, dword [ebp - 0x20]
mov dword [edi + 0x54], ecx
mov ecx, 0x58
mov word [edi + 0x22], cx
movzx edx, word [ebx + 0x1c]
movzx eax, word [ebx + 0x22]
add eax, dword [esi + 0x3c]
mov word [ebp - 0x30], dx
mov dword [ebp - 0x34], edx
shl edx, 3
lea ecx, [eax + edx]
cmp dword [ebp - 0x20], ecx
jb 0x6c824ed6
add eax, esi
cmp word [ebp - 0x30], 0
je 0x6c825270
mov ecx, dword [ebp - 0x28]
add edx, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], esi
mov ebx, dword [eax]
add eax, 8
add ecx, 0xa
mov esi, dword [eax - 4]
mov dword [ecx - 0xa], ebx
mov dword [ecx - 6], esi
cmp eax, edx
jne 0x6c824de0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x20]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2]
mov ecx, dword [edi + 0x54]
mov dword [ebp - 0x28], eax
sub eax, edi
mov dword [ebp - 0x20], ecx
movzx ecx, word [ebx + 0x26]
cmp word [ebx + 0x24], cx
jae 0x6c824f10
mov word [edi + 0x24], ax
movzx ecx, word [ebx + 0x24]
mov edx, dword [esi + 0x3c]
movzx eax, word [ebx + 0x26]
add edx, ecx
sub eax, ecx
lea ecx, [edx + eax]
cmp ecx, dword [ebp - 0x20]
ja 0x6c824ed6
add edx, dword [edi + 0x50]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
movzx eax, word [ebx + 0x26]
movzx edx, word [ebx + 0x24]
sub eax, edx
add dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov ecx, dword [edi + 0x54]
sub eax, edi
mov dword [ebp - 0x20], ecx
jmp 0x6c824f16
test byte [0x6c8458e4], 2
jne 0x6c8250e0
lea esi, [esi]
mov ebx, 0xb
mov word [ebp - 0x1c], bx
movzx eax, word [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6c845914], 1
je 0x6c824ed6
mov eax, dword [ebp - 0x24]
call fcn.6c824960
mov dword [esp + 0xc], str.not_enough_space_for_entry_table_for__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.build_module
mov dword [esp + 4], 0x6c845914
mov dword [esp], 0
call fcn.6c824ba0
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym.krnl386.exe16_GlobalFree16
mov edx, 0xb
mov word [ebp - 0x1c], dx
sub esp, 4
movzx eax, word [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x15
mov word [ebp - 0x1c], ax
jmp 0x6c824e91
xor edx, edx
mov word [edi + 0x24], dx
mov word [edi + 0x26], ax
movzx ecx, word [ebx + 0x26]
mov edx, dword [esi + 0x3c]
movzx eax, word [ebx + 0x28]
add edx, ecx
sub eax, ecx
lea ecx, [edx + eax]
cmp ecx, dword [ebp - 0x20]
ja 0x6c824ed6
add edx, dword [edi + 0x50]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
movzx eax, word [ebx + 0x28]
movzx edx, word [ebx + 0x26]
sub eax, edx
add eax, dword [ebp - 0x28]
cmp word [ebx + 0x1e], 0
mov dword [ebp - 0x20], eax
jne 0x6c825090
xor eax, eax
mov word [edi + 0x28], ax
mov eax, dword [ebp - 0x20]
sub eax, edi
mov word [edi + 0x2a], ax
movzx ecx, word [ebx + 0x2a]
mov edx, dword [esi + 0x3c]
movzx eax, word [ebx + 4]
add edx, ecx
sub eax, ecx
lea ecx, [edx + eax]
cmp ecx, dword [edi + 0x54]
ja 0x6c824ed6
add edx, dword [edi + 0x50]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
movzx edx, word [ebx + 0x2a]
movzx eax, word [ebx + 4]
sub eax, edx
add eax, dword [ebp - 0x20]
mov ecx, eax
mov dword [ebp - 0x3c], eax
sub eax, edi
mov word [edi + 4], ax
movzx eax, word [ebx + 4]
movzx edx, word [ebx + 6]
add eax, dword [esi + 0x3c]
add edx, eax
cmp edx, dword [edi + 0x54]
ja 0x6c824ed6
add eax, dword [edi + 0x50]
mov edx, eax
je 0x6c824ed6
mov eax, ecx
mov dword [ecx], 0
xor ecx, ecx
mov word [eax + 4], cx
movzx ecx, byte [edx]
lea esi, [eax + 6]
test cl, cl
je 0x6c8251d6
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x40], ebx
movzx ebx, cl
mov dword [ebp - 0x34], edi
lea esi, [esi]
movzx ecx, byte [edx + 1]
lea edi, [edx + 2]
mov dword [ebp - 0x28], edi
movzx edi, bl
test cl, cl
je 0x6c825118
add eax, edi
mov edi, dword [ebp - 0x20]
mov word [edi + 2], ax
lea eax, [ebx - 1]
cmp cl, 0xff
je 0x6c825190
movzx eax, al
mov byte [ebp - 0x30], bl
lea edi, [eax + eax*2 + 5]
mov eax, esi
add edi, edx
mov edx, dword [ebp - 0x28]
lea esi, [esi]
nop
mov byte [eax], cl
movzx ebx, byte [edx]
add edx, 3
add eax, 5
mov byte [eax - 3], cl
mov byte [eax - 4], bl
movzx ebx, word [edx - 2]
mov word [eax - 2], bx
cmp edx, edi
jne 0x6c825048
movzx ebx, byte [ebp - 0x30]
lea edx, [ebx + ebx*2]
add edx, dword [ebp - 0x28]
lea eax, [ebx + ebx*4]
add esi, eax
movzx ebx, byte [edx]
test bl, bl
je 0x6c8251d0
mov eax, dword [ebp - 0x20]
movzx eax, word [eax + 2]
jmp 0x6c825008
sub eax, edi
mov word [edi + 0x28], ax
movzx edx, word [ebx + 0x1e]
movzx eax, word [ebx + 0x28]
add eax, dword [esi + 0x3c]
add edx, edx
lea ecx, [eax + edx]
cmp ecx, dword [edi + 0x54]
ja 0x6c824ed6
add eax, dword [edi + 0x50]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
mov ecx, dword [ebp - 0x20]
movzx eax, word [ebx + 0x1e]
lea eax, [ecx + eax*2]
mov dword [ebp - 0x20], eax
jmp 0x6c824f68
mov eax, dword [ebp - 0x24]
call fcn.6c824960
mov dword [esp + 0xc], str.Failed_to_create_module_for__s__16_bit_LDT_support_may_be_missing._n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.build_module
mov dword [esp + 4], 0x6c8458e4
mov dword [esp], 1
call fcn.6c824ba0
jmp 0x6c824e88
mov ebx, dword [ebp - 0x20]
cmp word [ebx], ax
je 0x6c825178
mov ebx, dword [ebp - 0x20]
mov edx, esi
add edi, eax
mov dword [ebp - 0x20], esi
sub edx, dword [ebp - 0x34]
xor eax, eax
add esi, 6
mov word [ebx + 4], dx
mov edx, dword [ebp - 0x28]
mov word [esi - 4], di
mov word [esi - 6], di
mov word [esi - 2], ax
jmp 0x6c825074
mov eax, dword [ebp - 0x24]
mov dword [esp], str.Sorry___s_is_an_OS_2_linear_executable__LX__file__n
mov esi, 0xc
mov dword [esp + 4], eax
call fcn.6c824bf0
mov word [ebp - 0x1c], si
jmp 0x6c824e91
add eax, edi
mov edx, dword [ebp - 0x28]
mov word [ebx], ax
mov word [ebx + 2], ax
jmp 0x6c825074
mov eax, dword [ebp - 0x28]
lea edx, [ebx + ebx*4]
add edx, esi
lea esi, [esi]
nop
mov byte [esi], 0xff
movzx ecx, byte [eax]
add esi, 5
add eax, 6
mov byte [esi - 4], cl
movzx ecx, byte [eax - 3]
mov byte [esi - 3], cl
movzx ecx, word [eax - 2]
mov word [esi - 2], cx
cmp esi, edx
jne 0x6c8251a0
mov edi, dword [ebp - 0x28]
lea eax, [ebx + ebx*2]
lea edx, [edi + eax*2]
jmp 0x6c825074
mov ebx, dword [ebp - 0x40]
mov edi, dword [ebp - 0x34]
movzx eax, word [ebx + 0x30]
lea edx, [eax*4]
sub eax, edx
movzx edx, word [ebx + 6]
lea eax, [edx + eax*2]
lea eax, [edx + eax*2 + 6]
mov edx, dword [ebp - 0x3c]
add edx, eax
cmp edx, esi
jb 0x6c824e9d
mov esi, dword [ebp - 0x24]
mov eax, edx
mov dword [ebp - 0x20], edx
sub eax, edi
mov word [edi + 0xa], ax
mov eax, dword [ebp - 0x38]
mov dword [esp], esi
call eax
mov edx, dword [ebp - 0x20]
add eax, 8
mov byte [edx], al
mov byte [edx + 1], 1
mov dword [esp + 4], esi
lea esi, [edx + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strcpy]
movzx eax, word [ebx + 0x20]
test ax, ax
jne 0x6c82527a
xor esi, esi
mov word [edi + 0x3a], si
movzx eax, word [edi + 0x1e]
test ax, ax
jne 0x6c8252e9
xor ecx, ecx
mov word [edi + 0x38], cx
mov eax, dword [0x6c845a20]
movzx edx, word [eax + 4]
mov word [edi + 6], dx
movzx edx, word [edi + 0x48]
mov word [eax + 4], dx
jmp 0x6c824e91
mov eax, 0x58
jmp 0x6c824e12
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.krnl386.exe16_GlobalAlloc16
sub esp, 8
mov word [edi + 0x3a], ax
test ax, ax
je 0x6c824ed6
mov esi, dword [ebp - 0x2c]
movzx eax, ax
mov dword [esp], eax
mov dword [esp + 4], esi
call sym.krnl386.exe16_FarSetOwner16
movzx eax, word [edi + 0x3a]
sub esp, 8
mov dword [esp], eax
call sym.krnl386.exe16_GlobalLock16
movzx edx, word [ebx + 0x20]
mov esi, eax
mov eax, dword [ebx + 0x2c]
sub esp, 4
lea ecx, [eax + edx]
cmp ecx, dword [edi + 0x54]
jbe 0x6c825323
movzx eax, word [edi + 0x3a]
mov dword [esp], eax
call sym.krnl386.exe16_GlobalFree16
xor eax, eax
sub esp, 4
mov word [edi + 0x3a], ax
jmp 0x6c82523c
lea eax, [eax + eax + 2]
mov dword [esp], 0x40
mov dword [esp + 4], eax
call sym.krnl386.exe16_GlobalAlloc16
sub esp, 8
mov word [edi + 0x38], ax
test ax, ax
je 0x6c82533b
mov esi, dword [ebp - 0x2c]
movzx eax, ax
mov dword [esp], eax
mov dword [esp + 4], esi
call sym.krnl386.exe16_FarSetOwner16
sub esp, 8
jmp 0x6c82524f
add eax, dword [edi + 0x50]
mov dword [esp + 8], edx
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.ucrtbase.dll_memcpy
jmp 0x6c82523c
movzx eax, word [edi + 0x3a]
test ax, ax
je 0x6c824ed6
mov dword [esp], eax
call sym.krnl386.exe16_GlobalFree16
push ebx
jmp 0x6c824ed6