Function at 0x1000b6e0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
lea ebp, [ecx + eax + 0x18]
mov eax, dword [edi + 0x30]
mov ecx, dword [ebp + 8]
dec eax
not eax
and eax, ecx
cmp dword [0x10034788], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
jne 0x1000b74d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
jbe 0x1000b745
push 0
push 0x80
push 0
push 0
push 4
push 0x40000000
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, ebp
call fcn.1000b3b0
mov edx, dword [ebp + 0x24]
mov ebx, eax
mov eax, dword [edi]
mov ecx, 1
add ebp, 0x28
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x18], 1
cmp cx, word [eax + 6]
jae 0x1000b9f4
mov esi, dword [edi + 0x30]
mov eax, dword [ebp + 8]
mov edi, dword [esp + 0x34]
dec esi
not esi
mov ecx, ebp
mov dword [esp + 0x14], eax
and esi, eax
call fcn.1000b3b0
mov edi, eax
mov dword [esp + 0x10], edi
cmp dword [esp + 0x20], esi
je 0x1000b830
mov edx, dword [esp + 0x1c]
add ebx, edx
cmp ebx, esi
ja 0x1000b830
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.1000b460
add esp, 8
test eax, eax
je 0x1000ba18
cmp dword [0x10034788], 0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], esi
jne 0x1000b824
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
jbe 0x1000b81c
push 0
push 0x80
push 0
push 0
push 4
push 0x40000000
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x28], eax
jmp 0x1000b9cc
cmp dword [0x10034788], 0
jne 0x1000b88b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
jbe 0x1000b87b
push 0
push 0x80
push 0
push 0
push 4
push 0x40000000
push 0
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x1000b897
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x1000b897
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x2000000
test dword [ebp + 0x24], eax
je 0x1000b8f4
test dword [esp + 0x28], eax
je 0x1000b8f4
cmp dword [0x10034788], 0
jne 0x1000b8e8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, eax
jbe 0x1000b8dc
push 0
push 0x80
push 0
push 0
push 4
push 0x40000000
push 0
call esi
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [esp + 0x10]
mov ecx, dword [ebp + 0x24]
or dword [esp + 0x28], ecx
jmp 0x1000b983
cmp dword [0x10034788], 0
jne 0x1000b972
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, eax
jbe 0x1000b929
push 0
push 0x80
push 0
push 0
push 4
push 0x40000000
push 0
call esi
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [0x10034788], 0
jne 0x1000b96e
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, eax
jbe 0x1000b966
push 0
push 0x80
push 0
push 0
push 4
push 0x40000000
push 0
call esi
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [esp + 0x10]
mov edx, dword [ebp + 0x24]
or edx, dword [esp + 0x28]
and edx, 0xfdffffff
mov dword [esp + 0x28], edx
cmp dword [0x10034788], 0
jne 0x1000b9c4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, eax
jbe 0x1000b9b8
push 0
push 0x80
push 0
push 0
push 4
push 0x40000000
push 0
call esi
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edi, dword [esp + 0x10]
sub edi, dword [esp + 0x1c]
add edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
movzx ecx, word [edx + 6]
inc eax
mov ebx, edi
mov edi, dword [esp + 0x34]
add ebp, 0x28
cmp eax, ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], eax
jl 0x1000b785
lea edx, [esp + 0x1c]
push edx
push edi
mov dword [esp + 0x34], 1
call fcn.1000b460
add esp, 8
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x20
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret