Function at 0x104b2f88
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x18]
cmp dword [ebp], 0
je 0x104b3130
cmp dword [ebp + 4], 0
je 0x104b3130
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
cmp dword [eax], 0x10000000
jae 0x104b3130
mov eax, dword [ecx + 4]
cmp dword [eax], 0x10000000
jae 0x104b3130
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
mov dword [edi + 0xfc], 1
mov edx, dword [ecx]
mov esi, dword [edx]
and esi, 0x800000
je 0x104b2ef0
cmp dword [edx + 4], 8
je 0x104b2f15
mov eax, dword [ecx + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [eax]
mov ebx, ecx
and ebx, 0x800000
mov dword [esp + 0x18], ebx
je 0x104b2f99
cmp dword [eax + 4], 8
jne 0x104b2f99
mov ebx, 0x16
mov dword [esp + 0x14], 0xc
mov ecx, dword [esp + 0x28]
mov esi, ebp
sub ecx, ebp
mov ebp, 2
mov dword [esp + 0x28], ecx
mov eax, dword [esi]
movzx edx, ax
shr eax, 0x18
and eax, 0x1f
mov dword [esp + 0x10], edx
cmp eax, 0xe
je 0x104b3031
cmp eax, 0xd
je 0x104b3031
cmp eax, 0x15
je 0x104b3064
cmp eax, 0x16
je 0x104b3064
mov eax, dword [ecx + esi]
movzx edx, bx
mov ecx, dword [eax]
mov eax, edx
shr ecx, 0xc
not ecx
shl eax, 5
and ecx, 0x800
or ecx, eax
or ecx, 0x13
or edx, 0x5500
movzx eax, cx
mov word [edi + 0x74], dx
mov word [edi + 0x72], ax
jmp 0x104b304f
cmp dword [esp + 0x2c], 0xa
mov ebx, 0x15
mov dword [esp + 0x14], 0xb
jge 0x104b2f22
mov eax, ecx
or eax, dword [edx]
test eax, 0x4000000
jne 0x104b2f22
cmp dword [edx + 4], 4
jne 0x104b2f22
mov eax, dword [esp + 0x10]
cmp dword [eax + 4], 4
jne 0x104b2f22
xor ecx, dword [edx]
test ecx, 0x800000
je 0x104b3025
movzx eax, word [ebp + 4]
mov edx, 0x8000
cmp ax, dx
jae 0x104b2ffb
mov ecx, eax
mov eax, dword [edi + 0x10]
cmp dword [eax + ecx*8], 0
jge 0x104b3025
movzx eax, word [ebp]
cmp ax, dx
jae 0x104b2f22
mov ecx, eax
mov eax, dword [edi + 0x10]
cmp dword [eax + ecx*8], 0
jl 0x104b2f22
xor ebx, ebx
cmp dword [esp + 0x18], ebx
setne bl
add ebx, 0x13
jmp 0x104b307d
xor ebx, ebx
test esi, esi
setne bl
add ebx, 0x13
jmp 0x104b307d
movzx edx, bx
mov ecx, edx
or edx, 0xa0
or ecx, 0x5500
shl edx, 5
or edx, eax
mov word [edi + 0x74], cx
mov word [edi + 0x72], dx
mov ecx, dword [esp + 0x10]
mov word [edi + 0x70], cx
mov ecx, edi
call fcn.104ac730
mov ecx, dword [esp + 0x28]
mov dword [esi], eax
add esi, 4
sub ebp, 1
jne 0x104b2f33
mov ebp, dword [esp + 0x2c]
cmp ebp, 0xa
jge 0x104b30db
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
cmp eax, 4
jne 0x104b308b
lea edx, [eax + 4]
jmp 0x104b30a5
xor ecx, ecx
mov edx, 2
cmp eax, 6
cmove edx, ecx
cmp ebx, 0x14
je 0x104b30a2
cmp ebx, 0x16
jne 0x104b30a5
add edx, 4
movzx eax, word [ebp]
movzx ecx, word [ebp + 4]
shl edx, 8
or edx, ebx
mov word [edi + 0x70], ax
or edx, 0x80
mov word [edi + 0x72], cx
mov word [edi + 0x74], dx
mov eax, 0x2007ffd
mov dword [edi + 0xf8], 2
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x24]
movzx ecx, word [eax]
movzx esi, word [eax + 4]
lea eax, [ebp + 0x1e]
shl eax, 8
or eax, ebx
mov word [edi + 0x70], cx
mov ecx, edi
mov word [edi + 0x74], ax
mov word [edi + 0x72], si
call fcn.104ac730
mov edx, dword [esp + 0x14]
mov ecx, edi
mov esi, eax
call fcn.10490320
movzx edx, ax
mov ecx, edi
mov eax, 0x518a
mov word [edi + 0x72], si
mov word [edi + 0x74], ax
mov word [edi + 0x70], dx
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
jmp fcn.104ac730
xor eax, eax
pop ebp
add esp, 0xc
ret