Function at 0x489ff0
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x564fa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push esi
push edi
xor ebx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x50], ebx
call fcn.00411f30
mov dword [esp + 0x34], 0x571d5c
mov dword [esp + 0x38], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x50], 2
call fcn.005132d2
mov eax, dword [esp + 0x68]
mov esi, dword [esp + 0x58]
push eax
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], 3
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x1c], ebx
call fcn.00416ab0
mov edi, eax
cmp edi, 0xffffffff
je 0x48a27b
push edi
push esi
lea ecx, [esp + 0x18]
call fcn.00417570
xor ecx, ecx
lea edx, [esp + 0x58]
mov cx, word [eax + 4]
push ecx
push esi
push edx
lea ecx, [esp + 0x1c]
call fcn.00416760
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 4
call fcn.005133d4
lea ecx, [esp + 0x58]
mov byte [esp + 0x50], 3
call fcn.005132cc
push edi
push esi
lea ecx, [esp + 0x18]
call fcn.00417570
movsx edx, byte [esi + 0x380]
xor ecx, ecx
cmp edi, edx
mov cl, byte [eax + 6]
mov dword [esp + 0x1c], ecx
jne 0x48a0dd
mov eax, dword [esp + 0x5c]
add eax, 0x29
mov dword [esp + 0x14], eax
jmp 0x48a27b
movsx ecx, byte [esi + 0x3d4]
cmp edi, ecx
jne 0x48a0f8
mov edx, dword [esp + 0x5c]
add edx, 0x25
mov dword [esp + 0x14], edx
jmp 0x48a27b
movsx eax, byte [esi + 0x40c]
cmp edi, eax
jne 0x48a113
mov ecx, dword [esp + 0x5c]
add ecx, 0x30
mov dword [esp + 0x14], ecx
jmp 0x48a27b
movsx edx, byte [esi + 0x3ee]
cmp edi, edx
jne 0x48a12e
mov eax, dword [esp + 0x5c]
add eax, 0x1c
mov dword [esp + 0x14], eax
jmp 0x48a27b
push edi
push esi
lea ecx, [esp + 0x18]
call fcn.004164c0
test eax, eax
je 0x48a1ad
lea ecx, [esp + 0x20]
call fcn.00513cb6
lea ecx, [esp + 0x20]
mov byte [esp + 0x50], 5
push ecx
push esi
lea ecx, [esp + 0x18]
call fcn.004170d0
cmp dword [esp + 0x28], ebx
jle 0x48a19f
mov edx, dword [esp + 0x24]
push edi
push esi
lea ecx, [esp + 0x18]
lea ebp, [edx + ebx*2]
call fcn.00417570
mov ax, word [eax + 4]
cmp ax, word [ebp]
je 0x48a193
mov eax, dword [esp + 0x28]
inc ebx
cmp ebx, eax
jl 0x48a160
mov byte [esp + 0x50], 3
lea ecx, [esp + 0x20]
jmp 0x48a276
mov ecx, dword [esp + 0x5c]
lea edx, [ebx + ecx + 0x1f]
mov dword [esp + 0x14], edx
mov byte [esp + 0x50], 3
lea ecx, [esp + 0x20]
jmp 0x48a276
push edi
push esi
lea ecx, [esp + 0x18]
call fcn.00416530
cmp eax, 0xffffffff
je 0x48a1ce
mov ecx, dword [esp + 0x5c]
lea edx, [eax + ecx + 0x2b]
mov dword [esp + 0x14], edx
jmp 0x48a27b
push edi
push esi
lea ecx, [esp + 0x18]
call fcn.004165f0
test eax, eax
je 0x48a1ed
mov eax, dword [esp + 0x5c]
add eax, 0x5c
mov dword [esp + 0x14], eax
jmp 0x48a27b
movsx ecx, byte [esi + 0x4aa]
cmp edi, ecx
jne 0x48a205
mov edx, dword [esp + 0x5c]
add edx, 0x5d
mov dword [esp + 0x14], edx
jmp 0x48a27b
push edi
push esi
lea ecx, [esp + 0x18]
call fcn.00416580
test eax, eax
je 0x48a27b
lea ecx, [esp + 0x20]
call fcn.00513cb6
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
push esi
mov byte [esp + 0x58], 6
call fcn.00416bc0
mov eax, dword [esp + 0x28]
xor ebp, ebp
cmp eax, ebx
jle 0x48a26d
mov ecx, dword [esp + 0x24]
push edi
push esi
lea ebx, [ecx + ebp*2]
lea ecx, [esp + 0x18]
call fcn.00417570
mov dx, word [eax + 4]
cmp dx, word [ebx]
je 0x48a261
mov eax, dword [esp + 0x28]
inc ebp
cmp ebp, eax
jl 0x48a23b
jmp 0x48a26d
mov eax, dword [esp + 0x5c]
lea ecx, [eax + ebp + 0x32]
mov dword [esp + 0x14], ecx
mov byte [esp + 0x50], 3
lea ecx, [esp + 0x20]
call fcn.00513cb0
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x18]
push edx
call fcn.005133d4
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x50], 2
mov dword [eax], ecx
lea ecx, [esp + 0x18]
call fcn.005132cc
lea ecx, [esp + 0x10]
mov byte [esp + 0x50], 0
call fcn.00411f60
lea ecx, [esp + 0x68]
mov dword [esp + 0x50], 0xffffffff
call fcn.005132cc
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 0x14