Function at 0x3f3c3
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ax, word [edi + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
movzx esi, byte [eax + 0x139]
mov dword [ebp - 0x1c], esi
call fcn.00011580
movzx eax, al
xor ebx, ebx
test byte [ebp + 0x1c], 1
mov dword [ebp - 0x14], eax
je 0x3f436
cmp dword [0x518dc], ebx
je 0x3f40c
cmp byte [0x5422c], bl
jne 0x3f436
cmp eax, ebx
jne 0x3f436
cmp esi, ebx
jne 0x3f436
push dword [ebp + 0x20]
mov esi, dword [ebp + 0x14]
push ebx
push ebx
push ebx
push dword [ebp + 0x1c]
push ebx
push ebx
push dword [edi + 0xc]
push dword [edi + 8]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0xc]
call fcn.0001236e
jmp 0x3f439
mov esi, dword [ebp + 0x14]
mov ax, word [esi + 6]
and ax, 0xff1f
mov ch, al
mov cl, ah
shl ecx, 3
movzx eax, cx
mov dword [ebp - 0xc], ecx
movzx ecx, word [ebp - 0x10]
add eax, ecx
cmp eax, 0xffeb
jbe 0x3f46e
inc dword [0x4fcc0]
push ebx
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x3f952
mov ebx, dword [ebp + 8]
lea ecx, [ebx + 0x20]
mov dword [ebp - 4], ecx
call dword [sym.imp.ntoskrnl.exe_KefAcquireSpinLockAtDpcLevel]
xor eax, eax
mov al, byte [esi + 9]
push eax
xor eax, eax
mov ax, word [esi + 4]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 8]
push dword [esi + 0x10]
push ebx
push eax
call fcn.0003f09c
mov ebx, eax
test ebx, ebx
jne 0x3f5a7
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_KefReleaseSpinLockFromDpcLevel]
mov eax, dword [0x4fbc8]
cmp eax, dword [0x4f9b4]
jb 0x3f4c8
inc dword [0x4fcc0]
inc dword [0x4fbcc]
jmp 0x3f4e5
push 0x10
push 0x64694354
push 0x60
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTagPriority]
mov ebx, eax
test ebx, ebx
jne 0x3f4ec
inc dword [0x4fcc0]
push 0
jmp 0x3f462
xor ecx, ecx
mov eax, 0x4fbc8
inc ecx
lock xadd dword [eax], ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_KefAcquireSpinLockAtDpcLevel]
xor eax, eax
mov al, byte [esi + 9]
push eax
xor eax, eax
mov ax, word [esi + 4]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 8]
push dword [esi + 0x10]
push dword [ebp + 8]
push eax
call fcn.0003f09c
test eax, eax
mov dword [ebp - 0x18], eax
je 0x3f541
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ebx, dword [ebp - 0x18]
mov eax, 0x4fbc8
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jmp 0x3f5a7
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebx], ecx
mov dword [eax], ebx
mov eax, dword [esi + 0x10]
mov dword [ebx + 4], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 8], eax
mov ax, word [esi + 4]
mov word [ebx + 0xc], ax
mov al, byte [esi + 9]
push 0x78
mov byte [ebx + 0xe], al
mov al, byte [esi + 8]
pop ecx
cmp al, cl
ja 0x3f571
movzx ecx, al
movzx edx, byte [0x51c24]
inc ecx
cmp edx, ecx
jle 0x3f581
mov eax, edx
jmp 0x3f58e
cmp al, 0x78
jbe 0x3f58a
push 0x78
pop eax
jmp 0x3f58d
movzx eax, al
inc eax
mov byte [ebx + 0xf], al
xor eax, eax
or word [ebx + 0x14], 0xffff
mov word [ebx + 0x1a], ax
mov dword [ebx + 0x10], eax
mov word [ebx + 0x16], ax
mov word [ebx + 0x18], ax
mov eax, dword [ebp - 0xc]
test ax, ax
jne 0x3f5d3
mov eax, dword [ebp + 0x18]
mov word [ebx + 0x18], ax
lea ecx, [eax + 8]
mov eax, ecx
shr ecx, 2
lea edi, [ebx + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
test byte [esi + 6], 0x20
jne 0x3f5e2
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov word [ebx + 0x14], cx
mov cx, word [ebx + 0x14]
cmp cx, word [ebx + 0x16]
jb 0x3f933
cmp cx, 0xffff
je 0x3f60b
movzx edx, word [ebx + 0x18]
movzx ecx, cx
add edx, ecx
cmp edx, 0xffff
jg 0x3f933
mov ecx, dword [ebp - 0x10]
lea ecx, [eax + ecx - 1]
mov dword [ebp + 0x14], ecx
lea ecx, [ebx + 0x10]
mov esi, dword [ecx]
test esi, esi
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x18], ecx
jne 0x3f62c
jmp 0x3f6f6
mov ecx, dword [ebp + 0x18]
cmp ax, word [esi + 0x24]
jb 0x3f6bf
cmp ax, word [esi + 0x26]
ja 0x3f666
inc word [ebx + 0x1a]
movzx edx, word [ebx + 0x1a]
cmp edx, dword [0x4f9b8]
jae 0x3f6d4
xor ecx, ecx
mov cx, word [esi + 0x26]
cmp word [ebp + 0x14], cx
jbe 0x3f6f0
inc ecx
mov dword [ebp + 0x10], ecx
mov eax, ecx
mov dword [ebp + 0x18], esi
mov esi, dword [esi]
test esi, esi
je 0x3f6f6
jmp 0x3f629
inc word [ebx + 0x1a]
movzx edx, word [ebx + 0x1a]
cmp edx, dword [0x4f9b8]
jae 0x3f6d4
mov dx, word [ebp + 0x14]
cmp dx, word [esi + 0x26]
jbe 0x3f6ac
mov ax, word [esi + 0xc]
sub word [ebx + 0x16], ax
mov eax, esi
mov esi, dword [esi]
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
jmp 0x3f6bb
xor edx, edx
mov dx, word [esi + 0x24]
cmp ax, dx
jae 0x3f6cb
dec edx
mov dword [ebp + 0x14], edx
test esi, esi
je 0x3f6f6
mov dx, word [ebp + 0x14]
cmp dx, word [esi + 0x24]
jb 0x3f6f6
jmp 0x3f675
mov dword [edi], esi
mov dword [ecx], edi
jmp 0x3f93c
mov dword [edi], esi
mov dword [ecx], edi
mov eax, dword [ebx]
mov ecx, dword [ebp - 8]
push ebx
mov dword [ecx], eax
call fcn.0003f374
inc dword [0x4fbcc]
jmp 0x3f949
lea ecx, [eax - 1]
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0x14]
sub ecx, eax
inc ecx
test cx, cx
jne 0x3f70f
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x3f949
mov word [edi + 0x24], ax
sub eax, dword [ebp - 0xc]
movzx edx, cx
mov dword [edi + 0xc], edx
mov dx, word [ebp + 0x14]
movzx eax, ax
mov word [edi + 0x26], dx
add word [ebx + 0x16], cx
add dword [edi + 8], eax
and dword [edi + 4], 0
mov eax, dword [ebp + 0x18]
mov dword [edi], esi
mov dword [eax], edi
mov ax, word [ebx + 0x16]
cmp ax, word [ebx + 0x14]
jne 0x3f949
cmp word [ebx + 0x18], 0
je 0x3f949
mov eax, dword [ebx]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_KefReleaseSpinLockFromDpcLevel]
mov al, byte [ebx + 0x24]
mov byte [ebp - 0x33], al
mov al, byte [ebx + 0x1d]
mov byte [ebp - 0x32], al
mov ax, word [ebx + 0x18]
cmp ax, 0x14
mov byte [ebp - 0x31], 0
je 0x3f78c
lea ecx, [ebx + 0x30]
mov dword [ebp - 0x3c], ecx
mov cl, al
sub cl, 0x14
mov byte [ebp - 0x34], cl
jmp 0x3f794
and dword [ebp - 0x3c], 0
mov byte [ebp - 0x34], 0
mov cx, word [ebx + 0x1e]
not cx
movzx edi, cx
mov cx, word [ebx + 0x26]
not cx
movzx ecx, cx
add edi, ecx
mov cx, word [ebx + 0x14]
add cx, ax
mov ah, cl
mov al, ch
mov word [ebx + 0x1e], ax
movzx eax, ax
add edi, eax
mov ax, word [ebx + 0x22]
test al, 0x20
je 0x3f7d4
mov ecx, 0xffdf
add edi, ecx
and ax, cx
mov word [ebx + 0x22], ax
movzx ecx, di
mov eax, edi
shr eax, 0x10
add eax, ecx
mov ecx, eax
shr ecx, 0x10
add ecx, eax
not ecx
mov word [ebx + 0x26], cx
mov edi, dword [ebx + 0x10]
mov ecx, 0xc8
cmp dword [edi + 0x28], ecx
mov dword [ebp + 0x18], edi
jl 0x3f8a5
cmp dword [edi + 0xc], ecx
jae 0x3f861
mov eax, dword [edi]
test eax, eax
je 0x3f861
mov edx, dword [edi + 0xc]
mov esi, ecx
mov ecx, dword [eax + 0xc]
sub esi, edx
cmp esi, ecx
mov dword [ebp + 0x14], esi
jb 0x3f81e
mov dword [ebp + 0x14], ecx
mov edi, dword [edi + 8]
mov ecx, dword [ebp + 0x14]
mov esi, dword [eax + 8]
add edi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x18]
mov ecx, edx
add dword [esi + 0xc], ecx
add dword [eax + 8], ecx
sub dword [eax + 0xc], ecx
jne 0x3f854
mov ecx, dword [eax]
push 0
push eax
mov dword [esi], ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edi, dword [ebp + 0x18]
mov ecx, 0xc8
cmp dword [esi + 0xc], ecx
jb 0x3f804
inc dword [0x4fcbc]
xor eax, eax
cmp dword [0x518dc], eax
je 0x3f879
cmp byte [0x5422c], al
jne 0x3f8b0
cmp dword [ebp - 0x14], eax
jne 0x3f8b0
cmp dword [ebp - 0x1c], eax
jne 0x3f8b0
push dword [ebp + 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
movzx eax, word [ebx + 0x14]
push eax
movzx eax, word [ebx + 0x18]
push edi
push eax
lea eax, [ebx + 0x1c]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00011ddd
push ebx
call fcn.0003f374
jmp 0x3f952
cmp dword [ebp - 0x14], eax
movzx esi, word [ebx + 0x14]
je 0x3f8f2
push 0x10
push 0x65694354
push 0x24
push eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTagPriority]
xor edx, edx
cmp eax, edx
je 0x3f8a5
lea ecx, [ebx + 0x1c]
mov dword [eax + 8], ecx
movzx ecx, word [ebx + 0x18]
mov dword [eax + 0xc], ecx
mov dword [eax + 4], edx
mov dword [eax], edi
mov dword [eax + 0x20], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
movzx ecx, word [ebx + 0x18]
add esi, ecx
jmp 0x3f8f4
mov eax, edi
push dword [ebp + 0x20]
lea ecx, [ebp - 0x3c]
push dword [ebp + 0x1c]
push 0
push ecx
push esi
push eax
movzx eax, word [ebx + 0x18]
push eax
lea eax, [ebx + 0x1c]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00011919
cmp dword [ebp - 0x14], 0
je 0x3f8a5
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0x4fbc8
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jmp 0x3f952
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebx]
mov ecx, dword [ebp - 8]
push ebx
mov dword [ecx], eax
call fcn.0003f374
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_KefReleaseSpinLockFromDpcLevel]
pop edi
pop esi
pop ebx
leave
ret 0x1c