Function at 0x73f1eaf3
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0x2c], edi
cmp dword [ebp + 8], edi
jne 0x73f1eb12
mov dword [ebp + 8], 0x73dbe4c4
push dword [ebp + 0xc]
call sym.dbghelp.dll_ImageNtHeader
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jne 0x73f1eb2d
mov eax, 0xd000007b
jmp 0x73f1efc8
movzx eax, word [ebx + 0x18]
mov edx, 0x10b
mov dword [ebp - 0x14], edi
mov ecx, edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
cmp ax, dx
je 0x73f1ec03
mov edx, 0x20b
cmp ax, dx
jne 0x73f1ecc3
and dword [ebp - 0x2c], ecx
lea esi, [ebx + 0x30]
mov ecx, dword [ebx + 0x84]
mov eax, dword [ebx + 0x54]
push 6
pop edx
cmp edx, ecx
mov dword [ebp - 0xc], eax
lea eax, [ebx + 0xb8]
sbb edx, edx
and edx, eax
mov eax, dword [esi]
mov dword [ebp - 0x14], edx
push 5
pop edx
cmp edx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 4]
sbb edx, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x50]
mov dword [ebp - 0x30], eax
lea eax, [ebx + 0xb0]
and edx, eax
lea eax, [ebx + 0xe8]
mov dword [ebp - 0x18], edx
push 0xc
pop edx
cmp edx, ecx
push 0xa
sbb edx, edx
and edx, eax
lea eax, [ebx + 0xd8]
mov dword [ebp - 8], edx
pop edx
cmp edx, ecx
sbb ecx, ecx
and ecx, eax
test byte [ebp + 0x30], 4
mov dword [ebp - 0x10], ecx
je 0x73f1ecc0
lea eax, [ebp - 0x48]
push eax
push 8
push 8
push esi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualProtect]
test eax, eax
je 0x73f1ec87
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 4], eax
jmp 0x73f1eca8
mov esi, dword [ebx + 0x74]
mov eax, dword [ebx + 0x54]
push 6
pop ecx
cmp ecx, esi
mov dword [ebp - 0xc], eax
lea eax, [ebx + 0xa8]
mov dword [ebp - 0x2c], 1
sbb ecx, ecx
and ecx, eax
mov eax, dword [ebx + 0x34]
cdq
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x50]
push 5
mov dword [ebp - 0x30], eax
pop eax
cmp eax, esi
mov dword [ebp - 0x14], ecx
lea ecx, [ebx + 0xa0]
mov dword [ebp - 0x24], edx
sbb eax, eax
and eax, ecx
push 0xc
pop ecx
cmp ecx, esi
mov dword [ebp - 0x18], eax
lea eax, [ebx + 0xd8]
sbb ecx, ecx
and ecx, eax
lea eax, [ebx + 0xc8]
push 0xa
mov dword [ebp - 8], ecx
pop ecx
cmp ecx, esi
sbb esi, esi
and esi, eax
test byte [ebp + 0x30], 4
mov dword [ebp - 0x10], esi
je 0x73f1ecc0
lea eax, [ebp - 0x48]
push eax
push 8
push 4
lea esi, [ebx + 0x34]
push esi
call dword [sym.imp.api_ms_win_core_memory_l1_1_0.dll_VirtualProtect]
test eax, eax
jne 0x73f1eca3
mov eax, dword [ebp - 4]
push 0x73dbf7a8
push dword [eax + 4]
call fcn.73f1f695
pop ecx
pop ecx
call fcn.73f1e77a
jmp 0x73f1efc8
mov eax, dword [ebp + 0x14]
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push dword [ebp + 0x2c]
mov esi, dword [ebp - 4]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push 0
push ecx
push 0
push dword [ebp + 0x1c]
mov ecx, esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.73f1e908
test eax, eax
jne 0x73f1efc8
movzx eax, word [ebx + 0x14]
xor edx, edx
and dword [ebp - 0x34], edi
add eax, 0x18
add eax, ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], eax
movzx eax, word [ebx + 6]
mov ecx, eax
cmp dx, ax
jae 0x73f1eea8
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x44], edx
test edx, edx
je 0x73f1ee91
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0x24]
and eax, 0xc0000000
cmp eax, 0xc0000000
jne 0x73f1ed64
test byte [ecx + 0x24], 0xc0
je 0x73f1ed64
test byte [ebp + 0x30], 1
je 0x73f1ee8e
test dword [ecx + 0x24], 0x10000000
je 0x73f1ed64
test byte [ebp + 0x30], 2
jne 0x73f1ee8e
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x73f1ed93
mov ecx, dword [eax]
cmp ecx, esi
jb 0x73f1ed93
lea eax, [esi + edx]
cmp ecx, eax
jae 0x73f1ed93
cmp byte [ebp + 0x1c], 0
je 0x73f1ed8b
sub ecx, esi
add ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 0xc]
mov dword [ebp - 0x3c], ecx
jmp 0x73f1ed93
mov eax, dword [ebp + 0xc]
add eax, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x73f1edbe
mov ecx, dword [eax]
cmp ecx, esi
jb 0x73f1edbe
lea eax, [esi + edx]
cmp ecx, eax
jae 0x73f1edbe
cmp byte [ebp + 0x1c], 0
je 0x73f1edb9
mov edi, ecx
sub edi, esi
add edi, dword [ebp - 0xc]
add edi, dword [ebp + 0xc]
jmp 0x73f1edbe
mov edi, dword [ebp + 0xc]
add edi, ecx
mov ecx, dword [ebp - 0x30]
lea eax, [esi + edx]
mov dword [ebp - 0x40], eax
cmp esi, ecx
jae 0x73f1edcf
cmp eax, ecx
jbe 0x73f1edee
push dword [ebp - 0x34]
mov eax, dword [ebp - 4]
push dword [ebp + 8]
push 0x73dbf7f8
push dword [eax + 4]
call fcn.73f1f72f
mov eax, dword [ebp - 0x40]
add esp, 0x10
mov edx, dword [ebp - 0x44]
test byte [ebp + 0x30], 8
je 0x73f1ee55
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x73f1ee55
mov ebx, dword [ecx]
cmp ebx, esi
jb 0x73f1ee52
cmp ebx, eax
jae 0x73f1ee52
sub ebx, esi
je 0x73f1ee3f
push dword [ebp + 0x2c]
mov ecx, dword [ebp - 4]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp - 0xc]
push ebx
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.73f1e908
test eax, eax
jne 0x73f1efc8
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 4]
mov ecx, dword [ebp - 0xc]
add eax, ebx
mov ebx, dword [ebp - 0x1c]
add esi, eax
add ecx, eax
sub edx, eax
jmp 0x73f1ee58
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
test edx, edx
je 0x73f1ee8e
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push ecx
push edx
push esi
push dword [ebp + 0x1c]
mov esi, dword [ebp - 4]
mov ecx, esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.73f1e908
test eax, eax
jne 0x73f1efc8
jmp 0x73f1ee91
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 0x34]
movzx ecx, word [ebx + 6]
inc edx
add dword [ebp - 0x38], 0x28
mov dword [ebp - 0x34], edx
cmp edx, ecx
jb 0x73f1ed18
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 0x14]
jne 0x73f1eeb8
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp + 0x18]
je 0x73f1eeff
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x73f1eeff
cmp dword [edx + 4], 0
je 0x73f1eeff
push dword [ebp - 0x28]
movzx eax, cx
mov ecx, dword [ebp + 0x14]
sub ecx, dword [ebp - 0x20]
push eax
push dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x1c]
sbb eax, dword [ebp - 0x24]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
movzx eax, word [ebx + 4]
push ecx
push dword [edx]
mov ecx, esi
push dword [edx + 4]
push eax
call fcn.73f1e138
test eax, eax
jne 0x73f1efc8
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x73f1ef4d
mov eax, dword [eax + 4]
test eax, eax
je 0x73f1ef4d
test edi, edi
je 0x73f1ef4d
xor ecx, ecx
xor ebx, ebx
xor edx, edx
xor esi, esi
cmp dword [ebp - 0x2c], ecx
je 0x73f1efcf
cmp eax, 0x80
jb 0x73f1ef43
cmp dword [edi + 0x7c], ecx
je 0x73f1ef43
mov ecx, dword [edi + 0x78]
xor eax, eax
movzx edx, word [edi + 0x8c]
inc eax
mov esi, dword [edi + 0x88]
jmp 0x73f1ef45
xor eax, eax
test eax, eax
jne 0x73f1f005
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0x3c]
test esi, esi
je 0x73f1efc6
mov eax, dword [ebp - 0x14]
xor edx, edx
push 0x1c
pop ecx
mov eax, dword [eax + 4]
div ecx
mov edi, eax
test edi, edi
je 0x73f1efc6
add esi, 0x18
mov ecx, dword [esi - 4]
dec edi
test ecx, ecx
je 0x73f1efbf
mov eax, dword [ebp - 0x30]
cmp dword [esi], eax
jb 0x73f1efbf
xor eax, eax
add ecx, dword [ebp + 0x14]
push 0
adc eax, dword [ebp + 0x18]
push 0
push eax
push ecx
mov ecx, ebx
call fcn.73f1e81e
test eax, eax
jne 0x73f1efbf
push dword [ebp + 0x2c]
mov ecx, ebx
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [esi]
push dword [esi - 8]
push dword [esi - 4]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.73f1e908
add esi, 0x1c
test edi, edi
jne 0x73f1ef6d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x2c
cmp eax, 0xd0
jb 0x73f1ef4d
mov eax, dword [edi + 0xc8]
or eax, dword [edi + 0xcc]
je 0x73f1ef4d
mov ecx, dword [edi + 0xc0]
mov ebx, dword [edi + 0xc4]
movzx edx, word [edi + 0xe4]
mov esi, dword [edi + 0xe0]
mov eax, ecx
or eax, ebx
jne 0x73f1f017
test edx, edx
jne 0x73f1f01f
test esi, esi
je 0x73f1ef4d
test edx, edx
jne 0x73f1f01f
test esi, esi
je 0x73f1f040
mov edi, dword [ebp - 0x1c]
movzx eax, word [edi + 6]
cmp edx, eax
ja 0x73f1f043
imul eax, edx, 0x28
mov edx, dword [ebp - 0x28]
cmp esi, dword [eax + edx - 0x20]
jae 0x73f1f046
mov ecx, dword [eax + edx - 0x1c]
add ecx, esi
xor ebx, ebx
jmp 0x73f1f046
mov edi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
mov eax, ecx
or eax, ebx
je 0x73f1ef4d
test ebx, ebx
ja 0x73f1ef4d
jb 0x73f1f063
cmp ecx, 0xffffffff
jae 0x73f1ef4d
push dword [ebp + 0x30]
movzx eax, word [edi + 6]
push edx
mov ebx, dword [ebp - 4]
push eax
push ecx
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push dword [ebp - 0x2c]
push ecx
mov ecx, ebx
call fcn.73ee36f7
test eax, eax
je 0x73f1ef50
jmp 0x73f1efc8