Function at 0x1000af5c
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
nop
push ebp
nop
mov ebp, esp
test esi, esi
add esp, 0x47
sub esp, 0x47
nop
mov esp, ebp
pop ebp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
xor edx, edx
mov dx, word [eax + 0x14]
lea eax, [ecx + edx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x1000afa8
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
xor edx, edx
mov dx, word [ecx + 6]
cmp dword [ebp - 8], edx
jge 0x1000b194
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x20000000
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x40000000
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
and edx, 0x80000000
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push ebp
mov ebp, esp
add esp, 0x13
sub esp, 0x13
push 0x28e0
add esp, 0xc
add esp, 0xfffffff4
add esp, 0xf
add esp, 0xfffffff1
mov esp, ebp
pop ebp
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x2000000
test ecx, ecx
je 0x1000b075
nop
push ebp
nop
mov ebp, esp
add esp, 0x5b
add esp, 0xffffffa5
add esp, 0x47
add esp, 0xffffffb9
nop
mov esp, ebp
nop
pop ebp
push str.VirtualFree
push 0x10015948
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
push 0x4000
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1000af96
nop
nop
push ebp
mov ebp, esp
inc ecx
dec ecx
test esi, esi
add esp, 0xa
sub esp, 0xa
add esp, 6
sub esp, 6
nop
nop
mov esp, ebp
nop
pop ebp
mov eax, dword [ebp - 0x10]
shl eax, 4
mov ecx, dword [ebp - 0x20]
lea edx, [eax + ecx*8 + 0x1001591c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x18], ecx
push ebp
mov ebp, esp
add esp, 9
add esp, 0xfffffff7
add esp, 0xa
add esp, 0xfffffff6
inc ecx
dec ecx
mov esp, ebp
pop ebp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
and eax, 0x4000000
test eax, eax
je 0x1000b0fa
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
test esi, esi
add esp, 0x51
sub esp, 0x51
nop
nop
mov esp, ebp
nop
pop ebp
mov ecx, dword [ebp - 0x18]
or ch, 2
mov dword [ebp - 0x18], ecx
nop
push ebp
mov ebp, esp
add esp, 0xf
add esp, 0xfffffff1
add esp, 9
sub esp, 9
nop
mov esp, ebp
nop
pop ebp
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1000b153
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x24]
and edx, 0x40
test edx, edx
je 0x1000b138
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x14], edx
jmp 0x1000b153
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x24]
and ecx, 0x80
test ecx, ecx
je 0x1000b153
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov ecx, dword [eax + 0x24]
mov dword [ebp - 0x14], ecx
push ebp
nop
nop
mov ebp, esp
add esp, 0x15
add esp, 0xffffffeb
add esp, 0xb
sub esp, 0xb
inc ecx
dec ecx
add esp, 2
sub esp, 2
nop
mov esp, ebp
pop ebp
cmp dword [ebp - 0x14], 0
jbe 0x1000b18f
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000af96
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret