Function at 0x3f343
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ax, word [edi + 0xc]
mov word [ebp - 0x10], ax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
movzx esi, byte [eax + 0x139]
mov dword [ebp - 0x1c], esi
call fcn.00011580
movzx eax, al
xor ebx, ebx
test byte [ebp + 0x1c], 1
mov dword [ebp - 0x14], eax
je 0x3f3b6
cmp dword [0x5185c], ebx
je 0x3f38c
cmp byte [0x541ac], bl
jne 0x3f3b6
cmp eax, ebx
jne 0x3f3b6
cmp esi, ebx
jne 0x3f3b6
push dword [ebp + 0x20]
mov esi, dword [ebp + 0x14]
push ebx
push ebx
push ebx
push dword [ebp + 0x1c]
push ebx
push ebx
push dword [edi + 0xc]
push dword [edi + 8]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0xc]
call fcn.0001236e
jmp 0x3f3b9
mov esi, dword [ebp + 0x14]
mov ax, word [esi + 6]
and ax, 0xff1f
mov ch, al
mov cl, ah
shl ecx, 3
movzx eax, cx
mov dword [ebp - 0xc], ecx
movzx ecx, word [ebp - 0x10]
add eax, ecx
cmp eax, 0xffeb
jbe 0x3f3ee
inc dword [0x4fc40]
push ebx
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x3f8d2
mov ebx, dword [ebp + 8]
lea ecx, [ebx + 0x20]
mov dword [ebp - 4], ecx
call dword [sym.imp.ntoskrnl.exe_KefAcquireSpinLockAtDpcLevel]
xor eax, eax
mov al, byte [esi + 9]
push eax
xor eax, eax
mov ax, word [esi + 4]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 8]
push dword [esi + 0x10]
push ebx
push eax
call fcn.0003f01c
mov ebx, eax
test ebx, ebx
jne 0x3f527
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_KefReleaseSpinLockFromDpcLevel]
mov eax, dword [0x4fb48]
cmp eax, dword [0x4f934]
jb 0x3f448
inc dword [0x4fc40]
inc dword [0x4fb4c]
jmp 0x3f465
push 0x10
push 0x64694354
push 0x60
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTagPriority]
mov ebx, eax
test ebx, ebx
jne 0x3f46c
inc dword [0x4fc40]
push 0
jmp 0x3f3e2
xor ecx, ecx
mov eax, 0x4fb48
inc ecx
lock xadd dword [eax], ecx
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_KefAcquireSpinLockAtDpcLevel]
xor eax, eax
mov al, byte [esi + 9]
push eax
xor eax, eax
mov ax, word [esi + 4]
push eax
push dword [esi + 0xc]
lea eax, [ebp - 8]
push dword [esi + 0x10]
push dword [ebp + 8]
push eax
call fcn.0003f01c
test eax, eax
mov dword [ebp - 0x18], eax
je 0x3f4c1
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ebx, dword [ebp - 0x18]
mov eax, 0x4fb48
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jmp 0x3f527
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebx], ecx
mov dword [eax], ebx
mov eax, dword [esi + 0x10]
mov dword [ebx + 4], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 8], eax
mov ax, word [esi + 4]
mov word [ebx + 0xc], ax
mov al, byte [esi + 9]
push 0x78
mov byte [ebx + 0xe], al
mov al, byte [esi + 8]
pop ecx
cmp al, cl
ja 0x3f4f1
movzx ecx, al
movzx edx, byte [0x51ba4]
inc ecx
cmp edx, ecx
jle 0x3f501
mov eax, edx
jmp 0x3f50e
cmp al, 0x78
jbe 0x3f50a
push 0x78
pop eax
jmp 0x3f50d
movzx eax, al
inc eax
mov byte [ebx + 0xf], al
xor eax, eax
or word [ebx + 0x14], 0xffff
mov word [ebx + 0x1a], ax
mov dword [ebx + 0x10], eax
mov word [ebx + 0x16], ax
mov word [ebx + 0x18], ax
mov eax, dword [ebp - 0xc]
test ax, ax
jne 0x3f553
mov eax, dword [ebp + 0x18]
mov word [ebx + 0x18], ax
lea ecx, [eax + 8]
mov eax, ecx
shr ecx, 2
lea edi, [ebx + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
test byte [esi + 6], 0x20
jne 0x3f562
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov word [ebx + 0x14], cx
mov cx, word [ebx + 0x14]
cmp cx, word [ebx + 0x16]
jb 0x3f8b3
cmp cx, 0xffff
je 0x3f58b
movzx edx, word [ebx + 0x18]
movzx ecx, cx
add edx, ecx
cmp edx, 0xffff
jg 0x3f8b3
mov ecx, dword [ebp - 0x10]
lea ecx, [eax + ecx - 1]
mov dword [ebp + 0x14], ecx
lea ecx, [ebx + 0x10]
mov esi, dword [ecx]
test esi, esi
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x18], ecx
jne 0x3f5ac
jmp 0x3f676
mov ecx, dword [ebp + 0x18]
cmp ax, word [esi + 0x24]
jb 0x3f63f
cmp ax, word [esi + 0x26]
ja 0x3f5e6
inc word [ebx + 0x1a]
movzx edx, word [ebx + 0x1a]
cmp edx, dword [0x4f938]
jae 0x3f654
xor ecx, ecx
mov cx, word [esi + 0x26]
cmp word [ebp + 0x14], cx
jbe 0x3f670
inc ecx
mov dword [ebp + 0x10], ecx
mov eax, ecx
mov dword [ebp + 0x18], esi
mov esi, dword [esi]
test esi, esi
je 0x3f676
jmp 0x3f5a9
inc word [ebx + 0x1a]
movzx edx, word [ebx + 0x1a]
cmp edx, dword [0x4f938]
jae 0x3f654
mov dx, word [ebp + 0x14]
cmp dx, word [esi + 0x26]
jbe 0x3f62c
mov ax, word [esi + 0xc]
sub word [ebx + 0x16], ax
mov eax, esi
mov esi, dword [esi]
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
jmp 0x3f63b
xor edx, edx
mov dx, word [esi + 0x24]
cmp ax, dx
jae 0x3f64b
dec edx
mov dword [ebp + 0x14], edx
test esi, esi
je 0x3f676
mov dx, word [ebp + 0x14]
cmp dx, word [esi + 0x24]
jb 0x3f676
jmp 0x3f5f5
mov dword [edi], esi
mov dword [ecx], edi
jmp 0x3f8bc
mov dword [edi], esi
mov dword [ecx], edi
mov eax, dword [ebx]
mov ecx, dword [ebp - 8]
push ebx
mov dword [ecx], eax
call fcn.0003f2f4
inc dword [0x4fb4c]
jmp 0x3f8c9
lea ecx, [eax - 1]
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0x14]
sub ecx, eax
inc ecx
test cx, cx
jne 0x3f68f
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x3f8c9
mov word [edi + 0x24], ax
sub eax, dword [ebp - 0xc]
movzx edx, cx
mov dword [edi + 0xc], edx
mov dx, word [ebp + 0x14]
movzx eax, ax
mov word [edi + 0x26], dx
add word [ebx + 0x16], cx
add dword [edi + 8], eax
and dword [edi + 4], 0
mov eax, dword [ebp + 0x18]
mov dword [edi], esi
mov dword [eax], edi
mov ax, word [ebx + 0x16]
cmp ax, word [ebx + 0x14]
jne 0x3f8c9
cmp word [ebx + 0x18], 0
je 0x3f8c9
mov eax, dword [ebx]
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_KefReleaseSpinLockFromDpcLevel]
mov al, byte [ebx + 0x24]
mov byte [ebp - 0x33], al
mov al, byte [ebx + 0x1d]
mov byte [ebp - 0x32], al
mov ax, word [ebx + 0x18]
cmp ax, 0x14
mov byte [ebp - 0x31], 0
je 0x3f70c
lea ecx, [ebx + 0x30]
mov dword [ebp - 0x3c], ecx
mov cl, al
sub cl, 0x14
mov byte [ebp - 0x34], cl
jmp 0x3f714
and dword [ebp - 0x3c], 0
mov byte [ebp - 0x34], 0
mov cx, word [ebx + 0x1e]
not cx
movzx edi, cx
mov cx, word [ebx + 0x26]
not cx
movzx ecx, cx
add edi, ecx
mov cx, word [ebx + 0x14]
add cx, ax
mov ah, cl
mov al, ch
mov word [ebx + 0x1e], ax
movzx eax, ax
add edi, eax
mov ax, word [ebx + 0x22]
test al, 0x20
je 0x3f754
mov ecx, 0xffdf
add edi, ecx
and ax, cx
mov word [ebx + 0x22], ax
movzx ecx, di
mov eax, edi
shr eax, 0x10
add eax, ecx
mov ecx, eax
shr ecx, 0x10
add ecx, eax
not ecx
mov word [ebx + 0x26], cx
mov edi, dword [ebx + 0x10]
mov ecx, 0xc8
cmp dword [edi + 0x28], ecx
mov dword [ebp + 0x18], edi
jl 0x3f825
cmp dword [edi + 0xc], ecx
jae 0x3f7e1
mov eax, dword [edi]
test eax, eax
je 0x3f7e1
mov edx, dword [edi + 0xc]
mov esi, ecx
mov ecx, dword [eax + 0xc]
sub esi, edx
cmp esi, ecx
mov dword [ebp + 0x14], esi
jb 0x3f79e
mov dword [ebp + 0x14], ecx
mov edi, dword [edi + 8]
mov ecx, dword [ebp + 0x14]
mov esi, dword [eax + 8]
add edi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x18]
mov ecx, edx
add dword [esi + 0xc], ecx
add dword [eax + 8], ecx
sub dword [eax + 0xc], ecx
jne 0x3f7d4
mov ecx, dword [eax]
push 0
push eax
mov dword [esi], ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edi, dword [ebp + 0x18]
mov ecx, 0xc8
cmp dword [esi + 0xc], ecx
jb 0x3f784
inc dword [0x4fc3c]
xor eax, eax
cmp dword [0x5185c], eax
je 0x3f7f9
cmp byte [0x541ac], al
jne 0x3f830
cmp dword [ebp - 0x14], eax
jne 0x3f830
cmp dword [ebp - 0x1c], eax
jne 0x3f830
push dword [ebp + 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
movzx eax, word [ebx + 0x14]
push eax
movzx eax, word [ebx + 0x18]
push edi
push eax
lea eax, [ebx + 0x1c]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00011ddd
push ebx
call fcn.0003f2f4
jmp 0x3f8d2
cmp dword [ebp - 0x14], eax
movzx esi, word [ebx + 0x14]
je 0x3f872
push 0x10
push 0x65694354
push 0x24
push eax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTagPriority]
xor edx, edx
cmp eax, edx
je 0x3f825
lea ecx, [ebx + 0x1c]
mov dword [eax + 8], ecx
movzx ecx, word [ebx + 0x18]
mov dword [eax + 0xc], ecx
mov dword [eax + 4], edx
mov dword [eax], edi
mov dword [eax + 0x20], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
movzx ecx, word [ebx + 0x18]
add esi, ecx
jmp 0x3f874
mov eax, edi
push dword [ebp + 0x20]
lea ecx, [ebp - 0x3c]
push dword [ebp + 0x1c]
push 0
push ecx
push esi
push eax
movzx eax, word [ebx + 0x18]
push eax
lea eax, [ebx + 0x1c]
push eax
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.00011919
cmp dword [ebp - 0x14], 0
je 0x3f825
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0x4fb48
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jmp 0x3f8d2
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebx]
mov ecx, dword [ebp - 8]
push ebx
mov dword [ecx], eax
call fcn.0003f2f4
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_KefReleaseSpinLockFromDpcLevel]
pop edi
pop esi
pop ebx
leave
ret 0x1c