Function at 0x479fd0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov esi, dword [ecx + 8]
cmp esi, 0xfffffade
je 0x47a4cc
lea eax, [esp + 0x2d0]
sub eax, esi
cmp eax, 0x42f4
jbe 0x47a4cc
sub esp, 0x40a4
mov dword [esp + 0x40bc], 0
xor ebx, ebx
mov dword [esp + 0x40c0], ebx
mov dword [esp + 0x40c4], ebx
xor ebx, ebx
mov dword [esp + 0x40c0], ebx
mov dword [esp + 0x40c4], ebx
mov dword [esp + 0x40bc], 0
mov ebx, dword [esp + 0x40a8]
mov dword [esp], ebx
mov ebx, dword [esp + 0x40ac]
mov dword [esp + 4], ebx
call dbg.syscall.StringToUTF16Ptr
mov ebx, dword [esp + 8]
mov dword [esp], ebx
mov dword [esp + 4], 0x80000000
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0x2200000
mov dword [esp + 0x18], 0
call dbg.syscall.CreateFile
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x40c0], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x40c4], ebx
mov ebx, dword [esp + 0x40c0]
cmp ebx, 0
je 0x47a0d0
mov dword [esp + 0x40bc], 0xffffffff
nop
call dbg.runtime.deferreturn
add esp, 0x40a4
ret
mov dword [esp + 0x28], ecx
mov dword [esp + 8], ecx
mov dword [esp], 0xc
mov eax, 0x58633c
mov dword [esp + 4], eax
call dbg.runtime.deferproc
cmp eax, 0
jne 0x47a4bf
lea edi, [esp + 0x58]
xor eax, eax
mov ecx, 0x1000
rep stosd dword es:[edi], eax
lea ebx, [esp + 0x58]
cmp ebx, 0
je 0x47a4b8
mov ecx, 0x4000
mov dword [esp + 0x4070], 0x4000
mov edx, ebx
mov dword [esp + 0x2c], 0
mov ebx, dword [esp + 0x28]
mov dword [esp], ebx
mov dword [esp + 4], 0x900a8
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
cmp ecx, 0
mov dword [esp + 0x406c], ecx
jbe 0x47a4b1
mov dword [esp + 0x4068], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ecx
lea ebx, [esp + 0x2c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 0
call dbg.syscall.DeviceIoControl
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x40c0], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x40c4], ebx
mov ebx, dword [esp + 0x40c0]
cmp ebx, 0
je 0x47a1b7
mov dword [esp + 0x40bc], 0xffffffff
nop
call dbg.runtime.deferreturn
add esp, 0x40a4
ret
cmp dword [esp + 0x406c], 0
jbe 0x47a4aa
mov eax, dword [esp + 0x4068]
xor ebx, ebx
mov dword [esp + 0x4058], ebx
mov dword [esp + 0x405c], ebx
mov ebp, dword [eax]
cmp ebp, 0xa0000003
jne 0x47a373
add eax, 8
cmp eax, 0
je 0x47a36c
lea edx, [eax + 8]
movzx ebp, word [eax + 4]
movzx ebp, word [eax + 4]
mov ebx, ebp
shr bx, 1
mov edi, ebx
movzx ebp, word [eax + 6]
mov esi, ebp
movzx ebp, word [eax + 4]
mov ebx, ebp
mov ebp, esi
sub ebp, ebx
movzx ebp, word [eax + 6]
mov ecx, ebp
movzx ebp, word [eax + 4]
mov ebx, ebp
mov ebp, ecx
sub ebp, ebx
mov ebx, ebp
shr bx, 1
mov ecx, ebx
movzx ebx, di
mov eax, ebx
movzx ebx, cx
cmp ebx, 0xffff
ja 0x47a365
cmp eax, ebx
ja 0x47a365
mov esi, ebx
sub esi, eax
mov ecx, 0xffff
sub ecx, eax
mov ebx, edx
cmp edx, 0
je 0x47a35e
cmp ecx, 0
je 0x47a26d
mov ebp, eax
imul ebp, ebp, 2
add ebx, ebp
mov dword [esp + 0x4098], ebx
mov dword [esp], ebx
mov dword [esp + 0x409c], esi
mov dword [esp + 4], esi
mov dword [esp + 0x40a0], ecx
mov dword [esp + 8], ecx
call dbg.syscall.UTF16ToString
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
lea ebx, [esp + 0x38]
mov dword [esp], ebx
mov dword [esp + 0x4058], ecx
mov dword [esp + 4], ecx
mov dword [esp + 0x405c], eax
mov dword [esp + 8], eax
call dbg.runtime.stringtoslicebyte
mov ebp, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x40b0]
mov eax, dword [esp + 0x40b4]
mov ebx, dword [esp + 0x40b8]
mov dword [esp + 0x4088], ebx
mov dword [esp + 0x408c], ebp
mov dword [esp + 0x4090], edx
mov dword [esp + 0x4094], ecx
mov dword [esp + 0x407c], ecx
mov dword [esp + 0x4084], eax
mov dword [esp + 0x4078], edx
cmp edx, eax
jge 0x47a314
mov eax, edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x4080], esi
mov dword [esp], esi
mov dword [esp + 0x4074], ebp
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
call dbg.runtime.memmove
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x40bc], ebx
xor ebx, ebx
mov dword [esp + 0x40c0], ebx
mov dword [esp + 0x40c4], ebx
nop
call dbg.runtime.deferreturn
add esp, 0x40a4
ret
mov dword [edx], eax
jmp 0x47a261
call dbg.runtime.panicslice
ud2
mov dword [eax], eax
jmp 0x47a1f6
cmp ebp, 0xa000000c
jne 0x47a43a
add eax, 8
cmp eax, 0
je 0x47a433
lea edi, [eax + 0xc]
movzx ebp, word [eax + 4]
movzx ebp, word [eax + 4]
mov ebx, ebp
shr bx, 1
mov esi, ebx
movzx ebp, word [eax + 6]
mov edx, ebp
movzx ebp, word [eax + 4]
mov ebx, ebp
mov ebp, edx
sub ebp, ebx
movzx ebp, word [eax + 6]
mov ecx, ebp
movzx ebp, word [eax + 4]
mov ebx, ebp
mov ebp, ecx
sub ebp, ebx
mov ebx, ebp
shr bx, 1
mov ecx, ebx
movzx ebx, si
mov eax, ebx
movzx ebx, cx
cmp ebx, 0xffff
ja 0x47a42c
cmp eax, ebx
ja 0x47a42c
mov edx, ebx
sub edx, eax
mov ecx, 0xffff
sub ecx, eax
mov ebx, edi
cmp edi, 0
je 0x47a428
cmp ecx, 0
je 0x47a3f6
mov ebp, eax
imul ebp, ebp, 2
add ebx, ebp
mov dword [esp + 0x4098], ebx
mov dword [esp], ebx
mov dword [esp + 0x409c], edx
mov dword [esp + 4], edx
mov dword [esp + 0x40a0], ecx
mov dword [esp + 8], ecx
call dbg.syscall.UTF16ToString
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
jmp 0x47a29a
mov dword [edi], eax
jmp 0x47a3ea
call dbg.runtime.panicslice
ud2
mov dword [eax], eax
jmp 0x47a38b
mov dword [esp + 0x30], 2
mov dword [esp], 0x533de0
mov dword [esp + 4], 0x524ae0
mov dword [esp + 8], 0xb3d998
lea ebx, [esp + 0x30]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0
call dbg.runtime.convT2I
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x40bc], 0xffffffff
mov dword [esp + 0x4060], edx
mov dword [esp + 0x40c0], edx
mov dword [esp + 0x4064], ecx
mov dword [esp + 0x40c4], ecx
nop
call dbg.runtime.deferreturn
add esp, 0x40a4
ret
call dbg.runtime.panicindex
ud2
call dbg.runtime.panicindex
ud2
mov dword [ebx], eax
jmp 0x47a110
nop
call dbg.runtime.deferreturn
add esp, 0x40a4
ret
call dbg.runtime.morestack_noctxt
jmp dbg.syscall.Readlink