Function at 0x4a1170
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov ebx, dword [esp + 0x4c]
mov edi, edx
mov esi, ecx
call 0x4a1184
pop eax
cmp ebx, 7
ja 0x4a11c4
add eax, dword [ebx*4 + 0x4a1964]
jmp eax
cmp ebx, 0xf
jae 0x4a1449
test ebx, ebx
je 0x4a171e
movzx eax, byte [edi]
movzx eax, byte [eax + 0x834c98]
test al, al
mov dword [esp + 0x30], eax
je 0x4a1713
cmp ebx, 1
je 0x4a1726
movzx eax, byte [edi + 1]
movzx ecx, byte [eax + 0x834c98]
test cl, cl
je 0x4a1713
cmp ebx, 2
je 0x4a1728
movzx eax, byte [edi + 2]
movzx eax, byte [eax + 0x834c98]
test al, al
je 0x4a1713
cmp ebx, 3
je 0x4a172a
mov dword [esp + 0xc], eax
movzx eax, byte [edi + 3]
movzx edx, byte [eax + 0x834c98]
mov eax, dword [esp + 0xc]
test dl, dl
je 0x4a1713
cmp ebx, 4
je 0x4a172c
movzx eax, byte [edi + 4]
mov dword [esp + 0x34], ecx
movzx eax, byte [eax + 0x834c98]
mov ebp, eax
mov eax, dword [esp + 0xc]
mov ecx, ebp
mov dword [esp + 0x28], ebp
test cl, cl
mov ecx, dword [esp + 0x34]
je 0x4a1713
cmp ebx, 5
je 0x4a1734
movzx eax, byte [edi + 5]
movzx eax, byte [eax + 0x834c98]
test al, al
je 0x4a1713
cmp ebx, 6
mov dword [esp + 0x24], eax
jne 0x4a17df
mov eax, dword [esp + 0xc]
jmp 0x4a173c
test ebx, ebx
js 0x4a192c
mov ecx, 8
mov edx, ebx
call fcn.0071ee80
test eax, eax
je 0x4a1931
xor ecx, ecx
nop word [eax + eax]
movzx edx, byte [edi + ecx]
movzx edx, byte [edx + 0x834c98]
test dl, dl
je 0x4a1704
mov byte [eax + ecx], dl
inc ecx
cmp ebx, ecx
jne 0x4a1470
mov byte [esi], 0xa
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
jmp 0x4a1716
push eax
push 0
push dword [0x94bf18]
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi], 0xb
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 0x30], 0
xor ecx, ecx
xor eax, eax
xor edx, edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
xor ebp, ebp
mov dword [esp], 0
mov edi, edx
mov edx, eax
mov eax, ecx
mov ecx, dword [esp + 0x30]
mov byte [esi], 9
mov byte [esi + 1], cl
mov byte [esi + 2], al
mov eax, edi
mov byte [esi + 3], dl
mov byte [esi + 4], al
mov eax, dword [esp + 0x28]
mov byte [esi + 5], al
mov eax, dword [esp + 0x24]
mov byte [esi + 6], al
mov eax, dword [esp + 0x20]
mov byte [esi + 7], al
mov eax, dword [esp + 0x18]
mov byte [esi + 8], al
mov eax, dword [esp + 0x14]
mov byte [esi + 9], al
mov eax, dword [esp + 0x10]
mov byte [esi + 0xa], al
mov eax, dword [esp + 8]
mov byte [esi + 0xb], al
mov eax, dword [esp + 4]
mov byte [esi + 0xc], al
mov eax, ebp
mov byte [esi + 0xd], al
mov eax, dword [esp]
mov byte [esi + 0xe], al
mov byte [esi + 0xf], 0
mov byte [esi + 0x10], bl
jmp 0x4a1716
movzx eax, byte [edi + 6]
movzx eax, byte [eax + 0x834c98]
test al, al
je 0x4a1713
cmp ebx, 7
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edx
jne 0x4a1809
mov dword [esp + 0x18], 0
jmp 0x4a1825
movzx eax, byte [edi + 7]
movzx eax, byte [eax + 0x834c98]
test al, al
je 0x4a1713
cmp ebx, 8
mov dword [esp + 0x18], eax
jne 0x4a1852
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
jmp 0x4a176c
movzx eax, byte [edi + 8]
movzx eax, byte [eax + 0x834c98]
test al, al
je 0x4a1713
cmp ebx, 9
mov dword [esp + 0x14], eax
jne 0x4a1888
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
jmp 0x4a1845
movzx eax, byte [edi + 9]
movzx eax, byte [eax + 0x834c98]
test al, al
je 0x4a1713
cmp ebx, 0xa
mov dword [esp + 0x10], eax
jne 0x4a18b6
mov dword [esp + 8], 0
mov dword [esp + 4], 0
jmp 0x4a1845
movzx eax, byte [edi + 0xa]
movzx eax, byte [eax + 0x834c98]
test al, al
je 0x4a1713
cmp ebx, 0xb
mov dword [esp + 8], eax
jne 0x4a18df
mov dword [esp + 4], 0
jmp 0x4a1845
movzx eax, byte [edi + 0xb]
movzx eax, byte [eax + 0x834c98]
test al, al
je 0x4a1713
cmp ebx, 0xc
mov dword [esp + 4], eax
je 0x4a1845
movzx eax, byte [edi + 0xc]
movzx eax, byte [eax + 0x834c98]
test al, al
je 0x4a1713
cmp ebx, 0xd
mov dword [esp + 0x2c], eax
jne 0x4a193d
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x2c]
jmp 0x4a176e
call fcn.00418cb0
mov ecx, 1
mov edx, ebx
call fcn.007c1490
movzx edx, byte [edi + 0xd]
mov ebp, dword [esp + 0x2c]
movzx eax, byte [edx + 0x834c98]
mov edx, dword [esp + 0x1c]
mov dword [esp], eax
test al, al
mov eax, dword [esp + 0xc]
jne 0x4a1775
jmp 0x4a1713