Function at 0x45ebeb
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov ecx, dword [esi + 0x14]
lea eax, [esi + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x10]
add eax, dword [esi + 0x18]
push edi
mov edi, dword [ebp + 8]
and eax, 0xfff
lea eax, [eax + ecx + 0xfff]
shr eax, 0xc
mov dword [ebp + 0x10], eax
mov eax, edi
shr eax, 0xa
and eax, 0x3ffffc
mov ecx, dword [eax - 0x40000004]
sub eax, 0x40000000
and ebx, 0xfffffffe
cmp ecx, ebx
lea edx, [eax - 8]
je 0x45ec4e
push ecx
push dword [ebp + 0xc]
push edi
push 0x104
jmp 0x45ed22
mov ecx, dword [edx]
shr ecx, 1
cmp ecx, 2
ja 0x45ec66
push ecx
push dword [ebp + 0xc]
push edi
push 0x105
jmp 0x45ed22
lea ebx, [ecx - 2]
cmp dword [ebp + 0x10], ebx
ja 0x45ed32
lea ecx, [eax + ecx*4 - 8]
jmp 0x45ec84
cmp dword [eax], 0
jne 0x45ed1a
add eax, 4
cmp eax, ecx
jb 0x45ec78
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0xc], eax
xor eax, eax
mov ax, word [esi + 6]
add edx, 8
mov dword [ebp - 8], edx
and eax, 0x800
mov dword [ebp - 0xc], eax
movsx eax, ax
test eax, eax
je 0x45ecac
push 6
pop eax
mov ecx, dword [ebp + 0x14]
add eax, ecx
mov edi, dword [eax*4 + 0x47a028]
cmp edi, 1
mov dword [ebp + 0x14], edi
je 0x45ecf8
mov ebx, dword [ebp - 4]
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x45ecdc
push eax
call fcn.00431b16
test eax, eax
jne 0x45ed2c
add ebx, 4
dec dword [ebp + 0x10]
jne 0x45ecc3
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x10], eax
push 1
lea eax, [esi + 0x1c]
push 0
mov dword [ebp - 4], eax
call sym.ntoskrnl.exe_KeFlushEntireTb
push 1
call fcn.00431b4e
mov ebx, dword [0x47a148]
mov eax, edi
sub eax, 0
je 0x45ed41
dec eax
dec eax
jne 0x45ed44
cmp byte [0x47c291], 1
jne 0x45ed39
and ebx, 0xffffffef
or ebx, 8
jmp 0x45ed44
push ecx
push eax
push edi
push 0x107
push 0xda
call sym.ntoskrnl.exe_KeBugCheckEx
inc dword [0x487ce4]
xor eax, eax
jmp 0x45eea1
and ebx, 0xfffffff7
or ebx, 0x10
jmp 0x45ed44
or ebx, 0x18
mov ecx, dword [ebp - 8]
lea eax, [esi + 0x1c]
sub ecx, eax
mov byte [ebp + 0xf], 0x1f
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
cmp edx, 0xffffffff
je 0x45ee74
cmp word [ebp - 0xc], 0
je 0x45ed95
cmp edx, dword [0x488520]
ja 0x45ee4f
mov edi, dword [0x483aac]
mov eax, edx
shr eax, 5
mov eax, dword [edi + eax*4]
mov ecx, edx
and ecx, 0x1f
shr eax, cl
and eax, 1
mov dword [ebp - 0x10], eax
je 0x45ee4f
mov ecx, dword [0x4884c8]
mov ebx, dword [0x47a148]
lea eax, [edx + edx*2]
lea edi, [ecx + eax*8]
mov ecx, dword [edi + 0xc]
shr ecx, 0xc
and ecx, 3
sub ecx, 0
je 0x45ee40
dec ecx
je 0x45ee32
dec ecx
je 0x45ee15
dec ecx
jne 0x45ee4f
cmp byte [ebp + 0xf], 0x1f
jne 0x45edd5
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov byte [ebp + 0xf], al
mov eax, dword [ebp + 0x14]
sub eax, 0
je 0x45ee0f
dec eax
je 0x45edfd
dec eax
jne 0x45ee4f
mov eax, dword [edi + 0xc]
and eax, 0xffffefff
or eax, 0x2000
mov dword [edi + 0xc], eax
jmp 0x45ee21
and ebx, 0xfffffff7
or ebx, 0x10
jmp 0x45ee4f
mov eax, dword [edi + 0xc]
and eax, 0xffffdfff
or eax, 0x1000
mov dword [edi + 0xc], eax
jmp 0x45ee4f
and byte [edi + 0xd], 0xcf
jmp 0x45ee4c
cmp dword [ebp + 0x14], 2
je 0x45ee21
inc dword [0x487d18]
cmp byte [0x47c291], 1
jne 0x45edf5
and ebx, 0xffffffef
or ebx, 8
jmp 0x45ee4f
cmp dword [ebp + 0x14], 1
je 0x45ee4f
inc dword [0x487d10]
jmp 0x45ee4f
cmp dword [ebp + 0x14], 0
je 0x45ee4c
inc dword [0x487d14]
or ebx, 0x18
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
shl ecx, 0xc
and ebx, 0xfff
or ebx, ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + eax], ebx
add eax, 4
dec dword [ebp + 0x10]
mov dword [ebp - 4], eax
jne 0x45ed53
mov cl, byte [ebp + 0xf]
cmp cl, 0x1f
je 0x45ee82
call dword [sym.imp.HAL.dll_KfLowerIrql]
or byte [esi + 6], 1
mov ax, word [esi + 6]
test al, 0x10
mov ecx, dword [ebp + 8]
mov dword [esi + 0xc], ecx
je 0x45ee9c
or ax, 0x20
mov word [esi + 6], ax
mov eax, dword [esi + 0x18]
add eax, ecx
pop edi
pop esi
pop ebx
leave
ret 0x10