Function at 0x39170
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x8c
mov edx, dword [esp + 0x98]
push ebx
mov ebx, dword [esp + 0x94]
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0xa0]
mov ecx, dword [ebx + esi*4 + 0xb6c]
push edi
mov edi, eax
mov eax, ecx
and eax, 0xff
mov dword [esp + 0x2c], eax
je 0x391b2
cmp byte [edi + 0x1a], 0
jne 0x391c0
test ecx, 0xff0000
je 0x391de
cmp byte [edx + 0x1a], 0
je 0x391de
test eax, eax
mov eax, edi
jne 0x391c8
mov eax, edx
shl word [eax + 6], 1
shl word [eax + 0xe], 1
shl word [eax + 0x12], 1
shl word [eax + 0x10], 1
shl word [eax + 0x16], 1
shl dword [eax], 1
mov eax, ecx
and eax, 0xff0000
mov dword [esp + 0x30], eax
je 0x392a7
movzx eax, word [edx + 0x12]
movzx esi, word [edx + 8]
movzx ecx, word [edx + 0xc]
mov dword [esp + 0x14], eax
movzx eax, word [edx + 0xa]
mov dword [esp + 0x24], eax
movzx eax, word [edx + 0x10]
mov dword [esp + 0x10], eax
movzx eax, word [edx + 0x14]
add eax, eax
mov ebx, eax
mov eax, esi
sub eax, ebx
movzx ebx, word [edx + 4]
sub eax, ebx
movzx ebx, word [edx + 0x16]
sub eax, dword [esp + 0x24]
add ebx, ebx
sub eax, ecx
mov dword [esp + 0x1c], ecx
movzx ecx, word [edx + 0xe]
movzx edx, word [edx + 6]
mov dword [esp + 0x18], ecx
sub ecx, ebx
mov ebx, dword [esp + 0xa0]
mov ebx, dword [ebx + 0xca0]
sub ecx, edx
sub ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xa4]
sub ecx, dword [esp + 0x14]
shl edx, 4
cmp dword [ebx + edx + 0x1f8], 3
mov ebx, dword [esp + 0xa8]
mov dl, byte [ebx + 0x18]
neg dl
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x18]
sbb edx, edx
and edx, 0x1000
mov dword [ebp + 0x1c], edx
mov bl, byte [ebx + 0x19]
neg bl
sbb ebx, ebx
and ebx, 0x2000
or ebx, edx
mov edx, dword [esp + 0xa8]
mov dword [ebp + 0x1c], ebx
mov edx, dword [edx]
jmp 0x3951b
test ch, 0xff
je 0x393d9
mov esi, dword [ebx + esi*4 + 0xb7c]
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
mov eax, ebx
call fcn.0003b5e0
mov ecx, dword [ebx + 8]
mov dword [esp + 0x3c], eax
push 0x3c
lea eax, [esp + 0x3c]
push eax
mov eax, dword [ebx + 0xca0]
mov eax, dword [eax + 0x54]
push ecx
mov edx, 0x2000001
mov ecx, 0x88100070
call fcn.000353e0
add esp, 0xc
test eax, eax
jne 0x3969f
mov eax, dword [esp + 0x3c]
cmp eax, 6
je 0x3931a
cmp eax, 7
je 0x3931a
cmp eax, 8
je 0x3931a
cmp eax, 9
je 0x3931a
cmp eax, 0xc
jne 0x39328
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ecx
jmp 0x39330
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x40]
and eax, 0x7fff
and ecx, 0x7fff
shl eax, 0x10
or eax, ecx
mov ecx, dword [esp + 0x4c]
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 0x50]
and eax, 0x7fff
and ecx, 0x7fff
shl eax, 0x10
or eax, ecx
mov ecx, dword [esp + 0x60]
mov dword [ebp + 0x18], edx
mov edx, dword [esp + 0x58]
mov dword [ebp], eax
mov eax, dword [esp + 0x54]
and edx, 0x7fff
and eax, 0x7fff
shl edx, 0x10
or edx, eax
mov eax, dword [esp + 0x68]
and ecx, 0x7fff
mov dword [ebp + 4], edx
mov edx, dword [esp + 0x5c]
shl ecx, 0x10
and edx, 0x7fff
or ecx, edx
mov dword [ebp + 8], ecx
mov ecx, dword [esp + 0x64]
and eax, 0x7fff
and ecx, 0x7fff
shl eax, 0x10
or eax, ecx
lea edi, [ebp + 0x20]
mov ecx, 0xf
lea esi, [esp + 0x38]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0xc], eax
pop ebp
pop ebx
add esp, 0x8c
ret 0x10
cmp byte [edi + 0x1b], 0
je 0x3949d
movzx edx, word [edi + 4]
mov ax, word [edi + 6]
add ax, ax
add dx, dx
mov word [esp + 0x92], ax
mov word [esp + 0x90], dx
mov eax, 0x10624dd3
mul dword [edi + 0x1c]
mov eax, dword [esp + 0x90]
shr edx, 6
mov word [esp + 0x96], dx
movzx edx, word [ebx + 0x230]
mov word [esp + 0x94], dx
mov edx, dword [esp + 0x98]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x94]
lea eax, [esp + 0x28]
push eax
mov eax, dword [ebx + 8]
push 0x54
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x40]
push ecx
push 0x54
mov dword [esp + 0x54], edx
mov edx, ecx
push edx
push 0x232fec
push eax
mov dword [esp + 0xa4], 0x21
call sub.WIN32K.SYS_EngDeviceIoControl
test eax, eax
jne 0x3949d
cmp byte [esp + 0x62], al
lea edi, [esp + 0x48]
je 0x3949d
shl word [esp + 0x4e], 1
shl word [esp + 0x56], 1
shl word [esp + 0x5a], 1
shl word [esp + 0x58], 1
shl word [esp + 0x5e], 1
shl dword [esp + 0x48], 1
movzx eax, word [edi + 0x10]
movzx edx, word [edi + 0x12]
movzx esi, word [edi + 0xa]
movzx ecx, word [edi + 0xc]
mov dword [esp + 0x10], eax
movzx eax, word [edi + 0x14]
add eax, eax
mov dword [esp + 0x14], edx
movzx edx, word [edi + 8]
mov ebx, eax
mov eax, edx
sub eax, ebx
movzx ebx, word [edi + 4]
sub eax, ebx
mov dword [esp + 0x1c], ecx
sub eax, esi
sub eax, ecx
movzx ecx, word [edi + 0x16]
add ecx, ecx
mov ebx, ecx
mov dword [esp + 0x24], esi
movzx esi, word [edi + 0xe]
mov ecx, esi
sub ecx, ebx
movzx ebx, word [edi + 6]
sub ecx, ebx
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x20], edx
sub ecx, dword [esp + 0x14]
cmp byte [edi + 0x18], 0
jne 0x39508
mov dword [ebp + 0x1c], 0
jmp 0x3950f
mov dword [ebp + 0x1c], 1
cmp byte [edi + 0x19], 0
je 0x39519
or dword [ebp + 0x1c], 2
mov edx, dword [edi]
lea edx, [edx + edx*4]
add edx, edx
mov dword [ebp + 0x18], edx
mov edx, dword [esp + 0x20]
and edx, 0x7fff
mov ebx, esi
and ebx, 0x7fff
shl ebx, 0x10
or ebx, edx
mov dword [ebp], ebx
mov ebx, dword [esp + 0x14]
add ebx, 0xffffffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x1c]
and ebx, 0x7fff
shl ebx, 0x10
add edx, 0xffffffff
and edx, 0x7fff
or ebx, edx
mov dword [esp + 0x34], edx
mov edx, esi
sub edx, dword [esp + 0x10]
mov dword [ebp + 4], ebx
add edx, 0xffffffff
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
and ebx, 0x7fff
shl ebx, 0x10
sub edx, 1
and edx, 0x7fff
or ebx, edx
mov dword [ebp + 0xc], ebx
mov ebx, dword [esp + 0x14]
lea ecx, [ecx + ebx - 1]
mov ebx, dword [esp + 0x1c]
lea eax, [eax + ebx - 1]
mov ebx, ecx
and ebx, 0x7fff
and eax, 0x7fff
shl ebx, 0x10
or ebx, eax
cmp dword [esp + 0x30], 0
mov dword [ebp + 0x10], 0
mov dword [ebp + 8], ebx
je 0x395db
mov ebx, dword [esp + 0xa8]
cmp byte [ebx + 0x1a], 0
jne 0x395e8
cmp dword [esp + 0x2c], 0
je 0x39660
cmp byte [edi + 0x1a], 0
je 0x39660
mov ebx, dword [esp + 0x18]
and ebx, 0xfffe
shl ebx, 0xf
or ebx, dword [esp + 0x34]
shr dword [ebp + 0x18], 1
mov dword [ebp + 4], ebx
mov ebx, dword [esp + 0x10]
and ebx, 0xfffe
shl ebx, 0xf
or ebx, edx
mov edx, ecx
and edx, 0xfffe
shl edx, 0xf
or edx, eax
mov eax, esi
and al, 0xfe
and ecx, 0xfffffffe
mov dword [ebp + 8], edx
mov edx, esi
shr edx, 1
and esi, 0x7ffe
or esi, 1
lea ecx, [ecx + eax + 2]
mov eax, dword [esp + 0x10]
shr eax, 1
shl ecx, 0xf
lea eax, [eax + edx + 1]
and ecx, 0x7fff0000
and eax, 0x7fff
or ecx, eax
shl esi, 0x10
or esi, dword [esp + 0x28]
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ecx
mov dword [ebp], esi
mov ecx, dword [esp + 0xa0]
cmp dword [ecx + 0xd10], 0
je 0x3969f
mov edx, dword [ecx + 0xca0]
cmp dword [edx + 0x2e4], 0
je 0x3969f
mov eax, dword [esp + 0xa4]
test byte [edx + eax*4 + 0x2dc], 0x20
je 0x3969f
mov edx, dword [esp + 0xa8]
push ebp
push edx
push edi
call fcn.00038eb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 0x10