Function at 0x10001810
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
mov eax, dword [0x1001203c]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, ecx
push 0x3e
push eax
lea ecx, [esp + 0x122]
push ecx
mov dword [esp + 0x24], esi
mov word [esp + 0x124], ax
call fcn.10009150
add esp, 0xc
push 0xf4
lea edx, [esp + 0x28]
push 0
push edx
mov dword [esp + 0x2c], 0
call fcn.10009150
add esp, 0xc
call fcn.10001710
test eax, eax
jne 0x1000188c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.10004b1d
mov esp, ebp
pop ebp
ret
push str.IsPeFromHandle_ok_
push 0
push 0x1000fc03
call fcn.100022d0
add esp, 0xc
push 0xb1d9a2f4
push 1
push 0
call fcn.10001480
add esp, 0xc
test eax, eax
je 0x100018be
push 0
push 0
push 0
push esi
call eax
push 0x7ba190cd
push 1
push 0
call fcn.10001480
add esp, 0xc
test eax, eax
je 0x100018e7
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x40
lea edx, [esp + 0x124]
push edx
push esi
call eax
mov edi, dword [esp + 0x154]
push 0xb1d9a2f4
push 1
push 0
call fcn.10001480
add esp, 0xc
test eax, eax
je 0x1000190b
push 0
push 0
push edi
push esi
call eax
push 0x7ba190cd
push 1
push 0
call fcn.10001480
add esp, 0xc
test eax, eax
je 0x10001934
push 0
lea ecx, [esp + 0x14]
push ecx
push 0xf8
lea edx, [esp + 0x2c]
push edx
push esi
call eax
mov eax, dword [esp + 0x74]
mov ebx, dword [esp + 0x70]
push 0x963527e7
push 1
push 0
mov dword [esp + 0x18], eax
call fcn.10001480
add esp, 0xc
test eax, eax
je 0x10001875
push 0x40
push 0x3000
push ebx
push 0
call eax
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
je 0x10001875
push str.pVirtualAlloc_ok_
push 0
push 0x1000fc03
call fcn.100022d0
add esp, 0xc
test ebx, ebx
jbe 0x10001997
push ebx
push 0
push edi
call fcn.10009150
add esp, 0xc
push 0xb1d9a2f4
push 1
push 0
call fcn.10001480
add esp, 0xc
test eax, eax
je 0x100019b5
push 0
push 0
push 0
push esi
call eax
push 0x7ba190cd
push 1
push 0
call fcn.10001480
add esp, 0xc
test eax, eax
je 0x100019da
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x14]
push ecx
push edx
push edi
push esi
call eax
mov eax, dword [edi + 0x3c]
movzx ecx, word [eax + edi + 0x14]
mov edx, dword [eax + edi + 0x34]
add eax, edi
lea ebx, [ecx + eax + 0x18]
mov ecx, dword [eax + 0x28]
add ecx, edi
mov dword [0x100140d8], ecx
movzx ecx, word [eax + 6]
mov dword [esp + 0x1c], eax
mov dword [0x100140d0], edx
test ecx, ecx
jbe 0x10001a76
add ebx, 0x10
mov dword [esp + 0xc], ecx
jmp 0x10001a16
mov esi, dword [esp + 0x18]
mov edi, dword [ebx + 4]
push 0xb1d9a2f4
push 1
push 0
call fcn.10001480
add esp, 0xc
test eax, eax
je 0x10001a36
push 0
push 0
push edi
push esi
call eax
mov edi, dword [ebx - 4]
mov esi, dword [ebx]
add edi, dword [esp + 0x14]
push 0x7ba190cd
push 1
push 0
call fcn.10001480
add esp, 0xc
test eax, eax
je 0x10001a64
mov ecx, dword [esp + 0x18]
push 0
lea edx, [esp + 0x14]
push edx
push esi
push edi
push ecx
call eax
add ebx, 0x28
sub dword [esp + 0xc], 1
jne 0x10001a12
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0xa0]
mov eax, dword [eax + 0xa4]
mov ecx, dword [esp + 0x15c]
add edx, edi
mov dword [0x100140d4], eax
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [0x100140cc], edx
call fcn.10004b1d
mov esp, ebp
pop ebp
ret