Function at 0x1f0522f0
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push edi
mov edi, eax
xor eax, eax
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
push ebx
push edi
mov dword [edi + 0x1c], eax
call fcn.1f0536f0
mov ebp, eax
add esp, 0xc
test ebp, ebp
je 0x1f052829
cmp dword [esp + 0x24], 0
movzx eax, word [ebp]
movzx edx, byte [eax*8 + 0x1f0757f0]
lea eax, [eax*8 + 0x1f0757f0]
mov dword [esp + 0x1c], eax
mov eax, dword [edx*4 + 0x1f070478]
mov dword [esp + 0xc], eax
je 0x1f0523ae
mov eax, dword [ebx]
test eax, 0x2000
je 0x1f052379
cmp dword [ebx + 0x18], 1
jne 0x1f052379
test byte [ebx + 0x24], 8
je 0x1f052379
cmp dword [ebx + 0x1c], 0
jne 0x1f052379
and eax, 0xffffdfff
mov dword [ebx], eax
mov ax, word [ebx + 0x14]
or word [ebx + 0xc], ax
mov ecx, dword [ebx]
mov eax, dword [edi + 0x24]
test ecx, 0x4000
je 0x1f052394
xor edx, edx
cmp eax, 1
setne dl
mov dword [esp + 0x14], edx
jmp 0x1f052398
mov dword [esp + 0x14], eax
mov edx, dword [ebx + 0x24]
push edx
mov edx, dword [esp + 0x10]
call fcn.1f0522b0
add esp, 4
mov dword [esp + 0x18], eax
jmp 0x1f0523d4
mov ecx, dword [edi + 0x24]
mov dword [esp + 0x14], ecx
cmp ecx, 2
jne 0x1f0523d0
and eax, 0x3000000
sub eax, 0x1000000
neg eax
sbb eax, eax
add eax, ecx
mov dword [esp + 0x18], eax
jmp 0x1f0523d4
mov dword [esp + 0x18], ecx
push 0x68
push 0
push esi
call fcn.1f03f590
mov edx, dword [esp + 0x18]
add esp, 0xc
test dl, 1
je 0x1f052409
test edx, 0x40000000
jne 0x1f0523ff
inc dword [edi + 0x18]
add dword [edi + 0x20], 0xffffffff
js 0x1f052829
mov eax, dword [edi + 0x18]
movzx ecx, byte [eax]
mov dword [esp + 0x10], ecx
mov eax, dword [edi + 8]
and eax, dword [edi]
mov ecx, dword [edi + 0xc]
and ecx, dword [edi + 4]
inc dword [edi + 0x18]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
movzx eax, word [ebp + 2]
mov ecx, dword [esp + 0x1c]
mov word [esi + 0x20], ax
movzx eax, word [ecx + 6]
mov ecx, 0x8000
and ax, cx
mov ecx, dword [esp + 0x1c]
mov word [esi + 0x18], ax
mov eax, dword [esp + 0x14]
and eax, 3
shl eax, 0xa
or word [esi + 0x18], ax
mov byte [esi + 0x35], 0xff
mov byte [esi + 0x34], 0xff
mov al, byte [ecx + 2]
test al, al
je 0x1f0525c9
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x20], 1
lea ebx, [esi + 0x22]
test ecx, 0x10100000
je 0x1f05249e
cmp dword [esp + 0x10], 0xc0
jae 0x1f05248b
test ecx, 0x100000
jne 0x1f052829
test ecx, 0x10000000
je 0x1f05249e
test byte [esp + 0x10], 0x38
jne 0x1f052829
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebx
push edx
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push ecx
movzx edx, al
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push esi
push edi
call fcn.1f0541f0
add esp, 0x28
add ebx, 4
test eax, eax
je 0x1f052829
mov ecx, dword [esp + 0x1c]
mov al, byte [ecx + 1]
test al, al
je 0x1f0525ac
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ebx
push edx
mov edx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push ecx
movzx edx, al
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push esi
push edi
call fcn.1f0541f0
add esp, 0x28
add ebx, 4
test eax, eax
je 0x1f052829
test dword [esp + 0xc], 0x20000
mov dword [esp + 0x20], 2
je 0x1f0525ac
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
push ebx
push ecx
mov ecx, dword [esp + 0x18]
push edx
movzx edx, byte [ebp + 5]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push ebp
push esi
push edi
call fcn.1f0541f0
add esp, 0x28
test eax, eax
je 0x1f052829
test dword [esp + 0xc], 0x40000
mov dword [esp + 0x20], 3
je 0x1f0525ac
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
lea eax, [ebx + 4]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x18]
push edx
movzx edx, byte [ebp + 6]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
push ebp
push esi
push edi
call fcn.1f0541f0
add esp, 0x28
test eax, eax
je 0x1f052829
mov dword [esp + 0x20], 4
mov ecx, dword [esp + 0xc]
mov dl, byte [esp + 0x20]
mov ebx, dword [esp + 0x2c]
shr ecx, 0x19
and ecx, 0x40
or word [esi + 0x18], cx
add byte [esi + 0x32], dl
mov edx, dword [esp + 0xc]
test edx, 0x8e0c060
je 0x1f052742
test ebx, ebx
je 0x1f0525eb
test edx, 0x8000
je 0x1f0525eb
mov eax, dword [ebx]
and eax, 0x2000
or dword [ebx + 4], eax
cmp dword [edi + 0x24], 2
je 0x1f0525f9
test edx, 0x8000000
jmp 0x1f0525ff
test edx, 0x800000
jne 0x1f052829
test edx, 0x200000
je 0x1f05264a
push edi
call fcn.1f053c30
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x1f052829
movzx eax, word [ebp]
movzx ecx, byte [eax*8 + 0x1f0757f0]
mov edx, dword [ecx*4 + 0x1f070478]
lea eax, [eax*8 + 0x1f0757f0]
mov dword [esp + 0x1c], eax
mov ax, word [ebp + 2]
mov dword [esp + 0xc], edx
mov word [esi + 0x20], ax
test edx, 0x400000
je 0x1f0526aa
add dword [edi + 0x20], 0xffffffff
js 0x1f052829
mov eax, dword [edi + 0x18]
movzx ecx, byte [eax]
inc eax
mov dword [edi + 0x18], eax
test edx, 0x20000000
je 0x1f05268c
cmp ecx, 0x20
jae 0x1f052829
mov cx, word [ecx*2 + 0x1f0766d0]
add cx, word [ebp + 2]
mov word [esi + 0x20], cx
jmp 0x1f0527ec
cmp ecx, 8
jae 0x1f052829
mov ax, word [ecx*2 + 0x1f0766c0]
add ax, word [ebp + 2]
mov word [esi + 0x20], ax
jmp 0x1f0527ec
cmp dword [esp + 0x24], 0
je 0x1f0526de
test dl, 0x60
je 0x1f0526de
test dl, 0x20
je 0x1f0526cb
test byte [ebx], 0x20
je 0x1f0526cb
or dword [ebx + 4], 0x20
or word [esi + 0x18], 2
jmp 0x1f0526de
test dl, 0x40
je 0x1f0526de
test byte [ebx], 0x40
je 0x1f0526de
or dword [ebx + 4], 0x40
or word [esi + 0x18], 4
mov eax, 0x4000
test eax, edx
je 0x1f052742
test edx, 0x10000
je 0x1f052726
or dword [ebx + 4], eax
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x1f052707
mov cx, word [ebp + 2]
mov word [esi + 0x20], cx
jmp 0x1f0527ec
cmp eax, 1
jne 0x1f052719
mov ax, word [ebp + 8]
mov word [esi + 0x20], ax
jmp 0x1f0527ec
mov cx, word [ebp + 0xa]
mov word [esi + 0x20], cx
jmp 0x1f0527ec
test edx, 0x8000
je 0x1f0527ec
mov cx, word [ebp + 2]
mov word [esi + 0x20], cx
or dword [ebx + 4], eax
jmp 0x1f0527ec
mov eax, dword [esp + 0x18]
cmp eax, 1
jne 0x1f052786
mov eax, 0x100
or word [esi + 0x18], ax
test edx, 0x10000
je 0x1f0527ec
test edx, 0x80000
je 0x1f05277c
cmp dword [esp + 0x10], 0xc0
jae 0x1f0527e5
mov cx, word [ebp + 8]
mov word [esi + 0x20], cx
jmp 0x1f0527e5
mov ax, word [ebp + 8]
mov word [esi + 0x20], ax
jmp 0x1f0527e5
cmp eax, 2
jne 0x1f0527d7
mov ecx, 0x200
or word [esi + 0x18], cx
test edx, 0x4010000
je 0x1f0527ec
cmp dword [esp + 0x10], 0xc0
jb 0x1f0527ae
test edx, 0x80000
jne 0x1f052829
test edx, 0x4000000
je 0x1f0527cd
test byte [ebx + 0x24], 8
je 0x1f0527cd
or dword [ebx + 4], 0x2000000
mov ax, word [ebp + 0xa]
mov word [esi + 0x20], ax
jmp 0x1f0527ec
mov cx, word [ebp + 8]
mov word [esi + 0x20], cx
jmp 0x1f0527ec
mov eax, edx
and eax, 0x1010008
cmp eax, 0x10000
jne 0x1f0527ec
or dword [ebx + 4], 0x2000
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x1f05281b
test edx, 0x20000000
je 0x1f05281b
mov al, byte [ebp + 4]
test al, 4
je 0x1f052809
test byte [ebx + 0x24], 8
jne 0x1f052813
test al, 8
je 0x1f05281b
test byte [ebx + 0x24], 0x10
je 0x1f05281b
mov dx, word [ebp + 8]
mov word [esi + 0x20], dx
mov al, byte [edi + 0x18]
sub al, byte [esp + 0x30]
mov byte [esi + 0x33], al
cmp al, 0xf
jbe 0x1f052896
mov ebx, dword [esp + 0x30]
cmp byte [ebx], 0x9b
jne 0x1f05288a
push 0x68
push 0
push esi
call fcn.1f03f590
mov eax, dword [edi + 8]
and eax, dword [edi]
mov ecx, dword [edi + 0xc]
and ecx, dword [edi + 4]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, 0x100
or word [esi + 0x38], ax
mov byte [esi], 0x9b
mov byte [esi + 0x34], 0xff
mov byte [esi + 0x35], 0xff
mov byte [esi + 0x33], 1
mov edx, 0x2745
mov word [esi + 0x20], dx
mov ecx, dword [edi + 0x18]
sub ecx, ebx
add esp, 0xc
dec ecx
add dword [edi + 0x20], ecx
inc ebx
mov dword [edi + 0x18], ebx
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret
pop edi
pop ebp
mov eax, 3
pop ebx
add esp, 0x1c
ret
test ecx, ecx
je 0x1f0528a7
push ebx
call fcn.1f052f40
add esp, 4
mov word [esi + 0x1a], ax
mov ecx, dword [esp + 0x1c]
mov dx, word [ecx + 6]
mov word [esi + 0x38], dx
test dword [edi + 0x28], 0x4000
je 0x1f05297d
mov al, byte [ecx + 4]
test al, al
je 0x1f0528ff
mov dl, al
and dl, 2
movzx dx, dl
mov bl, al
and bl, 8
movzx di, bl
add dx, dx
mov bl, al
or dx, di
and bl, 0x20
add dx, dx
movzx di, bl
and al, 0xd5
or dx, di
movzx ax, al
shl dx, 6
or dx, ax
mov word [esi + 0x3c], dx
mov al, byte [ecx + 3]
test al, al
je 0x1f05293e
mov dl, al
and dl, 2
movzx dx, dl
mov bl, al
and bl, 8
movzx di, bl
add dx, dx
mov bl, al
or dx, di
and bl, 0x20
add dx, dx
movzx di, bl
and al, 0xd5
or dx, di
movzx ax, al
shl dx, 6
or dx, ax
mov word [esi + 0x3a], dx
mov al, byte [ecx + 5]
test al, al
je 0x1f05297d
mov cl, al
and cl, 2
movzx dx, cl
mov cl, al
and cl, 8
movzx cx, cl
add dx, dx
or dx, cx
mov cl, al
and cl, 0x20
add dx, dx
movzx cx, cl
and al, 0xd5
or dx, cx
movzx ax, al
shl dx, 6
or dx, ax
mov word [esi + 0x3e], dx
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret