Function at 0x10004a00
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push edi
mov dword [esp + 0x14], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + 0x18]
mov edi, dword [sym.imp.imagehlp.dll_ImageDirectoryEntryToData]
lea eax, [esp + 8]
push eax
push 0
push 1
push edx
call edi
mov dword [esp + 0x18], eax
test eax, eax
jne 0x10004a44
mov eax, 0xc000007b
pop edi
add esp, 0x1c
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
mov ecx, dword [esi + 0x18]
lea eax, [esp + 0x10]
push eax
push 0xc
push 1
push ecx
call edi
mov edx, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], edx
test eax, eax
jne 0x10004ae7
mov edx, dword [esi + 0x18]
push edx
call dword [sym.imp.imagehlp.dll_ImageNtHeader]
movzx ecx, word [eax + 0x14]
mov edi, dword [eax + 0x80]
lea ecx, [ecx + eax + 0x18]
test edi, edi
je 0x10004ad2
movzx ebx, word [eax + 6]
xor edx, edx
test ebx, ebx
jbe 0x10004ad2
mov eax, dword [ecx + 0xc]
cmp edi, eax
jb 0x10004aa0
mov ebp, dword [ecx + 0x10]
add ebp, eax
cmp edi, ebp
jb 0x10004ab5
inc edx
add ecx, 0x28
cmp edx, ebx
jb 0x10004a90
pop esi
pop ebp
pop ebx
mov eax, 0xc000007b
pop edi
add esp, 0x1c
ret
add eax, dword [esi + 0x18]
mov edx, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
test edx, edx
jne 0x10004ace
mov edx, dword [ecx + 0x10]
mov dword [esp + 0x10], edx
test eax, eax
jne 0x10004adf
pop esi
pop ebp
pop ebx
mov eax, 0xc000007b
pop edi
add esp, 0x1c
ret
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], edx
lea ecx, [esp + 0x18]
push ecx
push 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [esp + 0x3c], 0
je 0x10004b94
mov ebx, dword [esp + 0x38]
mov ebp, dword [ebx + 0xc]
add ebp, dword [esi + 0x18]
mov edi, dword [ebx + 8]
mov dword [esp + 0x1c], ebp
cmp edi, 0xffffffff
jne 0x10004b56
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop esi
mov eax, ebp
pop ebp
pop ebx
pop edi
add esp, 0x1c
ret
mov ebp, dword [esp + 0x1c]
mov edx, dword [esi + 0x18]
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x10]
lea edx, [edx + edi*4]
mov edi, dword [eax + edx]
push ebp
add eax, edx
add ecx, edx
mov edx, dword [esp + 0x18]
push 1
push edx
mov edx, dword [esp + 0x30]
push edx
push eax
mov eax, dword [esi + 0x18]
push ecx
mov ecx, dword [esp + 0x48]
mov edx, dword [ecx + 0x18]
push eax
push edx
call fcn.10004580
add esp, 0x20
mov ebp, eax
cmp edi, 0xffffffff
jne 0x10004b52
jmp 0x10004b1b
mov ebp, dword [esp + 0x38]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x10004b17
mov eax, dword [esi + 0x18]
push eax
add ebx, eax
call dword [sym.imp.imagehlp.dll_ImageNtHeader]
mov ecx, dword [ebp]
cmp ecx, dword [eax + 0x54]
jb 0x10004bc3
cmp ecx, dword [eax + 0x50]
jae 0x10004bc3
mov edi, dword [esi + 0x18]
add edi, ecx
jmp 0x10004bc5
mov edi, ebx
mov eax, dword [ebp + 0xc]
add eax, dword [esi + 0x18]
cmp dword [edi], 0
mov dword [esp + 0x1c], eax
je 0x10004b17
jmp 0x10004be4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 0x18]
push eax
mov eax, dword [esp + 0x18]
push 1
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [eax + 0x18]
push ebx
push edi
push edx
push ecx
call fcn.10004580
add edi, 4
add esp, 0x20
add ebx, 4
cmp dword [edi], 0
mov ebp, eax
jne 0x10004be0
jmp 0x10004b1b