Function at 0x4344b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x4c
push ebx
mov ebx, dword [esp + 0x58]
push ebp
push esi
push edi
mov edi, ecx
movzx ecx, byte [ebx + 1]
mov esi, eax
mov eax, dword [esp + 0x60]
cmp ecx, dword [eax + 0x2c]
jae 0x4346d7
mov eax, dword [eax + 0x24]
cmp eax, 5
je 0x4344e1
cmp eax, 6
jne 0x4346d7
movzx edx, word [ebx + 6]
mov ebp, dword [sym.imp.WS2_32.dll_ntohs]
push edx
call ebp
movzx eax, ax
add dword [esi], eax
mov esi, dword [esi]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x2878]
add eax, dword [edi + 0x2874]
cmp esi, eax
ja 0x4346d7
movzx eax, byte [ebx + 1]
mov edx, dword [esp + 0x60]
mov ecx, eax
shl ecx, 4
sub ecx, eax
mov eax, dword [edx + 0x28]
lea esi, [eax + ecx*4]
movzx ecx, word [ebx + 4]
push ecx
mov dword [esp + 0x1c], esi
call ebp
movzx ebp, ax
movzx eax, word [esi + 0x26]
mov edx, ebp
shr edx, 0xc
movzx ecx, dx
mov dx, ax
shr dx, 0xc
movzx edx, dx
cmp ebp, eax
jae 0x43454d
add ecx, 0x10
cmp cx, dx
jb 0x4346a1
movzx eax, cx
add edx, 7
cmp eax, edx
jge 0x4346a1
mov ecx, dword [ebx + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push ecx
call esi
mov edx, dword [ebx + 8]
push edx
mov dword [esp + 0x20], eax
call esi
mov dword [esp + 0x64], eax
mov eax, dword [ebx + 0x14]
push eax
call esi
mov ecx, dword [ebx + 0x10]
mov edi, eax
push ecx
mov dword [esp + 0x24], edi
call esi
cmp edi, eax
jae 0x4346d7
mov edx, dword [esp + 0x14]
lea ecx, [edi + edx]
mov dword [esp + 0x24], ecx
cmp ecx, eax
ja 0x4346d7
mov ecx, dword [esp + 0x64]
cmp dword [esp + 0x1c], ecx
jae 0x4346d7
mov edi, dword [esp + 0x18]
mov esi, dword [edi + 0x30]
add edi, 0x2c
cmp esi, edi
je 0x4345f6
mov edx, dword [esp + 0x18]
movzx edx, word [edx + 0x26]
nop
movzx ecx, word [esi + 8]
cmp ebp, edx
jb 0x4345df
cmp cx, dx
jb 0x4345ef
jmp 0x4345e4
cmp cx, dx
jae 0x4345f6
movzx ecx, cx
cmp ecx, ebp
jbe 0x4346ab
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x4345d0
push 1
push eax
mov ecx, 0xc
mov esi, ebx
lea edi, [esp + 0x30]
push 0
rep movsd dword es:[edi], dword [esi]
call fcn.00436870
add esp, 0xc
test eax, eax
je 0x4346d7
mov ecx, dword [esp + 0x64]
push ecx
push eax
mov eax, dword [esp + 0x68]
lea edx, [esp + 0x30]
push edx
push eax
mov word [esp + 0x3a], bp
call fcn.00436220
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4346d7
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 0x44]
mov edx, ecx
shr edx, 5
lea eax, [eax + edx*4]
and ecx, 0x1f
mov edx, 1
shl edx, cl
test dword [eax], edx
jne 0x4346a1
dec dword [esi + 0x40]
or dword [eax], edx
mov ecx, dword [esi + 0x48]
mov eax, dword [ecx + 0xc]
cmp dword [esp + 0x24], eax
jbe 0x434675
sub eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov eax, dword [ecx + 8]
add eax, dword [esp + 0x20]
push edx
add ebx, 0x18
push ebx
push eax
call fcn.00412180
add esp, 0xc
cmp dword [esi + 0x40], 0
ja 0x4346a1
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x60]
call fcn.00436070
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
movzx edx, word [esi + 8]
cmp edx, ebp
jb 0x4345f6
mov cl, byte [esi + 0xc]
and cl, 0xf
cmp cl, 8
jne 0x4346d7
mov edx, dword [esi + 0x48]
cmp eax, dword [edx + 0xc]
jne 0x4346d7
mov eax, dword [esp + 0x64]
cmp eax, dword [esi + 0x3c]
je 0x43463f
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x4c
ret