Function at 0x403c40
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
push ebp
push edi
xor ecx, ecx
mov edi, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov cx, word [eax + 0x14]
cmp word [eax + 6], 0
lea ebp, [ecx + eax + 0x18]
jbe 0x403fa9
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
add ebp, 0x10
jmp 0x403c80
mov edi, dword [esp + 0x14]
cmp dword [ebp], 0
jne 0x403dc9
mov edx, dword [esp + 0x24]
mov esi, dword [edx + 0x38]
test esi, esi
jle 0x403f87
mov eax, dword [ebp - 4]
push 4
push 0x1000
add eax, edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
mov edi, eax
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
mov dword [ebp - 8], edi
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
mov ecx, esi
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x403f87
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp]
push 4
push 0x1000
add ecx, edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
push 0
mov dword [esp + 0x1c], edi
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
mov esi, dword [ebp + 4]
mov edx, dword [esp + 0x20]
mov ecx, dword [ebp]
add esi, edx
mov edx, ecx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
push 0
call ebx
mov eax, dword [esp + 0x18]
mov dword [ebp - 8], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
inc eax
add ebp, 0x28
mov edx, dword [ecx]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cx, word [edx + 6]
cmp eax, ecx
jl 0x403c7c
pop esi
pop ebx
pop edi
pop ebp
add esp, 0xc
ret