Function at 0x4396f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xa4
mov dword [esp + 8], edx
push ebx
mov dword [esp + 4], ecx
push esi
push edi
push ebp
push 0x4aa330
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.004371e0
test al, al
je 0x439db7
xor ecx, ecx
mov cl, byte [0x4aa4a0]
call fcn.0042b210
test al, al
je 0x439db7
mov dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
add ebx, 2
xor edx, edx
mov eax, dword [esp + 0x18]
mov cl, byte [esp + 0x14]
nop
mov dl, byte [eax + 1]
mov eax, 1
shl eax, cl
test eax, edx
je case.0x43976f.9
mov al, byte [ebx]
xor ecx, ecx
mov dl, al
shr dl, 4
mov cl, dl
cmp ecx, 0xf
ja case.0x43976f.9
jmp dword [ecx*4 + 0x439dd0]
mov eax, dword [esp + 0x10]
mov esi, ebx
lea ecx, [eax + eax*2]
lea edi, [ecx*8 + 0x4b3fe0]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
call fcn.0043b070
jmp case.0x43976f.9
and eax, 0xf
mov esi, ebx
lea ecx, [eax + eax*2]
lea ebp, [ecx*8 + 0x4b36e0]
mov ecx, 6
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x4b6449]
test al, al
je 0x4397e5
mov al, byte [ebx]
mov esi, ebp
and eax, 0xf
lea ecx, [eax + eax*2]
lea eax, [ecx*8 + 0x48b008]
mov ecx, 6
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dl, byte [eax]
mov ecx, 1
and dl, 0xf
call fcn.00439ea0
mov al, byte [0x4b6450]
test al, al
je 0x4397fd
mov al, byte [ebp]
test al, 0xf
jne 0x4397fd
mov eax, dword [ebp + 1]
mov dword [0x4b4520], eax
mov eax, dword [ebp + 8]
lea edx, [ebp + 8]
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x1c]
mov esi, dword [edx + 4]
mov dword [ecx + 4], esi
mov edi, dword [edx + 8]
mov dword [ecx + 8], edi
mov eax, dword [edx + 0xc]
lea edx, [esp + 0x1c]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp + 1]
mov dword [esp + 0x50], ecx
mov cl, byte [ebp]
and cl, 0xf
call fcn.0043abc0
jmp case.0x43976f.9
and eax, 0xf
mov esi, ebx
lea ecx, [eax + eax*2]
lea edx, [ecx*8 + 0x4b2dd0]
mov ecx, 6
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x4b6449]
test al, al
je case.0x43976f.9
mov al, byte [ebx]
mov esi, edx
and eax, 0xf
lea ecx, [eax + eax*2]
lea eax, [ecx*8 + 0x48bef8]
mov ecx, 6
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dl, byte [eax]
mov ecx, 2
and dl, 0xf
call fcn.00439ea0
jmp case.0x43976f.9
mov ecx, ebx
call fcn.00437520
test eax, eax
je 0x4398d8
mov cl, byte [eax + 0x300]
test cl, cl
je 0x4398ba
mov al, byte [ebx]
mov esi, ebx
and eax, 0xf
mov ecx, 0xc
shl eax, 4
lea edi, [eax + eax*2 + 0x4b2f50]
rep movsd dword es:[edi], dword [esi]
jmp 0x4398fa
lea edi, [esp + 0x54]
mov esi, ebx
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x54]
and al, 0xf
cmp al, 0xf
jne 0x4398fa
call fcn.00407370
jmp 0x4398fa
lea edi, [esp + 0x84]
mov esi, ebx
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
mov al, byte [esp + 0x84]
and al, 0xf
cmp al, 0xf
jne 0x4398fa
call fcn.0042dea0
mov al, byte [0x4b6449]
test al, al
je case.0x43976f.9
mov al, byte [ebx]
mov esi, ebx
and eax, 0xf
mov ecx, 0xc
shl eax, 4
lea eax, [eax + eax*2 + 0x48d520]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dl, byte [eax]
mov ecx, 3
and dl, 0xf
call fcn.00439ea0
jmp case.0x43976f.9
mov ecx, ebx
call fcn.00437520
test eax, eax
je 0x439969
mov cl, byte [eax + 0x300]
test cl, cl
je 0x439969
mov cl, byte [ebx]
mov esi, ebx
and ecx, 0xf
lea edx, [ecx + ecx*2]
mov ecx, 6
lea edi, [edx*8 + 0x4b33e0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.004044e0
mov al, byte [0x4b6449]
test al, al
je case.0x43976f.9
mov al, byte [ebx]
mov esi, ebx
and eax, 0xf
lea ecx, [eax + eax*2]
lea eax, [ecx*8 + 0x48c080]
mov ecx, 6
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dl, byte [eax]
mov ecx, 4
and dl, 0xf
call fcn.00439ea0
jmp case.0x43976f.9
mov ecx, ebx
call fcn.00437520
test eax, eax
je 0x4399ce
mov cl, byte [ebx]
mov esi, ebx
and ecx, 0xf
lea edx, [ecx + ecx*2]
mov ecx, 6
lea edi, [edx*8 + 0x4b4220]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.00437900
mov al, byte [0x4b6449]
test al, al
je case.0x43976f.9
mov al, byte [ebx]
mov esi, ebx
and eax, 0xf
lea ecx, [eax + eax*2]
lea eax, [ecx*8 + 0x48cc80]
mov ecx, 6
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dl, byte [eax]
mov ecx, 5
and dl, 0xf
call fcn.00439ea0
jmp case.0x43976f.9
and eax, 0xf
mov esi, ebx
lea ecx, [eax + eax*2]
lea eax, [ecx*8 + 0x4b2d70]
mov ecx, 6
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dl, byte [0x4b6450]
test dl, dl
jne 0x439a47
mov dl, byte [eax]
and dl, 0xf
je 0x439a47
push ebx
xor ecx, ecx
push 6
mov cl, dl
mov edx, dword [esp + 0x18]
call fcn.00439e10
jmp case.0x43976f.9
mov ecx, eax
call fcn.00448a60
jmp case.0x43976f.9
and eax, 0xf
mov esi, ebx
lea ecx, [eax + eax*2]
lea eax, [ecx*8 + 0x4b41c0]
mov ecx, 6
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dl, byte [0x4b6450]
test dl, dl
jne 0x439a91
mov dl, byte [eax]
and dl, 0xf
je 0x439a91
push ebx
xor ecx, ecx
push 7
mov cl, dl
mov edx, dword [esp + 0x18]
call fcn.00439e10
jmp case.0x43976f.9
mov ecx, eax
call fcn.0041b740
jmp case.0x43976f.9
and eax, 0xf
mov esi, ebx
lea ecx, [eax + eax*2]
lea eax, [ecx*8 + 0x4b2d10]
mov ecx, 6
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dl, byte [0x4b6450]
test dl, dl
jne 0x439adb
mov dl, byte [eax]
and dl, 0xf
je 0x439adb
push ebx
xor ecx, ecx
push 8
mov cl, dl
mov edx, dword [esp + 0x18]
call fcn.00439e10
jmp case.0x43976f.9
mov ecx, eax
call fcn.0043c3e0
jmp case.0x43976f.9
xor eax, eax
mov esi, ebx
mov al, byte [ebx + 5]
lea ecx, [eax + eax*2]
lea ebp, [ecx*8 + 0x4b5750]
mov ecx, 6
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov dl, byte [0x4b6449]
test dl, dl
je 0x439b45
mov al, byte [ebp]
xor ecx, ecx
and eax, 0xf
mov cl, byte [ebp + 5]
shl eax, 4
mov esi, ebp
add eax, ecx
mov ecx, 6
lea edx, [eax + eax*2]
lea eax, [edx*8 + 0x48cf20]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov dl, byte [eax]
mov cl, byte [eax + 5]
and dl, 0xf
push ecx
mov ecx, 0xa
call fcn.0043a010
mov ecx, ebp
call fcn.0042d150
jmp case.0x43976f.9
mov al, byte [ebx + 5]
test al, al
jne 0x439b7e
xor eax, eax
mov esi, ebx
mov al, byte [ebx + 6]
lea ecx, [eax + eax*2]
lea eax, [ecx*8 + 0x4b55d0]
mov ecx, 6
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.0042d010
jmp case.0x43976f.9
xor eax, eax
mov esi, ebx
mov al, byte [ebx + 6]
lea ecx, [eax + eax*2]
lea ebp, [ecx*8 + 0x4b5af0]
mov ecx, 6
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov dl, byte [0x4b6449]
test dl, dl
je 0x439be1
mov al, byte [ebp]
xor ecx, ecx
and eax, 0xf
mov cl, byte [ebp + 6]
shl eax, 4
mov esi, ebp
add eax, ecx
mov ecx, 6
lea edx, [eax + eax*2]
lea eax, [edx*8 + 0x48c680]
mov edx, 1
mov edi, eax
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov cl, byte [eax + 6]
mov al, byte [eax]
push ecx
and al, 0xf
push eax
mov ecx, 0xb
call fcn.0043a0d0
mov ecx, ebp
call fcn.0042d0d0
jmp case.0x43976f.9
and eax, 0xf
mov esi, ebx
lea ecx, [eax + eax*2]
lea ebp, [ecx*8 + 0x4b6070]
mov ecx, 6
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x4b6449]
test al, al
je 0x439c37
mov al, byte [ebx]
mov esi, ebp
and eax, 0xf
lea ecx, [eax + eax*2]
lea eax, [ecx*8 + 0x48bdb8]
mov ecx, 6
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dl, byte [eax]
mov ecx, 0xd
and dl, 0xf
call fcn.00439ea0
mov ecx, ebp
call fcn.0042d720
jmp case.0x43976f.9
and eax, 0xf
mov esi, ebx
lea ecx, [eax + eax*2]
lea edx, [ecx*8 + 0x4b43a0]
mov ecx, 6
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x4b6449]
test al, al
je case.0x43976f.9
mov al, byte [ebx]
mov esi, edx
and eax, 0xf
lea ecx, [eax + eax*2]
lea eax, [ecx*8 + 0x4b3860]
mov ecx, 6
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov dl, byte [eax]
mov ecx, 0xe
and dl, 0xf
call fcn.00439ea0
jmp case.0x43976f.9
mov al, byte [ebx + 5]
cmp al, 6
jne 0x439cb4
mov edi, 0x4b5e70
mov esi, ebx
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x4b5e70
call fcn.0042dca0
jmp case.0x43976f.9
cmp al, 7
jne 0x439cd2
mov edi, 0x4b5c70
mov esi, ebx
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x4b5c70
call fcn.0042db70
jmp case.0x43976f.9
cmp al, 8
jne case.0x43976f.9
mov edi, 0x4b58d0
mov esi, ebx
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x4b58d0
call fcn.0042dda0
add ebx, 0x18
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 3
jb 0x43973e
mov al, byte [0x4b6449]
test al, al
je 0x439d9f
push 0x4aa370
mov esi, 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0042cd70
cmp eax, esi
jle 0x439d90
mov ebx, 4
mov edi, 0x48af25
mov ebp, 0xffffffff
mov eax, dword [ebx + 0x4b8870]
test eax, eax
je 0x439d80
movsx ecx, byte [eax + 0x328]
call fcn.0042b210
test al, al
je 0x439d80
mov eax, dword [ebx + 0x4b8870]
cmp dword [eax + 0x324], ebp
jne 0x439d80
mov ecx, esi
mov byte [edi], 0
mov dword [ebx + 0x48ce50], 0
call fcn.0043a1e0
cmp byte [edi], 0
je 0x439d80
mov ecx, esi
call fcn.0043a1a0
add ebx, 4
call fcn.0042cd70
add edi, 0x4c
inc esi
cmp eax, esi
jg 0x439d38
push 0x4aa370
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
jmp 0x439da5
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x4aa330
call esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xa4
ret
push 0x4aa330
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xa4
ret