Function at 0x43d534
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3a0
push ebx
mov ebx, 0x4706e4
push esi
push edi
mov ax, word [ebx]
mov esi, dword [ebp + 0xc]
mov word [ebp - 0x460], ax
lea edi, [ebp - 0x424]
mov dl, byte [ebx + 2]
mov byte [ebp - 0x45e], dl
mov cx, word [ebx + 4]
mov word [ebp - 0x45c], cx
mov ax, word [ebx + 6]
mov word [ebp - 0x45a], ax
mov edx, dword [ebx + 8]
mov dword [ebp - 0x458], edx
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x454], ecx
mov al, byte [ebx + 0x10]
mov byte [ebp - 0x450], al
mov edx, dword [ebx + 0x14]
mov dword [ebp - 0x44c], edx
mov ecx, dword [ebx + 0x18]
mov dword [ebp - 0x448], ecx
mov al, byte [ebx + 0x1c]
mov byte [ebp - 0x444], al
mov dl, byte [ebx + 0x1d]
mov byte [ebp - 0x443], dl
mov cx, word [ebx + 0x1e]
mov word [ebp - 0x442], cx
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x440], eax
mov edx, dword [ebx + 0x24]
mov dword [ebp - 0x43c], edx
mov ecx, dword [ebx + 0x28]
mov dword [ebp - 0x438], ecx
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x434], eax
mov edx, dword [ebx + 0x30]
mov dword [ebp - 0x430], edx
mov ecx, dword [ebx + 0x34]
mov dword [ebp - 0x42c], ecx
mov ecx, pe_nt_image_headers32
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0x428], eax
push esi
lea esi, [ebx + 0x3c]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop esi
push esi
or ecx, 0xffffffff
mov edi, 0x470b20
lea esi, [ebp - 0x860]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 8]
pop esi
add eax, 0x1c4
push eax
call fcn.0042b6e0
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [ebp - 4]
push esi
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, 0x470b20
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 4]
pop esi
add eax, 0x800
lea edi, [ebx + 0x3c]
mov dx, word [eax]
mov word [ebx], dx
mov cl, byte [eax + 2]
mov byte [ebx + 2], cl
mov dx, word [eax + 4]
mov word [ebx + 4], dx
mov cx, word [eax + 6]
mov word [ebx + 6], cx
mov edx, dword [eax + 8]
mov dword [ebx + 8], edx
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0xc], ecx
mov dl, byte [eax + 0x10]
mov byte [ebx + 0x10], dl
mov ecx, dword [eax + 0x14]
mov dword [ebx + 0x14], ecx
mov edx, dword [eax + 0x18]
mov dword [ebx + 0x18], edx
mov cl, byte [eax + 0x1c]
mov byte [ebx + 0x1c], cl
mov dl, byte [eax + 0x1d]
mov byte [ebx + 0x1d], dl
mov cx, word [eax + 0x1e]
mov word [ebx + 0x1e], cx
mov edx, dword [eax + 0x20]
mov dword [ebx + 0x20], edx
mov ecx, dword [eax + 0x24]
mov dword [ebx + 0x24], ecx
mov ecx, pe_nt_image_headers32
mov edx, dword [eax + 0x28]
mov dword [ebx + 0x28], edx
push esi
lea esi, [eax + 0x3c]
lea edx, [eax + 0x2c]
rep movsd dword es:[edi], dword [esi]
pop esi
mov ecx, dword [edx]
mov dword [ebx + 0x2c], ecx
add eax, 0x34
mov edx, dword [edx + 4]
mov dword [ebx + 0x30], edx
mov ecx, dword [eax]
mov dword [ebx + 0x34], ecx
mov eax, dword [eax + 4]
mov dword [ebx + 0x38], eax
mov edx, dword [ebp + 8]
add edx, 0x1a0
push edx
call fcn.0041844c
mov dword [ebx + 8], eax
push 0x20
mov ecx, dword [ebp + 8]
add ecx, 0x1a0
push ecx
lea eax, [ebp - 0xc]
push eax
call fcn.00426368
lea edx, [ebp - 0xc]
push edx
call fcn.0041844c
mov dword [ebx + 0x24], eax
test byte [ebx + 4], 2
je 0x43d741
or word [ebx + 4], 1
or word [ebx + 4], 2
mov eax, dword [ebp - 4]
mov dx, word [ebx]
add eax, 0x800
mov word [eax], dx
lea edi, [eax + 0x3c]
mov cl, byte [ebx + 2]
mov byte [eax + 2], cl
mov dx, word [ebx + 4]
mov word [eax + 4], dx
mov cx, word [ebx + 6]
mov word [eax + 6], cx
mov edx, dword [ebx + 8]
mov dword [eax + 8], edx
mov ecx, dword [ebx + 0xc]
mov dword [eax + 0xc], ecx
mov dl, byte [ebx + 0x10]
mov byte [eax + 0x10], dl
mov ecx, dword [ebx + 0x14]
mov dword [eax + 0x14], ecx
mov edx, dword [ebx + 0x18]
mov dword [eax + 0x18], edx
mov cl, byte [ebx + 0x1c]
mov byte [eax + 0x1c], cl
mov dl, byte [ebx + 0x1d]
mov byte [eax + 0x1d], dl
mov cx, word [ebx + 0x1e]
mov word [eax + 0x1e], cx
mov edx, dword [ebx + 0x20]
mov dword [eax + 0x20], edx
mov ecx, dword [ebx + 0x24]
mov dword [eax + 0x24], ecx
mov ecx, pe_nt_image_headers32
mov edx, dword [ebx + 0x28]
mov dword [eax + 0x28], edx
push esi
lea esi, [ebx + 0x3c]
lea edx, [eax + 0x2c]
rep movsd dword es:[edi], dword [esi]
pop esi
mov ecx, dword [ebx + 0x2c]
mov dword [edx], ecx
mov ecx, dword [ebx + 0x30]
mov dword [edx + 4], ecx
lea edx, [eax + 0x34]
mov ecx, dword [ebx + 0x34]
mov dword [edx], ecx
mov ecx, dword [ebx + 0x38]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x1c0]
not edx
add esp, 0xfffffff8
mov dword [ebx + 0x14], edx
push 0
lea eax, [esp + 4]
push eax
call fcn.004262cc
mov edx, dword [ebp + 8]
add edx, 0x1a0
push edx
lea ecx, [ebp - 0x14]
push ecx
call fcn.004262f8
mov eax, dword [ebp + 8]
mov dword [eax + 0x1c0], 0xffffffff
test byte [esi + 0x440], 1
jne 0x43d82e
mov byte [0x4756bc], 0
or word [esi + 0x440], 1
push 0
add esp, 0xfffffff8
mov edx, dword [esi + 0xd14]
add edx, 7
push edx
lea ecx, [esp + 4]
push ecx
call fcn.004262cc
push esi
call fcn.00426df8
push 0x73
push esi
call fcn.004287d8
push 0
add esp, 0xfffffff8
mov eax, dword [ebp + 8]
add eax, 0x1c4
push eax
lea edx, [esp + 4]
push edx
call fcn.00440625
push esi
call fcn.00426df8
push 0x74
push esi
call fcn.004287d8
mov dword [ebx + 0x14], 0xffffffff
push esi
call fcn.0042803c
mov ecx, dword [ebx + 0x18]
push ecx
push esi
call fcn.00440642
mov word [esi + 0x442], 0xd
and word [esi + 0x440], 0xff9d
xor eax, eax
mov dword [esi + 0xd14], eax
call fcn.0043dd94
push 0x4732b8
call fcn.0043c628
push eax
push 0x208
call fcn.00408028
push eax
lea edx, [ebp - 0xa60]
push edx
call fcn.00456f9c
add esp, 0xc
lea ecx, [ebp - 0xa60]
push ecx
call fcn.00413da8
call fcn.004131fc
cmp byte [0x4756bc], 0
jne 0x43d933
push 0x4732b8
call fcn.004259ac
test al, al
je 0x43d933
push 0x4732b8
call fcn.00419b90
sub eax, 0xffffffff
je 0x43d917
sub eax, 3
je 0x43d917
dec eax
je 0x43d923
jmp 0x43d933
push 0xff
push 0xffffffffffffffff
call fcn.0043fb04
cmp dword [0x472428], 0
jne 0x43d933
mov byte [0x4756bc], 1
cmp dword [0x472428], 0
je 0x43d946
push 0x4732b8
call fcn.00426094
lea eax, [ebp - 0x1c]
push eax
call fcn.004262c0
add esp, 0xfffffff8
push 0x3e8
lea edx, [esp + 4]
push edx
call fcn.004262cc
add esp, 0xfffffff8
add esp, 0xfffffff8
push 0x4732b8
lea ecx, [esp + 4]
push ecx
call fcn.00425ad8
lea eax, [ebp - 0x1c]
push eax
lea edx, [esp + 0xc]
push edx
call fcn.004262f8
call fcn.004267f4
test al, al
je 0x43d9cb
push 0
call fcn.004086bc
push 0x41
push 0x346
call fcn.00408028
push eax
push 0x345
call fcn.00408028
push eax
mov ecx, dword [0x4656e4]
push ecx
call sub.USER32.dll_MessageBoxA
cmp eax, 2
jne 0x43d94f
push 0xff
push 0xffffffffffffffff
call fcn.0043fb04
jmp 0x43d94f
cmp dword [0x4723fc], 0
je 0x43da44
add esp, 0xfffffff8
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
mov dword [esp], eax
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
push 0x4723f4
push ecx
call fcn.004262f8
jmp 0x43da44
xor edi, edi
push 0x4732b8
push 0x1f6
call fcn.00408028
push eax
lea eax, [ebp - 0xc60]
push eax
call fcn.00456f9c
add esp, 0xc
test edi, edi
jne 0x43da3b
push 0x35
push 0x66
call fcn.00408028
push eax
lea edx, [ebp - 0xc60]
push edx
mov ecx, dword [0x4656e4]
push ecx
call sub.USER32.dll_MessageBoxA
cmp eax, 4
je 0x43da44
push 2
push 0xffffffffffffffff
call fcn.0043fb04
push 0
push 0
push 0x4732b8
push esi
call fcn.00427024
test al, al
je 0x43d9f4
push 0x72
push esi
call fcn.004287d8
push 0x73
push esi
call fcn.004287d8
push esi
mov eax, dword [ebp + 8]
push eax
call fcn.0042d010
movzx edx, word [ebx + 6]
push edx
push 0x4732b0
call fcn.00440042
push 1
add esp, 0xfffffff8
movzx ecx, word [ebx + 6]
push ecx
lea eax, [esp + 4]
push eax
call fcn.004262cc
push esi
call fcn.00426df8
add esp, 0xfffffff8
push 0x14
lea edx, [esp + 4]
push edx
call fcn.004262cc
mov ecx, dword [ebp + 8]
add ecx, 0x1c4
push ecx
call fcn.00440655
push esi
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.0043c518
xor eax, eax
lea edi, [ebp - 0x860]
or ecx, 0xffffffff
mov esi, 0x470b20
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [ebp - 0x460]
lea esi, [ebp - 0x424]
mov word [ebx], ax
lea edi, [ebx + 0x3c]
mov dl, byte [ebp - 0x45e]
mov byte [ebx + 2], dl
mov cx, word [ebp - 0x45c]
mov word [ebx + 4], cx
mov ax, word [ebp - 0x45a]
mov word [ebx + 6], ax
mov edx, dword [ebp - 0x458]
mov dword [ebx + 8], edx
mov ecx, dword [ebp - 0x454]
mov dword [ebx + 0xc], ecx
mov al, byte [ebp - 0x450]
mov byte [ebx + 0x10], al
mov edx, dword [ebp - 0x44c]
mov dword [ebx + 0x14], edx
mov ecx, dword [ebp - 0x448]
mov dword [ebx + 0x18], ecx
mov al, byte [ebp - 0x444]
mov byte [ebx + 0x1c], al
mov dl, byte [ebp - 0x443]
mov byte [ebx + 0x1d], dl
mov cx, word [ebp - 0x442]
mov word [ebx + 0x1e], cx
mov eax, dword [ebp - 0x440]
mov dword [ebx + 0x20], eax
mov edx, dword [ebp - 0x43c]
mov dword [ebx + 0x24], edx
mov ecx, dword [ebp - 0x438]
mov dword [ebx + 0x28], ecx
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x434]
mov dword [ebx + 0x2c], eax
mov edx, dword [ebp - 0x430]
mov dword [ebx + 0x30], edx
mov ecx, dword [ebp - 0x42c]
mov dword [ebx + 0x34], ecx
mov eax, dword [ebp - 0x428]
mov dword [ebx + 0x38], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8