Function at 0x1003a3d0
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [ebp + 8]
push ebx
lea edx, [eax + 0x78c]
push esi
mov ecx, eax
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x38], edx
cmp eax, edx
ja 0x1003a5d4
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
mov edi, edi
cmp ecx, 0x2560
ja 0x1003a4f7
je 0x1003a4e2
lea eax, [ecx - 0x2448]
cmp eax, 0xfc
ja case.0x1003a42a.9289
movzx eax, byte [eax + 0x1003aba8]
jmp dword [eax*4 + 0x1003ab7c]
movzx eax, byte [edx + 6]
mov byte [ebp - 0x3c], al
movzx eax, byte [edx + 7]
mov byte [ebp - 0x43], al
movzx eax, byte [edx + 8]
mov byte [ebp - 0x3f], al
jmp case.0x1003a42a.9289
movzx eax, byte [edx + 3]
mov byte [ebp - 0x3a], al
movzx eax, byte [edx + 4]
mov byte [ebp - 0x3d], al
jmp case.0x1003a42a.9289
mov eax, 0x72
mov word [ebp - 0x5c], ax
mov eax, 0x6e
mov word [ebp - 0x5a], ax
mov eax, 0x65
mov word [ebp - 0x58], ax
jmp case.0x1003a42a.9289
mov eax, 0x6c
mov word [ebp - 0x56], ax
jmp case.0x1003a42a.9289
movzx eax, byte [edx + 9]
mov byte [ebp - 0x41], al
movzx eax, byte [edx + 0xa]
mov byte [ebp - 0x40], al
mov byte [ebp - 0x39], 0
jmp case.0x1003a42a.9289
mov edx, str.FCeAielreat
mov dword [ebp - 0xc], edx
jmp case.0x1003a42a.9289
mov eax, 0x6b
mov word [ebp - 0x60], ax
jmp case.0x1003a42a.9289
mov al, byte [edx + 5]
mov byte [ebp - 0x3b], al
jmp case.0x1003a42a.9289
movzx eax, byte [edx]
mov byte [ebp - 0x3e], al
movzx eax, byte [edx + 1]
mov byte [ebp - 0x44], al
movzx eax, byte [edx + 2]
mov byte [ebp - 0x42], al
jmp case.0x1003a42a.9289
mov eax, 0x33
mov word [ebp - 0x54], ax
mov dword [ebp - 0x52], 0x2e0032
jmp case.0x1003a42a.9289
cmp ecx, 0x25d0
ja 0x1003a654
je 0x1003a55c
mov eax, ecx
sub eax, 0x257c
je 0x1003a544
sub eax, 0x1c
je 0x1003a539
sub eax, 0x1c
jne case.0x1003a42a.9289
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x44]
push edx
push 0x53b0
call fcn.10062d30
add esp, 0xc
mov dword [ebp - 0x28], eax
jmp 0x1003a5bf
xor eax, eax
mov word [ebp - 0x48], ax
jmp case.0x1003a42a.9289
mov eax, 0x64
mov word [ebp - 0x4e], ax
mov eax, 0x6c
mov word [ebp - 0x4c], ax
mov word [ebp - 0x4a], ax
jmp case.0x1003a42a.9289
mov eax, dword [esi + 0x10]
mov byte [ebp + 0xb], 0
mov dword [ebp - 0x14], eax
cmp eax, dword [esi + 0x14]
je case.0x1003a42a.9289
jmp 0x1003a570
mov eax, dword [eax + 4]
mov ecx, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1003a595
test dl, dl
je 0x1003a591
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1003a595
add eax, 2
add ecx, 2
test dl, dl
jne 0x1003a575
xor eax, eax
jmp 0x1003a59a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1003a63a
mov esi, 0x337b
mov eax, esi
sub eax, 0x337b
je 0x1003a5de
sub eax, 0x4e
jne 0x1003a62b
mov dword [ebp - 8], 0x25ec
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
add ecx, 0x1c
mov dword [ebp - 8], ecx
cmp ecx, dword [ebp - 0x38]
jbe 0x1003a400
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x14]
mov edx, dword [ecx + 0x14]
add eax, 0x18
cmp eax, edx
je 0x1003a620
lea ecx, [eax - 0x18]
mov edi, dword [eax]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [ecx + 4], edi
mov edi, dword [eax + 8]
mov dword [ecx + 8], edi
mov edi, dword [eax + 0xc]
mov dword [ecx + 0xc], edi
mov edi, dword [eax + 0x10]
mov dword [ecx + 0x10], edi
mov edi, dword [eax + 0x14]
mov dword [ecx + 0x14], edi
add eax, 0x18
add ecx, 0x18
cmp eax, edx
jne 0x1003a5f1
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
add dword [eax + 0x14], 0xffffffe8
mov byte [ebp + 0xb], 1
add esi, 0x4e
cmp esi, 0x33c9
jbe 0x1003a5a7
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
add eax, 0x18
mov dword [ebp - 0x14], eax
cmp eax, dword [esi + 0x14]
jne 0x1003a570
jmp 0x1003a5bf
mov eax, ecx
sub eax, 0x25ec
je 0x1003a5b5
sub eax, 0x1c
je 0x1003a6b8
sub eax, 0x2417
jne 0x1003a5bc
and eax, 0x46b403c7
mov ecx, 0x4570
jmp 0x1003a680
mov eax, ecx
sub eax, 0x4570
je 0x1003a8b0
sub eax, 0x5f
je 0x1003a898
add ecx, 0x5f
cmp ecx, 0x45cf
jbe 0x1003a680
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov eax, 0x65
mov word [ebp - 0x5e], ax
jmp case.0x1003a42a.9289
cmp byte [ebp + 0xb], 0
je 0x1003a5bc
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], 0
lea esp, [esp]
cmp dword [ebp - 0x14], 0x57
ja case.0x1003a6e4.1
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x1003acbc]
jmp dword [edx*4 + 0x1003aca8]
mov eax, dword [esi + 0x20]
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push eax
call dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
jmp case.0x1003a6e4.1
cmp dword [ebp - 0x18], 0xffffffff
je 0x1003a5d4
jmp case.0x1003a6e4.1
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x1003a6e4.1
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je case.0x1003a6e4.1
mov dword [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 4
nop
cmp eax, 0x8a
ja case.0x1003a772.1
movzx ecx, byte [eax + 0x1003ad28]
jmp dword [ecx*4 + 0x1003ad14]
mov ecx, dword [esi + 0x10]
mov edx, 0xd
mov word [ebp - 4], dx
mov edx, dword [ebp - 0x10]
mov eax, 0xa
mov word [ebp - 3], ax
mov eax, dword [edx + ecx + 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003a798
sub eax, edx
add eax, 3
mov dword [ebp - 0x2c], eax
push 0x2f77
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
call fcn.10066470
add esp, 0x10
mov ebx, eax
jmp case.0x1003a772.1
push 0
push 0
push 0x1313
push ebx
call fcn.10062ff0
add esp, 0x10
jmp case.0x1003a772.1
xor ebx, ebx
jmp case.0x1003a772.1
mov edx, dword [ebp - 0x10]
mov ecx, dword [esi + 0x10]
mov ecx, dword [edx + ecx + 4]
mov edx, ebx
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x1003a7e7
lea eax, [ebp - 4]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003a7f6
sub eax, ecx
mov esi, ecx
lea edi, [ebx - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1003a804
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, ebx
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003a820
push 0
lea ecx, [ebp - 0x34]
push ecx
sub eax, edx
mov edx, dword [ebp - 0x18]
push eax
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x20]
add eax, 0x2e
dec dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
jne 0x1003a760
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x10]
inc dword [ebp - 0x1c]
add dword [ebp - 0x10], 0x18
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x1c], eax
jb 0x1003a753
mov eax, dword [ebp - 0x14]
add eax, 0x1d
mov dword [ebp - 0x14], eax
add eax, 0xc19
cmp eax, 0xc70
jbe 0x1003a6d0
jmp 0x1003a5bf
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x74f3
mov eax, dword [ebp - 0x1c]
lea ebx, [ebx]
sub eax, 0x74f3
je 0x1003a8eb
sub eax, 0x3c
jne 0x1003ab4d
mov esi, 0x881daff7
cmp dword [edi + 0x10], 3
jne 0x1003ab4d
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi + 0x10], 0
jne 0x1003aa7a
mov ebx, 0x2417
lea ebx, [ebx]
cmp ebx, 0x249d
ja 0x1003a9ed
je 0x1003a9ce
mov eax, ebx
sub eax, 0x2417
je 0x1003a9a5
sub eax, 0x43
jne 0x1003aa6b
mov esi, 0xfffffffd
cmp dword [ebp + 8], esi
jne 0x1003a965
mov ecx, 0x2b7
lea edx, [eax + 2]
lea ebx, [ebx]
mov eax, ecx
sub eax, 0x2b7
je 0x1003a954
sub eax, 0x20
je 0x1003a5d4
jmp 0x1003a95a
mov dword [edi + 4], edx
mov dword [ebp - 0x18], esi
add ecx, 0x20
cmp ecx, 0x2d7
jbe 0x1003a940
push 0
push 0
push str.__lu
lea esi, [edi + 0x8c]
push esi
push 0x6bed
call fcn.1000f7d0
push 0x1007512c
lea ecx, [ebp - 0x38]
push ecx
push 0x4d4
push esi
mov dword [ebp - 0x38], 0
call fcn.10037590
add esp, 0x24
mov dword [ebp - 0x38], eax
jmp 0x1003aa6b
mov eax, dword [edi + 0x70]
push eax
lea edx, [edi + 0x8c]
push 0x4e1b
push edx
call fcn.10029600
add esp, 0xc
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x1003a898
jmp 0x1003aa6b
or ebx, dword [ecx - 0x7477b655]
inc ebp
enter 0xffffffffffffc085, 0xf
mov byte [ebp - 0x75000000], cl
invalid
mov eax, ebx
sub eax, 0x24e0
je 0x1003aa04
sub eax, 0x43
jne 0x1003aa6b
mov dword [edi + 0x10], 1
jmp 0x1003aa6b
mov eax, dword [edi + 0x8c]
lea edx, [ebp - 0x34]
push edx
push 0x11c2
push 0
lea esi, [edi + 0x8c]
push 0
push eax
mov dword [ebp - 0x34], 0x10
call fcn.10039ea0
lea ecx, [ebp - 0x34]
push ecx
push esi
push 0x4bff
push 0
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], edx
mov dword [ebp - 0x34], 0
call fcn.10052110
mov edx, dword [edi + 0x48]
mov ecx, dword [edi + 0x70]
mov eax, dword [edi + 0x4c]
push 0
push ecx
mov dword [ebp - 0x30], edx
lea edx, [ebp - 0x30]
push 0x4151
push edx
mov dword [ebp - 0x2c], eax
call fcn.1002f1e0
add esp, 0x34
add ebx, 0x43
cmp ebx, 0x2523
jbe 0x1003a900
cmp dword [edi + 0x10], 1
jne 0x1003aab1
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push 0x4fc4
push edi
lea edx, [ebp + 8]
push edx
push eax
mov dword [ebp + 8], ecx
call fcn.1004bf40
add esp, 0x10
mov dword [ebp + 8], eax
cmp eax, 0xfffffffe
jne 0x1003a5d7
mov dword [edi + 0x10], 2
cmp dword [edi + 0x10], 2
jne 0x1003ab4d
mov esi, 0x2b20
mov eax, esi
sub eax, 0x2b20
je 0x1003ab02
sub eax, 0x56
jne 0x1003ab3e
lea ecx, [ebp - 0x34]
push ecx
lea edx, [edi + 0x8c]
push edx
xor ebx, ebx
push 0x4bff
push ebx
mov dword [ebp - 0x34], ebx
call fcn.10052110
mov eax, dword [edi + 0x48]
add esp, 0x10
or eax, dword [edi + 0x4c]
jne 0x1003aafd
mov dword [edi + 0x10], 3
jmp 0x1003ab3e
mov dword [edi + 0x10], ebx
jmp 0x1003ab3e
mov eax, dword [edi + 0x70]
push eax
lea ecx, [edi + 0x8c]
push 0x4e1b
push ecx
call fcn.10029600
add esp, 0xc
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x1003a898
cmp eax, 0xfffffffd
jne 0x1003ab3e
mov eax, 0xb32
cmp eax, eax
je 0x1003ab66
add eax, 2
cmp eax, 0xb32
jbe 0x1003ab32
add esi, 0x56
cmp esi, 0x2b76
jbe 0x1003aac0
mov eax, dword [ebp - 0x1c]
add eax, 0x3c
mov dword [ebp - 0x1c], eax
cmp eax, 0x752f
jbe 0x1003a8c0
jmp 0x1003a8b0
mov dword [edi + 4], 2
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
mov esp, ebp
pop ebp
ret