Function at 0x10017d20
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10483448]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1047ee28]
and eax, dword [0x1047eddc]
mov dword [0x1047eddc], eax
mov ecx, dword [0x1047ee78]
imul ecx, dword [0x1047efdc]
mov dword [0x1047ee7c], ecx
mov edx, dword [0x1047ee58]
add edx, dword [0x1047efd4]
mov dword [0x1047eecc], edx
mov eax, dword [0x1047f028]
imul eax, dword [0x1047efb4]
mov dword [0x1047ef08], eax
mov ecx, dword [0x1047eff4]
sub ecx, dword [0x1047eed0]
mov dword [0x1047edec], ecx
mov edx, dword [0x1047ed8c]
add edx, dword [0x1047edf0]
mov dword [0x1047edc8], edx
mov eax, dword [0x1047ee50]
sub eax, dword [0x1047f03c]
mov dword [0x1047ee28], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
movzx eax, word [ecx + 0x14]
lea ecx, [edx + eax + 0x18]
mov dword [ebp - 0xc], ecx
mov edx, dword [0x1047eed0]
add edx, dword [0x1047f004]
mov dword [0x1047eeb8], edx
mov eax, dword [0x1047efe0]
sub eax, dword [0x1047eeac]
mov dword [0x1047edb8], eax
mov ecx, dword [0x1047ee94]
and ecx, dword [0x1047ed80]
mov dword [0x1047ede4], ecx
mov edx, dword [0x1047eda8]
add edx, dword [0x1047ed94]
mov dword [0x1047f028], edx
mov eax, dword [0x1047ef30]
imul eax, dword [0x1047ef44]
mov dword [0x1047edbc], eax
mov dword [ebp - 0x14], 0
jmp 0x10017e31
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x28
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x14], edx
jge 0x100182f7
mov eax, dword [0x1047efcc]
and eax, dword [0x1047f010]
mov dword [0x1047ed90], eax
mov ecx, dword [0x1047edc4]
add ecx, dword [0x1047ee80]
mov dword [0x1047eecc], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
and eax, 0x20000000
je 0x10017e7b
mov dword [ebp - 0x20], 1
jmp 0x10017e82
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x30], ecx
mov edx, dword [0x1047eecc]
add edx, dword [0x1047ef00]
mov dword [0x1047eed8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
and ecx, 0x40000000
je 0x10017eb1
mov dword [ebp - 0x1c], 1
jmp 0x10017eb8
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], edx
mov eax, dword [0x1047edec]
imul eax, dword [0x1047ede4]
mov dword [0x1047edd8], eax
mov ecx, dword [0x1047ef90]
sub ecx, dword [0x1047ee14]
mov dword [0x1047ee74], ecx
mov edx, dword [0x1047ee6c]
sub edx, dword [0x1047edec]
mov dword [0x1047f030], edx
mov eax, dword [0x1047ee74]
sub eax, dword [0x1047ee6c]
mov dword [0x1047ef8c], eax
mov ecx, dword [0x1047ef48]
and ecx, dword [0x1047eea8]
mov dword [0x1047ee6c], ecx
mov edx, dword [0x1047ee08]
add edx, dword [0x1047edb8]
mov dword [0x1047ed94], edx
mov eax, dword [0x1047eef8]
add eax, dword [0x1047ee68]
mov dword [0x1047eddc], eax
mov ecx, dword [0x1047ed84]
sub ecx, dword [0x1047edc0]
mov dword [0x1047f020], ecx
mov edx, dword [0x1047edec]
and edx, dword [0x1047f01c]
mov dword [0x1047eec0], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x24]
and ecx, 0x80000000
je 0x10017f72
mov dword [ebp - 0x24], 1
jmp 0x10017f79
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], edx
mov eax, dword [0x1047ed80]
and eax, dword [0x1047ef4c]
mov dword [0x1047ee84], eax
mov ecx, dword [0x1047efe0]
and ecx, dword [0x1047ef1c]
mov dword [0x1047eefc], ecx
mov edx, dword [0x1047ee78]
and edx, dword [0x1047ed84]
mov dword [0x1047f03c], edx
mov eax, dword [0x1047ede8]
add eax, dword [0x1047efc8]
mov dword [0x1047ef00], eax
mov ecx, dword [0x1047f00c]
add ecx, dword [0x1047f014]
mov dword [0x1047ee6c], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
and eax, 0x2000000
je 0x100180d7
push 0x4000
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [0x1047efc0]
add edx, dword [0x1047eea0]
mov dword [0x1047ef00], edx
mov eax, dword [0x1047f028]
imul eax, dword [0x1047ee28]
mov dword [0x1047eef8], eax
mov ecx, dword [0x1047ef1c]
imul ecx, dword [0x1047ee9c]
mov dword [0x1047ed8c], ecx
mov edx, dword [0x1047f028]
and edx, dword [0x1047ef40]
mov dword [0x1047f008], edx
mov eax, dword [0x1047eed8]
sub eax, dword [0x1047ee6c]
mov dword [0x1047efe4], eax
mov ecx, dword [0x1047ede0]
sub ecx, dword [0x1047edf8]
mov dword [0x1047ee88], ecx
mov edx, dword [0x1047ee98]
sub edx, dword [0x1047efdc]
mov dword [0x1047edf4], edx
mov eax, dword [0x1047edd0]
add eax, dword [0x1047ee20]
mov dword [0x1047ee80], eax
mov ecx, dword [0x1047ef00]
add ecx, dword [0x1047efc4]
mov dword [0x1047ef78], ecx
jmp 0x10017e1f
mov edx, dword [ebp - 0x30]
shl edx, 4
mov eax, dword [ebp - 0x28]
lea ecx, [edx + eax*8 + 0x1047f048]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ecx + edx*4]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x1047eeac]
imul ecx, dword [0x1047ef20]
mov dword [0x1047eec8], ecx
mov edx, dword [0x1047ee98]
add edx, dword [0x1047ef40]
mov dword [0x1047ef30], edx
mov eax, dword [0x1047eddc]
and eax, dword [0x1047edc4]
mov dword [0x1047f028], eax
mov ecx, dword [0x1047f000]
sub ecx, dword [0x1047ee78]
mov dword [0x1047ee50], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
and eax, 0x4000000
je 0x100181e1
mov ecx, dword [ebp - 0x18]
or ecx, 0x200
mov dword [ebp - 0x18], ecx
mov edx, dword [0x1047ede0]
imul edx, dword [0x1047eeb4]
mov dword [0x1047ee84], edx
mov eax, dword [0x1047eed4]
add eax, dword [0x1047eeb4]
mov dword [0x1047eda8], eax
mov ecx, dword [0x1047edf8]
imul ecx, dword [0x1047ee9c]
mov dword [0x1047ee3c], ecx
mov edx, dword [0x1047efa0]
add edx, dword [0x1047ef58]
mov dword [0x1047efb8], edx
mov eax, dword [0x1047ef48]
sub eax, dword [0x1047efb4]
mov dword [0x1047ed84], eax
mov ecx, dword [0x1047f010]
imul ecx, dword [0x1047eea4]
mov dword [0x1047ede0], ecx
mov edx, dword [0x1047efd0]
and edx, dword [0x1047efe8]
mov dword [0x1047ede8], edx
mov eax, dword [0x1047efb4]
sub eax, dword [0x1047eda4]
mov dword [0x1047ee84], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [0x1047ee30]
imul eax, dword [0x1047ed9c]
mov dword [0x1047eef8], eax
mov ecx, dword [0x1047ee98]
add ecx, dword [0x1047f01c]
mov dword [0x1047efcc], ecx
cmp dword [ebp - 0x10], 0
jne 0x100182d3
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
and eax, 0x40
je 0x10018275
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1047ee1c]
sub ecx, dword [0x1047ee1c]
mov dword [0x1047ee6c], ecx
mov edx, dword [0x1047ee80]
and edx, dword [0x1047eeb0]
mov dword [0x1047ede8], edx
mov eax, dword [0x1047ee30]
and eax, dword [0x1047ef04]
mov dword [0x1047ee48], eax
mov ecx, dword [0x1047eeb4]
and ecx, dword [0x1047ef7c]
mov dword [0x1047ef60], ecx
jmp 0x100182d3
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x24]
and eax, 0x80
je 0x100182d3
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x1047ef30]
and ecx, dword [0x1047ef48]
mov dword [0x1047ee18], ecx
mov edx, dword [0x1047edd0]
sub edx, dword [0x1047f03c]
mov dword [0x1047eec8], edx
mov eax, dword [0x1047eee8]
sub eax, dword [0x1047ef34]
mov dword [0x1047ee38], eax
mov ecx, dword [0x1047ee2c]
sub ecx, dword [0x1047efdc]
mov dword [0x1047edfc], ecx
cmp dword [ebp - 0x10], 0
jbe 0x100182f2
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10017e1f
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10129f9e
mov esp, ebp
pop ebp
ret