Function at 0x420f44
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
mov ebx, edx
mov esi, eax
mov edi, 0x4321f4
push eax
add esp, 0xffffffa8
lea eax, [ebx + 0xc58]
mov byte [esp], cl
mov dx, word [eax]
mov word [esp + 0x1c], dx
mov cl, byte [eax + 2]
mov byte [esp + 0x1e], cl
mov dx, word [eax + 4]
mov word [esp + 0x20], dx
mov cx, word [eax + 6]
mov word [esp + 0x22], cx
mov edx, dword [eax + 8]
mov dword [esp + 0x24], edx
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x28], ecx
mov dl, byte [eax + 0x10]
mov byte [esp + 0x2c], dl
mov ecx, dword [eax + 0x14]
mov dword [esp + 0x30], ecx
mov edx, dword [eax + 0x18]
mov dword [esp + 0x34], edx
mov cl, byte [eax + 0x1c]
mov byte [esp + 0x38], cl
mov dl, byte [eax + 0x1d]
mov byte [esp + 0x39], dl
mov cx, word [eax + 0x1e]
mov word [esp + 0x3a], cx
mov edx, dword [eax + 0x20]
mov dword [esp + 0x3c], edx
mov ecx, dword [eax + 0x24]
mov dword [esp + 0x40], ecx
mov edx, dword [eax + 0x28]
mov dword [esp + 0x44], edx
lea edx, [eax + 0x2c]
mov ecx, dword [edx]
mov dword [esp + 0x48], ecx
mov edx, dword [edx + 4]
mov dword [esp + 0x4c], edx
lea edx, [eax + 0x34]
mov ecx, dword [edx]
mov dword [esp + 0x50], ecx
mov ecx, 0x100
mov edx, dword [edx + 4]
mov dword [esp + 0x54], edx
push esi
push edi
lea edi, [esp + 0x60]
lea esi, [eax + 0x3c]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [esp + 0x460]
lea esi, [eax + 0x43c]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x42f228
lea eax, [esp + 0xc5c]
push eax
call fcn.00424d38
add esp, 8
lea eax, [esi + 0x1cc]
call fcn.004153f4
mov ebp, eax
cmp byte [esp], 0
je 0x42106b
push ebp
push 0x42f228
call fcn.00424d38
add esp, 8
mov ecx, 0x30f
push esi
push edi
lea edi, [ebx + 0xc58]
lea esi, [ebp + 0x1800]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [esi + 0x1a8]
lea ecx, [esp + 4]
mov dword [ebx + 0xc60], eax
lea eax, [esi + 0x1a8]
mov edx, 0x20
call fcn.00401ff0
mov ecx, dword [esp + 4]
mov dword [ebx + 0xc7c], ecx
test byte [ebx + 0xc5c], 2
je 0x4210a6
or word [ebx + 0xc5c], 1
or word [ebx + 0xc5c], 2
cmp byte [esp], 0
je 0x4210cb
push esi
push edi
lea edi, [ebp + 0x1800]
lea esi, [ebx + 0xc58]
mov ecx, 0x30f
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [esi + 0x1c8]
not eax
mov dword [ebx + 0xc6c], eax
lea eax, [esp + 0xc]
xor edx, edx
call fcn.00401f50
mov ecx, dword [eax]
mov dword [esi + 0x1a8], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 0x1ac], ecx
mov dword [esi + 0x1c8], 0xffffffff
test byte [ebx + 0xc4c], 1
jne 0x42113a
mov byte [0x434e15], 0
or word [ebx + 0xc4c], 1
mov byte [ebx + 0x2576], 1
cmp dword [0x4313a0], 0
je 0x42113a
or word [ebx + 0xc4c], 0x10
mov ecx, edi
mov edx, edi
mov eax, esi
call fcn.0042169c
add esp, 0xfffffff8
mov edx, dword [ebx + 0x257c]
add edx, 7
mov eax, esp
call fcn.00401f50
xor edx, edx
mov eax, ebx
call fcn.00402fe8
mov edx, 0x73
mov eax, ebx
call fcn.00412f54
lea eax, [esi + 0x246d8]
add esp, 0xfffffff8
mov edx, dword [eax]
mov dword [esp], edx
xor edx, edx
mov ecx, dword [eax + 4]
mov eax, ebx
mov dword [esp + 4], ecx
call fcn.00402fe8
mov edx, 0x74
mov eax, ebx
call fcn.00412f54
mov dword [ebx + 0xc6c], 0xffffffff
push str._b_b_b_b
call fcn.00410f14
pop ecx
xor edx, edx
mov eax, ebx
call fcn.004148a4
mov edx, edi
mov eax, ebx
call fcn.00402df8
test al, al
jne 0x4211de
push edi
lea ecx, [ebx + 0xd]
push ecx
mov eax, 0xca8
call fcn.0040a360
push eax
call fcn.0041d308
add esp, 0xc
mov eax, 0x4313b0
mov edx, 6
call fcn.00411d84
mov eax, dword [ebx + 0xc70]
xor edx, edx
mov dword [ebx + 0xc40], eax
mov eax, edi
mov word [ebx + 0xc4e], 0xd
and word [ebx + 0xc4c], 0xff9d
mov dword [ebx + 0x257c], edx
cmp dword [0x4313a0], 0
setne dl
and edx, 1
call fcn.00401d74
cmp byte [0x434e15], 0
jne 0x421283
cmp byte [0x4313a5], 0
jne 0x421235
mov eax, edi
call fcn.0040361c
test al, al
je 0x421283
mov eax, 0xcae
call fcn.0040a360
push eax
call fcn.00410f14
pop ecx
mov eax, 0xbbc
call fcn.0040a360
call fcn.004113a8
sub eax, 0xffffffff
je 0x421264
sub eax, 3
je 0x421264
dec eax
je 0x421273
jmp 0x421283
mov eax, 0x4313b0
mov edx, 0xff
call fcn.00411d84
cmp dword [0x431328], 0
jne 0x421283
mov byte [0x434e15], 1
cmp dword [0x431328], 0
je 0x4212c9
mov eax, edi
call fcn.004037cc
jmp 0x4212c9
mov eax, 0xcb0
call fcn.0040a360
push eax
call fcn.00410f14
pop ecx
mov eax, 0xbc0
call fcn.0040a360
call fcn.004113a8
cmp eax, 2
jne 0x4212c9
mov eax, 0x4313b0
mov edx, 0xff
call fcn.00411d84
add esp, 0xfffffff8
mov eax, edi
mov edx, esp
call fcn.00403684
add esp, 0xfffffff8
mov edx, 0x3e8
mov eax, esp
call fcn.00401f50
call fcn.004024b4
test al, al
jne 0x421295
jmp 0x421326
push edi
mov eax, 0xdcc
call fcn.0040a360
push eax
call fcn.00410f14
add esp, 8
mov eax, 0xbba
call fcn.0040a360
call fcn.004113a8
cmp eax, 2
jne 0x421326
mov eax, 0x4313b0
mov edx, 2
call fcn.00411d84
push 0
push 0
mov edx, edi
xor ecx, ecx
mov eax, ebx
call fcn.00403f0c
test al, al
je 0x4212ef
mov edx, 0x72
mov eax, ebx
call fcn.00412f54
mov edx, 0x73
mov eax, ebx
call fcn.00412f54
push edi
cmp byte [ebx + 0x2575], 0
je 0x421367
mov eax, 0xcf0
call fcn.0040a360
jmp 0x42136c
mov eax, 0x42c68f
push eax
mov eax, 0xcb2
call fcn.0040a360
push eax
call fcn.00410f14
add esp, 0xc
cmp byte [esp], 0
jne 0x4213a9
mov edx, dword [esp + 0x30]
xor ecx, ecx
mov dword [ebx + 0xc6c], edx
mov dword [ebx + 0xc60], ecx
and word [ebx + 0xc5c], 0xfffd
or word [ebx + 0xc5c], 1
add esp, 0xfffffff8
mov eax, dword [0x4312f8]
mov dword [esp], eax
mov edx, dword [0x4312fc]
mov dword [esp + 4], edx
mov edx, ebx
mov eax, esi
call fcn.004173d0
movzx eax, word [ebx + 0xc5e]
cmp eax, dword [0x4313a8]
jbe 0x4213dc
dec dword [0x4313ac]
sub dword [0x4313a8], eax
mov edx, 0x74
mov eax, ebx
call fcn.00412f54
lea eax, [esp + 0x14]
mov edx, 0x14
call fcn.00401f50
mov ecx, dword [esp + 0x14]
xor edx, edx
mov dword [esi + 0x246d8], ecx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x246dc], ecx
mov ecx, ebx
call fcn.00410e90
lea eax, [esp + 0xc58]
push eax
push 0x42f228
call fcn.00424d38
add esp, 8
mov eax, 0x42f228
call fcn.0040189c
push eax
mov eax, 0xcf6
call fcn.0040a360
push eax
call fcn.00410f14
add esp, 8
lea edi, [ebx + 0xc58]
mov ecx, 0x30f
lea esi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
add esp, 0x1058
pop ebp
pop edi
pop esi
pop ebx
ret