Function at 0x41b001
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
sub esp, 0x94
mov eax, dword fs:[0x18]
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov eax, dword [eax + 0x30]
push esi
mov dword [esp + 0xc], eax
lea eax, [ebx + 0x348]
push edi
push eax
call dword [ebx + 0x38]
mov ebp, eax
xor eax, eax
mov edx, dword [ebp + 0x3c]
add edx, ebp
movzx edi, word [edx + 0x14]
movzx esi, word [edx + 6]
add edi, edx
lea ecx, [edi + 0x18]
test esi, esi
je 0x41b055
mov edx, dword [ebx + 0x340]
cmp dword [ecx], edx
je 0x41b082
inc eax
add ecx, 0x28
cmp eax, esi
jb 0x41b049
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
call dword [ebx + 0x78]
xor ecx, ecx
mov ebp, eax
test esi, esi
je 0x41b0a8
mov edx, edi
lea eax, [edx + 4]
mov dword [esp + 0x18], edx
mov edx, eax
cmp dword [eax], ebp
je 0x41b094
inc ecx
cmp ecx, esi
jb 0x41b06a
mov ebp, dword [esp + 0x18]
jmp 0x41b0b0
imul eax, eax, 0x28
add eax, edi
mov edi, dword [eax + 0x24]
mov esi, dword [eax + 0x20]
add edi, ebp
shr esi, 2
jmp 0x41b05d
push dword [esp + 0xac]
mov ebp, dword [esp + 0x1c]
push ebp
call dword [ebx + 0x110]
jmp 0x41b0b0
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x18], ebp
call dword [ebx + 0x74]
xor ecx, ecx
mov edx, eax
test esi, esi
je 0x41b0e8
cmp dword [edi + 4], edx
je 0x41b0ca
inc ecx
add edi, 4
cmp ecx, esi
jb 0x41b0bb
jmp 0x41b0e8
push 1
push ebp
lea eax, [esp + 0x24]
push eax
call dword [ebx + pe_nt_image_headers32]
push 8
lea eax, [esp + 0x20]
push eax
push edi
call fcn.0041b8bc
add esp, 0xc
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0xc]
cmp dword [edi + 0x18], 0
je 0x41b21b
lea eax, [ebx + 0x370]
mov edx, eax
mov dword [esp + 0x14], edx
mov al, byte [edx]
xor ebp, ebp
and dword [esp + 0x10], 0
inc ebp
xor ecx, ecx
test al, al
je 0x41b209
lea ebx, [esp + 0x24]
mov esi, edx
sub ebx, edx
mov edx, ebp
cmp al, 0x3b
je 0x41b153
cmp ecx, 0x80
jae 0x41b153
cmp al, 0x77
jne 0x41b13a
xor ebp, ebp
jmp 0x41b148
mov ebp, edx
cmp al, 0x70
jne 0x41b148
mov dword [esp + 0x10], 1
mov byte [esi + ebx], al
inc ecx
inc esi
mov al, byte [esi]
test al, al
jne 0x41b124
mov ebx, dword [esp + 0xa8]
test ecx, ecx
je 0x41b209
mov eax, dword [esp + 0x14]
inc eax
mov byte [esp + ecx + 0x24], 0
add eax, ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
push 0
push eax
push dword [edi + 0x18]
push ebx
call fcn.0041b2ec
mov edx, dword [esp + 0x24]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41b108
test ebp, ebp
je 0x41b1ca
cmp dword [esp + 0x10], 0
je 0x41b1ae
call esi
mov edx, dword [esp + 0x14]
mov esi, eax
test esi, esi
je 0x41b108
push dword [esi]
push ebx
call fcn.00419c50
mov edx, dword [esp + 0x1c]
pop ecx
pop ecx
test eax, eax
je 0x41b108
mov eax, dword [esp + 0x20]
jmp 0x41b1fe
cmp dword [esp + 0x10], 0
je 0x41b1e1
call esi
mov edx, dword [esp + 0x14]
mov esi, eax
test esi, esi
je 0x41b108
push dword [esi]
push ebx
call fcn.00419c50
mov edx, dword [esp + 0x1c]
pop ecx
pop ecx
test eax, eax
je 0x41b108
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x14]
mov dword [esi], eax
jmp 0x41b108
mov edi, dword [edi]
lea eax, [ebx + 0x370]
cmp dword [edi + 0x18], 0
jne 0x41b102
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x94
ret