Function at 0x63dc60
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
sub esp, 0x44
push ebp
push edi
mov ebp, ecx
xor edi, edi
mov dword [esp + 0x10], ebp
cmp dword [ebp + 0x10], edi
jne 0x63dc7b
lea eax, [edi + 1]
pop edi
pop ebp
add esp, 0x44
ret
mov eax, dword [ebp + 4]
push ebx
push esi
push edi
push edi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp + 0x2c]
sub ecx, dword [ebp + 0x28]
lea esi, [ebp + 0x1c]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
je 0x63df67
xor ebx, ebx
mov edi, edi
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov word [esp + 0x50], ax
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov dword [esp + 0x34], 0x4034b50
cmp edi, ecx
jb 0x63dd07
call fcn.0071ffb6
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + edx]
test eax, eax
je 0x63e11f
lea ecx, [esp + 0x34]
test ecx, ecx
je 0x63e11f
movzx edx, word [eax + 6]
mov word [esp + 0x38], dx
movzx ecx, word [eax + 8]
mov word [esp + 0x3a], cx
movzx edx, word [eax + 0xa]
mov word [esp + 0x3c], dx
movzx ecx, word [eax + 0xc]
mov word [esp + 0x3e], cx
movzx edx, word [eax + 0xe]
mov word [esp + 0x40], dx
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x42], ecx
mov edx, dword [eax + 0x14]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov dword [esp + 0x46], edx
mov eax, dword [eax + 0x18]
mov dword [esp + 0x4a], eax
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jb 0x63dd83
call fcn.0071ffb6
mov edx, dword [esi + 0xc]
push 0x104
lea eax, [ebx + edx + 0x20c]
push 0
push eax
call fcn.007202b0
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add esp, 0xc
cmp edi, ecx
jb 0x63ddbd
call fcn.0071ffb6
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov ebp, dword [esi + 0xc]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
add ebp, ebx
cmp edi, eax
jb 0x63dde2
call fcn.0071ffb6
mov eax, dword [esi + 0xc]
push 0
push 0
push 0x104
add ebp, 0x20c
push ebp
add eax, ebx
push 0xffffffffffffffff
add eax, 4
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x63e11f
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
lea ebp, [eax - 1]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov word [esp + 0x4e], bp
cmp edi, ecx
jb 0x63de37
call fcn.0071ffb6
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + edx]
mov word [eax + 0x1c], bp
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jb 0x63de61
call fcn.0071ffb6
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + edx]
mov ebp, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x14]
push ecx
mov dword [eax + 0x2a], ebp
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 4]
push 0x1e
lea edx, [esp + 0x40]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x63e11f
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
add ebp, dword [esp + 0x10]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x63deb6
call fcn.0071ffb6
mov eax, dword [esi + 0xc]
movzx edx, word [esp + 0x4e]
push 0
lea ecx, [esp + 0x14]
push ecx
add eax, ebx
push edx
add eax, 0x20c
push eax
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x63e11f
add ebp, dword [esp + 0x10]
cmp dword [esp + 0x46], 0
mov dword [esp + 0x14], ebp
je 0x63df3d
push edi
mov ecx, esi
call fcn.0063d710
cmp dword [eax + 0x310], 0
je 0x63df3d
mov eax, dword [esp + 0x46]
push 0
lea edx, [esp + 0x14]
push edx
push eax
push edi
mov ecx, esi
call fcn.0063d710
mov ecx, dword [eax + 0x310]
mov edx, dword [esp + 0x24]
mov eax, dword [edx + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x63e11f
add ebp, dword [esp + 0x10]
mov dword [esp + 0x14], ebp
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
inc edi
add ecx, edx
add ebx, 0x314
cmp edi, ecx
jb 0x63dcc0
mov ebp, dword [esp + 0x18]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], ax
mov dword [esp + 0x28], eax
mov word [esp + 0x22], ax
xor edx, edx
mov word [esp + 0x20], dx
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov word [esp + 0x24], cx
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x532ae21d
imul ecx
mov ecx, dword [esp + 0x14]
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [esp + 0x26], ax
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
xor edx, edx
mov word [esp + 0x30], dx
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
xor ebx, ebx
xor edi, edi
add eax, edx
mov dword [esp + 0x1c], 0x6054b50
je 0x63e0f5
xor ebp, ebp
lea esp, [esp]
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp edi, ecx
jb 0x63e020
call fcn.0071ffb6
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x18]
push 0
lea edx, [esp + 0x14]
push edx
mov edx, dword [ecx + 4]
add eax, ebp
mov eax, dword [eax]
push 0x2e
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x63e11f
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
add ebx, dword [esp + 0x10]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x14], ebx
cmp edi, eax
jb 0x63e06f
call fcn.0071ffb6
mov ecx, dword [esi + 0x10]
sub ecx, dword [esi + 0xc]
mov ebx, dword [esi + 0xc]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
add ebx, ebp
cmp edi, ecx
jb 0x63e094
call fcn.0071ffb6
mov ecx, dword [ebx]
mov eax, dword [esi + 0xc]
push 0
lea edx, [esp + 0x14]
push edx
movzx edx, word [ecx + 0x1c]
add eax, ebp
push edx
add eax, 0x20c
push eax
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x63e11f
mov ecx, dword [esi + 0x10]
mov edx, dword [esp + 0x10]
add dword [esp + 0x14], edx
sub ecx, dword [esi + 0xc]
mov ebx, dword [esp + 0x14]
mov eax, 0x532ae21d
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
inc edi
add eax, edx
add ebp, 0x314
cmp edi, eax
jb 0x63e000
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x16
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
neg eax
pop ebx
sbb eax, eax
pop edi
neg eax
pop ebp
add esp, 0x44
ret
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x44
ret