Function at 0x40f600
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
push 0x40
push edi
xor ebx, ebx
call fcn.0040f8a0
add esp, 8
test eax, eax
jne 0x40f620
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov esi, dword [esp + 0x18]
cmp word [esi], 0x5a4d
je 0x40f633
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esi + 0x3c]
add eax, 0xf8
push eax
push edi
call fcn.0040f8a0
add esp, 8
test eax, eax
jne 0x40f64f
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edi, dword [esi + 0x3c]
add edi, esi
mov dword [esp + 0x10], edi
cmp dword [edi], 0x4550
je 0x40f668
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
cmp word [edi + 4], 0x14c
je 0x40f678
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
test byte [edi + 0x38], 1
je 0x40f686
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
xor ecx, ecx
xor eax, eax
mov cx, word [edi + 0x14]
mov ax, word [edi + 6]
test eax, eax
lea ecx, [ecx + edi + 0x18]
jbe 0x40f6b9
add ecx, 0xc
mov esi, eax
mov edx, dword [ecx + 4]
mov eax, dword [ecx]
test edx, edx
jne 0x40f6ab
mov edx, dword [edi + 0x38]
add eax, edx
cmp eax, ebx
jbe 0x40f6b3
mov ebx, eax
add ecx, 0x28
dec esi
jne 0x40f69f
mov ebp, dword [edi + 0x50]
add ebx, 0xfff
add ebp, 0xfff
and ebx, 0xfffff000
and ebp, 0xfffff000
cmp ebp, ebx
je 0x40f6e0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov esi, dword [esp + 0x34]
mov edx, dword [edi + 0x34]
push esi
push 4
push 0x3000
push ebp
push edx
call dword [esp + 0x34]
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x40f71b
push esi
push 4
push 0x3000
push ebp
push eax
call dword [esp + 0x34]
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x40f71b
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0x40
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
jne 0x40f749
push esi
push 0x8000
push eax
push ebx
call dword [esp + 0x34]
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [ebp + 4], ebx
mov ax, word [edi + 0x16]
shr eax, 0xd
and eax, 1
mov dword [ebp + 0x1c], ecx
mov ecx, dword [esp + 0x2c]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [ebp + 0x20], edx
mov edx, dword [esp + 0x30]
mov dword [ebp + 0x24], eax
mov dword [ebp + 0x28], ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebp + 0x2c], edx
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x3c], 0x1000
mov eax, dword [edi + 0x54]
push eax
push ecx
call fcn.0040f8a0
add esp, 8
test eax, eax
je 0x40f856
mov edx, dword [edi + 0x54]
push esi
push 4
push 0x1000
push edx
push ebx
call dword [esp + 0x34]
mov ecx, dword [edi + 0x54]
mov esi, dword [esp + 0x2c]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
push esi
mov edx, dword [ecx + 0x3c]
add eax, edx
mov dword [ebp], eax
mov dword [eax + 0x34], ebx
mov eax, dword [esp + 0x38]
push eax
push ecx
call fcn.0040f8b0
add esp, 0x24
test eax, eax
je 0x40f856
mov ecx, dword [ebp]
mov eax, dword [ecx + 0x34]
mov ecx, dword [esi + 0x34]
sub eax, ecx
je 0x40f80a
push eax
push ebp
call fcn.0040fc40
add esp, 8
mov dword [ebp + 0x18], eax
jmp 0x40f811
mov dword [ebp + 0x18], 1
push ebp
call fcn.0040fcd0
add esp, 4
test eax, eax
je 0x40f856
push ebp
call fcn.0040f9d0
add esp, 4
test eax, eax
je 0x40f856
push ebp
call fcn.0040fbf0
add esp, 4
test eax, eax
je 0x40f856
mov edx, dword [ebp]
mov eax, dword [edx + 0x28]
test eax, eax
je 0x40f883
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x40f876
push 0
push 1
add eax, ebx
push ebx
call eax
test eax, eax
jne 0x40f867
push ebp
call fcn.0040ff90
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
mov dword [ebp + 0x10], 1
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret
add eax, ebx
pop edi
mov dword [ebp + 0x38], eax
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
mov dword [ebp + 0x38], 0
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret