Function at 0x38414010
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov ebx, edx
mov esi, ecx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [0x6e46000]
xor eax, ebp
mov dword [esp + 0x10], eax
test edx, edx
je 0x3841403b
mov dword [edx], 0
mov eax, dword [ebp + 0x18]
test ecx, ecx
je 0x38414048
mov dword [ecx], 0
mov dword [eax], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebx]
lea ecx, [esp + 8]
push ecx
push ebx
call dword [eax + 0x14]
add esp, 8
test eax, eax
js 0x38414237
mov dword [esp], esi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
cmp eax, 0x10107
ja 0x384140e8
lea esi, [eax + eax]
cmp esi, 0x10108
ja 0x38414094
mov esi, 0x10108
cmp eax, esi
jae 0x384140e8
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx]
add esp, 8
test eax, eax
je 0x38414289
mov edi, eax
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
mov edx, eax
je 0x384140e3
mov eax, dword [edx]
test eax, eax
je 0x384140e3
push dword [edx + 4]
push eax
push edi
call fcn.38416300
add esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
push dword [edx]
push eax
call dword [ecx + 8]
mov edx, dword [ebp + 8]
add esp, 8
mov dword [edx], edi
mov dword [edx + 8], esi
mov dword [edx + 4], 0x10108
mov dword [esp + 4], 0
mov eax, dword [ebx]
lea ecx, [esp + 4]
push ecx
push 0x10108
push dword [edx]
push 0
push 0
push ebx
call dword [eax + 0xc]
add esp, 0x18
test eax, eax
js 0x3841424c
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x38414250
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
cmp eax, ebx
jae 0x384141a3
mov edi, eax
cmp eax, 0x7fffffff
jb 0x3841413c
mov edi, 0x7fffffff
add edi, edi
cmp edi, ebx
ja 0x38414144
mov edi, ebx
cmp eax, edi
jae 0x384141a3
cmp edi, 0x10
ja 0x38414152
mov edi, 0x10
mov eax, dword [edx + 0xc]
mov ecx, dword [eax]
push edi
push eax
mov esi, edx
call dword [ecx]
add esp, 8
test eax, eax
je 0x384142d4
cmp dword [esi + 8], 0
mov edx, esi
je 0x3841419e
mov ecx, dword [edx]
test ecx, ecx
je 0x3841419e
push dword [edx + 4]
push ecx
push eax
mov esi, eax
call fcn.38416300
add esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
push dword [edx]
push eax
call dword [ecx + 8]
mov eax, esi
mov edx, dword [ebp + 8]
add esp, 8
mov dword [edx], eax
mov dword [edx + 8], edi
mov dword [edx + 4], ebx
mov eax, dword [edx]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x38414257
mov ecx, dword [eax + 0x3c]
xor edx, edx
mov esi, ecx
add esi, 0x18
setb dl
cmp esi, ebx
sbb edx, 0
jae 0x38414290
cmp dword [eax + ecx], 0x4550
mov edx, dword [esp]
jne 0x384142aa
add eax, ecx
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x384141ea
mov dword [edx], eax
mov edx, dword [ebp + 0x14]
movzx esi, word [eax + 4]
cmp esi, 0x8664
je 0x384142db
movzx esi, si
cmp esi, 0x14c
jne 0x38414312
mov dword [edx], 1
xor edx, edx
mov edi, ecx
add edi, 0xe0
setb dl
mov esi, dword [ebp + 8]
mov esi, dword [esi + 4]
cmp edi, esi
sbb edx, 0
jae 0x3841432c
xor edx, edx
jmp 0x384142fd
mov edi, eax
mov eax, dword [esi]
push edi
push 0x6e423e5
push 0
push esi
call dword [eax + 4]
add esp, 0x10
jmp 0x384142bf
mov edi, eax
jmp 0x384142bf
mov edi, 0x1abe0001
jmp 0x384142bf
cmp ebx, 0x200
mov ecx, dword [esp]
jb 0x3841427d
movzx eax, word [eax + 0x1fe]
cmp eax, 0xaa55
jne 0x3841427d
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
xor edi, edi
jmp 0x384142bf
mov eax, dword [ecx]
push 0x6e44729
push 0
push ecx
jmp 0x384142b4
mov edi, 0x80000041
jmp 0x384142bf
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0x6e44693
push 0
push ecx
call dword [eax + 4]
add esp, 0xc
mov edi, 0x9abe0002
jmp 0x384142bf
mov eax, dword [edx]
push 0x6e4473c
push 0
push edx
call dword [eax + 4]
add esp, 0xc
mov edi, 0x80000006
mov ecx, dword [esp + 0x10]
xor ecx, ebp
call 0x387310a4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, 0x8000004b
jmp 0x384142bf
mov dword [edx], 0
xor edx, edx
mov edi, ecx
add edi, 0xf0
setb dl
mov esi, dword [ebp + 8]
mov esi, dword [esi + 4]
cmp edi, esi
sbb edx, 0
mov dl, 1
jae 0x3841432c
movzx ebx, word [eax + 0x16]
test bl, 2
jne 0x3841433b
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0x6e443a3
jmp 0x3841431c
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0x6e446b6
push 0
push ecx
call dword [eax + 4]
add esp, 0xc
mov edi, 0x1abe0001
jmp 0x384142bf
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0x6e445e1
jmp 0x3841429a
movzx edi, word [eax + 6]
test edi, edi
je 0x38414380
test dl, dl
je 0x3841438c
cmp dword [eax + 0x84], 0x10
jne 0x384143cf
cmp word [eax + 0x5c], 1
je 0x3841436c
and ebx, 0x2000
test bx, bx
je 0x3841436c
cmp dword [eax + 0x28], 0
je 0x38414450
cmp dword [eax + 0xf8], 0
je 0x384143de
cmp dword [eax + 0xfc], 0
jne 0x384143c0
jmp 0x384143de
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0x6e446a6
jmp 0x3841431c
cmp dword [eax + 0x74], 0x10
jne 0x384143cf
cmp word [eax + 0x5c], 1
je 0x384143ae
and ebx, 0x2000
test bx, bx
je 0x384143ae
cmp dword [eax + 0x28], 0
je 0x38414468
cmp dword [eax + 0xe8], 0
je 0x384143de
cmp dword [eax + 0xec], 0
je 0x384143de
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0x6e4428c
jmp 0x3841431c
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0x6e442dd
jmp 0x3841429a
movzx edx, word [eax + 0x14]
add ecx, edx
add ecx, 0x18
mov edx, edi
shl edx, 3
lea edx, [edx + edx*4]
xor ebx, ebx
add edx, ecx
setb bl
cmp edx, esi
sbb ebx, 0
jae 0x38414424
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x3841440f
mov esi, dword [ebp + 8]
add ecx, dword [esi]
mov dword [edx], ecx
movzx edi, word [eax + 6]
cmp di, 1
jne 0x38414433
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0x6e44406
jmp 0x3841429a
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0x6e445d0
jmp 0x3841429a
mov eax, edi
xor edi, edi
cmp ax, 0xa
jb 0x384142bf
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0x6e44393
jmp 0x3841429a
cmp dword [eax + 0x88], 0
je 0x38414478
cmp dword [eax + 0x8c], 0
jne 0x3841436c
jmp 0x38414478
cmp dword [eax + 0x78], 0
je 0x38414478
cmp dword [eax + 0x7c], 0
jne 0x384143ae
mov ecx, dword [esp]
mov eax, dword [ecx]
push 0x6e442ff
jmp 0x3841431c