Function at 0x4ec7bbb3
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp + 8]
push eax
push 1
xor esi, esi
push esi
push 0xffffffffffffffff
push esi
push edi
call fcn.4ec7a27a
cmp eax, esi
jne 0x4ec7bdf8
lea eax, [ebp - 4]
push eax
push 1
push 1
push 0xffffffffffffffff
push esi
push edi
call fcn.4ec7a27a
cmp eax, esi
jne 0x4ec7bdf8
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
mov ah, byte [ebx + 0xc]
movzx ecx, byte [ebx + 0xe]
mov al, byte [ebx + 0xd]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebx + 0xf]
shl eax, 8
or eax, ecx
cmp eax, 0x5f0f3cf5
jne 0x4ecd2466
movzx cx, byte [ebx + 0x13]
xor eax, eax
mov ah, byte [ebx + 0x12]
or ax, cx
cmp ax, 0x10
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
jb 0x4ec7bdfe
cmp ax, 0x4000
ja 0x4ec7bdfe
mov al, byte [ebx + 0x11]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
and al, 8
sub al, 8
neg al
sbb eax, eax
inc eax
mov dword [ecx], eax
movzx cx, byte [esi + 0x23]
xor eax, eax
mov ah, byte [esi + 0x22]
or ax, cx
mov word [edi + 0xc4], ax
je 0x4ecd2470
xor eax, eax
mov ah, byte [ebx + 0x32]
mov al, byte [ebx + 0x33]
mov word [edi + 0xc], ax
lea eax, [ebp + 8]
push eax
push 0
push 0xe
push 0x4e
push 0
push edi
call fcn.4ec7a27a
test eax, eax
jne 0x4ec7bdf7
mov eax, dword [ebp + 8]
test eax, eax
je 0x4ecd247a
xor ecx, ecx
mov ch, byte [eax + 0x44]
push eax
mov cl, byte [eax + 0x45]
mov word [edi + 0xdc], cx
xor ecx, ecx
mov ch, byte [eax + 0x46]
mov cl, byte [eax + 0x47]
mov word [edi + 0xde], cx
call dword [edi + 8]
pop ecx
xor eax, eax
mov ah, byte [esi + 6]
push esi
mov al, byte [esi + 7]
mov word [edi + 0xe0], ax
call dword [edi + 8]
push ebx
call dword [edi + 8]
pop ecx
pop ecx
lea eax, [ebp + 8]
push eax
push 1
push 3
push 0xffffffffffffffff
push 0
push edi
call fcn.4ec7a27a
test eax, eax
jne 0x4ec7bdf7
mov eax, dword [ebp + 8]
xor ecx, ecx
mov ch, byte [eax]
movzx edx, byte [eax + 2]
mov esi, dword [ebp + 0x14]
push eax
mov cl, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
mov dword [esi], ecx
xor ecx, ecx
mov ch, byte [eax + 4]
mov cl, byte [eax + 5]
mov word [esi + 4], cx
xor ecx, ecx
mov ch, byte [eax + 6]
mov cl, byte [eax + 7]
mov word [esi + 6], cx
xor ecx, ecx
mov ch, byte [eax + 8]
mov cl, byte [eax + 9]
mov word [esi + 8], cx
xor ecx, ecx
mov ch, byte [eax + 0xa]
mov cl, byte [eax + 0xb]
mov word [esi + 0xa], cx
xor ecx, ecx
mov ch, byte [eax + 0xc]
mov cl, byte [eax + 0xd]
mov word [esi + 0xc], cx
xor ecx, ecx
mov ch, byte [eax + 0xe]
mov cl, byte [eax + 0xf]
mov word [esi + 0xe], cx
xor ecx, ecx
mov ch, byte [eax + 0x10]
mov cl, byte [eax + 0x11]
mov word [esi + 0x10], cx
xor ecx, ecx
mov ch, byte [eax + 0x12]
mov cl, byte [eax + 0x13]
mov word [esi + 0x12], cx
xor ecx, ecx
mov ch, byte [eax + 0x14]
mov cl, byte [eax + 0x15]
mov word [esi + 0x14], cx
xor ecx, ecx
mov ch, byte [eax + 0x16]
mov cl, byte [eax + 0x17]
mov word [esi + 0x16], cx
xor ecx, ecx
mov ch, byte [eax + 0x18]
mov cl, byte [eax + 0x19]
mov word [esi + 0x18], cx
xor ecx, ecx
mov ch, byte [eax + 0x1a]
mov cl, byte [eax + 0x1b]
mov word [esi + 0x1a], cx
xor ecx, ecx
mov ch, byte [eax + 0x1c]
mov cl, byte [eax + 0x1d]
mov word [esi + 0x1c], cx
xor ecx, ecx
mov ch, byte [eax + 0x1e]
mov cl, byte [eax + 0x1f]
mov word [esi + 0x1e], cx
call dword [edi + 8]
movzx eax, word [esi + 6]
pop ecx
movzx ecx, word [esi + 0xa]
cmp ax, cx
movzx eax, ax
jbe 0x4ecd249d
cmp eax, 0xfff6
jg 0x4ecd24a5
lea eax, [edi + 0xc8]
push eax
lea eax, [edi + 0xc6]
push eax
push edi
call fcn.4ec7be0a
pop ebx
pop edi
pop esi
leave
ret 0x10
mov eax, 0x140e
jmp 0x4ec7bdf7
mov eax, 0x1405
jmp 0x4ec7bdf7
mov eax, 0x140f
jmp 0x4ec7bdf7
xor eax, eax
mov ah, byte [esi + 4]
mov al, byte [esi + 5]
mov word [edi + 0xdc], ax
xor eax, eax
mov ah, byte [esi + 6]
mov al, byte [esi + 7]
mov word [edi + 0xde], ax
jmp 0x4ec7bcc3
movzx eax, cx
jmp 0x4ec7bdd8
mov eax, 0x140b
jmp 0x4ec7bdf7