Function at 0x4ec7aed3
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
push eax
push 1
xor edi, edi
push edi
push 0xffffffffffffffff
push edi
push esi
call fcn.4ec7b10c
cmp eax, edi
jne 0x4ec7b0fa
lea eax, [ebp - 4]
push eax
push 1
push 1
push 0xffffffffffffffff
push edi
push esi
call fcn.4ec7b10c
cmp eax, edi
jne 0x4ec7b0fa
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
mov ah, byte [ebx + 0xc]
movzx ecx, byte [ebx + 0xe]
mov al, byte [ebx + 0xd]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebx + 0xf]
shl eax, 8
or eax, ecx
cmp eax, 0x5f0f3cf5
jne 0x4ecde7da
movzx cx, byte [ebx + 0x13]
xor eax, eax
mov ah, byte [ebx + 0x12]
or eax, ecx
cmp ax, 0x10
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
jb 0x4ec7b100
cmp ax, 0x4000
ja 0x4ec7b100
mov al, byte [ebx + 0x11]
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp - 4]
and al, 8
sub al, 8
neg al
sbb eax, eax
inc eax
mov dword [ecx], eax
movzx cx, byte [edi + 0x23]
xor eax, eax
mov ah, byte [edi + 0x22]
or eax, ecx
test ax, ax
mov word [esi + 0xc4], ax
je 0x4ecde7e4
xor eax, eax
mov ah, byte [ebx + 0x32]
mov al, byte [ebx + 0x33]
mov word [esi + 0xc], ax
lea eax, [ebp + 8]
push eax
push 0
push 0xe
push 0xffffffffffffffff
push 0
push esi
call fcn.4ec7b10c
test eax, eax
jne 0x4ec7b0f9
mov eax, dword [ebp + 8]
test eax, eax
je 0x4ecde7ee
xor ecx, ecx
mov ch, byte [eax + 0x44]
push eax
mov cl, byte [eax + 0x45]
mov word [esi + 0xdc], cx
xor ecx, ecx
mov ch, byte [eax + 0x46]
mov cl, byte [eax + 0x47]
mov word [esi + 0xde], cx
call dword [esi + 8]
pop ecx
xor eax, eax
mov ah, byte [edi + 6]
push edi
mov al, byte [edi + 7]
mov word [esi + 0xe0], ax
call dword [esi + 8]
push ebx
call dword [esi + 8]
pop ecx
pop ecx
lea eax, [ebp + 8]
push eax
push 1
push 3
push 0xffffffffffffffff
push 0
push esi
call fcn.4ec7b10c
test eax, eax
jne 0x4ec7b0f9
mov eax, dword [ebp + 8]
xor edx, edx
mov dh, byte [eax]
movzx ecx, byte [eax + 2]
push eax
mov dl, byte [eax + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 3]
shl edx, 8
or edx, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], edx
xor edx, edx
mov dh, byte [eax + 4]
mov dl, byte [eax + 5]
mov word [ecx + 4], dx
xor edx, edx
mov dh, byte [eax + 6]
mov dl, byte [eax + 7]
mov word [ecx + 6], dx
xor edx, edx
mov dh, byte [eax + 8]
mov dl, byte [eax + 9]
mov word [ecx + 8], dx
xor edx, edx
mov dh, byte [eax + 0xa]
mov dl, byte [eax + 0xb]
mov word [ecx + 0xa], dx
xor edx, edx
mov dh, byte [eax + 0xc]
mov dl, byte [eax + 0xd]
mov word [ecx + 0xc], dx
xor edx, edx
mov dh, byte [eax + 0xe]
mov dl, byte [eax + 0xf]
mov word [ecx + 0xe], dx
xor edx, edx
mov dh, byte [eax + 0x10]
mov dl, byte [eax + 0x11]
mov word [ecx + 0x10], dx
xor edx, edx
mov dh, byte [eax + 0x12]
mov dl, byte [eax + 0x13]
mov word [ecx + 0x12], dx
xor edx, edx
mov dh, byte [eax + 0x14]
mov dl, byte [eax + 0x15]
mov word [ecx + 0x14], dx
xor edx, edx
mov dh, byte [eax + 0x16]
mov dl, byte [eax + 0x17]
mov word [ecx + 0x16], dx
xor edx, edx
mov dh, byte [eax + 0x18]
mov dl, byte [eax + 0x19]
mov word [ecx + 0x18], dx
xor edx, edx
mov dh, byte [eax + 0x1a]
mov dl, byte [eax + 0x1b]
mov word [ecx + 0x1a], dx
xor edx, edx
mov dh, byte [eax + 0x1c]
mov dl, byte [eax + 0x1d]
mov word [ecx + 0x1c], dx
xor edx, edx
mov dh, byte [eax + 0x1e]
mov dl, byte [eax + 0x1f]
mov word [ecx + 0x1e], dx
call dword [esi + 8]
pop ecx
lea eax, [esi + 0xc8]
push eax
lea eax, [esi + 0xc6]
push eax
push esi
call fcn.4ec78631
pop ebx
pop edi
pop esi
leave
ret 0x10
mov eax, 0x140e
jmp 0x4ec7b0f9
mov eax, 0x1405
jmp 0x4ec7b0f9
mov eax, 0x140f
jmp 0x4ec7b0f9
xor eax, eax
mov ah, byte [edi + 4]
mov al, byte [edi + 5]
mov word [esi + 0xdc], ax
xor eax, eax
mov ah, byte [edi + 6]
mov al, byte [edi + 7]
mov word [esi + 0xde], ax
jmp 0x4ec7afe4