Function at 0x40598f
Capabilities:
Enumerate pe sections
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push dword [0x41fe64]
push 0x1a
push 1
push esi
call fcn.0040a221
add esp, 0x10
cmp eax, 0x1a
je 0x4059b4
xor eax, eax
leave
ret
movzx eax, byte [esi + 1]
movzx ecx, byte [esi]
shl ax, 8
or ax, cx
mov word [edi], ax
movzx eax, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl ax, 8
or ax, cx
mov word [edi + 2], ax
movzx eax, byte [esi + 5]
movzx ecx, byte [esi + 4]
shl ax, 8
or ax, cx
mov word [edi + 4], ax
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
shl ax, 8
or ax, cx
mov word [edi + 6], ax
movzx eax, byte [esi + 9]
movzx ecx, byte [esi + 8]
shl ax, 8
or ax, cx
mov word [edi + 8], ax
movzx eax, byte [esi + 0xd]
movzx ecx, byte [esi + 0xc]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 0xb]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 0xa]
shl eax, 8
or eax, ecx
mov dword [edi + 0xc], eax
movzx eax, byte [esi + 0x11]
movzx ecx, byte [esi + 0x10]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 0xf]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 0xe]
shl eax, 8
or eax, ecx
cdq
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
movzx eax, byte [esi + 0x15]
movzx ecx, byte [esi + 0x14]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 0x13]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 0x12]
shl eax, 8
or eax, ecx
cdq
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], edx
movzx eax, byte [esi + 0x17]
movzx ecx, byte [esi + 0x16]
shl ax, 8
or ax, cx
mov word [edi + 0x20], ax
movzx eax, byte [esi + 0x19]
movzx ecx, byte [esi + 0x18]
and dword [edi + 0x2c], 0
shl ax, 8
or ax, cx
push 0x410
mov word [edi + 0x22], ax
lea eax, [edi + 0x30]
push 0
push eax
call fcn.00409cd0
movzx eax, word [edi + 0x20]
add esp, 0xc
mov ecx, 0x104
cmp ax, cx
ja 0x4059b0
push ebx
push dword [0x41fe64]
movzx ebx, word [edi + 0x20]
push eax
push 1
push esi
mov dword [ebp - 8], ebx
call fcn.0040a221
add esp, 0x10
cmp ebx, eax
jne 0x405bb3
inc ebx
push ebx
call fcn.0040b18c
and dword [ebp - 4], 0
cmp dword [ebp - 8], 0
pop ecx
mov ebx, eax
jle 0x405b1a
mov ecx, esi
sub ecx, ebx
mov dl, byte [ecx + eax]
inc dword [ebp - 4]
mov byte [eax], dl
movzx edx, word [edi + 0x20]
inc eax
cmp dword [ebp - 4], edx
jl 0x405b08
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0
push ebx
lea eax, [edi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call fcn.00409dd8
movzx eax, word [edi + 0x22]
pop ecx
test ax, ax
je 0x405bf3
push dword [0x41fe64]
mov ebx, eax
push ebx
push 1
push esi
call fcn.0040a221
movzx ecx, word [edi + 0x22]
add esp, 0x10
cmp ecx, eax
jne 0x405bb3
movzx eax, word [edi + 2]
test ax, ax
je 0x405bf3
test al, 0x40
je 0x405bb7
and eax, 0xff00
mov ecx, 0x3300
cmp ax, cx
jne 0x405bb7
push 0x80
lea eax, [ebp - 0x10c]
push eax
push 0xd
push dword [0x41e420]
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x10
push str.ZIP_SFX
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
or dword [0x41e43c], 0xffffffff
xor eax, eax
jmp 0x405c26
mov eax, esi
test ebx, ebx
jle 0x405bf3
push 0xfffffffffffffffa
pop ecx
sub ecx, esi
cmp byte [eax], 1
jne 0x405bd9
cmp byte [eax + 1], 0x99
jne 0x405bd9
cmp byte [eax + 6], 0x41
jne 0x405bd9
cmp byte [eax + 7], 0x45
je 0x405be4
inc eax
lea edx, [ecx + eax + 6]
cmp edx, ebx
jl 0x405bc2
jmp 0x405bf3
movzx ecx, byte [eax + 8]
mov dword [edi + 0x2c], ecx
movzx eax, byte [eax + 9]
mov word [edi + 4], ax
push dword [0x41fe64]
call fcn.0040aac4
mov ebx, eax
mov eax, esi
mov ecx, edi
mov dword [ebp - 8], edx
call fcn.004055df
push 0
push dword [ebp - 8]
mov dword [edi + 0x28], eax
push ebx
push dword [0x41fe64]
call fcn.0040b10d
xor eax, eax
add esp, 0x14
inc eax
pop ebx
leave
ret