Function at 0x41cd6f
Capabilities:
Enumerate pe sections
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x68], ecx
mov esi, edx
mov dword [ebp - 0x80], eax
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x78], edi
cmp byte [0x52e6b4], bl
jne 0x41cde4
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.Wow64DisableWow64FsRedirection
push str.Kernel32.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.Wow64RevertWow64FsRedirection
push str.Kernel32.dll
mov dword [0x52af6c], eax
call edi
push eax
call esi
mov esi, dword [ebp - 0x74]
mov edi, dword [ebp - 0x78]
mov dword [0x52e6b0], eax
mov byte [0x52e6b4], 1
mov eax, dword [0x52af6c]
test eax, eax
je 0x41cdf3
lea ecx, [ebp - 0x7c]
push ecx
call eax
push ebx
push ebx
push 3
push ebx
push 3
push SysReAllocString
push dword [ebp - 0x68]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [0x52e6b0]
mov dword [ebp - 0x70], eax
test ecx, ecx
je 0x41ce1d
push dword [ebp - 0x7c]
call ecx
mov eax, dword [ebp - 0x70]
cmp eax, 0xffffffff
je 0x41cfd0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
or dword [edi], 1
mov dword [edi + 4], eax
lea eax, [ebp - 0x6c]
push ebx
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x74], eax
call eax
test eax, eax
je 0x41cfc7
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x84], eax
cmp eax, 0x138
jb 0x41cfc7
mov ecx, dword [esi + 0x3c]
lea edx, [esi + eax]
lea eax, [esi + 0xf8]
add eax, ecx
cmp eax, edx
ja 0x41cfc7
movzx eax, word [ecx + esi + 4]
mov dword [ebp - 0x68], 0x14c
cmp word [ebp - 0x68], ax
jne 0x41cebf
movzx eax, word [ecx + esi + 0x14]
add eax, 0x18
add eax, ecx
add eax, esi
mov dword [ebp - 0x68], eax
movzx eax, word [ecx + esi + 6]
imul eax, eax, 0x28
add eax, dword [ebp - 0x68]
cmp eax, edx
ja 0x41cfc7
xor eax, eax
cmp eax, dword [ecx + esi + 0x98]
jmp 0x41cefb
mov dword [ebp - 0x68], 0x8664
cmp word [ebp - 0x68], ax
jne 0x41cfc7
movzx eax, word [ecx + esi + 0x14]
add eax, 0x18
add eax, ecx
add eax, esi
mov dword [ebp - 0x68], eax
movzx eax, word [ecx + esi + 6]
imul eax, eax, 0x28
add eax, dword [ebp - 0x68]
cmp eax, edx
ja 0x41cfc7
xor eax, eax
cmp eax, dword [ecx + esi + 0xa8]
mov edx, dword [ebp - 0x80]
sbb eax, eax
neg eax
mov dword [edx], eax
or eax, 0xffffffff
movzx edx, word [ecx + esi + 6]
test edx, edx
je 0x41cfc7
mov ecx, dword [ebp - 0x68]
add ecx, 0x14
cmp dword [ecx - 4], ebx
je 0x41cf28
cmp dword [ecx], ebx
je 0x41cf28
cmp dword [ecx], eax
cmovb eax, dword [ecx]
add ecx, 0x28
sub edx, 1
jne 0x41cf1a
cmp eax, 0xffffffff
je 0x41cfc7
cmp eax, dword [ebp - 0x84]
push ebx
cmova eax, dword [ebp - 0x84]
push eax
push esi
call fcn.0049bcf0
or dword [edi], 2
mov dword [edi + 8], eax
lea eax, [ebp - 0x64]
push eax
call fcn.00499f50
push dword [ebp - 0x6c]
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0049a660
add esp, 0x10
mov dword [ebp - 0x6c], ebx
lea eax, [ebp - 0x6c]
push ebx
push eax
push dword [ebp + 8]
push esi
push dword [ebp - 0x70]
call dword [ebp - 0x74]
test eax, eax
je 0x41cfb2
mov edi, dword [ebp - 0x70]
cmp dword [ebp - 0x6c], ebx
je 0x41cfaf
push dword [ebp - 0x6c]
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0049a660
add esp, 0xc
mov dword [ebp - 0x6c], ebx
lea eax, [ebp - 0x6c]
push ebx
push eax
push dword [ebp + 8]
push esi
push edi
call dword [ebp - 0x74]
test eax, eax
jne 0x41cf86
mov edi, dword [ebp - 0x78]
lea eax, [ebp - 0x64]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.00499ec0
or dword [edi], 8
xor ebx, ebx
pop ecx
pop ecx
inc ebx
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret