Function at 0x974f6f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
push eax
push 1
xor edi, edi
push edi
push 0xffffffffffffffff
push edi
push esi
call fcn.0097df99
cmp eax, edi
jne 0x975194
lea eax, [ebp - 4]
push eax
push 1
push 1
push 0xffffffffffffffff
push edi
push esi
call fcn.0097df99
cmp eax, edi
jne 0x975194
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
mov ah, byte [ebx + 0xc]
movzx ecx, byte [ebx + 0xe]
mov al, byte [ebx + 0xd]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebx + 0xf]
shl eax, 8
or eax, ecx
cmp eax, 0x5f0f3cf5
jne 0x9c0f33
movzx cx, byte [ebx + 0x13]
xor eax, eax
mov ah, byte [ebx + 0x12]
or eax, ecx
cmp ax, 0x10
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
jb 0x97519a
cmp ax, 0x4000
ja 0x97519a
mov al, byte [ebx + 0x11]
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp - 4]
and al, 8
sub al, 8
neg al
sbb eax, eax
inc eax
mov dword [ecx], eax
movzx cx, byte [edi + 0x23]
xor eax, eax
mov ah, byte [edi + 0x22]
or eax, ecx
test ax, ax
mov word [esi + 0xc4], ax
je 0x9c0f3d
xor eax, eax
mov ah, byte [ebx + 0x32]
mov al, byte [ebx + 0x33]
mov word [esi + 0xc], ax
lea eax, [ebp + 8]
push eax
push 0
push 0xe
push 0xffffffffffffffff
push 0
push esi
call fcn.0097df99
test eax, eax
jne 0x975193
mov eax, dword [ebp + 8]
test eax, eax
je 0x9c0f47
xor ecx, ecx
mov ch, byte [eax + 0x44]
push eax
mov cl, byte [eax + 0x45]
mov word [esi + 0xdc], cx
xor ecx, ecx
mov ch, byte [eax + 0x46]
mov cl, byte [eax + 0x47]
mov word [esi + 0xde], cx
call dword [esi + 8]
pop ecx
xor eax, eax
mov ah, byte [edi + 6]
push edi
mov al, byte [edi + 7]
mov word [esi + 0xe0], ax
call dword [esi + 8]
push ebx
call dword [esi + 8]
pop ecx
pop ecx
lea eax, [ebp + 8]
push eax
push 1
push 3
push 0xffffffffffffffff
push 0
push esi
call fcn.0097df99
test eax, eax
jne 0x975193
mov eax, dword [ebp + 8]
xor edx, edx
mov dh, byte [eax]
movzx ecx, byte [eax + 2]
push eax
mov dl, byte [eax + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 3]
shl edx, 8
or edx, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], edx
xor edx, edx
mov dh, byte [eax + 4]
mov dl, byte [eax + 5]
mov word [ecx + 4], dx
xor edx, edx
mov dh, byte [eax + 6]
mov dl, byte [eax + 7]
mov word [ecx + 6], dx
xor edx, edx
mov dh, byte [eax + 8]
mov dl, byte [eax + 9]
mov word [ecx + 8], dx
xor edx, edx
mov dh, byte [eax + 0xa]
mov dl, byte [eax + 0xb]
mov word [ecx + 0xa], dx
xor edx, edx
mov dh, byte [eax + 0xc]
mov dl, byte [eax + 0xd]
mov word [ecx + 0xc], dx
xor edx, edx
mov dh, byte [eax + 0xe]
mov dl, byte [eax + 0xf]
mov word [ecx + 0xe], dx
xor edx, edx
mov dh, byte [eax + 0x10]
mov dl, byte [eax + 0x11]
mov word [ecx + 0x10], dx
xor edx, edx
mov dh, byte [eax + 0x12]
mov dl, byte [eax + 0x13]
mov word [ecx + 0x12], dx
xor edx, edx
mov dh, byte [eax + 0x14]
mov dl, byte [eax + 0x15]
mov word [ecx + 0x14], dx
xor edx, edx
mov dh, byte [eax + 0x16]
mov dl, byte [eax + 0x17]
mov word [ecx + 0x16], dx
xor edx, edx
mov dh, byte [eax + 0x18]
mov dl, byte [eax + 0x19]
mov word [ecx + 0x18], dx
xor edx, edx
mov dh, byte [eax + 0x1a]
mov dl, byte [eax + 0x1b]
mov word [ecx + 0x1a], dx
xor edx, edx
mov dh, byte [eax + 0x1c]
mov dl, byte [eax + 0x1d]
mov word [ecx + 0x1c], dx
xor edx, edx
mov dh, byte [eax + 0x1e]
mov dl, byte [eax + 0x1f]
mov word [ecx + 0x1e], dx
call dword [esi + 8]
pop ecx
lea eax, [esi + 0xc8]
push eax
lea eax, [esi + 0xc6]
push eax
push esi
call fcn.009751a1
pop ebx
pop edi
pop esi
leave
ret 0x10
mov eax, 0x140e
jmp 0x975193
mov eax, 0x1405
jmp 0x975193
mov eax, 0x140f
jmp 0x975193
xor eax, eax
mov ah, byte [edi + 4]
mov al, byte [edi + 5]
mov word [esi + 0xdc], ax
xor eax, eax
mov ah, byte [edi + 6]
mov al, byte [edi + 7]
mov word [esi + 0xde], ax
jmp 0x97507e