Function at 0x603ee9d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [edx + 0x90]
mov ecx, dword [eax + 0x134]
test ecx, ecx
je 0x603ee9fd
and word [edi + 0x96], 0xfffe
mov eax, dword [edx + 0x90]
mov eax, dword [eax + 0x130]
test eax, eax
je 0x603eea10
or word [edi + 0x96], 0x2000
mov word [edi], 0x5a4d
mov word [edi + 2], 0x90
mov word [edi + 4], 3
mov word [edi + 6], 0
mov word [edi + 8], 4
mov word [edi + 0xa], 0
mov word [edi + 0xc], 0xffff
mov word [edi + 0xe], 0
mov word [edi + 0x10], 0xb8
mov word [edi + 0x12], 0
mov word [edi + 0x14], 0
mov word [edi + 0x16], 0
mov word [edi + 0x18], 0x40
mov word [edi + 0x1a], 0
xor esi, esi
mov word [edi + esi*2 + 0x1c], 0
inc esi
cmp esi, 3
jle 0x603eea65
mov word [edi + 0x24], 0
mov word [edi + 0x26], 0
xor esi, esi
mov word [edi + esi*2 + 0x28], 0
inc esi
cmp esi, 9
jle 0x603eea80
mov eax, dword [ebp + 8]
mov dword [edi + 0x3c], pe_nt_image_headers32
mov dword [edi + 0x40], 0xeba1f0e
mov dword [edi + 0x44], 0xcd09b400
mov dword [edi + 0x48], 0x4c01b821
mov dword [edi + 0x4c], 0x685421cd
mov dword [edi + 0x50], 0x70207369
mov dword [edi + 0x54], 0x72676f72
mov dword [edi + 0x58], 0x63206d61
mov dword [edi + 0x5c], 0x6f6e6e61
mov dword [edi + 0x60], 0x65622074
mov dword [edi + 0x64], 0x6e757220
mov dword [edi + 0x68], 0x206e6920
mov dword [edi + 0x6c], 0x20534f44
mov dword [edi + 0x70], 0x65646f6d
mov dword [edi + 0x74], 0xa0d0d2e
mov dword [edi + 0x78], 0x24
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0x4550
push esi
push esi
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x84
push eax
mov ax, word [edi + 0x84]
and eax, 0xffff
push eax
call dword [edx + 0x60]
mov eax, dword [ebp + 8]
pop ecx
pop ebx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x86
push eax
mov ax, word [edi + 0x86]
and eax, 0xffff
push eax
call dword [edx + 0x60]
pop eax
mov eax, dword [ebp + 0x10]
pop edx
add eax, 0x88
mov edx, dword [ebp + 8]
mov ebx, dword [edx + 4]
push eax
push 0
call sub.msvcrt.dll_time
mov dword [esp], eax
call dword [ebx + 0x54]
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
pop ebx
mov eax, dword [ebp + 0x10]
pop esi
add eax, 0x8c
push eax
mov ecx, dword [edi + 0x8c]
push ecx
call dword [edx + 0x54]
pop eax
mov eax, dword [ebp + 8]
pop edx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x90
push eax
mov esi, dword [edi + 0x90]
push esi
call dword [edx + 0x54]
mov eax, dword [ebp + 8]
pop ecx
pop ebx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x94
push eax
mov ax, word [edi + 0x94]
and eax, 0xffff
push eax
call dword [edx + 0x60]
pop eax
mov eax, dword [ebp + 8]
pop edx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x96
push eax
mov ax, word [edi + 0x96]
and eax, 0xffff
push eax
call dword [edx + 0x60]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
pop ebx
pop esi
mov edx, dword [eax + 4]
push ecx
mov ax, word [edi]
and eax, 0xffff
push eax
call dword [edx + 0x60]
pop eax
mov eax, dword [ebp + 8]
pop edx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 2
push eax
mov ax, word [edi + 2]
and eax, 0xffff
push eax
call dword [edx + 0x60]
pop esi
pop eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 4
push eax
mov ax, word [edi + 4]
and eax, 0xffff
push eax
call dword [edx + 0x60]
mov eax, dword [ebp + 8]
pop ecx
pop ebx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 6
push eax
mov ax, word [edi + 6]
and eax, 0xffff
push eax
call dword [edx + 0x60]
pop eax
mov eax, dword [ebp + 8]
pop edx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 8
push eax
mov ax, word [edi + 8]
and eax, 0xffff
push eax
call dword [edx + 0x60]
pop esi
pop eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0xa
push eax
mov ax, word [edi + 0xa]
and eax, 0xffff
push eax
call dword [edx + 0x60]
mov eax, dword [ebp + 8]
pop ecx
pop ebx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0xc
push eax
mov ax, word [edi + 0xc]
and eax, 0xffff
push eax
call dword [edx + 0x60]
pop eax
mov eax, dword [ebp + 8]
pop edx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0xe
push eax
mov ax, word [edi + 0xe]
and eax, 0xffff
push eax
call dword [edx + 0x60]
pop esi
pop eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x10
push eax
mov ax, word [edi + 0x10]
and eax, 0xffff
push eax
call dword [edx + 0x60]
mov eax, dword [ebp + 8]
pop ecx
pop ebx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x12
push eax
mov ax, word [edi + 0x12]
and eax, 0xffff
push eax
call dword [edx + 0x60]
pop eax
mov eax, dword [ebp + 8]
pop edx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x14
push eax
mov ax, word [edi + 0x14]
and eax, 0xffff
push eax
call dword [edx + 0x60]
pop esi
xor esi, esi
pop eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x16
push eax
mov ax, word [edi + 0x16]
and eax, 0xffff
push eax
call dword [edx + 0x60]
mov eax, dword [ebp + 8]
pop ecx
pop ebx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x18
push eax
mov ax, word [edi + 0x18]
and eax, 0xffff
push eax
call dword [edx + 0x60]
pop eax
mov eax, dword [ebp + 8]
pop edx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x1a
push eax
mov ax, word [edi + 0x1a]
and eax, 0xffff
push eax
call dword [edx + 0x60]
mov ebx, dword [ebp + 0x10]
add esp, 0x10
add ebx, 0x1c
push eax
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
push ebx
mov ax, word [edi + esi*2 + 0x1c]
add ebx, 2
and eax, 0xffff
inc esi
push eax
call dword [edx + 0x60]
add esp, 0x10
cmp esi, 3
jle 0x603eed75
mov eax, dword [ebp + 8]
push ecx
xor esi, esi
push ecx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x24
push eax
mov ax, word [edi + 0x24]
and eax, 0xffff
push eax
call dword [edx + 0x60]
pop eax
mov eax, dword [ebp + 8]
pop edx
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
add eax, 0x26
push eax
mov ax, word [edi + 0x26]
and eax, 0xffff
push eax
call dword [edx + 0x60]
mov ebx, dword [ebp + 0x10]
add esp, 0x10
add ebx, 0x28
nop
lea esi, [esi]
push eax
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
push ebx
mov ax, word [edi + esi*2 + 0x28]
add ebx, 2
and eax, 0xffff
inc esi
push eax
call dword [edx + 0x60]
add esp, 0x10
cmp esi, 9
jle 0x603eede0
mov eax, dword [ebp + 8]
push esi
push esi
mov edx, dword [eax + 4]
xor esi, esi
mov eax, dword [ebp + 0x10]
add eax, 0x3c
push eax
mov ebx, dword [edi + 0x3c]
push ebx
call dword [edx + 0x54]
mov ebx, dword [ebp + 0x10]
add esp, 0x10
add ebx, 0x40
mov edx, dword [ebp + 8]
push ecx
push ecx
mov eax, dword [edx + 4]
push ebx
mov edx, dword [edi + esi*4 + 0x40]
add ebx, 4
push edx
inc esi
call dword [eax + 0x54]
add esp, 0x10
cmp esi, 0xf
jle 0x603eee24
push eax
push eax
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 0x10]
sub eax, 0xffffff80
push eax
mov eax, dword [edi + 0x80]
push eax
call dword [edx + 0x54]
lea esp, [ebp - 0xc]
mov eax, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret