Function at 0x385eb220
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0
push edi
mov dword [ebp - 0x20], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
mov bx, word [eax + 4]
mov dword [ebp - 0x34], ecx
mov al, byte [ebp - 0x34]
shr ecx, 8
mov word [ebp - 4], bx
mov byte [ebp - 1], al
cmp cl, 0x1f
jae 0x385eb2c5
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 8]
test eax, eax
je 0x385eb2c5
mov ecx, dword [esi]
lea edi, [ecx + eax]
test edi, edi
je 0x385eb2c5
cmp word [edi], 1
je 0x385eb2fe
mov eax, dword [edi + 4]
test eax, eax
je 0x385eb280
lea ebx, [ecx + eax]
jmp 0x385eb282
xor ebx, ebx
mov cl, byte [ebp - 1]
mov dword [ebp - 0xc], ebx
cmp byte [ebx], cl
je 0x385eb2b0
lea esp, [esp]
mov edx, ebx
add ebx, 6
cmp byte [ebx], cl
jne 0x385eb290
mov al, byte [ebx + 1]
mov dword [ebp - 0xc], ebx
cmp al, byte [ebx - 5]
jb 0x385eb2b0
mov ecx, ebx
call fcn.385ea190
mov ebx, edx
mov dword [ebp - 0xc], ebx
mov al, byte [ebx + 1]
cmp al, 0x6c
jae 0x385eb2c1
add al, 2
mov byte [ebx + 1], al
add word [edi + 2], 2
mov bx, word [ebp - 4]
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x385eb31f
push eax
lea edx, [eax + 2]
mov ecx, esi
call fcn.385eb010
test eax, eax
je 0x385eb60c
movzx eax, word [ebp - 0x32]
movzx ecx, bx
shl ecx, 0x10
or ecx, eax
je 0x385eb310
mov eax, dword [esi]
add eax, ecx
pop edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi + 3], 0x20
lea edx, [edi + 2]
mov dword [ebp - 0xc], edx
setb al
add byte [edx + 1], al
jmp 0x385eb2c5
xor eax, eax
pop edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 0xffffffff
mov dword [esi + 0x2c], eax
mov ax, word [ebp - 0x32]
mov word [ebp - 6], ax
jne 0x385eb35a
movzx ecx, bx
shl ecx, 0x10
movzx eax, ax
or ecx, eax
je 0x385eb34c
mov ebx, dword [esi]
add ebx, ecx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x10], ebx
jmp 0x385eb383
xor ebx, ebx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x10], ebx
jmp 0x385eb383
mov ebx, dword [esi + 0xc]
cmp ebx, dword [esi + 8]
je 0x385eb36d
add ebx, 0xfffffff4
mov dword [ebp - 0x10], ebx
mov dword [esi + 0xc], ebx
jmp 0x385eb37e
mov edx, 1
mov ecx, esi
call fcn.385e9f10
mov ebx, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov word [ebx], ax
mov eax, dword [esi + 0x1c]
cmp word [eax], 0
jne 0x385eb3ac
mov cl, byte [ebp - 1]
mov byte [eax + 2], cl
mov ecx, dword [esi + 0x1c]
test ebx, ebx
je 0x385eb39f
mov eax, ebx
sub eax, dword [esi]
jmp 0x385eb3a1
xor eax, eax
mov word [ecx + 4], ax
shr eax, 0x10
mov word [ecx + 6], ax
mov eax, dword [esi + 0x14]
movzx edi, byte [ebp - 0x33]
mov dword [ebp - 0x28], edi
movzx ecx, word [eax + 2]
movzx edx, word [eax]
sub ecx, edi
mov edi, dword [esi + 0x18]
sub ecx, edx
inc ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x2c], ecx
cmp edi, eax
je 0x385eb5e0
movzx eax, word [edi]
mov ebx, 3
mov ecx, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], ecx
cmp ecx, 1
je 0x385eb4ac
test cl, 1
jne 0x385eb478
mov eax, dword [edi + 4]
test eax, eax
je 0x385eb402
mov ebx, dword [esi]
add ebx, eax
jmp 0x385eb404
xor ebx, ebx
mov edx, ecx
shr edx, 1
movzx eax, byte [edx + 0x7b87807]
mov dword [ebp - 0x14], eax
movzx eax, byte [edx + 0x7b87808]
cmp dword [ebp - 0x14], eax
je 0x385eb465
inc edx
mov ecx, esi
call fcn.385e9f10
mov dword [ebp - 0x24], eax
test eax, eax
je 0x385eb460
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ecx + 0x7b877e0]
lea ecx, [ecx + ecx*2]
shl ecx, 2
push ecx
push ebx
push eax
call 0x37ac2ff0
mov ecx, dword [ebp - 0x14]
add esp, 0xc
mov eax, dword [esi + ecx*4 + 0x5d8]
mov dword [ebx], eax
sub ebx, dword [esi]
mov eax, dword [ebp - 0x24]
mov dword [esi + ecx*4 + 0x5d8], ebx
mov ecx, dword [ebp - 0x1c]
mov ebx, eax
test ebx, ebx
je 0x385eb5c7
sub ebx, dword [esi]
mov dword [edi + 4], ebx
je 0x385eb60c
movzx edx, word [edi + 2]
mov ebx, dword [ebp - 0x1c]
shl ecx, 3
cmp ecx, edx
sbb ecx, ecx
lea eax, [ebx*4]
inc ecx
cmp dword [ebp - 0x18], eax
sbb eax, eax
inc eax
and cx, ax
lea eax, [ebx + ebx]
add cx, cx
cmp eax, dword [ebp - 0x18]
sbb eax, eax
neg eax
add cx, ax
add cx, dx
jmp 0x385eb4f7
mov edx, 1
mov ecx, esi
call fcn.385e9f10
mov edx, eax
test edx, edx
je 0x385eb60c
mov ecx, dword [edi + 2]
mov dword [edx], ecx
mov cx, word [edi + 6]
mov word [edx + 4], cx
mov ecx, edx
sub ecx, dword [esi]
mov dword [edi + 4], ecx
mov al, byte [edx + 1]
cmp al, 0x1e
jae 0x385eb4e1
add al, al
jmp 0x385eb4e3
mov al, pe_nt_image_headers32
cmp ebx, dword [ebp - 0x18]
mov byte [edx + 1], al
sbb ecx, ecx
movzx eax, al
neg ecx
add cx, word [esi + 0x28]
add cx, ax
mov ebx, dword [ebp - 0x2c]
movzx eax, cx
mov dword [ebp - 0x14], eax
movzx eax, ax
mov word [edi + 2], cx
add ebx, eax
lea ecx, [eax + 6]
imul ecx, dword [ebp - 0x28]
lea eax, [ebx + ebx*2]
add eax, eax
add ecx, ecx
cmp ecx, eax
jae 0x385eb538
lea eax, [ebx*4]
cmp ecx, eax
sbb edx, edx
inc edx
cmp ebx, ecx
sbb eax, eax
neg eax
inc eax
add edx, eax
mov eax, dword [ebp - 0x14]
add eax, 3
jmp 0x385eb562
mov eax, ebx
shl eax, 4
sub eax, ebx
cmp ecx, eax
lea eax, [ebx + ebx*8]
sbb edx, edx
inc edx
cmp ecx, eax
sbb eax, eax
add eax, 5
add edx, eax
lea eax, [ebx + ebx*2]
shl eax, 2
cmp ecx, eax
sbb eax, eax
inc eax
add edx, eax
mov eax, dword [ebp - 0x14]
add eax, edx
movzx eax, ax
mov word [edi + 2], ax
mov eax, dword [edi + 4]
test eax, eax
je 0x385eb576
mov ecx, dword [esi]
add ecx, eax
jmp 0x385eb578
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x10]
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*2]
test ebx, ebx
je 0x385eb58e
mov eax, ebx
sub eax, dword [esi]
jmp 0x385eb590
xor eax, eax
mov word [ecx + 2], ax
shr eax, 0x10
mov word [ecx + 4], ax
mov al, byte [ebp - 1]
mov byte [ecx], al
mov eax, dword [ebp - 0x34]
inc eax
mov byte [ecx + 1], dl
mov word [edi], ax
mov eax, dword [edi + 8]
test eax, eax
je 0x385eb5bd
mov edi, dword [esi]
add edi, eax
cmp edi, dword [esi + 0x14]
jmp 0x385eb3cd
xor edi, edi
cmp edi, dword [esi + 0x14]
jmp 0x385eb3cd
mov ecx, esi
mov dword [edi + 4], 0
call fcn.385eacc0
pop edi
mov byte [esi + 0x48], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, word [ebp - 4]
movzx eax, word [ebp - 6]
shl ecx, 0x10
or ecx, eax
je 0x385eb656
mov eax, dword [esi]
add eax, ecx
je 0x385eb656
cmp word [eax], 0
jne 0x385eb61e
push dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
mov ecx, esi
call fcn.385eb010
test eax, eax
jne 0x385eb61e
mov ecx, esi
call fcn.385eacc0
pop edi
mov byte [esi + 0x48], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x20]
movzx ecx, word [eax + 4]
movzx eax, word [eax + 2]
shl ecx, 0x10
or ecx, eax
je 0x385eb644
mov eax, dword [esi]
add eax, ecx
mov dword [esi + 0x1c], ebx
pop edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esi + 0x1c], ebx
pop edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x20]
test ebx, ebx
je 0x385eb663
mov eax, ebx
sub eax, dword [esi]
jmp 0x385eb665
xor eax, eax
mov word [ecx + 2], ax
shr eax, 0x10
mov word [ecx + 4], ax
mov eax, dword [esi + 0x14]
inc dword [esi + 0x2c]
pop edi
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret