Function at 0x4cea3e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, edx
mov edi, ecx
mov eax, dword [0x1b2d2024]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, dword [edx]
add ecx, 4
push 0x58
call 0xff00cc7e
mov dword [esi + 4], eax
mov ecx, dword [esi]
add eax, dword [ecx + 0xc]
mov ecx, eax
call 0x3f207e
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0xc]
mov dl, byte [eax + ecx + 8]
and dl, 0xfe
or dl, byte [edi]
mov byte [eax + ecx + 8], dl
mov al, byte [edi + 1]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 8]
add al, al
and ah, 0xfd
or ah, al
mov byte [ecx + edx + 8], ah
mov al, byte [edi + 2]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 8]
shl al, 2
and ah, 0xfb
or ah, al
mov byte [ecx + edx + 8], ah
mov al, byte [edi + 3]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 8]
shl al, 3
and ah, 0xf7
or ah, al
mov byte [ecx + edx + 8], ah
mov al, byte [edi + 4]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 8]
shl al, 4
and ah, 0xef
or ah, al
mov byte [ecx + edx + 8], ah
mov al, byte [edi + 5]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 8]
shl al, 5
and ah, 0xdf
or ah, al
mov byte [ecx + edx + 8], ah
mov al, byte [edi + 6]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 8]
shl al, 6
and ah, 0xbf
or ah, al
mov byte [ecx + edx + 8], ah
cmp byte [edi + 7], 0
setne al
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 8]
shl al, 7
and ah, 0x7f
or ah, al
mov byte [ecx + edx + 8], ah
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0xc]
mov dl, byte [eax + ecx + 9]
and dl, 0xfe
or dl, byte [edi + 8]
mov byte [eax + ecx + 9], dl
mov al, byte [edi + 9]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 9]
add al, al
and ah, 0xfd
or ah, al
mov byte [ecx + edx + 9], ah
mov al, byte [edi + 0xa]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 9]
shl al, 2
and ah, 0xfb
or ah, al
mov byte [ecx + edx + 9], ah
mov al, byte [edi + 0xb]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 9]
shl al, 3
and ah, 0xf7
or ah, al
mov byte [ecx + edx + 9], ah
mov al, byte [edi + 0xc]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 9]
shl al, 4
and ah, 0xef
or ah, al
mov byte [ecx + edx + 9], ah
mov al, byte [edi + 0xd]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 9]
shl al, 5
and ah, 0xdf
or ah, al
mov byte [ecx + edx + 9], ah
mov al, byte [edi + 0xe]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 9]
shl al, 6
and ah, 0xbf
or ah, al
mov byte [ecx + edx + 9], ah
cmp byte [edi + 0xf], 0
setne al
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 9]
shl al, 7
and ah, 0x7f
or ah, al
mov byte [ecx + edx + 9], ah
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0xc]
mov dl, byte [eax + ecx + 0xa]
and dl, 0xfe
or dl, byte [edi + 0x10]
mov byte [eax + ecx + 0xa], dl
mov al, byte [edi + 0x11]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xa]
add al, al
and ah, 0xfd
or ah, al
mov byte [ecx + edx + 0xa], ah
mov al, byte [edi + 0x12]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xa]
shl al, 2
and ah, 0xfb
or ah, al
mov byte [ecx + edx + 0xa], ah
mov al, byte [edi + 0x13]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xa]
shl al, 3
and ah, 0xf7
or ah, al
mov byte [ecx + edx + 0xa], ah
mov al, byte [edi + 0x14]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xa]
shl al, 4
and ah, 0xef
or ah, al
mov byte [ecx + edx + 0xa], ah
mov eax, dword [edi + 0x18]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov dword [ecx + edx + 0xc], eax
mov eax, dword [edi + 0x1c]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov dword [ecx + edx + 0x10], eax
mov eax, dword [edi + 0x20]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov dword [ecx + edx + 0x14], eax
mov eax, dword [edi + 0x24]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov dword [ecx + edx + 0x18], eax
mov al, byte [edi + 0x28]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xa]
shl al, 5
and ah, 0xdf
or ah, al
mov byte [ecx + edx + 0xa], ah
mov al, byte [edi + 0x29]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xa]
shl al, 6
and ah, 0xbf
or ah, al
mov byte [ecx + edx + 0xa], ah
cmp byte [edi + 0x2a], 0
setne al
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xa]
shl al, 7
and ah, 0x7f
or ah, al
mov byte [ecx + edx + 0xa], ah
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0xc]
mov dl, byte [eax + ecx + 0xb]
and dl, 0xfe
or dl, byte [edi + 0x2b]
mov byte [eax + ecx + 0xb], dl
mov al, byte [edi + 0x2c]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xb]
add al, al
and ah, 0xfd
or ah, al
mov byte [ecx + edx + 0xb], ah
mov al, byte [edi + 0x2d]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xb]
shl al, 2
and ah, 0xfb
or ah, al
mov byte [ecx + edx + 0xb], ah
mov al, byte [edi + 0x2e]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xb]
shl al, 3
and ah, 0xf7
or ah, al
mov byte [ecx + edx + 0xb], ah
mov al, byte [edi + 0x2f]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xb]
shl al, 4
and ah, 0xef
or ah, al
mov byte [ecx + edx + 0xb], ah
lea ecx, [edi + 0x30]
mov eax, dword [esi]
lea ebx, [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebx + 4], 0xffffffff
mov edx, ebx
call fcn.004cf0ee
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0xc]
add eax, ecx
add eax, 0x20
mov edx, dword [ebx + 4]
xor ecx, ecx
cmp edx, 0xffffffff
je 0x4cede5
mov ecx, dword [ebp - 0x18]
add edx, dword [ecx + 0xc]
mov ecx, edx
mov edx, ecx
sub edx, eax
mov ebx, edx
sar ebx, 0x1f
test ecx, ecx
cmove ebx, ecx
cmove edx, ecx
mov dword [eax], edx
mov dword [eax + 4], ebx
mov al, byte [edi + 0x3c]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xb]
shl al, 5
and ah, 0xdf
or ah, al
mov byte [ecx + edx + 0xb], ah
mov al, byte [edi + 0x3d]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xb]
shl al, 6
and ah, 0xbf
or ah, al
mov byte [ecx + edx + 0xb], ah
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov ebx, dword [eax + 0xc]
mov eax, dword [edi + 0x40]
cmp eax, 4
jb 0x4cee4e
mov dword [ebp - 0x2c], ecx
call 0xffc9ddfe
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebx + ecx + 0x1c], eax
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov ebx, dword [eax + 0xc]
mov eax, dword [edi + 0x44]
cmp eax, 4
jb 0x4cee6f
mov dword [ebp - 0x2c], ecx
call 0xffc9ddfe
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebx + ecx + 0x28], eax
cmp byte [edi + 0x48], 0
setne al
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0xb]
shl al, 7
and ah, 0x7f
or ah, al
mov byte [ecx + edx + 0xb], ah
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0xc]
mov dl, byte [eax + ecx + 0x2c]
and dl, 0xfe
or dl, byte [edi + 0x49]
mov byte [eax + ecx + 0x2c], dl
mov al, byte [edi + 0x4a]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0x2c]
add al, al
and ah, 0xfd
or ah, al
mov byte [ecx + edx + 0x2c], ah
mov eax, dword [edi + 0x4c]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov dword [ecx + edx + 0x30], eax
mov eax, dword [edi + 0x50]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov dword [ecx + edx + 0x34], eax
mov al, byte [edi + 0x54]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0x2c]
shl al, 2
and ah, 0xfb
or ah, al
mov byte [ecx + edx + 0x2c], ah
mov al, byte [edi + 0x55]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0x2c]
shl al, 3
and ah, 0xf7
or ah, al
mov byte [ecx + edx + 0x2c], ah
mov al, byte [edi + 0x56]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0x2c]
shl al, 4
and ah, 0xef
or ah, al
mov byte [ecx + edx + 0x2c], ah
mov al, byte [edi + 0x57]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0x2c]
shl al, 5
and ah, 0xdf
or ah, al
mov byte [ecx + edx + 0x2c], ah
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov ebx, dword [eax + 0xc]
mov eax, dword [edi + 0x5c]
cmp eax, 4
jb 0x4cef69
mov dword [ebp - 0x2c], ecx
call 0xffc9ddfe
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebx + ecx + 0x38], eax
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov ebx, dword [eax + 0xc]
mov eax, dword [edi + 0x60]
cmp eax, 5
jb 0x4cef8a
mov dword [ebp - 0x2c], ecx
call 0xffc9ddfe
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebx + ecx + 0x3c], eax
mov al, byte [edi + 0x64]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0x2c]
shl al, 6
and ah, 0xbf
or ah, al
mov byte [ecx + edx + 0x2c], ah
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov ebx, dword [eax + 0xc]
mov eax, dword [edi + 0x58]
cmp eax, 3
jb 0x4cefc6
mov dword [ebp - 0x2c], ecx
call 0xffc9ddfe
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov dword [ebx + ecx + 0x40], eax
lea eax, [edi + 0x68]
mov ecx, dword [esi]
lea ebx, [ebp - 0x20]
mov dword [ebx], ecx
mov dword [ebx + 4], 0xffffffff
push 0x1a29ebe0
push ebx
push eax
call 0xffd540ce
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0xc]
add eax, ecx
add eax, 0x48
mov edx, dword [ebx + 4]
mov ecx, 0
cmp edx, 0xffffffff
je 0x4cf00c
mov ecx, dword [ebp - 0x20]
add edx, dword [ecx + 0xc]
mov ecx, edx
mov edx, ecx
sub edx, eax
mov ebx, edx
sar ebx, 0x1f
test ecx, ecx
cmove ebx, ecx
cmove edx, ecx
mov dword [eax], edx
mov dword [eax + 4], ebx
mov eax, dword [esi]
lea ebx, [ebp - 0x28]
mov dword [ebx], eax
lea eax, [edi + 0x74]
mov dword [ebx + 4], 0xffffffff
push 0x1a29ebe0
push ebx
push eax
call 0xffd540ce
add esp, 0xc
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov edx, dword [ebx + 4]
cmp edx, 0xffffffff
mov ebx, 0
je 0x4cf05f
mov ebx, dword [ebp - 0x28]
add edx, dword [ebx + 0xc]
mov ebx, edx
add eax, ecx
add eax, 0x50
mov ecx, ebx
sub ecx, eax
mov edx, ecx
sar edx, 0x1f
test ebx, ebx
cmove edx, ebx
cmove ecx, ebx
mov dword [eax], ecx
mov dword [eax + 4], edx
cmp byte [edi + 0x81], 0
setne al
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0x2c]
shl al, 7
and ah, 0x7f
or ah, al
mov byte [ecx + edx + 0x2c], ah
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov eax, dword [eax + 0xc]
mov dl, byte [eax + ecx + 0x2d]
and dl, 0xfe
or dl, byte [edi + 0x82]
mov byte [eax + ecx + 0x2d], dl
mov al, byte [edi + 0x84]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov ecx, dword [ecx + 0xc]
mov ah, byte [ecx + edx + 0x2d]
add al, al
and ah, 0xfd
or ah, al
mov byte [ecx + edx + 0x2d], ah
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call 0xffc423eb
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret