Function at 0x1001e900
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov eax, ecx
mov esi, edx
mov dword [ebp - 0x18], eax
push edi
mov edi, 0x57
test eax, eax
je 0x1001ecf0
cmp dword [eax + 0xc], 0
je 0x1001ecf0
cmp dword [eax + 8], 0
je 0x1001ecf0
cmp dword [eax + 0x10], 0
je 0x1001ecf0
mov ebx, dword [eax]
test ebx, ebx
je 0x1001ecf0
cmp dword [eax + 4], 0
je 0x1001ecf0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1001ecf0
mov dword [eax + 8], 0
lea edx, [edi + 0x67]
mov dword [eax], 0
xor ecx, ecx
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1c], 0x5a4d
test esi, esi
je 0x1001e9e0
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp ecx, 0x40
jbe 0x1001eceb
movzx eax, word [esi]
xor edi, edi
cmp ax, word [ebp - 0x1c]
cmovne edi, edx
mov edx, 0x5a4d
cmp ax, dx
jne 0x1001e9de
mov edi, dword [esi + 0x3c]
add ecx, 0xfffffee0
mov eax, edi
cdq
test edx, edx
ja 0x1001e9d9
jb 0x1001e9c1
cmp eax, ecx
jae 0x1001e9d9
lea eax, [esi + edi]
mov ecx, 0xbe
xor edi, edi
mov dword [ebp - 8], eax
cmp dword [eax], 0x4550
cmovne edi, ecx
jmp 0x1001e9e0
mov edi, 0xd
xor eax, eax
test edi, edi
jne 0x1001eceb
add eax, 0x50
push 0x40
push 0x3000
mov dword [ebp - 0x10], eax
push dword [eax]
push edi
call ebx
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
mov dword [eax], ebx
test ebx, ebx
je 0x1001ecf0
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x54]
test esi, esi
je 0x1001ea2e
test edx, edx
je 0x1001ea2e
lea ecx, [ebx + edx]
sub esi, ebx
nop
mov al, byte [esi + ecx - 1]
lea ecx, [ecx - 1]
mov byte [ecx], al
sub edx, 1
jne 0x1001ea20
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x14]
lea edi, [edx + 0x18]
add edi, eax
je 0x1001eaa0
movzx eax, word [edx + 6]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1001eaa0
add edi, 0x14
nop word [eax + eax]
mov eax, dword [edi - 8]
mov esi, dword [edi]
add eax, ebx
add esi, dword [ebp - 4]
mov ecx, dword [edi - 4]
test ecx, ecx
jne 0x1001ea75
mov ecx, dword [edi + 0x10]
test cl, 0x40
je 0x1001ea6e
mov ecx, dword [edx + 0x20]
jmp 0x1001ea75
test cl, cl
jns 0x1001ea97
mov ecx, dword [edx + 0x24]
test eax, eax
je 0x1001ea97
test esi, esi
je 0x1001ea97
test ecx, ecx
je 0x1001ea97
lea edx, [ecx + eax]
sub esi, eax
mov al, byte [esi + edx - 1]
lea edx, [edx - 1]
mov byte [edx], al
sub ecx, 1
jne 0x1001ea86
mov edx, dword [ebp - 8]
add edi, 0x28
sub dword [ebp - 0x1c], 1
jne 0x1001ea50
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx]
cmp ecx, 0x40
jbe 0x1001ecb6
movzx eax, word [ebx]
xor edx, edx
mov esi, 0x5a4d
mov edi, 0xbe
cmp ax, si
cmovne edx, edi
mov dword [ebp - 4], edx
jne 0x1001eaf9
mov esi, dword [ebx + 0x3c]
add ecx, 0xfffffee0
mov eax, esi
cdq
test edx, edx
ja 0x1001eaf1
jb 0x1001eade
cmp eax, ecx
jae 0x1001eaf1
lea ecx, [esi + ebx]
xor edx, edx
cmp dword [ecx], 0x4550
mov dword [ebp - 0xc], ecx
cmovne edx, edi
jmp 0x1001eaf6
mov edx, 0xd
mov dword [ebp - 4], edx
test edx, edx
jne 0x1001ec8a
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x1001ecb3
lea eax, [esi + 0x80]
test eax, eax
je 0x1001ecb3
cmp dword [eax + 4], edx
je 0x1001ecb3
mov eax, dword [eax]
test eax, eax
je 0x1001ecb3
lea ecx, [eax + ebx]
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x1001ecb3
cmp dword [ecx + 0xc], edx
je 0x1001ebc8
test edx, edx
jne 0x1001ec8a
mov eax, dword [ecx + 0xc]
add eax, ebx
push eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x1c], edx
test edx, edx
je 0x1001ec58
mov eax, dword [ecx]
test eax, eax
je 0x1001eb75
lea esi, [ebx + eax]
jmp 0x1001eb7a
mov esi, dword [ecx + 0x10]
add esi, ebx
mov edi, dword [ecx + 0x10]
add edi, ebx
je 0x1001ebb1
test esi, esi
je 0x1001ebae
mov eax, dword [esi]
test eax, eax
je 0x1001ebae
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 8]
jns 0x1001eb98
movzx eax, word [edi]
jmp 0x1001eb9d
add eax, 2
add eax, ebx
push eax
push edx
call ecx
mov edx, dword [ebp - 0x1c]
add esi, 4
mov dword [edi], eax
add edi, 4
jne 0x1001eb81
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
add ecx, 0x14
mov dword [ebp - 8], ecx
cmp dword [ecx + 0xc], 0
jne 0x1001eb44
test edx, edx
jne 0x1001ec8a
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0xa4], 0
jbe 0x1001ec8a
lea eax, [ecx + 0xa0]
test eax, eax
je 0x1001ecb3
cmp dword [eax + 4], 0
je 0x1001ecb3
mov eax, dword [eax]
test eax, eax
je 0x1001ecb3
lea esi, [ebx + eax]
test esi, esi
je 0x1001ecb3
cmp dword [esi], 0
je 0x1001ec8a
nop
mov edi, dword [esi + 4]
lea eax, [esi + 4]
mov dword [ebp - 0x1c], eax
test edi, edi
je 0x1001ec8a
add edi, 0xfffffff8
shr edi, 1
je 0x1001ec83
sub ebx, dword [ecx + 0x34]
xor edx, edx
test edi, edi
je 0x1001ec80
nop dword [eax]
movzx ecx, word [esi + edx*2 + 8]
mov eax, ecx
shr ecx, 0xc
and eax, 0xfff
dec ecx
add eax, dword [esi]
add eax, dword [ebp - 0x14]
cmp ecx, 9
ja case.0x1001ec51.4
movzx ecx, byte [ecx + 0x1001ed0c]
jmp dword [ecx*4 + 0x1001ecfc]
mov edx, 0x7e
mov dword [ebp - 4], edx
jmp 0x1001ebb4
add dword [eax], ebx
jmp case.0x1001ec51.4
mov ecx, ebx
shr ecx, 0x10
jmp 0x1001ec73
movzx ecx, bx
add dword [eax], ecx
inc edx
cmp edx, edi
jb 0x1001ec30
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x14]
add esi, dword [eax]
cmp dword [esi], 0
jne 0x1001ec10
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
test edi, edi
jne 0x1001ecbb
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x28]
add eax, ebx
mov dword [ecx + 8], esi
mov dword [ecx + 4], eax
mov eax, dword [edx]
mov dword [ecx + 0xc], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10]
mov edi, 0xd
mov eax, dword [ebp - 0x18]
push 0x8000
push dword [edx]
mov eax, dword [eax + 4]
push ebx
call eax
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 0xe
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret