Function at 0x408e10
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8098
call fcn.00404340
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
test eax, eax
je 0x408e34
cmp dword [ebp + 0xc], 0
je 0x408e34
xor ecx, ecx
mov word [eax], cx
mov ebx, 0xc0000365
mov edi, 0xffffffd5
push esi
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], esi
call fcn.00404450
add esp, 4
add eax, eax
mov word [ebp - 0x38], ax
mov edx, dword [ebp - 0x38]
xor eax, eax
push eax
push eax
push 0x60
push 1
push 1
push 0x80
add edx, 2
push eax
mov word [ebp - 0x36], dx
lea edx, [ebp - 0x40]
push edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
lea ecx, [ebp - 0x38]
push eax
mov dword [ebp - 0x50], ecx
push 0x80100000
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0x58], 0x18
mov dword [ebp - 0x4c], 0x40
call fcn.00402814
test eax, eax
js 0x409537
cmp dword [ebp - 0x40], 0
jl 0x409537
push esi
push str._ls:_n
call fcn.004014e0
mov ecx, dword [ebp - 0xc]
mov esi, dword [0x4a30c8]
add esp, 8
push 4
push 0x28
lea edx, [ebp - 0x8098]
push edx
lea eax, [ebp - 0x18]
push eax
push ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], edi
call esi
mov ecx, dword [ebp - 0x18]
xor edi, edi
cmp eax, edi
jl 0x408fe8
cmp ecx, edi
jl 0x408fe8
mov edx, dword [ebp - 0x8094]
mov eax, dword [ebp - 0x8098]
push edi
push 0x64
push edx
push eax
call fcn.004164d0
add eax, 0xb3960000
adc edx, 0x5e6684f4
push 0x40
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x28], edx
push ecx
lea edx, [ebp - 0x2c]
push edx
mov dword [ebp - 0x2c], eax
call fcn.00418e80
push eax
push str.____CreationTime:_____s_n
call fcn.004014e0
mov eax, dword [ebp - 0x8084]
mov ecx, dword [ebp - 0x8088]
add esp, 0x14
push edi
push 0x64
push eax
push ecx
call fcn.004164d0
add eax, 0xb3960000
adc edx, 0x5e6684f4
mov dword [ebp - 0x28], edx
push 0x40
lea edx, [ebp - 0x98]
mov dword [ebp - 0x2c], eax
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00418e80
push eax
push str.____LastWriteTime:____s_n
call fcn.004014e0
mov ecx, dword [ebp - 0x807c]
mov edx, dword [ebp - 0x8080]
add esp, 0x14
push edi
push 0x64
push ecx
push edx
call fcn.004164d0
add eax, 0xb3960000
mov dword [ebp - 0x2c], eax
push 0x40
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x2c]
adc edx, 0x5e6684f4
push ecx
mov dword [ebp - 0x28], edx
call fcn.00418e80
push eax
push str.____ChangeTime:_______s_n
call fcn.004014e0
mov edx, dword [ebp - 0x8078]
push edx
push str.____FileAttributes:___x_n
call fcn.004014e0
add esp, 0x1c
jmp 0x408ff7
push ecx
push eax
push str.____FileBasicInformation_____x__x_n
call fcn.004014e0
add esp, 0xc
mov edx, dword [ebp - 0xc]
push 5
push 0x18
lea eax, [ebp - 0x8098]
push eax
lea ecx, [ebp - 0x18]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x18]
cmp eax, edi
jl 0x40902c
cmp ecx, edi
jl 0x40902c
mov eax, dword [ebp - 0x808c]
mov ecx, dword [ebp - 0x8090]
push eax
push ecx
push str.____Size:_____________llx_n
jmp 0x409033
push ecx
push eax
push str.____FileStandardInformation_____x__x_n
call fcn.004014e0
add esp, 0xc
push 0x8000
lea edx, [ebp - 0x8098]
push edi
push edx
call fcn.004127e0
add esp, 0xc
push edi
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0xc]
push 0x8000
lea ecx, [ebp - 0x8098]
push ecx
lea edx, [ebp - 0x18]
push edx
push edi
push edi
push edi
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
call dword [0x4a3120]
mov ecx, dword [ebp - 0x18]
cmp eax, edi
jl 0x40951f
cmp ecx, edi
jl 0x40951f
xor eax, eax
mov ecx, 0x5a4d
mov dword [ebp - 4], eax
cmp word [ebp - 0x8098], cx
jne 0x4090b2
mov eax, dword [ebp - 0x805c]
mov dword [ebp - 4], eax
cmp eax, 0x7f08
jae 0x409501
cmp dword [ebp + eax - 0x8098], 0x4550
lea esi, [ebp + eax - 0x8098]
push eax
jne 0x4094e4
push str.____NT_Headers:_______x_n
call fcn.004014e0
mov edx, dword [esi + 8]
push edx
push str.____Timestamp:________x_n
call fcn.004014e0
movzx eax, word [esi + 4]
mov ecx, 0x14c
add esp, 0x10
cmp ax, cx
jne 0x4090fb
mov ecx, str.___i386
jmp 0x40910f
mov edx, 0x8664
mov ecx, str.___amd64
cmp ax, dx
je 0x40910f
mov ecx, 0x468f28
push ecx
push eax
push str.____Machine:__________x_s_n
call fcn.004014e0
mov ecx, dword [esi + 8]
push ecx
push str.____Timestamp:________x_n
call fcn.004014e0
movzx edx, word [esi + 0x46]
movzx eax, word [esi + 0x44]
push edx
push eax
push str.____Image_Version:____u._u_n
call fcn.004014e0
mov eax, dword [esi + 0x50]
push eax
push eax
push str.____SizeOfImage:______x___u__n
call fcn.004014e0
movzx eax, word [esi + 0x14]
mov ecx, 0xf0
add esp, 0x2c
lea edx, [eax + esi + 0x18]
xor ebx, ebx
mov dword [ebp - 0x10], edx
cmp ax, cx
jne 0x40917d
cmp dword [esi + 0x84], 2
jbe 0x40917d
mov edi, dword [esi + 0x98]
mov ebx, dword [esi + 0x9c]
jmp 0x409199
mov edx, 0xe0
cmp ax, dx
jne 0x409199
cmp dword [esi + 0x74], 2
jbe 0x409199
mov edi, dword [esi + 0x88]
mov ebx, dword [esi + 0x8c]
push ebx
push edi
push str.____Resource_Dir:_____x_LB__x_n
call fcn.004014e0
add esp, 0xc
cmp edi, dword [ebp - 4]
jbe 0x40952e
xor ecx, ecx
cmp ebx, ecx
jbe 0x40952e
movzx edx, word [esi + 6]
mov eax, dword [ebp - 0x10]
lea ebx, [edx + edx*4]
add ebx, ebx
add ebx, ebx
lea esi, [ebp - 0x98]
sub esi, eax
add ebx, ebx
mov dword [ebp - 0x24], edx
cmp esi, ebx
jb 0x40952e
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
jbe 0x409214
add eax, 8
jmp 0x4091f0
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 4]
mov esi, dword [eax]
mov dword [ebp - 8], edx
mov edx, edi
sub edx, ebx
cmp edx, esi
jae 0x40920b
mov edx, dword [ebp - 4]
cmp dword [ebp - 8], edx
ja 0x409231
inc ecx
add eax, 0x28
cmp ecx, dword [ebp - 0x24]
jb 0x4091f0
push str.____Resource_section_not_found._n
call fcn.004014e0
mov ecx, dword [ebp - 0xc]
add esp, 4
push ecx
call fcn.004027b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
sub eax, ebx
add eax, edi
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
jl 0x409214
jg 0x409248
test eax, eax
je 0x409214
push 0x8000
lea eax, [ebp - 0x8098]
push 0
push eax
call fcn.004127e0
add esp, 0xc
push 0
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0xc]
push 0x8000
lea edx, [ebp - 0x8098]
push edx
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push ecx
call dword [0x4a3120]
lea edx, [ebp - 0x8098]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], 0x8000
test eax, eax
js 0x4094ba
cmp dword [ebp - 0x18], 0
jl 0x409364
lea eax, [ebp - 0x30]
push eax
push 0x8000
mov eax, edx
call fcn.00408c00
add esp, 8
cmp eax, 0xffffffff
je 0x409364
mov edi, dword [ebp - 0x30]
cmp edi, esi
jae 0x409364
sub eax, ebx
sub esi, edi
cmp eax, esi
ja 0x409364
cmp eax, 0x8000
jae 0x4092fd
lea ecx, [eax + edi]
cmp ecx, 0x8000
ja 0x4092fd
lea edx, [ebp + eax - 0x8098]
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], edi
jmp 0x409364
add eax, dword [ebp - 8]
push 0x8000
lea edx, [ebp - 0x8098]
push 0
push edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
call fcn.004127e0
add esp, 0xc
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0xc]
push 0x8000
lea ecx, [ebp - 0x8098]
push ecx
lea edx, [ebp - 0x18]
push edx
push 0
push 0
push 0
push eax
call dword [0x4a3120]
lea ecx, [ebp - 0x8098]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], edi
cmp edi, 0x8000
jbe 0x409364
mov dword [ebp - 4], 0x8000
mov eax, dword [ebp - 0x10]
test eax, eax
js 0x4094ba
cmp dword [ebp - 0x18], 0
jl 0x4094ba
mov edi, 0x46c114
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], 6
mov eax, dword [edi]
mov esi, dword [ebp - 4]
lea edx, [eax + 0xa]
cmp esi, edx
jbe 0x40949b
mov ebx, dword [ebp - 0x24]
sub esi, eax
mov eax, dword [edi - 4]
movzx ecx, word [eax]
sub esi, 0xa
shr esi, 1
mov dword [ebp - 0x30], ecx
je 0x40949b
dec esi
cmp word [ebx], 1
jne 0x4093dc
mov dx, word [ebp - 0x30]
cmp word [ebx + 2], dx
lea eax, [ebx + 2]
jne 0x4093dc
mov ecx, dword [edi]
mov edx, dword [edi - 4]
add ecx, 2
push ecx
push edx
push eax
call fcn.0040b740
add esp, 0xc
test eax, eax
je 0x4093e8
add ebx, 2
test esi, esi
jne 0x4093b1
jmp 0x40949b
mov edi, dword [edi]
shr edi, 1
mov eax, 0xfffffffe
sub eax, edi
add esi, eax
lea ebx, [ebx + edi*2 + 4]
xor eax, eax
jmp 0x409400
cmp word [ebx], 0
jne 0x409410
inc eax
add ebx, 2
dec esi
cmp eax, 3
jb 0x409400
push 1
push esi
push ebx
call fcn.00404480
add esp, 0xc
test eax, eax
js 0x40946d
cmp edi, 0xf
jae 0x40942e
mov eax, 0xf
sub eax, edi
jmp 0x409430
xor eax, eax
mov esi, dword [ebp - 8]
mov ecx, dword [esi - 4]
push ebx
push 0x468f28
push eax
push ecx
push str._____ls:_s__ls
call fcn.004014e0
add esp, 0x14
cmp byte [esi + 4], 0
je 0x409498
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x409498
mov eax, dword [ebp + 0xc]
cmp eax, 1
jbe 0x409498
push ebx
push eax
push ecx
call fcn.00418310
add esp, 0xc
jmp 0x409498
cmp edi, 0xf
jae 0x40947b
mov ecx, 0xf
sub ecx, edi
jmp 0x40947d
xor ecx, ecx
mov edx, dword [ebp - 8]
push eax
mov eax, dword [edx - 4]
push 0x468f28
push ecx
push eax
push str._____ls:_s_rc_Rrc
call fcn.004014e0
add esp, 0x14
mov edi, dword [ebp - 8]
add edi, 0xc
dec dword [ebp - 0x10]
mov dword [ebp - 8], edi
jne 0x409388
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004027b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
push ecx
push eax
mov eax, dword [ebp - 0x20]
push edx
push eax
push str.____NtReadFile___llx_____x__x_n
call fcn.004014e0
mov ecx, dword [ebp - 0xc]
add esp, 0x14
push ecx
call fcn.004027b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.____Nt_Headers___x:_Invalid_signature_n
call fcn.004014e0
mov ecx, dword [ebp - 0xc]
add esp, 8
push ecx
call fcn.004027b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push str.____Nt_Headers___x:_out_side_buffer_n
call fcn.004014e0
mov ecx, dword [ebp - 0xc]
add esp, 8
push ecx
call fcn.004027b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
push eax
push str.____NtReadFile__0_____x__x_n
call fcn.004014e0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004027b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret