Function at 0x4bee08
Capabilities:
Enumerate pe sections
Get file size
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
xor eax, eax
push ebp
push 0x4bf635
push dword fs:[eax]
mov dword fs:[eax], esp
or edi, 0xffffffff
cmp dword [ebp + 8], 0
je 0x4bf61a
xor ecx, ecx
push ebp
push 0x4bf60e
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
jne 0x4bf59e
xor edi, edi
mov eax, dword [ebx + 0x18]
cmp word [eax + 0x18], 0x20b
jne 0x4bee7e
lea edx, [eax + 0x18]
mov edx, dword [edx + 0x80]
mov dword [ebp - 0x24], edx
lea edx, [eax + 0x18]
mov edx, dword [edx + 0x24]
mov dword [ebp - 0x28], edx
lea edx, [eax + 0x18]
add edx, 0xf0
mov esi, edx
jmp 0x4bee98
mov edx, dword [eax + 0x88]
mov dword [ebp - 0x24], edx
mov edx, dword [eax + 0x3c]
mov dword [ebp - 0x28], edx
lea edx, [eax + 0x18]
add edx, 0xe0
mov esi, edx
movzx eax, word [eax + 6]
dec eax
test eax, eax
jl 0x4bf58a
inc eax
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
mov edx, dword [esi + edx*8 + 0xc]
cmp edx, dword [ebp - 0x24]
jne 0x4bf580
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x1c]
call fcn.004be574
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
mov edx, dword [ebx + 0x1c]
mov eax, dword [ebp - 0x24]
call fcn.004be824
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x28]
call fcn.004bde30
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
sub eax, dword [esi + edx*8 + 0x10]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jge 0x4bef37
cmp byte [0x4c9178], 0
je 0x4bef37
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4bef6b
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0x14]
push eax
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*4]
mov edx, dword [esi + eax*8 + 0x14]
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*4]
add edx, dword [esi + eax*8 + 0x10]
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x18]
call fcn.004bdfbc
test al, al
je 0x4bf58a
mov eax, dword [ebx + 0x14]
cmp word [eax], 0x5a4d
jne 0x4bf58a
mov edx, dword [ebx + 0x14]
mov eax, edx
add edx, 0x3c
add eax, dword [edx]
mov dword [ebx + 0x18], eax
cmp dword [eax], 0x4550
jne 0x4bf58a
cmp word [eax + 0x18], 0x20b
jne 0x4bf292
lea edx, [eax + 0x18]
add edx, 0xf0
mov esi, edx
add eax, 0x18
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x80
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
add dword [edx + 8], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x20]
call fcn.004bde30
mov edi, eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
call fcn.004bde30
sub edi, eax
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x2c]
mov edx, dword [edx + 0x24]
call fcn.004bde30
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
mov dword [esi + edx*8 + 0x10], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
mov dword [esi + edx*8 + 8], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x30]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add dword [edx + 0x38], eax
mov eax, dword [ebx + 0x18]
movzx eax, word [eax + 6]
dec eax
test eax, eax
jl 0x4bf0d4
inc eax
mov dword [ebp - 0x34], eax
xor edi, edi
lea eax, [edi + edi*4]
mov eax, dword [esi + eax*8 + 0xc]
mov edx, dword [ebp - 0x30]
cmp eax, dword [edx]
jbe 0x4bf0ce
lea eax, [edi + edi*4]
mov edx, dword [ebp - 0x1c]
add dword [esi + eax*8 + 0xc], edx
lea eax, [edi + edi*4]
mov edx, dword [ebp - 0x18]
add dword [esi + eax*8 + 0x14], edx
lea eax, [edi + edi*4]
mov eax, dword [esi + eax*8 + 0x1c]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
cmp eax, dword [esi + edx*8 + 0x14]
jbe 0x4bf0b1
lea eax, [edi + edi*4]
mov edx, dword [ebp - 0x18]
add dword [esi + eax*8 + 0x1c], edx
lea eax, [edi + edi*4]
mov eax, dword [esi + eax*8 + 0x18]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
cmp eax, dword [esi + edx*8 + 0x14]
jbe 0x4bf0ce
lea eax, [edi + edi*4]
mov edx, dword [ebp - 0x18]
add dword [esi + eax*8 + 0x18], edx
inc edi
dec dword [ebp - 0x34]
jne 0x4bf072
xor edi, edi
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + edi*8 + 0x70]
mov edx, dword [ebp - 0x30]
cmp eax, dword [edx]
jbe 0x4bf0ee
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
add dword [eax + edi*8 + 0x70], edx
inc edi
cmp edi, 0x10
jne 0x4bf0d6
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0xa4], 0
jbe 0x4bf16c
mov eax, dword [ebx + 0x18]
movzx eax, word [eax + 6]
dec eax
test eax, eax
jl 0x4bf16c
inc eax
mov dword [ebp - 0x34], eax
xor edi, edi
lea eax, [edi + edi*4]
mov eax, dword [esi + eax*8 + 0xc]
mov edx, dword [ebp - 0x2c]
cmp eax, dword [edx + 0xa0]
ja 0x4bf166
mov eax, dword [ebx + 0x18]
movzx eax, word [eax + 6]
dec eax
cmp edi, eax
je 0x4bf147
lea eax, [edi + edi*4]
mov eax, dword [esi + eax*8 + 0x34]
mov edx, dword [ebp - 0x2c]
cmp eax, dword [edx + 0xa0]
jbe 0x4bf166
lea eax, [edi + edi*4]
mov eax, dword [esi + eax*8 + 0x14]
add eax, dword [ebx + 0x14]
mov edx, dword [ebp - 0x2c]
add eax, dword [edx + 0xa0]
lea edx, [edi + edi*4]
sub eax, dword [esi + edx*8 + 0xc]
mov dword [ebp - 0x20], eax
jmp 0x4bf16c
inc edi
dec dword [ebp - 0x34]
jne 0x4bf117
cmp dword [ebp - 0x20], 0
je 0x4bf1d8
mov eax, dword [ebp - 0x2c]
mov edi, dword [eax + 0xa4]
mov eax, edi
mov ecx, 0x1c
cdq
idiv ecx
test edx, edx
jne 0x4bf195
mov ecx, 0x1c
mov eax, edi
cdq
idiv ecx
mov edi, eax
test edi, edi
jle 0x4bf1d8
mov dword [ebp - 0x34], edi
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
mov edx, dword [esi + edx*8 + 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x18]
cmp edx, eax
jae 0x4bf1cf
test eax, eax
je 0x4bf1bd
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
add dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x14], 0
je 0x4bf1cf
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add dword [edx + 0x14], eax
add dword [ebp - 0x20], 0x1c
dec dword [ebp - 0x34]
jne 0x4bf19c
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
mov ecx, eax
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*4]
mov edx, dword [esi + eax*8 + 0x14]
add edx, dword [ebx + 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0040451c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_UnmapViewOfFile
lea edx, [ebp - 0x40]
mov eax, dword [ebx + 0x1c]
call fcn.004be214
mov eax, dword [ebp - 0x40]
call fcn.004be3d8
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x18]
add edx, 0x18
mov edx, dword [edx + 0x24]
call fcn.004bde30
mov edi, eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], 0
jle 0x4bf57b
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
mov edx, dword [esi + edx*8 + 0x14]
add edx, dword [ebx + 0x14]
add eax, edx
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.0040c058
jmp 0x4bf57b
lea edx, [eax + 0x18]
add edx, 0xe0
mov esi, edx
add eax, 0x18
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
add eax, 0x70
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x38]
add dword [edx + 8], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x38]
mov edx, dword [edx + 0x20]
call fcn.004bde30
mov edi, eax
mov eax, dword [ebp - 0x38]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 4]
call fcn.004bde30
sub edi, eax
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x38]
mov edx, dword [edx + 0x24]
call fcn.004bde30
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
mov dword [esi + edx*8 + 0x10], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
mov dword [esi + edx*8 + 8], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x3c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x38]
add dword [edx + 0x38], eax
mov eax, dword [ebx + 0x18]
movzx eax, word [eax + 6]
dec eax
test eax, eax
jl 0x4bf3c6
inc eax
mov dword [ebp - 0x34], eax
xor edi, edi
lea eax, [edi + edi*4]
mov eax, dword [esi + eax*8 + 0xc]
mov edx, dword [ebp - 0x3c]
cmp eax, dword [edx]
jbe 0x4bf3c0
lea eax, [edi + edi*4]
mov edx, dword [ebp - 0x1c]
add dword [esi + eax*8 + 0xc], edx
lea eax, [edi + edi*4]
mov edx, dword [ebp - 0x18]
add dword [esi + eax*8 + 0x14], edx
lea eax, [edi + edi*4]
mov eax, dword [esi + eax*8 + 0x1c]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
cmp eax, dword [esi + edx*8 + 0x14]
jbe 0x4bf3a3
lea eax, [edi + edi*4]
mov edx, dword [ebp - 0x18]
add dword [esi + eax*8 + 0x1c], edx
lea eax, [edi + edi*4]
mov eax, dword [esi + eax*8 + 0x18]
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
cmp eax, dword [esi + edx*8 + 0x14]
jbe 0x4bf3c0
lea eax, [edi + edi*4]
mov edx, dword [ebp - 0x18]
add dword [esi + eax*8 + 0x18], edx
inc edi
dec dword [ebp - 0x34]
jne 0x4bf364
xor edi, edi
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + edi*8 + 0x60]
mov edx, dword [ebp - 0x3c]
cmp eax, dword [edx]
jbe 0x4bf3e0
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x1c]
add dword [eax + edi*8 + 0x60], edx
inc edi
cmp edi, 0x10
jne 0x4bf3c8
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x94], 0
jbe 0x4bf45e
mov eax, dword [ebx + 0x18]
movzx eax, word [eax + 6]
dec eax
test eax, eax
jl 0x4bf45e
inc eax
mov dword [ebp - 0x34], eax
xor edi, edi
lea eax, [edi + edi*4]
mov eax, dword [esi + eax*8 + 0xc]
mov edx, dword [ebp - 0x38]
cmp eax, dword [edx + 0x90]
ja 0x4bf458
mov eax, dword [ebx + 0x18]
movzx eax, word [eax + 6]
dec eax
cmp edi, eax
je 0x4bf439
lea eax, [edi + edi*4]
mov eax, dword [esi + eax*8 + 0x34]
mov edx, dword [ebp - 0x38]
cmp eax, dword [edx + 0x90]
jbe 0x4bf458
lea eax, [edi + edi*4]
mov eax, dword [esi + eax*8 + 0x14]
add eax, dword [ebx + 0x14]
mov edx, dword [ebp - 0x38]
add eax, dword [edx + 0x90]
lea edx, [edi + edi*4]
sub eax, dword [esi + edx*8 + 0xc]
mov dword [ebp - 0x20], eax
jmp 0x4bf45e
inc edi
dec dword [ebp - 0x34]
jne 0x4bf409
cmp dword [ebp - 0x20], 0
je 0x4bf4cd
mov eax, dword [ebp - 0x38]
mov edi, dword [eax + 0x94]
mov eax, edi
mov ecx, 0x1c
cdq
idiv ecx
test edx, edx
jne 0x4bf487
mov ecx, 0x1c
mov eax, edi
cdq
idiv ecx
mov edi, eax
test edi, edi
jle 0x4bf4cd
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*4]
mov eax, dword [esi + eax*8 + 0x14]
mov edx, dword [ebp - 0x20]
cmp eax, dword [edx + 0x18]
jae 0x4bf4c4
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x18], 0
je 0x4bf4b2
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
add dword [edx + 0x18], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x14], 0
je 0x4bf4c4
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add dword [edx + 0x14], eax
add dword [ebp - 0x20], 0x1c
dec dword [ebp - 0x34]
jne 0x4bf48e
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
mov ecx, eax
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
lea eax, [eax + eax*4]
mov edx, dword [esi + eax*8 + 0x14]
add edx, dword [ebx + 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0040451c
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_UnmapViewOfFile
lea edx, [ebp - 0x44]
mov eax, dword [ebx + 0x1c]
call fcn.004be214
mov eax, dword [ebp - 0x44]
call fcn.004be3d8
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x18]
mov edx, dword [edx + 0x3c]
call fcn.004bde30
mov edi, eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
add eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], 0
jle 0x4bf57b
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov edx, 4
call fcn.004bde30
mov edx, dword [ebp - 0x14]
lea edx, [edx + edx*4]
mov edx, dword [esi + edx*8 + 0x14]
add edx, dword [ebx + 0x14]
add eax, edx
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
call fcn.0040c058
or edi, 0xffffffff
jmp 0x4bf58a
inc dword [ebp - 0x14]
dec eax
jne 0x4beead
push 0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_GetFileSize
mov edx, eax
mov eax, dword [ebx + 0x14]
call fcn.004bed58
lea eax, [ebx + 0x1c]
call fcn.004be4ec
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
mov eax, dword [ebx + 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [ebp + 0xc], 0
jne 0x4bf5d9
push 2
push 0
push 0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_SetFilePointer
cmp eax, 0xffffffff
je 0x4bf5d9
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_SetEndOfFile
cmp byte [ebx + 0xc], 0
je 0x4bf5ef
lea eax, [ebx + 4]
push eax
push 0
push 0
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_SetFileTime
mov eax, dword [ebx]
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, 0x20
mov eax, dword [ebp + 8]
call fcn.0040436c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bf61a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf63c
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.004068f4
ret