Function at 0x408400
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8090
call fcn.00404080
push ebx
push esi
mov esi, ecx
push edi
mov ebx, 0xffffffd5
push esi
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x38], 0xc0000365
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], esi
call fcn.00404170
add esp, 4
xor edi, edi
push edi
push edi
push 0x60
push 1
add eax, eax
push 1
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x2c]
push 0x80
push edi
add eax, 2
lea edx, [ebp - 0x38]
push edx
mov word [ebp - 0x2a], ax
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x2c]
push eax
mov dword [ebp - 0x48], ecx
push 0x80100000
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 0x50], 0x18
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x44], 0x40
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call fcn.004025f9
cmp eax, edi
jl 0x4089fa
cmp dword [ebp - 0x38], edi
jl 0x4089fa
push esi
push str._ls:_n
call fcn.004014e0
mov ecx, dword [ebp - 8]
mov esi, dword [0x4a00c8]
add esp, 8
push 4
push 0x28
lea edx, [ebp - 0x8090]
push edx
lea eax, [ebp - 0x18]
push eax
push ecx
mov dword [ebp - 0x18], 0xc0000365
mov dword [ebp - 0x14], ebx
call esi
mov ecx, dword [ebp - 0x18]
cmp eax, edi
jl 0x4085c6
cmp ecx, edi
jl 0x4085c6
mov edx, dword [ebp - 0x808c]
mov eax, dword [ebp - 0x8090]
push edi
push 0x64
push edx
push eax
call fcn.00414c50
add eax, 0xb3960000
adc edx, 0x5e6684f4
push 0x40
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x20], edx
push ecx
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], eax
call fcn.00417500
push eax
push str.____CreationTime:_____s_n
call fcn.004014e0
mov eax, dword [ebp - 0x807c]
mov ecx, dword [ebp - 0x8080]
add esp, 0x14
push edi
push 0x64
push eax
push ecx
call fcn.00414c50
add eax, 0xb3960000
adc edx, 0x5e6684f4
mov dword [ebp - 0x20], edx
push 0x40
lea edx, [ebp - 0x90]
mov dword [ebp - 0x24], eax
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.00417500
push eax
push str.____LastWriteTime:____s_n
call fcn.004014e0
mov ecx, dword [ebp - 0x8074]
mov edx, dword [ebp - 0x8078]
add esp, 0x14
push edi
push 0x64
push ecx
push edx
call fcn.00414c50
add eax, 0xb3960000
mov dword [ebp - 0x24], eax
push 0x40
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x24]
adc edx, 0x5e6684f4
push ecx
mov dword [ebp - 0x20], edx
call fcn.00417500
push eax
push str.____ChangeTime:_______s_n
call fcn.004014e0
mov edx, dword [ebp - 0x8070]
push edx
push str.____FileAttributes:___x_n
call fcn.004014e0
add esp, 0x1c
jmp 0x4085d5
push ecx
push eax
push str.____FileBasicInformation_____x__x_n
call fcn.004014e0
add esp, 0xc
mov edx, dword [ebp - 8]
push 5
push 0x18
lea eax, [ebp - 0x8090]
push eax
lea ecx, [ebp - 0x18]
push ecx
push edx
call esi
mov ecx, dword [ebp - 0x18]
cmp eax, edi
jl 0x40860a
cmp ecx, edi
jl 0x40860a
mov eax, dword [ebp - 0x8084]
mov ecx, dword [ebp - 0x8088]
push eax
push ecx
push str.____Size:_____________llx_n
jmp 0x408611
push ecx
push eax
push str.____FileStandardInformation_____x__x_n
call fcn.004014e0
add esp, 0xc
push 0x8000
lea edx, [ebp - 0x8090]
push edi
push edx
call fcn.00411580
add esp, 0xc
push edi
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push 0x8000
lea ecx, [ebp - 0x8090]
push ecx
lea edx, [ebp - 0x18]
push edx
push edi
push edi
push edi
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call dword [0x4a0120]
mov ecx, dword [ebp - 0x18]
cmp eax, edi
jl 0x4089e2
cmp ecx, edi
jl 0x4089e2
xor eax, eax
mov ecx, 0x5a4d
mov dword [ebp - 4], eax
cmp word [ebp - 0x8090], cx
jne 0x408690
mov eax, dword [ebp - 0x8054]
mov dword [ebp - 4], eax
cmp eax, 0x7f08
jae 0x4089c4
cmp dword [ebp + eax - 0x8090], 0x4550
lea esi, [ebp + eax - 0x8090]
push eax
jne 0x4089a7
push str.____NT_Headers:_______x_n
call fcn.004014e0
mov edx, dword [esi + 8]
push edx
push str.____Timestamp:________x_n
call fcn.004014e0
movzx eax, word [esi + 4]
mov ecx, 0x14c
add esp, 0x10
cmp ax, cx
jne 0x4086d9
mov ecx, str.___i386
jmp 0x4086ed
mov edx, 0x8664
mov ecx, str.___amd64
cmp ax, dx
je 0x4086ed
mov ecx, 0x467e28
push ecx
push eax
push str.____Machine:__________x_s_n
call fcn.004014e0
mov ecx, dword [esi + 8]
push ecx
push str.____Timestamp:________x_n
call fcn.004014e0
movzx edx, word [esi + 0x46]
movzx eax, word [esi + 0x44]
push edx
push eax
push str.____Image_Version:____u._u_n
call fcn.004014e0
mov eax, dword [esi + 0x50]
push eax
push eax
push str.____SizeOfImage:______x___u__n
call fcn.004014e0
movzx eax, word [esi + 0x14]
mov ecx, 0xf0
add esp, 0x2c
lea edx, [eax + esi + 0x18]
xor ebx, ebx
mov dword [ebp - 0x1c], edx
cmp ax, cx
jne 0x40875b
cmp dword [esi + 0x84], 2
jbe 0x40875b
mov edi, dword [esi + 0x98]
mov ebx, dword [esi + 0x9c]
jmp 0x408777
mov edx, 0xe0
cmp ax, dx
jne 0x408777
cmp dword [esi + 0x74], 2
jbe 0x408777
mov edi, dword [esi + 0x88]
mov ebx, dword [esi + 0x8c]
push ebx
push edi
push str.____Resource_Dir:_____x_LB__x_n
call fcn.004014e0
add esp, 0xc
cmp edi, dword [ebp - 4]
jbe 0x4089f1
xor eax, eax
cmp ebx, eax
jbe 0x4089f1
movzx esi, word [esi + 6]
mov ebx, dword [ebp - 0x1c]
lea edx, [esi + esi*4]
add edx, edx
add edx, edx
lea ecx, [ebp - 0x90]
sub ecx, ebx
add edx, edx
cmp ecx, edx
jb 0x4089f1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
cmp esi, eax
jbe 0x4087df
lea ecx, [ebx + 0x10]
mov edx, dword [ecx - 4]
sub edx, edi
cmp edx, dword [ecx]
jae 0x4087d7
mov edx, dword [ebp - 4]
cmp dword [ecx + 4], edx
ja 0x4087fc
inc eax
add ecx, 0x28
cmp eax, esi
jb 0x4087c6
push str.____Resource_section_not_found._n
call fcn.004014e0
mov ecx, dword [ebp - 8]
add esp, 4
push ecx
call fcn.00402597
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [eax + eax*4]
lea ecx, [ebx + eax*8]
mov eax, dword [ecx + 0x14]
add eax, dword [ecx + 0xc]
sub eax, edi
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
jl 0x4087df
jg 0x40881a
test eax, eax
je 0x4087df
push 0x8000
lea ecx, [ebp - 0x8090]
push 0
push ecx
call fcn.00411580
add esp, 0xc
push 0
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp - 8]
push 0x8000
lea eax, [ebp - 0x8090]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0
push 0
push edx
call dword [0x4a0120]
mov ecx, dword [ebp - 0x18]
test eax, eax
js 0x408980
test ecx, ecx
js 0x408980
mov edi, 0x46a374
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], 6
jmp 0x408880
mov eax, dword [edi]
movzx ecx, word [eax]
mov esi, 0x7ff6
sub esi, dword [edi + 4]
lea ebx, [ebp - 0x8090]
shr esi, 1
mov dword [ebp - 0x30], ecx
je 0x408961
mov edi, edi
dec esi
cmp word [ebx], 1
jne 0x4088cb
mov dx, word [ebp - 0x30]
cmp word [ebx + 2], dx
lea eax, [ebx + 2]
jne 0x4088cb
mov ecx, dword [edi + 4]
mov edx, dword [edi]
add ecx, 2
push ecx
push edx
push eax
call fcn.00414c90
add esp, 0xc
test eax, eax
je 0x4088d7
add ebx, 2
test esi, esi
jne 0x4088a0
jmp 0x408961
mov edi, dword [edi + 4]
shr edi, 1
mov eax, 0xfffffffe
sub eax, edi
add esi, eax
lea ebx, [ebx + edi*2 + 4]
xor eax, eax
jmp 0x4088f0
cmp word [ebx], 0
jne 0x408900
inc eax
add ebx, 2
dec esi
cmp eax, 3
jb 0x4088f0
push 1
push esi
push ebx
call fcn.004041a0
add esp, 0xc
test eax, eax
js 0x408934
cmp edi, 0xf
jae 0x40891e
mov eax, 0xf
sub eax, edi
jmp 0x408920
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push ebx
push 0x467e28
push eax
push edx
push str._____ls:_s__ls
jmp 0x408956
cmp edi, 0xf
jae 0x408942
mov ecx, 0xf
sub ecx, edi
jmp 0x408944
xor ecx, ecx
push eax
mov eax, dword [ebp - 4]
push 0x467e28
push ecx
mov ecx, dword [eax]
push ecx
push str._____ls:_s_rc_Rrc
call fcn.004014e0
mov edi, dword [ebp - 4]
add esp, 0x14
add edi, 8
dec dword [ebp - 0x1c]
mov dword [ebp - 4], edi
jne 0x408880
mov ecx, dword [ebp - 8]
push ecx
call fcn.00402597
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xc]
push ecx
push eax
mov eax, dword [ebp - 0x10]
push edx
push eax
push str.____NtReadFile___llx_____x__x_n
call fcn.004014e0
mov ecx, dword [ebp - 8]
add esp, 0x14
push ecx
call fcn.00402597
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.____Nt_Headers___x:_Invalid_signature_n
call fcn.004014e0
mov ecx, dword [ebp - 8]
add esp, 8
push ecx
call fcn.00402597
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push str.____Nt_Headers___x:_out_side_buffer_n
call fcn.004014e0
mov ecx, dword [ebp - 8]
add esp, 8
push ecx
call fcn.00402597
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
push eax
push str.____NtReadFile__0_____x__x_n
call fcn.004014e0
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call fcn.00402597
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret