Function at 0x4e4ec0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x20], 0
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov dword [esp], ecx
je 0x4e5f17
mov al, byte [eax + 8]
push ebp
test al, 4
je 0x4e4ef5
cmp al, 3
je 0x4e5f16
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x4e5f16
jmp 0x4e4ef9
mov ebp, dword [esp + 0x20]
movzx eax, al
cmp eax, 6
ja case.default.0x4e4f08
push ebx
push esi
push edi
jmp dword [eax*4 + 0x4e5f1c]
mov edx, dword [esp + 0x24]
movzx eax, byte [edx + 9]
dec eax
cmp eax, 0xf
ja case.0x4e4f28.3
movzx eax, byte [eax + 0x4e5f50]
jmp dword [eax*4 + 0x4e5f38]
mov esi, dword [esp + 0x28]
mov edx, 7
test ecx, ecx
jbe case.0x4e4f28.3
mov edi, dword [esp + 0x30]
mov ebp, ecx
mov bl, byte [esi]
mov al, bl
mov cl, dl
shr al, cl
and al, 1
movzx cx, al
mov eax, dword [esp + 0x2c]
cmp cx, word [eax + 8]
jne 0x4e4f7b
mov ecx, 7
sub ecx, edx
mov eax, 0x7f7f
sar eax, cl
mov ecx, edx
and al, bl
mov byte [esi], al
mov bl, byte [edi + 8]
shl bl, cl
or bl, al
mov byte [esi], bl
test edx, edx
jne 0x4e4f87
mov edx, 7
inc esi
jmp 0x4e4f88
dec edx
sub ebp, 1
jne 0x4e4f46
jmp case.0x4e4f28.3
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x28]
mov edx, 6
test edi, edi
je 0x4e503f
test ecx, ecx
jbe case.0x4e4f28.3
mov dword [esp + 0x18], ecx
mov bl, byte [esi]
mov ebp, dword [esp + 0x2c]
mov cl, dl
mov al, bl
shr al, cl
and al, 3
movzx cx, al
cmp cx, word [ebp + 8]
jne 0x4e4fea
mov ecx, 6
sub ecx, edx
mov eax, 0x3f3f
sar eax, cl
mov ecx, dword [esp + 0x30]
and al, bl
mov byte [esi], al
mov bl, byte [ecx + 8]
mov ecx, edx
shl bl, cl
jmp 0x4e501c
movzx eax, al
lea ecx, [eax*4]
or ecx, eax
add ecx, ecx
add ecx, ecx
or ecx, eax
add ecx, ecx
add ecx, ecx
or ecx, eax
mov al, byte [ecx + edi]
mov ecx, 6
sub ecx, edx
mov ebx, 0x3f3f
sar ebx, cl
shr al, 6
mov ecx, edx
and bl, byte [esi]
shl al, cl
or bl, al
mov byte [esi], bl
test edx, edx
jne 0x4e502c
mov edx, 6
inc esi
jmp 0x4e502f
sub edx, 2
sub dword [esp + 0x18], 1
jne 0x4e4fb3
jmp case.0x4e4f28.3
test ecx, ecx
jbe case.0x4e4f28.3
mov edi, dword [esp + 0x30]
mov ebp, ecx
lea ecx, [ecx]
mov bl, byte [esi]
mov al, bl
mov cl, dl
shr al, cl
and al, 3
movzx cx, al
mov eax, dword [esp + 0x2c]
cmp cx, word [eax + 8]
jne 0x4e5085
mov ecx, 6
sub ecx, edx
mov eax, 0x3f3f
sar eax, cl
mov ecx, edx
and al, bl
mov byte [esi], al
mov bl, byte [edi + 8]
shl bl, cl
or bl, al
mov byte [esi], bl
test edx, edx
jne 0x4e5091
mov edx, 6
inc esi
jmp 0x4e5094
sub edx, 2
sub ebp, 1
jne 0x4e5050
jmp case.0x4e4f28.3
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x28]
mov edx, 4
test edi, edi
je 0x4e513a
test ecx, ecx
jbe case.0x4e4f28.3
mov dword [esp + 0x18], ecx
nop
mov bl, byte [esi]
mov ebp, dword [esp + 0x2c]
mov cl, dl
mov al, bl
shr al, cl
and al, 0xf
movzx cx, al
cmp cx, word [ebp + 8]
jne 0x4e50f7
mov ecx, 4
sub ecx, edx
mov eax, 0xf0f
sar eax, cl
mov ecx, dword [esp + 0x30]
and al, bl
mov byte [esi], al
mov bl, byte [ecx + 8]
mov ecx, edx
shl bl, cl
jmp 0x4e511b
movzx eax, al
mov ecx, eax
shl ecx, 4
or ecx, eax
mov al, byte [ecx + edi]
mov ecx, 4
sub ecx, edx
mov ebx, 0xf0f
sar ebx, cl
shr al, 4
mov ecx, edx
and bl, byte [esi]
shl al, cl
or bl, al
mov byte [esi], bl
test edx, edx
jne 0x4e512b
mov edx, 4
inc esi
jmp 0x4e512e
sub edx, 4
sub dword [esp + 0x18], 1
jne 0x4e50c0
jmp case.0x4e4f28.3
test ecx, ecx
jbe case.0x4e4f28.3
mov edi, dword [esp + 0x30]
mov ebp, ecx
mov bl, byte [esi]
mov al, bl
mov cl, dl
shr al, cl
and al, 0xf
movzx cx, al
mov eax, dword [esp + 0x2c]
cmp cx, word [eax + 8]
jne 0x4e517d
mov ecx, 4
sub ecx, edx
mov eax, 0xf0f
sar eax, cl
mov ecx, edx
and al, bl
mov byte [esi], al
mov bl, byte [edi + 8]
shl bl, cl
or bl, al
mov byte [esi], bl
test edx, edx
jne 0x4e5189
mov edx, 4
inc esi
jmp 0x4e518c
sub edx, 4
sub ebp, 1
jne 0x4e5148
jmp case.0x4e4f28.3
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x28]
test esi, esi
je 0x4e51d4
test ecx, ecx
jbe case.0x4e4f28.3
mov edi, dword [esp + 0x30]
mov edx, ecx
mov cl, byte [eax]
movzx bx, cl
cmp bx, word [ebp + 8]
jne 0x4e51c1
mov cl, byte [edi + 8]
jmp 0x4e51c7
movzx ecx, cl
mov cl, byte [ecx + esi]
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x4e51b0
jmp case.0x4e4f28.3
test ecx, ecx
jbe case.0x4e4f28.3
mov esi, dword [esp + 0x30]
movzx dx, byte [eax]
cmp dx, word [ebp + 8]
jne 0x4e51ef
mov dl, byte [esi + 8]
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x4e51e0
jmp case.0x4e4f28.3
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x28]
test esi, esi
je 0x4e5271
test ecx, ecx
jbe case.0x4e4f28.3
mov bl, byte [esp + 0x50]
mov dword [esp + 0x18], ecx
mov dl, byte [eax]
mov cl, byte [eax + 1]
movzx di, dl
mov ebp, pe_nt_image_headers32
imul di, bp
movzx bp, cl
add di, bp
mov ebp, dword [esp + 0x2c]
cmp di, word [ebp + 8]
jne 0x4e5247
mov edi, dword [esp + 0x30]
mov dl, byte [edi + 9]
mov byte [eax], dl
mov cl, byte [edi + 8]
jmp 0x4e525f
movzx edi, cl
mov cl, bl
shr edi, cl
movzx edx, dl
mov ecx, dword [esi + edi*4]
movzx ecx, word [ecx + edx*2]
mov edx, ecx
shr edx, 8
mov byte [eax], dl
mov byte [eax + 1], cl
add eax, 2
sub dword [esp + 0x18], 1
jne 0x4e5216
jmp case.0x4e4f28.3
test ecx, ecx
jbe case.0x4e4f28.3
mov esi, dword [esp + 0x30]
lea ecx, [ecx]
movzx dx, byte [eax]
mov edi, pe_nt_image_headers32
imul dx, di
movzx di, byte [eax + 1]
add dx, di
cmp dx, word [ebp + 8]
jne 0x4e52a8
movzx edx, byte [esi + 9]
mov byte [eax], dl
movzx edx, byte [esi + 8]
mov byte [eax + 1], dl
add eax, 2
sub ecx, 1
jne 0x4e5280
jmp case.0x4e4f28.3
mov eax, dword [esp + 0x24]
cmp byte [eax + 9], 8
jne 0x4e5395
mov edx, dword [esp + 0x38]
test edx, edx
je 0x4e5341
test ecx, ecx
jbe case.0x4e4f28.3
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x30]
add eax, 2
mov edi, ecx
mov cl, byte [eax - 2]
movzx bx, cl
cmp bx, word [ebp + 2]
jne 0x4e5316
movzx bx, byte [eax - 1]
cmp bx, word [ebp + 4]
jne 0x4e5316
movzx bx, byte [eax]
cmp bx, word [ebp + 6]
jne 0x4e5316
movzx ecx, byte [esi + 2]
mov byte [eax - 2], cl
movzx ecx, byte [esi + 4]
mov byte [eax - 1], cl
movzx ecx, byte [esi + 6]
jmp 0x4e5332
movzx ecx, cl
movzx ecx, byte [ecx + edx]
mov byte [eax - 2], cl
movzx ecx, byte [eax - 1]
movzx ecx, byte [ecx + edx]
mov byte [eax - 1], cl
movzx ecx, byte [eax]
movzx ecx, byte [ecx + edx]
mov byte [eax], cl
add eax, 3
sub edi, 1
jne 0x4e52e0
jmp case.0x4e4f28.3
test ecx, ecx
jbe case.0x4e4f28.3
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x30]
add eax, 2
movzx dx, byte [eax - 2]
cmp dx, word [ebp + 2]
jne 0x4e5388
movzx dx, byte [eax - 1]
cmp dx, word [ebp + 4]
jne 0x4e5388
movzx dx, byte [eax]
cmp dx, word [ebp + 6]
jne 0x4e5388
movzx edx, byte [esi + 2]
mov byte [eax - 2], dl
movzx edx, byte [esi + 4]
mov byte [eax - 1], dl
movzx edx, byte [esi + 6]
mov byte [eax], dl
add eax, 3
sub ecx, 1
jne 0x4e5354
jmp case.0x4e4f28.3
mov esi, dword [esp + 0x44]
test esi, esi
je 0x4e54bc
test ecx, ecx
jbe case.0x4e4f28.3
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x30]
add eax, 2
mov dword [esp + 0x18], ecx
jmp 0x4e53c0
mov bl, byte [eax - 2]
mov cl, byte [eax - 1]
movzx dx, bl
mov ebp, pe_nt_image_headers32
imul dx, bp
movzx bp, cl
add dx, bp
mov ebp, dword [esp + 0x2c]
cmp dx, word [ebp + 2]
jne 0x4e544e
movzx dx, byte [eax]
mov ebp, pe_nt_image_headers32
imul dx, bp
movzx bp, byte [eax + 1]
add dx, bp
mov ebp, dword [esp + 0x2c]
cmp dx, word [ebp + 4]
jne 0x4e544e
movzx dx, byte [eax + 2]
mov ebp, pe_nt_image_headers32
imul dx, bp
movzx bp, byte [eax + 3]
add dx, bp
mov ebp, dword [esp + 0x2c]
cmp dx, word [ebp + 6]
jne 0x4e544e
movzx ecx, byte [edi + 3]
mov byte [eax - 2], cl
movzx edx, byte [edi + 2]
mov byte [eax - 1], dl
movzx ecx, byte [edi + 5]
mov byte [eax], cl
movzx edx, byte [edi + 4]
mov byte [eax + 1], dl
movzx ecx, byte [edi + 7]
mov byte [eax + 2], cl
movzx edx, byte [edi + 6]
mov byte [eax + 3], dl
jmp 0x4e54a9
movzx edx, byte [esp + 0x50]
movzx ebp, cl
mov cl, dl
shr ebp, cl
movzx ecx, bl
mov ebx, dword [esi + ebp*4]
movzx ecx, word [ebx + ecx*2]
mov ebx, ecx
shr ebx, 8
mov byte [eax - 2], bl
movzx ebx, byte [eax + 1]
mov byte [eax - 1], cl
mov cl, dl
shr ebx, cl
movzx ecx, byte [eax]
mov ebx, dword [esi + ebx*4]
movzx ecx, word [ebx + ecx*2]
mov ebx, ecx
shr ebx, 8
mov byte [eax], bl
movzx ebx, byte [eax + 3]
mov byte [eax + 1], cl
mov cl, dl
movzx edx, byte [eax + 2]
shr ebx, cl
mov ecx, dword [esi + ebx*4]
movzx ecx, word [ecx + edx*2]
mov edx, ecx
shr edx, 8
mov byte [eax + 2], dl
mov byte [eax + 3], cl
add eax, 6
sub dword [esp + 0x18], 1
jne 0x4e53c0
jmp case.0x4e4f28.3
test ecx, ecx
jbe case.0x4e4f28.3
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x30]
add eax, 2
nop
movzx dx, byte [eax - 2]
mov edi, pe_nt_image_headers32
imul dx, di
movzx di, byte [eax - 1]
add dx, di
cmp dx, word [ebp + 2]
jne 0x4e554c
movzx dx, byte [eax]
mov edi, pe_nt_image_headers32
imul dx, di
movzx di, byte [eax + 1]
add dx, di
cmp dx, word [ebp + 4]
jne 0x4e554c
movzx dx, byte [eax + 2]
mov edi, pe_nt_image_headers32
imul dx, di
movzx di, byte [eax + 3]
add dx, di
cmp dx, word [ebp + 6]
jne 0x4e554c
movzx edx, byte [esi + 3]
mov byte [eax - 2], dl
movzx edx, byte [esi + 2]
mov byte [eax - 1], dl
movzx edx, byte [esi + 5]
mov byte [eax], dl
movzx edx, byte [esi + 4]
mov byte [eax + 1], dl
movzx edx, byte [esi + 7]
mov byte [eax + 2], dl
movzx edx, byte [esi + 6]
mov byte [eax + 3], dl
add eax, 6
sub ecx, 1
jne 0x4e54d0
jmp case.0x4e4f28.3
mov eax, dword [esp + 0x24]
cmp byte [eax + 9], 8
jne 0x4e5698
mov edi, dword [esp + 0x40]
test edi, edi
je 0x4e5620
cmp dword [esp + 0x3c], 0
je 0x4e5620
cmp dword [esp + 0x38], 0
je 0x4e5620
cmp dword [esp + 0x10], 0
mov ecx, dword [esp + 0x28]
mov esi, ecx
jbe case.0x4e4f28.3
mov edx, dword [esp + 0x10]
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x18], edx
lea ebx, [ebx]
movzx ax, byte [ecx + 1]
movzx eax, ax
mov edx, 0xff
cmp ax, dx
jne 0x4e55cb
movzx eax, byte [ecx]
mov edx, dword [esp + 0x38]
jmp 0x4e560b
test ax, ax
jne 0x4e55d9
mov edx, dword [esp + 0x30]
mov al, byte [edx + 8]
jmp 0x4e560e
movzx ebx, byte [ecx]
movzx bx, byte [ebx + edi]
sub edx, eax
imul bx, ax
imul dx, word [ebp + 8]
add dx, bx
mov eax, 0x80
add dx, ax
movzx eax, dx
mov edx, eax
shr edx, 8
add edx, eax
sar edx, 8
movzx eax, dl
mov edx, dword [esp + 0x3c]
mov al, byte [eax + edx]
mov byte [esi], al
add ecx, 2
inc esi
sub dword [esp + 0x18], 1
jne 0x4e55b0
jmp case.0x4e4f28.3
cmp dword [esp + 0x10], 0
mov ecx, dword [esp + 0x28]
mov esi, ecx
jbe case.0x4e4f28.3
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x34]
lea esp, [esp]
mov al, byte [ecx + 1]
cmp al, 0xff
jne 0x4e564b
mov dl, byte [ecx]
jmp 0x4e5688
test al, al
jne 0x4e5658
mov eax, dword [esp + 0x30]
mov dl, byte [eax + 8]
jmp 0x4e5688
movzx bx, byte [ecx]
movzx ax, al
mov edx, 0xff
imul bx, ax
sub edx, eax
imul dx, word [ebp + 8]
add dx, bx
mov eax, 0x80
add dx, ax
movzx eax, dx
mov edx, eax
shr edx, 8
add edx, eax
sar edx, 8
mov byte [esi], dl
add ecx, 2
inc esi
sub edi, 1
jne 0x4e5640
jmp case.0x4e4f28.3
cmp dword [esp + 0x44], 0
je 0x4e57aa
cmp dword [esp + 0x48], 0
je 0x4e57aa
cmp dword [esp + 0x4c], 0
je 0x4e57aa
mov edx, dword [esp + 0x28]
mov esi, edx
test ecx, ecx
jbe case.0x4e4f28.3
mov bl, byte [esp + 0x50]
mov edi, dword [esp + 0x30]
mov eax, ecx
inc edx
mov dword [esp + 0x18], eax
jmp 0x4e56e0
movzx cx, byte [edx + 1]
mov eax, pe_nt_image_headers32
imul cx, ax
movzx ax, byte [edx + 2]
add cx, ax
movzx eax, cx
mov ecx, 0xffff
cmp ax, cx
jne 0x4e571c
movzx eax, byte [edx]
mov ebp, dword [esp + 0x44]
mov cl, bl
shr eax, cl
movzx ecx, byte [edx - 1]
mov eax, dword [ebp + eax*4]
movzx eax, word [eax + ecx*2]
jmp 0x4e578a
test ax, ax
jne 0x4e572e
mov al, byte [edi + 9]
mov byte [esi], al
mov cl, byte [edi + 8]
mov byte [esi + 1], cl
jmp 0x4e5794
movzx edi, byte [edx]
mov ebp, dword [esp + 0x4c]
mov cl, bl
shr edi, cl
movzx ecx, byte [edx - 1]
mov edi, dword [ebp + edi*4]
movzx ecx, word [edi + ecx*2]
mov edi, dword [esp + 0x34]
movzx edi, word [edi + 8]
movzx eax, ax
imul ecx, eax
mov ebp, 0xffff
sub ebp, eax
imul edi, ebp
lea ecx, [ecx + edi + 0x8000]
mov eax, ecx
shr eax, 0x10
add eax, ecx
shr eax, 0x10
movzx eax, ax
movzx edi, al
mov cl, bl
shr edi, cl
mov ecx, dword [esp + 0x48]
shr eax, 8
mov ecx, dword [ecx + edi*4]
movzx eax, word [ecx + eax*2]
mov edi, dword [esp + 0x30]
mov ecx, eax
shr ecx, 8
mov byte [esi + 1], al
mov byte [esi], cl
add edx, 4
add esi, 2
sub dword [esp + 0x18], 1
jne 0x4e56e0
jmp case.0x4e4f28.3
cmp dword [esp + 0x10], 0
mov ecx, dword [esp + 0x28]
mov esi, ecx
jbe case.0x4e4f28.3
mov edx, dword [esp + 0x10]
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x30]
add ecx, 3
mov edi, edi
movzx ax, byte [ecx - 1]
mov edi, pe_nt_image_headers32
imul ax, di
movzx di, byte [ecx]
add ax, di
movzx eax, ax
mov edi, 0xffff
cmp ax, di
jne 0x4e57fb
mov ax, word [ecx - 3]
mov word [esi], ax
jmp 0x4e5858
test ax, ax
jne 0x4e580c
movzx eax, byte [edx + 9]
mov byte [esi], al
movzx eax, byte [edx + 8]
jmp 0x4e5855
movzx dx, byte [ecx - 3]
mov edi, pe_nt_image_headers32
imul dx, di
movzx di, byte [ecx - 2]
add dx, di
movzx edi, word [ebp + 8]
movzx eax, ax
movzx edx, dx
imul edx, eax
mov ebx, 0xffff
sub ebx, eax
imul edi, ebx
lea edx, [edx + edi + 0x8000]
mov eax, edx
shr eax, 0x10
add eax, edx
shr eax, 0x10
mov edx, eax
shr edx, 8
mov byte [esi], dl
mov edx, dword [esp + 0x30]
mov byte [esi + 1], al
add ecx, 4
add esi, 2
sub dword [esp + 0x18], 1
jne 0x4e57d0
jmp case.0x4e4f28.3
mov eax, dword [esp + 0x24]
cmp byte [eax + 9], 8
jne 0x4e5ae6
mov ebp, dword [esp + 0x40]
test ebp, ebp
je 0x4e59e8
cmp dword [esp + 0x3c], 0
je 0x4e59e8
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x4e59e8
cmp dword [esp + 0x10], 0
jbe case.0x4e4f28.3
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x30]
lea esi, [edi + 2]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x34]
inc edi
mov al, byte [edi + 2]
cmp al, 0xff
jne 0x4e58eb
movzx eax, byte [edi - 1]
movzx eax, byte [eax + ecx]
mov byte [esi - 2], al
movzx eax, byte [edi]
movzx eax, byte [eax + ecx]
mov byte [esi - 1], al
movzx eax, byte [edi + 1]
movzx eax, byte [eax + ecx]
jmp 0x4e59d0
test al, al
jne 0x4e5906
movzx eax, byte [ebx + 2]
mov byte [esi - 2], al
movzx eax, byte [ebx + 4]
mov byte [esi - 1], al
movzx eax, byte [ebx + 6]
jmp 0x4e59d0
movzx ebx, byte [edi - 1]
movzx ebx, byte [ebx + ebp]
mov bp, word [edx + 2]
movzx ax, al
imul bx, ax
mov ecx, 0xff
sub ecx, eax
imul bp, cx
add bx, bp
mov ebp, 0x80
add bx, bp
movzx ebx, bx
movzx ebp, bx
mov ebx, ebp
shr ebx, 8
add ebx, ebp
mov ebp, dword [esp + 0x3c]
sar ebx, 8
movzx ebx, bl
movzx ebx, byte [ebx + ebp]
mov ebp, dword [esp + 0x40]
mov byte [esi - 2], bl
movzx ebx, byte [edi]
movzx ebx, byte [ebx + ebp]
mov bp, word [edx + 4]
imul bx, ax
imul bp, cx
add bx, bp
mov ebp, 0x80
add bx, bp
movzx ebx, bx
movzx ebp, bx
mov ebx, ebp
shr ebx, 8
add ebx, ebp
mov ebp, dword [esp + 0x3c]
sar ebx, 8
movzx ebx, bl
movzx ebx, byte [ebx + ebp]
mov ebp, dword [esp + 0x40]
mov byte [esi - 1], bl
movzx ebx, byte [edi + 1]
movzx ebx, byte [ebx + ebp]
imul bx, ax
mov ax, word [edx + 6]
imul ax, cx
add bx, ax
mov ecx, 0x80
add bx, cx
movzx eax, bx
mov ebx, dword [esp + 0x30]
mov ecx, eax
shr ecx, 8
add ecx, eax
sar ecx, 8
movzx eax, cl
mov ecx, dword [esp + 0x3c]
mov al, byte [eax + ecx]
mov ecx, dword [esp + 0x38]
mov byte [esi], al
add edi, 4
add esi, 3
sub dword [esp + 0x18], 1
jne 0x4e58c2
jmp case.0x4e4f28.3
cmp dword [esp + 0x10], 0
jbe case.0x4e4f28.3
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x30]
lea esi, [edi + 2]
inc edi
mov dword [esp + 0x18], ecx
mov al, byte [edi + 2]
cmp al, 0xff
jne 0x4e5a25
movzx eax, byte [edi - 1]
mov byte [esi - 2], al
mov cl, byte [edi]
mov byte [esi - 1], cl
movzx eax, byte [edi + 1]
mov byte [esi], al
jmp 0x4e5ad0
test al, al
jne 0x4e5a3f
movzx ecx, byte [edx + 2]
mov byte [esi - 2], cl
mov al, byte [edx + 4]
mov byte [esi - 1], al
movzx ecx, byte [edx + 6]
jmp 0x4e5ace
movzx ebx, byte [edi - 1]
mov bp, word [edx + 2]
movzx ax, al
imul bx, ax
mov ecx, 0xff
sub ecx, eax
imul bp, cx
add bx, bp
mov ebp, 0x80
add bx, bp
movzx ebx, bx
movzx ebp, bx
mov ebx, ebp
shr ebx, 8
add ebx, ebp
sar ebx, 8
mov byte [esi - 2], bl
movzx ebx, word [edx + 4]
movzx bp, byte [edi]
imul bx, cx
imul bp, ax
add bx, bp
mov ebp, 0x80
add bx, bp
movzx ebx, bx
movzx ebp, bx
mov ebx, ebp
shr ebx, 8
add ebx, ebp
sar ebx, 8
mov byte [esi - 1], bl
movzx ebx, byte [edi + 1]
imul bx, ax
mov ax, word [edx + 6]
imul ax, cx
add bx, ax
mov ecx, 0x80
add bx, cx
movzx eax, bx
mov ecx, eax
shr ecx, 8
add ecx, eax
sar ecx, 8
mov byte [esi], cl
add edi, 4
add esi, 3
sub dword [esp + 0x18], 1
jne 0x4e5a07
jmp case.0x4e4f28.3
mov ebp, dword [esp + 0x44]
test ebp, ebp
je 0x4e5d59
cmp dword [esp + 0x48], 0
je 0x4e5d59
cmp dword [esp + 0x4c], 0
je 0x4e5d59
test ecx, ecx
jbe case.0x4e4f28.3
mov edx, dword [esp + 0x28]
mov bl, byte [esp + 0x50]
lea eax, [edx + 2]
inc edx
mov dword [esp + 0x1c], ecx
movzx cx, byte [edx + 5]
mov esi, pe_nt_image_headers32
imul cx, si
movzx si, byte [edx + 6]
add cx, si
movzx esi, cx
mov ecx, 0xffff
cmp si, cx
jne 0x4e5bca
movzx esi, byte [edx]
movzx ecx, bl
shr esi, cl
mov dword [esp + 0x18], ecx
movzx ecx, byte [edx - 1]
mov esi, dword [ebp + esi*4]
movzx esi, word [esi + ecx*2]
mov ecx, esi
shr ecx, 8
mov byte [eax - 2], cl
mov dword [esp + 0x14], esi
movzx ecx, byte [esp + 0x14]
mov byte [eax - 1], cl
movzx esi, byte [edx + 2]
movzx ecx, byte [esp + 0x18]
shr esi, cl
movzx ecx, byte [edx + 1]
mov esi, dword [ebp + esi*4]
movzx esi, word [esi + ecx*2]
mov ecx, esi
shr ecx, 8
mov byte [eax], cl
mov dword [esp + 0x14], esi
movzx ecx, byte [esp + 0x14]
mov byte [eax + 1], cl
movzx esi, byte [edx + 4]
movzx ecx, byte [esp + 0x18]
shr esi, cl
movzx ecx, byte [edx + 3]
mov esi, dword [ebp + esi*4]
movzx esi, word [esi + ecx*2]
mov ecx, esi
shr ecx, 8
mov dword [esp + 0x14], esi
mov byte [eax + 2], cl
movzx ecx, byte [esp + 0x14]
jmp 0x4e5d40
test si, si
jne 0x4e5c12
mov ecx, dword [esp + 0x30]
movzx ecx, byte [ecx + 3]
mov byte [eax - 2], cl
mov ecx, dword [esp + 0x30]
movzx ecx, byte [ecx + 2]
mov byte [eax - 1], cl
mov ecx, dword [esp + 0x30]
movzx ecx, byte [ecx + 5]
mov byte [eax], cl
mov ecx, dword [esp + 0x30]
movzx ecx, byte [ecx + 4]
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x30]
movzx ecx, byte [ecx + 7]
mov byte [eax + 2], cl
mov ecx, dword [esp + 0x30]
movzx ecx, byte [ecx + 6]
jmp 0x4e5d40
movzx edi, si
movzx esi, byte [edx]
movzx ecx, bl
shr esi, cl
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edx - 1]
mov esi, dword [ebx + esi*4]
movzx ecx, word [esi + ecx*2]
mov esi, dword [esp + 0x34]
imul ecx, edi
movzx esi, word [esi + 2]
mov ebp, 0xffff
sub ebp, edi
imul esi, ebp
lea ecx, [ecx + esi + 0x8000]
mov esi, ecx
shr esi, 0x10
add esi, ecx
movzx ecx, word [esp + 0x50]
shr esi, 0x10
movzx ebx, si
mov dword [esp + 0x14], ecx
movzx esi, bl
shr esi, cl
mov ecx, dword [esp + 0x48]
shr ebx, 8
mov ecx, dword [ecx + esi*4]
movzx ecx, word [ecx + ebx*2]
mov byte [eax - 1], cl
mov ebx, ecx
movzx ecx, byte [esp + 0x18]
shr ebx, 8
mov byte [eax - 2], bl
movzx esi, byte [edx + 2]
shr esi, cl
movzx ecx, byte [edx + 1]
mov ebx, dword [esp + 0x4c]
mov esi, dword [ebx + esi*4]
movzx ecx, word [esi + ecx*2]
mov esi, dword [esp + 0x34]
imul ecx, edi
movzx esi, word [esi + 4]
imul esi, ebp
lea ecx, [ecx + esi + 0x8000]
mov esi, ecx
shr esi, 0x10
add esi, ecx
mov ecx, dword [esp + 0x14]
shr esi, 0x10
movzx ebx, si
movzx esi, bl
shr esi, cl
mov ecx, dword [esp + 0x48]
shr ebx, 8
mov ecx, dword [ecx + esi*4]
movzx ecx, word [ecx + ebx*2]
mov ebx, ecx
mov byte [eax + 1], cl
movzx ecx, byte [esp + 0x18]
shr ebx, 8
mov byte [eax], bl
movzx esi, byte [edx + 4]
mov ebx, dword [esp + 0x4c]
shr esi, cl
movzx ecx, byte [edx + 3]
mov esi, dword [ebx + esi*4]
movzx ecx, word [esi + ecx*2]
mov esi, dword [esp + 0x34]
imul ecx, edi
movzx esi, word [esi + 6]
imul esi, ebp
lea ecx, [ecx + esi + 0x8000]
mov esi, ecx
shr esi, 0x10
add esi, ecx
mov ecx, dword [esp + 0x14]
shr esi, 0x10
movzx ebx, si
movzx esi, bl
shr esi, cl
mov ecx, dword [esp + 0x48]
mov ecx, dword [ecx + esi*4]
mov ebp, dword [esp + 0x44]
shr ebx, 8
movzx ecx, word [ecx + ebx*2]
mov ebx, ecx
shr ebx, 8
mov byte [eax + 2], bl
mov bl, byte [esp + 0x50]
mov byte [eax + 3], cl
add edx, 8
add eax, 6
sub dword [esp + 0x1c], 1
jne 0x4e5b20
jmp case.0x4e4f28.3
mov edx, ecx
test edx, edx
jbe case.0x4e4f28.3
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x30]
lea eax, [ecx + 2]
add ecx, 7
mov dword [esp + 0x1c], edx
jmp 0x4e5d80
movzx dx, byte [ecx - 1]
mov edi, pe_nt_image_headers32
imul dx, di
movzx di, byte [ecx]
add dx, di
movzx edx, dx
mov edi, 0xffff
cmp dx, di
jne 0x4e5db5
mov edx, dword [ecx - 7]
mov dword [eax - 2], edx
mov dx, word [ecx - 3]
mov word [eax + 2], dx
jmp 0x4e5ebf
test dx, dx
jne 0x4e5de5
movzx edx, byte [esi + 3]
mov byte [eax - 2], dl
movzx edx, byte [esi + 2]
mov byte [eax - 1], dl
movzx edx, byte [esi + 5]
mov byte [eax], dl
movzx edx, byte [esi + 4]
mov byte [eax + 1], dl
movzx edx, byte [esi + 7]
mov byte [eax + 2], dl
movzx edx, byte [esi + 6]
jmp 0x4e5ebc
movzx esi, byte [ecx - 5]
mov edi, pe_nt_image_headers32
imul si, di
movzx edi, byte [ecx - 4]
add si, di
movzx esi, si
mov dword [esp + 0x18], esi
movzx esi, byte [ecx - 3]
mov edi, pe_nt_image_headers32
imul si, di
movzx edi, byte [ecx - 2]
mov ebp, dword [esp + 0x30]
add si, di
movzx esi, si
mov dword [esp + 0x14], esi
movzx esi, dx
movzx dx, byte [ecx - 7]
mov ebx, pe_nt_image_headers32
imul dx, bx
movzx bx, byte [ecx - 6]
add dx, bx
movzx ebx, word [ebp + 2]
movzx edx, dx
imul edx, esi
mov edi, 0xffff
sub edi, esi
imul ebx, edi
lea ebx, [edx + ebx + 0x8000]
mov edx, ebx
shr edx, 0x10
add edx, ebx
shr edx, 0x10
mov ebx, edx
mov byte [eax - 1], dl
shr ebx, 8
mov byte [eax - 2], bl
movzx edx, word [ebp + 4]
movzx ebx, word [esp + 0x18]
imul edx, edi
imul ebx, esi
lea ebx, [edx + ebx + 0x8000]
mov edx, ebx
shr edx, 0x10
add edx, ebx
shr edx, 0x10
mov ebx, edx
mov byte [eax + 1], dl
shr ebx, 8
mov byte [eax], bl
movzx edx, word [ebp + 6]
imul edx, edi
movzx edi, word [esp + 0x14]
imul edi, esi
lea esi, [edx + edi + 0x8000]
mov edx, esi
shr edx, 0x10
add edx, esi
shr edx, 0x10
mov ebx, edx
shr ebx, 8
mov byte [eax + 2], bl
mov esi, ebp
mov byte [eax + 3], dl
add ecx, 8
add eax, 6
sub dword [esp + 0x1c], 1
jne 0x4e5d80
pop edi
pop esi
pop ebx
mov edx, dword [esp + 0x18]
mov al, byte [edx + 8]
test al, 4
je 0x4e5f16
dec byte [edx + 0xa]
mov cl, byte [edx + 0xa]
and al, 0xfb
mov byte [edx + 8], al
mov al, byte [edx + 9]
imul cl
mov byte [edx + 0xb], al
cmp al, 8
movzx eax, al
jb 0x4e5f08
shr eax, 3
imul eax, dword [esp + 4]
mov dword [edx + 4], eax
pop ebp
add esp, 0x10
ret
imul eax, dword [esp + 4]
add eax, 7
shr eax, 3
mov dword [edx + 4], eax
pop ebp
add esp, 0x10
ret