Function at 0x479100
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x14]
push ebx
push esi
mov eax, dword [edx + 0x440]
mov ebx, dword [eax]
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
test eax, eax
je 0x4796da
mov esi, dword [esp + 0x24]
movzx ecx, byte [esi]
mov dword [esp + 8], ecx
cmp eax, ecx
jb 0x4796da
cmp ecx, 0x22
jb 0x4796da
movzx eax, byte [esi + 4]
push ebp
movzx ebp, byte [esi + 5]
shl ebp, 8
or ebp, eax
movzx eax, byte [esi + 3]
shl ebp, 8
or ebp, eax
movzx eax, byte [esi + 2]
push edi
movzx edi, byte [esi + 0x20]
shl ebp, 8
or ebp, eax
lea eax, [esi + 0xb]
push 3
push eax
call fcn.0047a5d0
movzx ecx, byte [esi + 0xa]
add esp, 8
shl eax, 8
add eax, ecx
mov ecx, dword [esp + 0x10]
add ecx, 0xffffffdf
mov dword [esp + 0x30], eax
cmp ecx, edi
jb 0x4796c0
test edi, edi
je 0x4796c0
test ebp, ebp
jle 0x4791d3
mov eax, dword [ebx + 0x70]
cdq
mov esi, eax
mov ecx, edx
add esi, dword [esp + 0x30]
push edx
adc ecx, 0
add esi, 0xffffffff
push eax
adc ecx, 0xffffffff
push ecx
push esi
call fcn.0067c320
mov esi, eax
mov ecx, edx
mov eax, ebp
cdq
add esi, eax
adc ecx, edx
test ecx, ecx
ja 0x4791dc
jb 0x4791cf
cmp esi, dword [ebx + 0x80]
ja 0x4791dc
mov eax, dword [esp + 0x30]
or eax, 0
je 0x4791f9
test ebp, ebp
jns 0x4791f9
push str.Invalid_location_of_extent_of_file
push 0xffffffffffffffff
push dword [esp + 0x2c]
call fcn.00469db0
add esp, 0xc
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret
mov eax, dword [ebx + 0x70]
cdq
mov esi, eax
mov ecx, edx
mov eax, ebp
cdq
push edx
push eax
push ecx
push esi
call fcn.0067c2e0
mov ebx, dword [esp + 0x28]
mov ecx, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
test ebx, ebx
je 0x479231
nop
cmp dword [ecx + 0x20], eax
jne 0x47922a
cmp dword [ecx + 0x24], edx
je 0x47924f
mov ecx, dword [ecx + 4]
test ecx, ecx
jne 0x479220
push 0xe0
push 1
call fcn.00681a00
mov esi, eax
add esp, 8
test esi, esi
jne 0x479258
push str.No_memory_for_file_entry
push 0xc
jmp 0x4791e3
push str.Directory_structure_contains_loop
push 0x2a
jmp 0x4791e3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0x2c]
add eax, 0x12
mov dword [esi + 4], ebx
push eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], 0
call fcn.00478be0
mov ecx, dword [esp + 0x30]
add esp, 4
add dword [esp + 0x10], ecx
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x68], eax
lea eax, [esi + 0xd4]
mov dword [eax], 0
mov dword [esi + 0xd8], eax
mov eax, edi
not eax
mov dword [esi + 0x5c], edx
and eax, 1
mov dword [esi + 0x64], edx
mov dword [esi + 0x6c], edx
lea edx, [ecx + 0x21]
add eax, edx
mov dword [esp + 0x30], edx
add eax, edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
cmp byte [eax + 0x1a], 0
je 0x47933f
cmp edi, 0xce
jbe 0x4792e2
mov edi, 0xce
jmp 0x4792ea
and edi, 0xfffffffe
cmp edi, 4
jbe 0x479309
cmp byte [edx + edi - 4], 0
jne 0x479309
cmp byte [edx + edi - 3], 0x3b
jne 0x479309
cmp byte [edx + edi - 2], 0
jne 0x479309
cmp byte [edx + edi - 1], 0x31
jne 0x479309
sub edi, 4
push edi
call fcn.006883b5
add esp, 4
mov dword [esi + 0x98], eax
test eax, eax
jne 0x47932c
push str.No_memory_for_file_name
push 0xc
push dword [esp + 0x2c]
jmp 0x479617
push edi
push dword [esp + 0x34]
push eax
call fcn.0067d850
mov dword [esi + 0x9c], edi
jmp 0x47937a
cmp edi, 2
jbe 0x479355
cmp byte [edx + edi - 2], 0x3b
jne 0x47935a
cmp byte [edx + edi - 1], 0x31
jne 0x47935a
sub edi, 2
cmp edi, 1
jbe 0x479362
cmp byte [edx + edi - 1], 0x2e
jne 0x479362
dec edi
push edi
push edx
lea eax, [esi + 0x8c]
mov dword [esi + 0x90], 0
push eax
call fcn.00498b20
mov eax, dword [esp + 0x38]
add esp, 0xc
mov edx, 0x8100
movzx ecx, byte [eax + 0x19]
mov eax, 0x41c0
test ecx, 2
mov dword [esp + 0x30], ecx
cmove eax, edx
mov word [esi + 0x78], ax
mov eax, ecx
shr eax, 7
and eax, 1
mov dword [esi + 0xc8], eax
mov eax, dword [esi + 0x28]
or eax, dword [esi + 0x2c]
jne 0x4793cf
test ebp, ebp
js 0x4793cf
or ebp, 0xffffffff
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0xffffffff
or eax, ebp
jmp 0x4793d1
xor eax, eax
mov dword [esi + 0x80], ebp
mov ebp, dword [esp + 0x14]
mov dword [esi + 0x84], eax
cmp dword [ebp + 8], 0
je 0x479546
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
test ebx, ebx
jne 0x47941d
mov eax, edx
sub eax, ecx
cmp eax, 7
jl 0x47941d
cmp dword [ecx], 0x1075053
jne 0x47941d
cmp word [ecx + 4], 0xefbe
jne 0x47941d
mov al, byte [ecx + 6]
add ecx, 7
mov byte [ebp + 0x1b], al
mov byte [ebp + 0x19], 1
cmp byte [ebp + 0x19], 0
mov edi, dword [esp + 0x24]
je 0x4794a5
mov byte [esi + 0xa0], 0
mov byte [esi + 0xb0], 0
movzx eax, byte [ebp + 0x1b]
push edx
add ecx, eax
push ecx
push esi
push edi
call fcn.00479700
add esp, 0x10
test eax, eax
jne 0x47961f
cmp dword [esi + 0x2c], eax
ja 0x479459
cmp dword [esi + 0x28], eax
jbe 0x4794ac
mov ax, word [esi + 0x78]
mov ecx, 0xf000
and ax, cx
mov ecx, 0xa000
cmp ax, cx
mov ecx, dword [esp + 0x30]
jne 0x4794b0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x80], 0xffffffff
mov dword [esi + 0x84], 0xffffffff
mov dword [esi + 0x20], 0xffffffff
mov dword [esi + 0x24], 0xffffffff
jmp 0x4794b0
mov dword [ebp + 8], 0
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x88], 1
test ebx, ebx
je 0x4794c6
test cl, 2
je 0x4794c6
inc dword [ebx + 0x10]
cmp byte [ebp + 0x18], 0
je 0x4796ae
test ebx, ebx
je 0x47963e
cmp dword [ebx + 4], 0
jne 0x47963e
test cl, 2
je 0x47963e
cmp dword [ebp + 0x1c], 0
jne 0x47963e
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x47963e
mov edx, str.rr_moved
mov ecx, eax
nop word [eax + eax]
mov bl, byte [ecx]
cmp bl, byte [edx]
mov byte [esp + 0x24], bl
mov ebx, dword [esp + 0x28]
jne 0x47954f
cmp byte [esp + 0x24], 0
je 0x479542
mov bl, byte [ecx + 1]
cmp bl, byte [edx + 1]
mov byte [esp + 0x24], bl
mov ebx, dword [esp + 0x28]
jne 0x47954f
add ecx, 2
add edx, 2
cmp byte [esp + 0x24], 0
jne 0x479510
xor ecx, ecx
jmp 0x479554
mov edi, dword [esp + 0x24]
jmp 0x4794b0
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x47958d
mov ecx, str..rr_moved
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x479580
test dl, dl
je 0x47957c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x479580
add eax, 2
add ecx, 2
test dl, dl
jne 0x479560
xor eax, eax
jmp 0x479585
sbb eax, eax
or eax, 1
test eax, eax
jne 0x47963e
mov dword [ebp + 0x1c], esi
mov word [esi + 0x38], 0x101
mov byte [esi + 0x3a], 0
dec dword [ebx + 0x10]
mov ecx, dword [esp + 0x30]
mov eax, dword [esi + 0x40]
or eax, dword [esi + 0x44]
je 0x4796ae
test ebx, ebx
je 0x47960f
cmp dword [ebx + 4], 0
je 0x47960f
test cl, 2
jne 0x47960f
inc dword [ebx + 0x10]
mov edx, dword [esi + 0x40]
mov ecx, edx
mov eax, dword [esi + 0x44]
add ecx, 1
mov dword [esi + 0x80], ecx
adc eax, 0
mov dword [esi + 0x20], ecx
mov ecx, dword [esi + 0x44]
mov dword [esi + 0x84], eax
mov dword [esi + 0x24], eax
mov eax, ebx
cmp dword [eax + 0x20], edx
jne 0x4795ee
cmp dword [eax + 0x24], ecx
je 0x47960f
mov eax, dword [eax + 4]
test eax, eax
jne 0x4795e4
mov eax, dword [esi + 0x40]
cmp eax, dword [esi + 0x20]
jne 0x479605
mov eax, dword [esi + 0x44]
cmp eax, dword [esi + 0x24]
je 0x47960f
cmp byte [ebx + 0x38], 0
je 0x4796ae
push str.Invalid_Rockridge_CL
push 0xffffffffffffffff
push edi
call fcn.00469db0
add esp, 0xc
lea eax, [esi + 0x8c]
push eax
call fcn.00497060
push esi
call fcn.00687807
add esp, 8
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret
cmp byte [esi + 0x3a], 0
je 0x479671
test ebx, ebx
je 0x47966a
cmp byte [ebx + 0x38], 0
je 0x47966a
mov eax, dword [esi + 0x40]
or eax, dword [esi + 0x44]
je 0x47965d
push str.Invalid_Rockridge_RE_and_CL
jmp 0x479614
mov ecx, dword [esp + 0x30]
test cl, 2
jne 0x4795a1
push str.Invalid_Rockridge_RE
jmp 0x479614
test ebx, ebx
je 0x47959d
cmp byte [ebx + 0x38], 0
mov ecx, dword [esp + 0x30]
je 0x47968c
mov byte [esi + 0x39], 0
jmp 0x4795a1
test cl, 2
je 0x4795a1
cmp byte [ebx + 0x3a], 0
jne 0x4796a5
cmp byte [ebx + 0x3b], 0
je 0x4795a1
mov byte [esi + 0x3b], 1
jmp 0x4795a1
mov eax, dword [ebp + 0x44]
mov dword [esi], eax
mov eax, esi
pop edi
mov dword [ebp + 0x44], esi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret
push str.Invalid_length_of_file_identifier
push 0xffffffffffffffff
push edx
call fcn.00469db0
add esp, 0xc
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x10
ret
push str.Invalid_length_of_directory_record
push 0xffffffffffffffff
push edx
call fcn.00469db0
add esp, 0xc
xor eax, eax
pop esi
pop ebx
add esp, 0x10
ret