Function at 0x401270
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x740
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
xor ebx, ebx
push 0x40
mov dword [ebp - 0x6dc], eax
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x6d4], eax
lea eax, [ebp - 0x73c]
push ebx
push eax
mov edi, ecx
mov dword [ebp - 0x6e0], ebx
mov dword [ebp - 0x740], ebx
call fcn.00401770
push 0x2c8
lea ecx, [ebp - 0x6c8]
push ebx
push ecx
mov dword [ebp - 0x6cc], ebx
call fcn.00401770
mov edx, 0x5a4d
add esp, 0x18
mov dword [ebp - 0x6e8], ebx
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x6f8], ebx
cmp word [esi], dx
jne 0x401541
mov ebx, dword [esi + 0x3c]
add ebx, esi
cmp dword [ebx], 0x4550
mov dword [ebp - 0x6e4], ebx
jne 0x40153f
push 0x44
lea eax, [ebp - 0x740]
push eax
call dword [0x40335c]
push pe_nt_image_headers32
lea ecx, [ebp - 0x6e0]
push ecx
call dword [0x40335c]
push 0x1fe
lea edx, [ebp - 0x400]
push edx
push 0
mov dword [ebp - 0x740], 0x44
call dword [0x403350]
test eax, eax
je 0x40154f
push 0
lea eax, [ebp - 0x6e0]
push eax
lea ecx, [ebp - 0x740]
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
push edi
lea edx, [ebp - 0x400]
push edx
push 0
mov dword [ebp - 0x6cc], 0x10002
call dword [0x403354]
test eax, eax
je 0x40153f
mov ecx, dword [ebp - 0x6dc]
lea eax, [ebp - 0x6cc]
push eax
push ecx
call dword [0x403360]
test eax, eax
js 0x40153f
mov eax, dword [ebp - 0x628]
lea edx, [ebp - 0x6d0]
push edx
mov edx, dword [ebp - 0x6e0]
push 4
lea ecx, [ebp - 0x6e8]
add eax, 8
push ecx
push eax
push edx
mov dword [ebp - 0x6fc], eax
call dword [0x403368]
test eax, eax
js 0x40153f
mov eax, dword [ebp - 0x6e8]
cmp eax, dword [ebx + 0x34]
jne 0x4013f6
push eax
mov eax, dword [ebp - 0x6e0]
push eax
call dword [0x40336c]
mov ecx, dword [ebx + 0x50]
mov edx, dword [ebx + 0x34]
push 0x40
push 0x3000
lea eax, [ebp - 0x6f4]
push eax
mov dword [ebp - 0x6f4], ecx
push 0
lea ecx, [ebp - 0x6ec]
mov dword [ebp - 0x6ec], edx
mov edx, dword [ebp - 0x6e0]
push ecx
push edx
call dword [0x403370]
test eax, eax
js 0x40153f
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x6f0], eax
test eax, eax
je 0x40153f
mov edx, dword [ebx + 0x54]
lea ecx, [ebp - 0x6d0]
push ecx
push edx
push esi
push eax
mov eax, dword [ebp - 0x6e0]
push eax
call dword [0x403374]
test eax, eax
js 0x40153f
xor ecx, ecx
xor edi, edi
cmp cx, word [ebx + 6]
jae 0x4014c9
xor ebx, ebx
jmp 0x401480
mov eax, dword [esi + 0x3c]
lea edx, [ebx + esi]
lea eax, [edx + eax + 0xf8]
mov edx, dword [eax + 0x10]
lea ecx, [ebp - 0x6d0]
push ecx
mov ecx, dword [eax + 0x14]
push edx
mov edx, dword [eax + 0xc]
add edx, dword [ebp - 0x6f0]
mov eax, dword [ebp - 0x6e0]
add ecx, esi
push ecx
push edx
push eax
call dword [0x403374]
mov ecx, dword [ebp - 0x6e4]
movzx edx, word [ecx + 6]
inc edi
add ebx, 0x28
cmp edi, edx
jb 0x401480
mov ebx, ecx
mov ecx, dword [ebp - 0x6fc]
mov edx, dword [ebp - 0x6e0]
lea eax, [ebp - 0x6d0]
push eax
push 4
lea eax, [ebx + 0x34]
push eax
push ecx
push edx
call dword [0x403374]
test eax, eax
js 0x40153f
mov eax, dword [ebx + 0x28]
add eax, dword [ebp - 0x6f0]
mov edx, dword [ebp - 0x6dc]
lea ecx, [ebp - 0x6cc]
push ecx
push edx
mov dword [ebp - 0x61c], eax
call dword [0x403364]
test eax, eax
js 0x40153f
mov ecx, dword [ebp - 0x6dc]
lea eax, [ebp - 0x6f8]
push eax
push ecx
call dword [0x403378]
test eax, eax
js 0x40153f
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040164e
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov edx, dword [ebp - 0x6e0]
push ebx
push edx
call dword [0x40337c]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0040164e
mov esp, ebp
pop ebp
ret