Function at 0x5cad35
Capabilities:
Enumerate pe sections

Disassembly:
cmp dword [edi + 0x20], edx
mov dword [ebp - 8], 1
jne 0x5cac84
mov edx, dword [edi + 0x10]
mov ecx, dword [edi + 8]
add eax, 0xfff
shr eax, 0xa
and eax, 0x3ffffc
sub eax, 0x40000000
cmp edx, ecx
mov dword [ebp - 0x2c], edx
jb 0x5e4c1c
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 0x38]
add ecx, dword [edi + 0xc]
mov edx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x2c]
lea ecx, [ecx + edx - 0x1001]
shr ecx, 0xa
and ecx, 0x3ffffc
sub ecx, 0x40000000
cmp ecx, eax
mov eax, dword [ebp - 0x30]
jb 0x5cac84
and dword [ebp - 8], 0
jmp 0x5cac84
cmp dword [eax + 0x20], 0
jne 0x5cae4c
jmp 0x5caeb7
pop esi
pop ebx
mov ecx, 0x483b40
call sym.ntoskrnl.exe_ExReleaseResourceLite
inc dword [edi + 0xd4]
jne 0x5ca4d4
lea eax, [edi + 0x34]
cmp dword [eax], eax
jne 0x5e4d03
pop edi
leave
ret
cmp dword [ebp - 0xc], edx
jne 0x5cac38
add eax, 0xfff
shr eax, 0xa
and eax, 0x3ffffc
sub eax, 0x40000000
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 8]
cmp eax, ecx
jb 0x5e4c42
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 0x38]
add ecx, dword [edi + 0xc]
add ecx, eax
mov eax, dword [ebp - 0x18]
lea eax, [ecx + eax - 0x1001]
shr eax, 0xa
and eax, 0x3ffffc
sub eax, 0x40000000
mov dword [ebp - 0x24], eax
jmp 0x5cacb7
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp - 0x18]
add eax, ecx
cmp dword [edi + 0x18], eax
mov dword [ebp - 0x30], eax
je 0x5ca43a
mov dword [ebp - 8], edx
mov edx, dword [edi]
mov ecx, 0x45474150
cmp edx, ecx
je 0x5cacd6
cmp edx, 0x6164652e
je 0x5cacd6
and dword [ebp - 8], 0
cmp dword [edi], ecx
je 0x5cae14
xor edx, edx
cmp dword [ebp - 8], edx
jne 0x5cac1b
cmp dword [ebp - 0xc], edx
jne 0x5cae56
dec dword [ebp - 0x20]
add edi, 0x28
cmp dword [ebp - 0x20], edx
jg 0x5cac6d
cmp dword [ebp - 0xc], edx
jne 0x5e4c4e
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
jmp 0x5cad92
cmp dword [ebp - 8], 0
jne 0x5cac97
mov dword [ebp - 8], 1
jmp 0x5cac9b
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
test byte [0x487fa8], 1
jne 0x5ca4d5
and dword [ebp - 0x24], 0
push edi
mov eax, dword fs:[0x124]
mov edi, eax
dec dword [edi + 0xd4]
push 1
push 0x483b40
mov dword [ebp - 0x28], edi
call sym.ntoskrnl.exe_ExAcquireResourceExclusiveLite
mov eax, dword [0x483b20]
cmp eax, 0x483b20
mov dword [ebp - 0x14], eax
je 0x5ca4b7
push ebx
push esi
mov esi, dword [sym.imp.HAL.dll_KfLowerIrql]
mov ebx, 0x487fe0
cmp dword [eax + 0x3c], 0
je 0x5cada7
mov eax, dword [eax]
cmp eax, 0x483b20
mov dword [ebp - 0x14], eax
je 0x5ca4b5
mov eax, dword [ebp - 0x14]
jmp 0x5cad8c
mov ecx, dword [eax + 0x18]
mov edx, ecx
shr edx, 0x14
and edx, 0xffc
mov edx, dword [edx - 0x3fd00000]
and dx, 0x81
cmp dl, 0x81
mov dword [ebp - 0x18], ecx
je 0x5cad92
push ecx
call sym.ntoskrnl.exe_RtlImageNtHeader
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx ecx, word [eax + 0x14]
and dword [ebp - 0x10], 0
lea edi, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
xor edx, edx
cmp eax, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], edx
jle 0x5caccb
jmp 0x5cac6d
cmp byte [edi + 5], 0x52
jne 0x5cae21
cmp byte [edi + 6], 0x46
jne 0x5cae21
cmp dword [0x47a064], 0xffffffff
jne 0x5e4c24
jmp 0x5cae21
mov cl, byte [edi + 4]
cmp cl, 0x4b
je 0x5cae35
cmp cl, 0x56
je 0x5cadf9
xor edx, edx
cmp dword [edi + 4], 0x43455053
je 0x5e4c2e
jmp 0x5caca5
cmp byte [edi + 5], 0x44
jne 0x5cae1c
movzx edx, byte [0x475b7c]
mov dword [ebp - 8], edx
jmp 0x5cae1c
mov ecx, dword [ebp - 8]
jmp 0x5cae8c
mov cl, byte [ebp - 1]
call esi
jmp 0x5e4cc3
mov cl, 1
call dword [sym.imp.HAL.dll_KfRaiseIrql]
push 1
push ebx
mov byte [ebp - 2], al
call sym.ntoskrnl.exe_ExAcquireResourceExclusiveLite
mov eax, dword [ebp - 0x28]
mov dword [0x487fc4], eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x10]
mov ecx, eax
and ecx, 0xfffff000
cmp ecx, edi
mov dword [ebp - 8], ecx
jae 0x5caea4
call fcn.0041c90c
test eax, eax
jne 0x5cae4c
add dword [ebp - 8], 0x1000
cmp dword [ebp - 8], edi
jb 0x5cae47
mov eax, dword [ebp - 0x10]
cmp eax, edi
jae 0x5caebc
mov ecx, dword [eax + 0xc]
add ecx, dword [ebp - 0x18]
cmp dword [eax + 0x18], ecx
je 0x5ca4a6
add eax, 0x28
jmp 0x5caea4
push dword [ebp - 0x24]
push dword [ebp - 0xc]
call fcn.005caef3
mov cl, byte [ebp - 1]
call esi
and dword [0x487fc4], 0
mov ecx, ebx
call sym.ntoskrnl.exe_ExReleaseResourceLite
mov cl, byte [ebp - 2]
call esi
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
xor edx, edx
jmp 0x5cacb7
mov dword [ebp - 0x2c], ecx
jmp 0x5ca46d
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x5cae23
cmp dword [0x4837c0], edx
je 0x5caca5
mov dword [ebp - 8], edx
jmp 0x5caca5
mov eax, ecx
jmp 0x5cac46
mov cl, 1
call dword [sym.imp.HAL.dll_KfRaiseIrql]
push 1
push ebx
mov byte [ebp - 2], al
call sym.ntoskrnl.exe_ExAcquireResourceExclusiveLite
mov eax, dword [ebp - 0x28]
mov dword [0x487fc4], eax
call dword [sym.imp.HAL.dll_KeRaiseIrqlToDpcLevel]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x10]
mov ecx, eax
and ecx, 0xfffff000
cmp ecx, edi
mov dword [ebp - 8], ecx
jae 0x5e4ca5
jmp 0x5e4c89
mov ecx, dword [ebp - 8]
call fcn.0041c90c
test eax, eax
jne 0x5cae4c
add dword [ebp - 8], 0x1000
cmp dword [ebp - 8], edi
jb 0x5e4c86
mov eax, dword [ebp - 0x10]
cmp eax, edi
jae 0x5e4cdb
mov ecx, dword [eax + 0xc]
add ecx, dword [ebp - 0x18]
cmp dword [eax + 0x18], ecx
jne 0x5e4cbe
cmp dword [eax + 0x20], 0
jne 0x5cae4c
add eax, 0x28
jmp 0x5e4ca5
and dword [0x487fc4], 0
mov ecx, ebx
call sym.ntoskrnl.exe_ExReleaseResourceLite
mov cl, byte [ebp - 2]
call esi
jmp 0x5cadd1
push dword [ebp - 0x24]
push dword [ebp - 0xc]
call fcn.005caef3
mov cl, byte [ebp - 1]
call esi
and dword [0x487fc4], 0
mov ecx, ebx
call sym.ntoskrnl.exe_ExReleaseResourceLite
mov cl, byte [ebp - 2]
call esi
jmp 0x5caccb
mov cl, 1
mov byte [edi + 0x49], 1
call dword [sym.imp.HAL.dll_HalRequestSoftwareInterrupt]
jmp 0x5ca4d4