Function at 0x5a6140
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ecx, dword [eax]
push 0x1c
push 0x7077d0
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edi, edi
cmp eax, edi
je case.0x5a632b.1
mov eax, dword [0x7077d4]
mov esi, eax
cmp word [eax], 0x5a4d
mov dword [ebp - 0x18], esi
jne case.0x5a632b.1
mov ecx, dword [eax + 0x3c]
xor edx, edx
add ecx, eax
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], edi
mov ax, word [ecx + 0x14]
mov dword [ebp - 8], edi
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0xc], eax
cmp word [ecx + 6], di
jbe 0x5a61fd
test edi, edi
jne 0x5a61c0
mov ecx, 7
mov edi, str..trace
mov esi, eax
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x5a61c0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
jmp 0x5a61e3
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x5a61e3
mov ecx, 6
mov edi, str..text
mov esi, eax
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x5a61e3
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
add eax, 0x28
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov cx, word [esi + 6]
inc edx
cmp edx, ecx
jb 0x5a619e
mov esi, dword [ebp - 0x18]
test edi, edi
je 0x5a6209
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
jmp 0x5a621d
lea eax, [ebp - 0xc]
push eax
call fcn.005a6640
add esp, 4
test eax, eax
je case.0x5a632b.1
mov eax, dword [ebp - 4]
push esi
push eax
call fcn.005a65f0
add esp, 8
cmp eax, 1
jne 0x5a624d
mov edx, dword [ebp + 8]
mov edi, str.Unknown
or ecx, 0xffffffff
mov esi, str.Unknown
mov dword [edx], eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x5a655e
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 8]
cmp ebx, 0x10
jb case.0x5a632b.1
test edi, edi
jne 0x5a6265
mov edi, dword [eax + 0x14]
jmp 0x5a6268
mov edi, dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
add edi, esi
xor eax, eax
mov esi, dword [ecx]
mov dword [ebp - 0x10], esi
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
add ecx, edx
mov edx, dword [edi + 0xc]
add eax, edx
cmp esi, ecx
jb 0x5a62a7
cmp eax, ebx
je case.0x5a632b.1
add edi, edx
cmp byte [edi], 0
jne 0x5a62a3
inc edi
inc eax
cmp eax, ebx
je case.0x5a632b.1
cmp byte [edi], 0
je 0x5a6294
cmp esi, ecx
jae 0x5a6274
lea eax, [edi + 1]
xor ebx, ebx
mov dword [ebp + 0xc], ebx
mov ecx, 0x10
mov dx, word [eax]
mov word [ebp + 0xc], dx
mov al, byte [eax + 2]
mov byte [ebp + 0xe], al
mov esi, dword [ebp + 0xc]
cmp esi, ebx
jbe 0x5a62e2
cmp esi, ebx
lea edx, [edi + 0x10]
jbe 0x5a62e2
mov ax, word [edx]
and eax, 0xffff
dec esi
lea ecx, [ecx + eax + 2]
lea edx, [edx + eax + 2]
jne 0x5a62cf
lea eax, [ecx + edi]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 0
cmp ecx, dword [edi + 0xc]
je 0x5a6479
xor edx, edx
mov dl, byte [eax]
mov esi, edx
and esi, 0xc0
sub esi, 0x80
je 0x5a6448
sub esi, 0x40
je 0x5a641a
cmp edx, 9
ja case.0x5a632b.1
jmp dword [edx*4 + 0x5a65c8]
inc eax
inc ecx
jmp 0x5a646e
mov edx, dword [eax + 1]
lea ecx, [edi + 0x10]
inc edx
mov dword [ebp - 0x14], edx
xor edx, edx
lea esi, [ecx + 2]
mov dx, word [ecx]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], edx
lea ecx, [ecx + edx + 2]
mov edx, dword [ebp - 0x14]
dec edx
mov dword [ebp - 0x14], edx
jne 0x5a6343
add eax, 5
jmp 0x5a646a
mov ebx, dword [eax + 4]
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
jb case.0x5a632b.1
xor ecx, ecx
mov cx, word [eax + 2]
test ecx, ecx
mov dword [ebp - 0x20], ecx
je 0x5a6387
lea edx, [eax + 8]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], ebx
lea eax, [eax + ecx + 8]
jmp 0x5a646a
movsx ecx, byte [eax + 1]
mov edx, dword [ebp + 0xc]
add edx, ecx
add eax, 2
mov dword [ebp + 0xc], edx
jmp 0x5a646a
movsx edx, word [eax + 1]
mov ecx, dword [ebp + 0xc]
add ecx, edx
add eax, 3
mov dword [ebp + 0xc], ecx
jmp 0x5a646a
mov ecx, dword [eax + 1]
mov edx, dword [ebp + 0xc]
add edx, ecx
add eax, 5
mov dword [ebp + 0xc], edx
jmp 0x5a646a
xor edx, edx
mov dl, byte [eax + 1]
lea ebx, [ebx + edx + 1]
jmp 0x5a6430
xor edx, edx
mov dx, word [eax + 1]
lea ebx, [ebx + edx + 1]
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 4], ebx
jb 0x5a63f6
mov dword [ebp - 8], 1
jmp 0x5a646e
add eax, 3
jmp 0x5a646a
mov edx, dword [eax + 1]
lea ebx, [ebx + edx + 1]
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 4], ebx
jb 0x5a6415
mov dword [ebp - 8], 1
jmp 0x5a646e
add eax, 5
jmp 0x5a646a
movsx esi, byte [eax + 1]
mov ebx, dword [ebp + 0xc]
add ebx, esi
mov esi, dword [ebp - 4]
and edx, 0x3f
mov dword [ebp + 0xc], ebx
lea ebx, [esi + edx + 1]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], ebx
cmp ebx, edx
jb 0x5a6443
mov dword [ebp - 8], 1
jmp 0x5a646e
add eax, 2
jmp 0x5a646a
mov esi, dword [ebp + 0xc]
and edx, 0x3f
inc esi
lea ebx, [ebx + edx + 1]
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp + 0xc], esi
mov dword [ebp - 4], ebx
jb 0x5a6469
mov dword [ebp - 8], 1
jmp 0x5a646e
inc eax
mov ecx, eax
sub ecx, edi
mov edx, dword [ebp - 8]
test edx, edx
je 0x5a62f8
mov eax, dword [ebp - 8]
test eax, eax
je case.0x5a632b.1
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 0xa
lea eax, [ebx + 0x20c]
push eax
push ecx
call fcn.005c4b0c
mov esi, dword [ebp - 0x18]
add esp, 0xc
test esi, esi
je 0x5a64c0
mov eax, dword [ebp - 0x20]
lea edi, [ebx + 4]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [eax + ebx + 4], 0
jmp 0x5a64e5
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
mov esi, str.Unknown
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebx + 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x5a6516
mov eax, dword [ebp - 0x24]
lea edi, [ebx + 0x108]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [eax + ebx + 0x108], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
mov esi, str.Unknown
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebx + 0x108]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, str.Unknown
mov eax, ecx
lea edi, [edx + 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Unknown
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, str.Unknown
mov eax, ecx
lea edi, [edx + 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Unknown
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [edx + 0x20c]
mov edx, ecx
mov esi, str.Unknown
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret