Function at 0x425cb0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ecx, dword [eax]
push 0x1c
push 0x47dd70
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
cmp eax, edx
je case.0x425eba.1
mov eax, dword [0x47dd74]
mov esi, eax
cmp word [eax], 0x5a4d
mov dword [ebp - 0x18], esi
jne case.0x425eba.1
mov ecx, dword [eax + 0x3c]
xor edi, edi
add ecx, eax
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], edi
mov ax, word [ecx + 0x14]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], edx
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 4], eax
cmp word [ecx + 6], dx
jbe 0x425da9
test edi, edi
jne 0x425d3a
mov ecx, 7
mov edi, str..trace
mov esi, eax
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x425d3a
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 1
jmp 0x425d8b
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x425d6b
mov ecx, 6
mov edi, str..text
mov esi, eax
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x425d6b
mov ecx, dword [eax + 0xc]
mov esi, dword [0x47dd74]
mov dword [ebp - 8], 1
mov ecx, dword [ecx + esi]
mov dword [ebp - 0x14], ecx
jmp 0x425d8b
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x425d8b
mov ecx, 7
mov edi, str..reloc
mov esi, eax
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x425d8b
mov dword [ebp - 0xc], 1
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
add eax, 0x28
xor ecx, ecx
mov dword [ebp - 4], eax
mov cx, word [esi + 6]
inc edx
cmp edx, ecx
jb 0x425d18
mov esi, dword [ebp - 0x18]
test edi, edi
je 0x425db5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
jmp 0x425dcc
lea edx, [ebp - 4]
push edx
call fcn.00426180
add esp, 4
test eax, eax
je case.0x425eba.1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x425ddd
cmp byte [ebp - 0x14], 0xe9
je case.0x425eba.1
mov ebx, dword [eax + 8]
cmp ebx, 0x10
jb case.0x425eba.1
test edi, edi
jne 0x425df2
mov edi, dword [eax + 0x14]
jmp 0x425df5
mov edi, dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
add edi, esi
xor eax, eax
mov esi, dword [ecx]
mov dword [ebp - 0x10], esi
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
add ecx, edx
mov edx, dword [edi + 0xc]
add eax, edx
cmp esi, ecx
jb 0x425e34
cmp eax, ebx
je case.0x425eba.1
add edi, edx
cmp byte [edi], 0
jne 0x425e30
inc edi
inc eax
cmp eax, ebx
je case.0x425eba.1
cmp byte [edi], 0
je 0x425e21
cmp esi, ecx
jae 0x425e01
lea eax, [edi + 1]
xor ebx, ebx
mov dword [ebp + 0xc], ebx
mov ecx, 0x10
mov dx, word [eax]
mov word [ebp + 0xc], dx
mov al, byte [eax + 2]
mov byte [ebp + 0xe], al
mov esi, dword [ebp + 0xc]
cmp esi, ebx
jbe 0x425e71
cmp esi, ebx
lea edx, [edi + 0x10]
jbe 0x425e71
mov ax, word [edx]
and eax, 0xffff
dec esi
lea ecx, [ecx + eax + 2]
lea edx, [edx + eax + 2]
jne 0x425e5c
xor ebx, ebx
lea eax, [ecx + edi]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 0
cmp ecx, dword [edi + 0xc]
je 0x426008
xor edx, edx
mov dl, byte [eax]
mov esi, edx
and esi, 0xc0
sub esi, 0x80
je 0x425fd7
sub esi, 0x40
je 0x425fa9
cmp edx, 9
ja case.0x425eba.1
jmp dword [edx*4 + 0x426154]
inc eax
inc ecx
jmp 0x425ffd
mov edx, dword [eax + 1]
lea ecx, [edi + 0x10]
inc edx
mov dword [ebp - 0x14], edx
xor edx, edx
lea esi, [ecx + 2]
mov dx, word [ecx]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], edx
lea ecx, [ecx + edx + 2]
mov edx, dword [ebp - 0x14]
dec edx
mov dword [ebp - 0x14], edx
jne 0x425ed2
add eax, 5
jmp 0x425ff9
mov ebx, dword [eax + 4]
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
jb case.0x425eba.1
xor ecx, ecx
mov cx, word [eax + 2]
test ecx, ecx
mov dword [ebp - 0x20], ecx
je 0x425f16
lea edx, [eax + 8]
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], ebx
lea eax, [eax + ecx + 8]
jmp 0x425ff9
movsx ecx, byte [eax + 1]
mov edx, dword [ebp + 0xc]
add edx, ecx
add eax, 2
mov dword [ebp + 0xc], edx
jmp 0x425ff9
movsx edx, word [eax + 1]
mov ecx, dword [ebp + 0xc]
add ecx, edx
add eax, 3
mov dword [ebp + 0xc], ecx
jmp 0x425ff9
mov ecx, dword [eax + 1]
mov edx, dword [ebp + 0xc]
add edx, ecx
add eax, 5
mov dword [ebp + 0xc], edx
jmp 0x425ff9
xor edx, edx
mov dl, byte [eax + 1]
lea ebx, [ebx + edx + 1]
jmp 0x425fbf
xor edx, edx
mov dx, word [eax + 1]
lea ebx, [ebx + edx + 1]
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 8], ebx
jb 0x425f85
mov dword [ebp - 0xc], 1
jmp 0x425ffd
add eax, 3
jmp 0x425ff9
mov edx, dword [eax + 1]
lea ebx, [ebx + edx + 1]
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 8], ebx
jb 0x425fa4
mov dword [ebp - 0xc], 1
jmp 0x425ffd
add eax, 5
jmp 0x425ff9
movsx esi, byte [eax + 1]
mov ebx, dword [ebp + 0xc]
add ebx, esi
mov esi, dword [ebp - 8]
and edx, 0x3f
mov dword [ebp + 0xc], ebx
lea ebx, [esi + edx + 1]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
cmp ebx, edx
jb 0x425fd2
mov dword [ebp - 0xc], 1
jmp 0x425ffd
add eax, 2
jmp 0x425ff9
mov esi, dword [ebp + 0xc]
and edx, 0x3f
inc esi
lea ebx, [ebx + edx + 1]
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp + 0xc], esi
mov dword [ebp - 8], ebx
jb 0x425ff8
mov dword [ebp - 0xc], 1
jmp 0x425ffd
inc eax
mov ecx, eax
sub ecx, edi
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x425e87
mov eax, dword [ebp - 0xc]
test eax, eax
je case.0x425eba.1
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 0xa
lea eax, [ebx + 0x208]
push eax
push ecx
call fcn.004439e0
mov esi, dword [ebp - 0x18]
add esp, 0xc
test esi, esi
je 0x42604d
mov eax, dword [ebp - 0x20]
mov edi, ebx
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [eax + ebx], 0
jmp 0x426071
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
mov esi, str.Unknown
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x4260a2
mov eax, dword [ebp - 0x24]
lea edi, [ebx + 0x104]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [eax + ebx + 0x104], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
mov esi, str.Unknown
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebx + 0x104]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, str.Unknown
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Unknown
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, str.Unknown
mov eax, ecx
lea edi, [edx + 0x104]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Unknown
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [edx + 0x208]
mov edx, ecx
mov esi, str.Unknown
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret