Function at 0x549910
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ecx, dword [eax]
push 0x1c
push 0x59cb58
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je case.0x549bbd.1
mov eax, dword [0x59cb5c]
mov edi, eax
cmp word [eax], 0x5a4d
mov dword [ebp - 4], edi
jne case.0x549bbd.1
mov ecx, dword [eax + 0x3c]
xor esi, esi
add ecx, eax
xor eax, eax
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ax, word [ecx + 0x14]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 8], eax
cmp word [ecx + 6], si
jbe 0x5499dd
test esi, esi
jne 0x549990
mov ecx, 7
mov edi, str..trace
mov esi, eax
xor ebx, ebx
repe cmpsb byte [esi], byte es:[edi]
jne 0x549990
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
jmp 0x5499b4
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x5499b4
mov ecx, 3
mov edi, str..text
mov esi, eax
xor ebx, ebx
repe cmpsw word [esi], word es:[edi]
jne 0x5499b4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 1
mov esi, dword [ebp - 0x20]
add eax, 0x28
xor ecx, ecx
mov dword [ebp - 8], eax
mov cx, word [esi + 6]
mov esi, dword [ebp - 0x10]
inc edx
cmp edx, ecx
jb 0x54996e
test esi, esi
je 0x5499da
mov edx, dword [ebp - 0x1c]
mov edi, dword [ebp - 4]
mov dword [ebp - 8], edx
jmp 0x5499f1
mov edi, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.00549f40
add esp, 4
test eax, eax
je case.0x549bbd.1
mov eax, dword [ebp - 0x18]
push edi
push eax
call fcn.00549ef0
add esp, 8
cmp eax, 1
jne 0x549a21
mov edx, dword [ebp + 8]
mov edi, str.Unknown
or ecx, 0xffffffff
mov esi, str.Unknown
mov dword [edx], eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jmp 0x549e24
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 8]
cmp ecx, 0x10
mov dword [ebp - 0x20], ecx
jb case.0x549bbd.1
test esi, esi
jne 0x549a3c
mov eax, dword [eax + 0x14]
jmp 0x549a3f
mov eax, dword [eax + 0xc]
add eax, edi
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dl, byte [eax]
mov esi, edx
cmp esi, 0xb
ja case.0x549bbd.1
xor edx, edx
mov dl, byte [esi + 0x549ea0]
jmp dword [edx*4 + 0x549e8c]
mov edx, 1
jmp 0x549aad
mov edx, 8
jmp 0x549aad
mov esi, dword [eax + 4]
mov ebx, dword [eax + 8]
mov edx, dword [eax + 0xc]
add ebx, esi
mov esi, dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 0x1c], edi
mov esi, dword [esi]
cmp esi, ebx
jae 0x549aad
cmp esi, dword [eax + 4]
jae 0x549ad0
jmp 0x549aad
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 8]
mov ebx, dword [eax + 4]
mov edx, dword [eax + 0xc]
mov edi, dword [edi]
add ebx, esi
cmp edi, ebx
mov dword [ebp - 0x18], eax
jae 0x549aad
cmp edi, esi
jae 0x549acd
mov esi, dword [ebp - 0x20]
add ecx, edx
cmp ecx, esi
jae case.0x549bbd.1
add eax, edx
xor edx, edx
mov dl, byte [eax]
mov esi, edx
cmp esi, 0xb
ja case.0x549bbd.1
jmp 0x549a55
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x10]
xor edx, edx
mov dl, byte [eax]
mov dword [ebp - 4], 0
dec edx
je 0x549b35
sub edx, 0xa
jne case.0x549bbd.1
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + 0xc]
mov dword [ebp - 0x14], esi
lea esi, [edx + 0x10]
inc edx
mov dword [ebp - 0xc], esi
mov esi, 0x10
mov di, word [edx]
mov word [ebp - 4], di
mov dl, byte [edx + 2]
mov byte [ebp - 2], dl
mov edx, dword [ebp - 4]
test edx, edx
jbe 0x549b7b
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov dx, word [edi]
and edx, 0xffff
lea esi, [esi + edx + 2]
lea edi, [edi + edx + 2]
mov edx, dword [ebp - 0x10]
dec edx
mov dword [ebp - 0x10], edx
jne 0x549b19
jmp 0x549b7b
mov edx, dword [edi + 0xc]
mov esi, 0x10
mov dword [ebp - 0x14], edx
lea edx, [edi + 0x10]
inc edi
mov dword [ebp - 0xc], edx
mov dx, word [edi]
mov word [ebp - 4], dx
mov dl, byte [edi + 2]
mov byte [ebp - 2], dl
mov edx, dword [ebp - 4]
test edx, edx
jbe 0x549b7b
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov dx, word [edi]
and edx, 0xffff
lea esi, [esi + edx + 2]
lea edi, [edi + edx + 2]
mov edx, dword [ebp - 0x10]
dec edx
mov dword [ebp - 0x10], edx
jne 0x549b61
add eax, esi
add ecx, esi
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], edi
cmp ecx, dword [ebp - 0x14]
je case.0x549bbd.1
xor edx, edx
mov dl, byte [eax]
mov esi, edx
and esi, 0xc0
sub esi, 0x80
je 0x549d28
sub esi, 0x40
je 0x549d02
cmp edx, 0xd
ja case.0x549bbd.1
jmp dword [edx*4 + 0x549eac]
inc eax
inc ecx
jmp 0x549b8a
add eax, 8
mov ecx, eax
sub ecx, ebx
jmp 0x549b8a
mov ecx, dword [eax + 1]
mov edx, dword [ebp - 0xc]
inc ecx
mov dword [ebp - 0x18], ecx
xor ecx, ecx
lea esi, [edx + 2]
mov cx, word [edx]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
lea edx, [edx + ecx + 2]
mov ecx, dword [ebp - 0x18]
dec ecx
mov dword [ebp - 0x18], ecx
jne 0x549bdb
add eax, 5
mov dword [ebp - 0xc], edx
mov ecx, eax
sub ecx, ebx
jmp 0x549b8a
mov ecx, dword [ebp + 0xc]
mov edi, dword [eax + 4]
cmp dword [ecx], edi
jb case.0x549bbd.1
xor ecx, ecx
mov cx, word [eax + 2]
test ecx, ecx
mov dword [ebp - 0x1c], ecx
je 0x549c23
lea edx, [eax + 8]
mov dword [ebp - 0x10], edx
lea eax, [eax + ecx + 8]
mov ecx, eax
sub ecx, ebx
jmp 0x549b8a
mov ecx, dword [ebp + 0xc]
mov edi, dword [eax + 8]
cmp dword [ecx], edi
jb case.0x549bbd.1
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
mov dword [ebp - 0x1c], ecx
je 0x549c51
lea edx, [eax + 0xc]
mov dword [ebp - 0x10], edx
lea eax, [eax + ecx + 0xc]
mov ecx, eax
sub ecx, ebx
jmp 0x549b8a
movsx ecx, byte [eax + 1]
mov edx, dword [ebp - 4]
add eax, 2
add edx, ecx
mov ecx, eax
mov dword [ebp - 4], edx
sub ecx, ebx
jmp 0x549b8a
movsx edx, word [eax + 1]
mov ecx, dword [ebp - 4]
add eax, 3
add ecx, edx
mov dword [ebp - 4], ecx
mov ecx, eax
sub ecx, ebx
jmp 0x549b8a
mov ecx, dword [eax + 1]
mov edx, dword [ebp - 4]
add eax, 5
add edx, ecx
mov ecx, eax
mov dword [ebp - 4], edx
sub ecx, ebx
jmp 0x549b8a
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [eax + 1]
lea edi, [edi + edx + 1]
mov edx, dword [ecx]
cmp edi, edx
jae 0x549d47
add eax, 2
mov ecx, eax
sub ecx, ebx
jmp 0x549b8a
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dx, word [eax + 1]
lea edi, [edi + edx + 1]
mov edx, dword [ecx]
cmp edi, edx
jae 0x549d47
add eax, 3
mov ecx, eax
sub ecx, ebx
jmp 0x549b8a
mov edx, dword [eax + 1]
mov ecx, dword [ebp + 0xc]
lea edi, [edi + edx + 1]
mov edx, dword [ecx]
cmp edi, edx
jae 0x549d47
add eax, 5
mov ecx, eax
sub ecx, ebx
jmp 0x549b8a
movsx ecx, byte [eax + 1]
mov esi, dword [ebp - 4]
and edx, 0x3f
add esi, ecx
lea edi, [edi + edx + 1]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], esi
cmp edi, dword [edx]
jae 0x549d47
add eax, 2
mov ecx, eax
sub ecx, ebx
jmp 0x549b8a
mov ecx, dword [ebp - 4]
and edx, 0x3f
inc ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0xc]
lea edi, [edi + edx + 1]
cmp edi, dword [ecx]
jae 0x549d47
inc eax
mov ecx, eax
sub ecx, ebx
jmp 0x549b8a
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 0xa
lea eax, [ebx + 0x20c]
push eax
push ecx
call fcn.005665f3
mov eax, dword [ebp - 0x10]
add esp, 0xc
test eax, eax
je 0x549d86
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x10]
mov ecx, eax
lea edi, [ebx + 4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [eax + ebx + 4], 0
jmp 0x549dab
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
mov esi, str.Unknown
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebx + 4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x549ddc
mov eax, dword [ebp - 0x24]
lea edi, [ebx + 0x108]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov byte [eax + ebx + 0x108], 0
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
mov esi, str.Unknown
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [ebx + 0x108]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, str.Unknown
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, str.Unknown
mov eax, ecx
lea edi, [edx + 4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Unknown
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, str.Unknown
mov eax, ecx
lea edi, [edx + 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Unknown
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [edx + 0x20c]
mov edx, ecx
mov esi, str.Unknown
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret