Function at 0x140001d13
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xa0
lea rbp, [rsp + 0xa0]
mov dword [rbp + 0x20], ecx
mov qword [rbp + 0x28], rdx
call sym.__main
mov rax, qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call rax
test eax, eax
setne al
test al, al
je 0x140001d5c
lea rax, str.attached_debugger_detected_:__n
mov rcx, rax
call sym.printf_char_const__::_
mov ebx, 0xfffffffe
jmp 0x14000210f
call sym.checkNUMA__
test eax, eax
setne al
test al, al
je 0x140001d83
lea rax, str.NUMA_memory_allocate_failed_:___n
mov rcx, rax
call sym.printf_char_const__::_
mov ebx, 0xfffffffe
jmp 0x14000210f
call sym.checkResources__
test eax, eax
sete al
test al, al
je 0x140001daa
lea rax, str.possibly_launched_in_sandbox_:__n
mov rcx, rax
call sym.printf_char_const__::_
mov ebx, 0xfffffffe
jmp 0x14000210f
mov qword [rbp - 0x28], 0
mov ecx, 0x5f5e100
call sym.malloc
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0
je 0x14000210a
mov rax, qword [rbp - 0x28]
mov r8d, 0x5f5e100
mov edx, 0
mov rcx, rax
call sym.memset
mov rax, qword [rbp - 0x28]
mov rcx, rax
call sym.free
lea rax, [rbp - 0x70]
lea rdx, [sym.DetectUnknownModules__]
mov rcx, rax
call method.std::thread.thread_void_________void__void______
lea rax, [rbp - 0x70]
mov rcx, rax
call method.std::thread.detach__
lea rax, section..data
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x30]
mov eax, dword [rax + 0x3c]
cdqe
lea rdx, section..data
add rax, rdx
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x80]
mov rcx, rax
call method.MemoryManager.MemoryManager__
mov rax, qword [rbp - 0x38]
mov eax, dword [rax + 0x50]
mov ecx, eax
mov rax, qword [rbp - 0x38]
mov rax, qword [rax + 0x30]
mov rdx, rax
lea rax, [rbp - 0x80]
mov r9d, 4
mov r8, rcx
mov rcx, rax
call method.MemoryManager.AllocateMemory_void__unsigned_long_long__unsigned_long_
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001eac
mov rax, qword [rbp - 0x38]
mov eax, dword [rax + 0x50]
mov edx, eax
lea rax, [rbp - 0x80]
mov r9d, 4
mov r8, rdx
mov edx, 0
mov rcx, rax
call method.MemoryManager.AllocateMemory_void__unsigned_long_long__unsigned_long_
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001eac
mov ebx, 1
mov esi, 0
jmp 0x1400020f9
mov rax, qword [rbp - 0x38]
mov eax, dword [rax + 0x54]
mov edx, eax
mov rax, qword [rbp - 8]
mov r8, rdx
lea rdx, section..data
mov rcx, rax
call sym.memcpy
mov rax, qword [rbp - 0x38]
movzx eax, word [rax + 0x14]
movzx eax, ax
mov rdx, qword [rbp - 0x38]
add rax, rdx
add rax, 0x18
mov qword [rbp - 0x40], rax
mov word [rbp - 0xa], 0
jmp 0x140001f7c
movzx edx, word [rbp - 0xa]
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp - 0x40]
add rax, rdx
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x68], rax
movzx edx, word [rbp - 0xa]
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp - 0x40]
add rax, rdx
mov eax, dword [rax + 0x10]
mov ecx, eax
movzx edx, word [rbp - 0xa]
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
mov rdx, rax
mov rax, qword [rbp - 0x40]
add rax, rdx
mov eax, dword [rax + 0x14]
mov edx, eax
lea rax, section..data
add rdx, rax
mov rax, qword [rbp - 0x68]
mov r8, rcx
mov rcx, rax
call sym.memcpy
add word [rbp - 0xa], 1
mov rax, qword [rbp - 0x38]
movzx eax, word [rax + 6]
cmp word [rbp - 0xa], ax
jb 0x140001ef0
mov rax, qword [rbp - 0x38]
mov rax, qword [rax + 0x30]
cmp qword [rbp - 8], rax
je 0x14000208a
mov rax, qword [rbp - 0x38]
mov eax, dword [rax + 0xb0]
mov edx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x18], rax
jmp 0x14000207c
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 4]
cmp eax, 7
jbe 0x14000206f
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 4]
mov eax, eax
sub rax, 8
shr rax, 1
mov dword [rbp - 0x44], eax
mov rax, qword [rbp - 0x18]
add rax, 8
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x1c], 0
jmp 0x140002067
mov eax, dword [rbp - 0x1c]
cdqe
lea rdx, [rax + rax]
mov rax, qword [rbp - 0x50]
add rax, rdx
movzx eax, word [rax]
shr ax, 0xc
cmp ax, 0xa
jne 0x140002063
mov rax, qword [rbp - 0x18]
mov eax, dword [rax]
mov ecx, eax
mov eax, dword [rbp - 0x1c]
cdqe
lea rdx, [rax + rax]
mov rax, qword [rbp - 0x50]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
and eax, 0xfff
lea rdx, [rcx + rax]
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x58]
mov rcx, qword [rax]
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x38]
mov rax, qword [rax + 0x30]
sub rdx, rax
add rdx, rcx
mov rax, qword [rbp - 0x58]
mov qword [rax], rdx
add dword [rbp - 0x1c], 1
mov eax, dword [rbp - 0x1c]
cmp eax, dword [rbp - 0x44]
jl 0x140001ff4
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 4]
mov eax, eax
add qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax]
test eax, eax
jne 0x140001fbc
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.ProcessImportTable_void_
mov rax, qword [rbp - 0x38]
mov eax, dword [rax + 0x28]
mov edx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x60], rax
mov rax, qword [rbp - 0x38]
mov eax, dword [rax + 0x50]
mov ecx, eax
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0x80]
mov r9d, 0x40
mov r8, rcx
mov rcx, rax
call method.MemoryManager.RevertCodeSectionProtection_void__unsigned_long_long__unsigned_long_
mov rax, qword [rbp - 0x60]
call rax
mov rax, qword [rbp - 0x38]
mov eax, dword [rax + 0x50]
mov ecx, eax
mov rdx, qword [rbp - 8]
lea rax, [rbp - 0x80]
mov r9d, 4
mov r8, rcx
mov rcx, rax
call method.MemoryManager.RevertCodeSectionProtection_void__unsigned_long_long__unsigned_long_
mov esi, 1
lea rax, [rbp - 0x70]
mov rcx, rax
call method.std::thread.thread__
cmp esi, 1
jne 0x14000210f
mov ebx, 0
mov eax, ebx
jmp 0x14000212d
add rsp, 0xa0
pop rbx
pop rsi
pop rbp
ret