Function at 0x140041570
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x48]
sub rsp, 0x148
mov rax, qword [0x140068008]
xor rax, rsp
mov qword [rbp + 0x38], rax
mov eax, dword [rcx + 0x10]
mov r14, r8
mov dword [rbp - 0x30], eax
mov r15, r9
movzx eax, word [rcx + 0x14]
mov r12, rcx
mov word [rbp - 0x2c], ax
mov eax, dword [rdx + 0x18]
lea r8, [rax + 8]
add rax, 0x18
cmp dword [rdx + 0x78], 0x87
mov qword [rsp + 0x20], rax
mov eax, dword [rdx + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], r8
jne 0x140041a1a
mov ebx, eax
mov rax, r9
sub rax, rbx
cmp rax, 0x18
jb 0x140041a1a
movzx eax, byte [r14 + rbx + 9]
lea rsi, [r14 + rbx]
movzx ecx, byte [rsi + 8]
movzx edx, byte [rsi + 0x10]
shl rcx, 8
or rcx, rax
shl rdx, 8
movzx eax, byte [rsi + 0xa]
shl rcx, 8
or rcx, rax
mov byte [rsp + 0x60], 6
movzx eax, byte [rsi + 0xb]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 0xc]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 0xd]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 0xe]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 0xf]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi + 0x11]
or rdx, rax
mov qword [rsp + 0x50], rcx
movzx eax, byte [rsi + 0x12]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsi + 0x13]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsi + 0x14]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsi + 0x15]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsi + 0x16]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsi + 0x17]
shl rdx, 8
or rdx, rax
mov rax, qword [r12 + 0x18]
mov qword [rsp + 0x58], rdx
cmp qword [rax + 0x18], rcx
jne 0x140041a1a
cmp qword [rax + 0x20], rdx
jne 0x140041a1a
movzx eax, byte [r14 + r8 + 1]
lea rdx, [rsp + 0x40]
movzx ecx, byte [r14 + r8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 6]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 9]
mov qword [rsp + 0x40], rcx
movzx ecx, byte [r14 + r8 + 8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 0xa]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 0xb]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 0xc]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 0xd]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 0xe]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + r8 + 0xf]
shl rcx, 8
or rcx, rax
mov qword [rsp + 0x48], rcx
lea rcx, [rbp - 0x60]
call fcn.140007180
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
movups xmm0, xmmword [rax + 0x20]
movsd xmm1, qword [rsp + 0x60]
movups xmmword [rbp + 0x28], xmm0
movups xmm0, xmmword [rsp + 0x50]
movsd qword [rbp - 0x70], xmm1
movaps xmmword [rbp - 0x80], xmm0
call fcn.140007450
lea r9, [rbp - 0x28]
mov ecx, 1
lea r8, [rbp + 8]
lea rdx, str.___received_NDP_request_from__s_for__s_n
movups xmm2, xmmword [rax]
movups xmmword [rbp - 0x28], xmm2
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rbp - 8], xmm1
call fcn.14004d730
mov qword [rsp + 0x30], 0
nop word [rax + rax]
mov r8, qword [r12]
mov r9d, dword [r8 + 0x28]
mov eax, dword [r8 + 0x18]
mov ecx, dword [r8 + 0x10]
sub eax, r9d
cmp eax, 1
jae 0x140041842
call fcn.140034d20
mov rdi, rax
call fcn.140034d20
sub rax, rdi
cmp rax, 0x3e8
jb 0x140041830
jmp 0x140041810
lea edx, [r9 + 1]
mov dword [r8 + 0x28], edx
and rcx, r9
mov r13, qword [r8 + rcx*8 + 0x30]
mov dword [r8 + 0x2c], edx
test r13, r13
je 0x140041a1a
lea rdi, [r13 + 8]
mov r8, r15
mov rcx, rdi
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [r14 + 6]
mov rcx, qword [rsp + 0x28]
movzx edx, word [rbp - 0x2c]
lea r8, [rdi + rcx]
mov dword [rdi], eax
movzx eax, word [r14 + 0xa]
mov word [rdi + 4], ax
movups xmm0, xmmword [r14 + rcx]
mov rax, qword [rsp + 0x20]
mov ecx, dword [rbp - 0x30]
add rax, rdi
mov qword [rsp + 0x20], rax
movups xmmword [rax], xmm0
movups xmm0, xmmword [rsi + 8]
movups xmmword [r8], xmm0
mov dword [rdi + 6], ecx
mov word [rdi + 0xa], dx
cmp rbx, 0x7f8
jae 0x140041934
mov byte [rdi + rbx], 0x88
inc rbx
cmp rbx, 0x7f8
jae 0x140041934
mov byte [rdi + rbx], 0
inc rbx
cmp rbx, 0x7f8
jae 0x140041934
mov byte [rdi + rbx], 0
inc rbx
cmp rbx, 0x7f8
jae 0x140041934
mov byte [rdi + rbx], 0
inc rbx
cmp rbx, 0x7f8
jae 0x140041934
mov byte [rdi + rbx], 0x60
inc rbx
cmp rbx, 0x7f8
jae 0x140041934
mov byte [rdi + rbx], 0
inc rbx
cmp rbx, 0x7f8
jae 0x140041934
mov byte [rdi + rbx], 0
inc rbx
cmp rbx, 0x7f8
jae 0x140041934
mov byte [rdi + rbx], 0
inc rbx
lea r15, [rbx + 0x10]
cmp r15, 0x7f8
jae 0x14004194b
movups xmm0, xmmword [rsi + 8]
movups xmmword [rdi + rbx], xmm0
jmp 0x140041957
mov r15, rbx
cmp rbx, 0x7f8
jae 0x140041970
mov byte [rdi + r15], 2
inc r15
cmp r15, 0x7f8
jae 0x140041970
mov byte [rdi + r15], 1
inc r15
lea rax, [r15 + 6]
cmp rax, 0x7f8
jae 0x140041989
mov dword [rdi + r15], ecx
mov word [rdi + r15 + 4], dx
mov r15, rax
mov rax, qword [rsp + 0x38]
mov rsi, r15
mov edx, reloc.WS2_32.dll_recv
mov rcx, r8
sub rsi, rax
lea r14, [rdi + rax]
call fcn.14004d180
mov rdx, rsi
mov rcx, r14
mov ebx, eax
call fcn.14004d180
mov rcx, qword [rsp + 0x20]
mov edx, reloc.WS2_32.dll_recv
mov edi, eax
call fcn.14004d180
movzx edx, byte [r14 + 2]
add eax, 0x3a
movzx ecx, byte [r14 + 3]
add eax, ebx
add eax, edi
shl edx, 8
or edx, ecx
mov rcx, r12
sub esi, edx
mov rdx, r13
add eax, esi
mov r8d, eax
movzx eax, ax
shr r8d, 0x10
add r8d, eax
mov eax, r8d
shr eax, 0x10
add eax, r8d
not eax
movzx r8d, ax
mov eax, r8d
mov byte [r14 + 3], r8b
shr eax, 8
mov byte [r14 + 2], al
mov qword [r13], r15
call fcn.140042910
xor eax, eax
jmp 0x140041a1f
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.14004da00
add rsp, 0x148
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret