Function at 0x140009d80
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x18
lea rax, [rcx + 0x1000]
mov r8, rdx
mov r9, rcx
cmp rax, 0x2000
jb 0x14000a44b
mov rax, rcx
movabs rdx, 0x800000000000
movabs rcx, 0xffff800000000000
movabs r10, 0xffff7fffffffffff
and rax, rcx
add rax, rdx
test r10, rax
jne 0x14000a44b
lea rax, [r8 + 0x1000]
cmp rax, 0x2000
jb 0x14000a44b
mov rax, r8
and rax, rcx
add rax, rdx
test r10, rax
jne 0x14000a44b
movzx ecx, word [r8]
xor eax, eax
mov qword [rsp + 0x20], rbx
cmp cx, 0x7b
mov qword [rsp + 0x28], rbp
mov edx, 2
mov qword [rsp + 0x30], rsi
cmove eax, edx
mov qword [rsp + 0x38], rdi
add r8, rax
mov qword [rsp + 0x10], r12
mov qword [rsp + 8], r14
mov qword [rsp], r15
mov r15d, 0xff00
movzx eax, word [r8]
test r15w, ax
jne 0x14000a444
movzx eax, al
lea r12, [0x1400226e0]
movzx r14d, byte [rax + r12]
cmp r14b, 0xff
je 0x14000a444
movzx eax, word [r8 + 2]
test r15w, ax
jne 0x14000a444
movzx eax, al
movzx ebp, byte [rax + r12]
cmp bpl, 0xff
je 0x14000a444
movzx eax, word [r8 + 4]
test r15w, ax
jne 0x14000a444
movzx eax, al
movzx esi, byte [rax + r12]
cmp sil, 0xff
je 0x14000a444
movzx eax, word [r8 + 6]
test r15w, ax
jne 0x14000a444
movzx eax, al
movzx edi, byte [rax + r12]
cmp dil, 0xff
je 0x14000a444
movzx eax, word [r8 + 8]
test r15w, ax
jne 0x14000a444
movzx eax, al
movzx ebx, byte [rax + r12]
cmp bl, 0xff
je 0x14000a444
movzx eax, word [r8 + 0xa]
test r15w, ax
jne 0x14000a444
movzx eax, al
movzx r11d, byte [rax + r12]
cmp r11b, 0xff
je 0x14000a444
movzx eax, word [r8 + 0xc]
test r15w, ax
jne 0x14000a444
movzx eax, al
movzx r10d, byte [rax + r12]
cmp r10b, 0xff
je 0x14000a444
movzx eax, word [r8 + 0xe]
test r15w, ax
jne 0x14000a444
movzx eax, al
movzx edx, byte [rax + r12]
cmp dl, 0xff
je 0x14000a444
cmp word [r8 + 0x10], 0x2d
jne 0x14000a444
movzx eax, word [r8 + 0x12]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x14]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x16]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x18]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
cmp word [r8 + 0x1a], 0x2d
jne 0x14000a444
movzx eax, word [r8 + 0x1c]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x1e]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x20]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x22]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
cmp word [r8 + 0x24], 0x2d
jne 0x14000a444
movzx eax, word [r8 + 0x26]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x28]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x2a]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x2c]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
cmp word [r8 + 0x2e], 0x2d
jne 0x14000a444
movzx eax, word [r8 + 0x30]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x32]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x34]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x36]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x38]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x3a]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x3c]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x3e]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x40]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x42]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x44]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
movzx eax, word [r8 + 0x46]
test r15w, ax
jne 0x14000a444
movzx eax, al
cmp byte [rax + r12], 0xff
je 0x14000a444
cmp cx, 0x7b
jne 0x14000a235
cmp word [r8 + 0x48], 0x7d
jne 0x14000a444
cmp cx, 0x7b
mov eax, 0x48
mov r15d, 0x4a
cmove eax, r15d
cmp word [rax + r8], 0
jne 0x14000a444
mov ecx, r14d
shl ecx, 4
or ecx, ebp
shl ecx, 4
or ecx, esi
shl ecx, 4
or ecx, edi
shl ecx, 4
or ecx, ebx
shl ecx, 4
or ecx, r11d
shl ecx, 4
or ecx, r10d
shl ecx, 4
or ecx, edx
mov dword [r9], ecx
movzx eax, word [r8 + 0x12]
movzx ecx, al
movzx eax, word [r8 + 0x14]
movzx edx, byte [rcx + r12]
shl dx, 4
movzx ecx, al
movzx eax, byte [rcx + r12]
or dx, ax
movzx eax, word [r8 + 0x16]
shl dx, 4
movzx ecx, al
movzx eax, byte [rcx + r12]
or dx, ax
movzx eax, word [r8 + 0x18]
shl dx, 4
movzx ecx, al
movzx eax, byte [rcx + r12]
or dx, ax
mov word [r9 + 4], dx
movzx eax, word [r8 + 0x1c]
movzx ecx, al
movzx eax, word [r8 + 0x1e]
movzx edx, byte [rcx + r12]
shl dx, 4
movzx ecx, al
movzx eax, byte [rcx + r12]
or dx, ax
movzx eax, word [r8 + 0x20]
shl dx, 4
movzx ecx, al
movzx eax, byte [rcx + r12]
or dx, ax
movzx eax, word [r8 + 0x22]
shl dx, 4
movzx ecx, al
movzx eax, byte [rcx + r12]
or dx, ax
mov word [r9 + 6], dx
movzx eax, word [r8 + 0x26]
movzx ecx, al
movzx eax, word [r8 + 0x28]
movzx edx, byte [rcx + r12]
shl dl, 4
movzx ecx, al
or dl, byte [rcx + r12]
mov byte [r9 + 8], dl
movzx eax, word [r8 + 0x2a]
movzx ecx, al
movzx eax, word [r8 + 0x2c]
movzx edx, byte [rcx + r12]
movzx ecx, al
shl dl, 4
or dl, byte [rcx + r12]
mov byte [r9 + 9], dl
movzx eax, word [r8 + 0x30]
movzx ecx, al
movzx eax, word [r8 + 0x32]
movzx edx, byte [rcx + r12]
movzx ecx, al
shl dl, 4
or dl, byte [rcx + r12]
mov byte [r9 + 0xa], dl
movzx eax, word [r8 + 0x34]
movzx ecx, al
movzx edx, byte [rcx + r12]
movzx eax, word [r8 + 0x36]
shl dl, 4
movzx ecx, al
or dl, byte [rcx + r12]
mov byte [r9 + 0xb], dl
movzx eax, word [r8 + 0x38]
movzx ecx, al
movzx eax, word [r8 + 0x3a]
movzx edx, byte [rcx + r12]
shl dl, 4
movzx ecx, al
or dl, byte [rcx + r12]
mov byte [r9 + 0xc], dl
movzx eax, word [r8 + 0x3c]
movzx ecx, al
movzx eax, word [r8 + 0x3e]
movzx edx, byte [rcx + r12]
shl dl, 4
movzx ecx, al
or dl, byte [rcx + r12]
mov byte [r9 + 0xd], dl
movzx eax, word [r8 + 0x40]
movzx ecx, al
movzx eax, word [r8 + 0x42]
movzx edx, byte [rcx + r12]
movzx ecx, al
shl dl, 4
or dl, byte [rcx + r12]
mov byte [r9 + 0xe], dl
movzx eax, word [r8 + 0x44]
movzx ecx, al
movzx eax, word [r8 + 0x46]
movzx edx, byte [rcx + r12]
movzx ecx, al
shl dl, 4
or dl, byte [rcx + r12]
mov byte [r9 + 0xf], dl
xor eax, eax
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov r15, qword [rsp]
add rsp, 0x18
ret
mov eax, 0xffffffcf
jmp 0x14000a41d
mov eax, 0xfffffffe
add rsp, 0x18
ret