Function at 0x7ff6eb1153f0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
movzx eax, byte [rcx + 2]
mov r8, rcx
movzx edx, byte [rcx + 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [rcx]
shl edx, 8
or edx, eax
mov dword [rcx], edx
movzx eax, byte [rcx + 6]
movzx r10d, byte [rcx + 7]
shl r10d, 8
or r10d, eax
movzx eax, byte [rcx + 5]
shl r10d, 8
or r10d, eax
movzx eax, byte [rcx + 4]
shl r10d, 8
or r10d, eax
mov dword [rcx + 4], r10d
movzx ecx, byte [rcx + 0xb]
movzx eax, byte [r8 + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 8]
shl ecx, 8
or ecx, eax
mov dword [r8 + 8], ecx
movzx eax, byte [r8 + 0xe]
movzx ebp, byte [r8 + 0xf]
shl ebp, 8
or ebp, eax
movzx eax, byte [r8 + 0xd]
shl ebp, 8
or ebp, eax
movzx eax, byte [r8 + 0xc]
shl ebp, 8
or ebp, eax
mov dword [r8 + 0xc], ebp
movzx eax, byte [r8 + 0x12]
movzx esi, byte [r8 + 0x13]
shl esi, 8
or esi, eax
movzx eax, byte [r8 + 0x11]
shl esi, 8
or esi, eax
movzx eax, byte [r8 + 0x10]
shl esi, 8
or esi, eax
mov dword [r8 + 0x10], esi
movzx eax, byte [r8 + 0x16]
movzx edi, byte [r8 + 0x17]
shl edi, 8
or edi, eax
movzx eax, byte [r8 + 0x15]
shl edi, 8
or edi, eax
movzx eax, byte [r8 + 0x14]
shl edi, 8
or edi, eax
mov dword [r8 + 0x14], edi
movzx eax, byte [r8 + 0x1a]
movzx ebx, byte [r8 + 0x1b]
shl ebx, 8
or ebx, eax
movzx eax, byte [r8 + 0x19]
shl ebx, 8
or ebx, eax
movzx eax, byte [r8 + 0x18]
shl ebx, 8
or ebx, eax
mov dword [r8 + 0x18], ebx
movzx r11d, byte [r8 + 0x1f]
movzx eax, byte [r8 + 0x1e]
shl r11d, 8
or r11d, eax
movzx eax, byte [r8 + 0x1d]
shl r11d, 8
or r11d, eax
movzx eax, byte [r8 + 0x1c]
shl r11d, 8
or r11d, eax
mov dword [r8 + 0x1c], r11d
movzx eax, byte [r8 + 0x22]
movzx r9d, byte [r8 + 0x23]
shl r9d, 8
or r9d, eax
movzx eax, byte [r8 + 0x21]
shl r9d, 8
or r9d, eax
movzx eax, byte [r8 + 0x20]
shl r9d, 8
or r9d, eax
mov dword [r8 + 0x20], r9d
movzx eax, byte [r8 + 0x26]
movzx ecx, byte [r8 + 0x27]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x25]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x24]
shl ecx, 8
or ecx, eax
mov dword [r8 + 0x24], ecx
movzx eax, byte [r8 + 0x2a]
movzx ecx, byte [r8 + 0x2b]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x29]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x28]
shl ecx, 8
or ecx, eax
mov dword [r8 + 0x28], ecx
movzx eax, byte [r8 + 0x2e]
movzx ecx, byte [r8 + 0x2f]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x2d]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [r8 + 0x2c], ecx
movzx eax, byte [r8 + 0x32]
movzx ecx, byte [r8 + 0x33]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x31]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x30]
shl ecx, 8
or ecx, eax
mov dword [r8 + 0x30], ecx
movzx eax, byte [r8 + 0x36]
movzx ecx, byte [r8 + 0x37]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x35]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x34]
shl ecx, 8
or ecx, eax
mov dword [r8 + 0x34], ecx
movzx eax, byte [r8 + 0x3a]
movzx ecx, byte [r8 + 0x3b]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x39]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x38]
shl ecx, 8
or ecx, eax
mov dword [r8 + 0x38], ecx
movzx eax, byte [r8 + 0x3e]
movzx ecx, byte [r8 + 0x3f]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x3d]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0x3c]
shl ecx, 8
or ecx, eax
mov dword [r8 + 0x3c], ecx
cmp edx, 0x9e2a83c1
jne case.0x7ff6eb1156c4.36
test ebp, ebp
js case.0x7ff6eb1156c4.36
test esi, esi
js case.0x7ff6eb1156c4.36
test edi, edi
js case.0x7ff6eb1156c4.36
test ebx, ebx
js case.0x7ff6eb1156c4.36
test r11d, r11d
js case.0x7ff6eb1156c4.36
test r9d, r9d
js case.0x7ff6eb1156c4.36
lea eax, [r10 - 0x23]
cmp eax, 0x30
ja case.0x7ff6eb1156c4.36
lea rdx, [0x7ff6eb0d0000]
cdqe
movzx eax, byte [rdx + rax + 0x456ec]
mov ecx, dword [rdx + rax*4 + 0x456e4]
add rcx, rdx
jmp rcx
xor eax, eax
jmp 0x7ff6eb1156cf
mov eax, 0xffffffff
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret