Function at 0x1400015f0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140017008]
xor rax, rsp
mov qword [rbp - 0x10], rax
movsxd rsi, dword [rcx + 0x3c]
xor r14d, r14d
mov eax, r14d
mov qword [rbp - 0x38], r14
add rsi, rcx
mov dword [rbp - 0x48], eax
mov dword [rbp - 0x20], eax
mov r12, rcx
mov dword [rbp - 0x50], eax
mov r13d, r14d
mov dword [rbp - 0x1c], eax
mov eax, 0x20b
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x28], r14
cmp word [rsi + 0x18], ax
jne 0x140001acb
mov edx, dword [rsi + 0x50]
lea r15d, [r14 + 4]
mov rcx, qword [rsi + 0x30]
mov ebx, 0x2000
mov r9d, r15d
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x140001698
mov edx, dword [rsi + 0x50]
mov r9d, r15d
mov r8d, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x140001acb
mov edx, dword [rsi + 0x50]
mov ebx, 0x1000
mov r8d, ebx
mov qword [rbp - 0x30], rdi
mov r9d, r15d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [rsi + 0x54]
mov r9d, r15d
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x140001aba
mov r8d, dword [rsi + 0x54]
mov rdx, r12
add r8d, dword [r12 + 0x3c]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
movsxd r14, dword [r12 + 0x3c]
xor eax, eax
add r14, rbx
mov dword [rbp - 0x4c], eax
mov qword [rbp - 0x38], r14
mov ecx, eax
mov qword [r14 + 0x30], rdi
movzx r15d, word [r14 + 0x14]
add r15, 0x18
add r15, r14
cmp ax, word [r14 + 6]
jae 0x1400017a4
cmp dword [r15 + 0x10], r13d
jne 0x140001750
cmp dword [rsi + 0x38], r13d
jbe 0x14000178a
mov ebx, dword [rsi + 0x38]
mov r9d, 4
mov ecx, dword [r15 + 0xc]
mov edx, ebx
add rcx, rdi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov dword [r15 + 8], eax
call sub.VCRUNTIME140.dll_memset
jmp 0x140001787
mov ecx, dword [r15 + 0xc]
mov r9d, 4
mov edx, dword [r15 + 0x10]
add rcx, rdi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [r15 + 0x14]
mov rcx, rax
mov r8d, dword [r15 + 0x10]
add rdx, r12
mov rbx, rax
call sub.VCRUNTIME140.dll_memmove
mov dword [r15 + 8], ebx
mov ecx, dword [rbp - 0x4c]
movzx eax, word [r14 + 6]
inc ecx
add r15, 0x28
mov dword [rbp - 0x4c], ecx
cmp ecx, eax
jl 0x140001713
mov r13, qword [rbp - 0x40]
mov r9, rdi
sub r9, qword [rsi + 0x30]
je 0x140001824
xor r12d, r12d
cmp dword [r14 + 0xb4], r12d
jbe 0x140001827
mov ecx, dword [r14 + 0xb0]
add rcx, rdi
jmp 0x14000181c
mov r8d, dword [rcx + 4]
lea r11, [rcx + 8]
mov edx, eax
mov r10d, r12d
add rdx, rdi
lea eax, [r8 - 8]
test eax, 0xfffffffe
jbe 0x140001816
movzx eax, word [r11]
mov r8d, eax
and eax, 0xfff
shr r8d, 0xc
cmp r8d, 3
je 0x1400017fc
cmp r8d, 0xa
jne 0x140001800
add qword [rax + rdx], r9
mov r8d, dword [rcx + 4]
add r11, 2
inc r10d
lea eax, [r8 - 8]
shr eax, 1
cmp r10d, eax
jl 0x1400017e0
mov eax, r8d
add rcx, rax
mov eax, dword [rcx]
test eax, eax
jne 0x1400017c5
jmp 0x140001827
xor r12d, r12d
cmp dword [r14 + 0x94], r12d
jbe 0x140001940
mov ebx, dword [r14 + 0x90]
mov edx, setsockopt
add rbx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
jmp 0x140001938
cmp dword [rbx + 0xc], r12d
je 0x140001940
mov ecx, dword [rbx + 0xc]
add rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, rax
test rax, rax
je 0x140001aae
test r13, r13
jne 0x140001888
lea edx, [r13 + 8]
lea ecx, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r13, rax
mov r15d, dword [rbp - 0x48]
mov r8d, 2
mov rcx, r13
lea esi, [r15 + 1]
mov edx, esi
shl rdx, 3
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov qword [rbp - 0x28], rax
mov r13, rax
test rax, rax
je 0x140001aae
mov eax, r15d
shl rax, 3
add r13, rax
mov qword [r13], r12
sub r13, rax
mov ecx, dword [rbx]
mov eax, esi
mov dword [rbp - 0x48], eax
mov dword [rbp - 0x20], eax
mov qword [rbp - 0x28], r13
test ecx, ecx
je 0x1400018dd
mov eax, dword [rbx + 0x10]
jmp 0x1400018e2
mov ecx, dword [rbx + 0x10]
mov eax, ecx
mov r15d, eax
add r15, rdi
mov esi, ecx
add rsi, rdi
jmp 0x14000191d
mov rcx, r12
test rax, rax
jns 0x1400018fc
movzx edx, ax
jmp 0x140001903
lea rdx, [rax + 2]
add rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [r15], rax
test rax, rax
je 0x140001aae
add r15, 8
add rsi, 8
mov rax, qword [rsi]
test rax, rax
jne 0x1400018ef
add rbx, 0x14
lea edx, [rax + 0x14]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor r12d, r12d
test eax, eax
je 0x140001851
mov rsi, qword [r14 + 0x30]
lea rbx, [r14 + 0x18]
movabs rax, 0xffffffff00000000
mov r15d, r12d
and rsi, rax
movzx eax, word [r14 + 0x14]
add rbx, rax
cmp r12w, word [r14 + 6]
jae 0x140001a7b
mov r13d, 0x200
mov r8d, dword [rbx + 0x24]
bt r8d, 0x19
jae 0x140001996
mov ecx, dword [rbx + 8]
mov r8d, 0x4000
mov edx, dword [rbx + 0x10]
or rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140001a66
mov edx, r8d
mov eax, r8d
and edx, 0x4000000
and eax, 0x40000000
bt r8d, 0x1d
jae 0x1400019ee
test eax, eax
mov eax, edx
je 0x1400019d1
test r8d, r8d
jns 0x1400019c5
neg eax
sbb ecx, ecx
and ecx, r13d
add ecx, 0x40
jmp 0x140001a2b
neg eax
sbb ecx, ecx
and ecx, r13d
add ecx, 0x20
jmp 0x140001a2b
test r8d, r8d
jns 0x1400019e2
neg eax
sbb ecx, ecx
and ecx, r13d
sub ecx, 0xffffff80
jmp 0x140001a2b
neg eax
sbb ecx, ecx
and ecx, r13d
add ecx, 0x10
jmp 0x140001a2b
test eax, eax
mov eax, edx
je 0x140001a11
test r8d, r8d
jns 0x140001a05
neg eax
sbb ecx, ecx
and ecx, r13d
add ecx, 4
jmp 0x140001a2b
neg eax
sbb ecx, ecx
and ecx, r13d
add ecx, 2
jmp 0x140001a2b
test r8d, r8d
jns 0x140001a22
neg eax
sbb ecx, ecx
and ecx, r13d
add ecx, 8
jmp 0x140001a2b
neg eax
sbb ecx, ecx
and ecx, r13d
inc ecx
mov eax, dword [rbx + 0x10]
mov r10d, ecx
or r10d, r13d
test edx, edx
cmove r10d, ecx
test eax, eax
jne 0x140001a4c
test r8b, 0x40
je 0x140001a66
mov eax, dword [r14 + 0x20]
test eax, eax
je 0x140001a66
mov ecx, dword [rbx + 8]
lea r9, [rbp - 0x18]
mov edx, dword [rbx + 0x10]
or rcx, rsi
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001aae
movzx eax, word [r14 + 6]
inc r15d
add rbx, 0x28
cmp r15d, eax
jl 0x140001971
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140001aae
lea rdx, str.RtlAddFunctionTable
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
test rax, rax
jne 0x140001af7
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rbp - 0x50]
test eax, eax
jne 0x140001b26
test rdi, rdi
je 0x140001acb
mov r8d, 0x8000
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14000c390
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [r14 + 0x28], r12d
je 0x140001b1c
mov eax, dword [r14 + 0x28]
add rax, rdi
je 0x140001aae
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call rax
test eax, eax
je 0x140001aae
mov eax, 1
mov dword [rbp - 0x1c], eax
jmp 0x140001ab1
mov ecx, 0x20
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x140001ab5
movups xmm0, xmmword [rbp - 0x38]
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
jmp 0x140001acd