Function at 0x180006240
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [rcx + 0x28], 0
mov r14, rcx
jne 0x1800068f7
test byte [rcx], 8
jne 0x1800068f7
mov rdi, qword [rcx + 0x68]
xor r13d, r13d
mov r12, qword [rcx + 0x18]
mov esi, 0xb2d
mov rcx, r12
mov r15d, 0xffffffff
test rdi, rdi
je 0x1800065d6
mov edx, 0x2014b50
mov rcx, r14
call fcn.18000d650
mov edx, 0x201
mov rcx, r14
call fcn.18000d650
mov edx, esi
mov rcx, r14
call fcn.18000d650
mov edx, 0x2d
mov rcx, r14
call fcn.18000d650
movzx edx, word [rdi]
mov rcx, r14
call fcn.18000d650
movzx edx, word [rdi + 2]
mov rcx, r14
call fcn.18000d650
mov edx, dword [rdi + 4]
mov rcx, r14
call fcn.18000d650
movzx edx, word [rdi + 6]
mov rcx, r14
call fcn.18000d650
mov edx, dword [rdi + 8]
mov rcx, r14
call fcn.18000d650
movzx edx, word [rdi + 0xa]
mov rcx, r14
call fcn.18000d650
mov rcx, r14
cmp qword [rdi + 0x10], r15
jb 0x180006320
mov edx, r15d
call fcn.18000d650
mov eax, r15d
jmp 0x180006330
mov edx, dword [rdi + 0x10]
call fcn.18000d650
mov rax, qword [rdi + 0x10]
shr rax, 0x10
mov edx, eax
mov rcx, r14
call fcn.18000d650
mov rcx, r14
cmp qword [rdi + 0x18], r15
jb 0x180006350
mov edx, r15d
call fcn.18000d650
mov eax, r15d
jmp 0x180006360
mov edx, dword [rdi + 0x18]
call fcn.18000d650
mov rax, qword [rdi + 0x18]
shr rax, 0x10
mov edx, eax
mov rcx, r14
call fcn.18000d650
mov edx, dword [rdi + 0x20]
mov rcx, r14
call fcn.18000d650
cmp qword [rdi + 0x38], r15
jae 0x18000638b
cmp qword [rdi + 0x18], r15
jae 0x18000638b
cmp qword [rdi + 0x10], r15
jae 0x18000638b
xor ecx, ecx
jmp 0x180006390
mov ecx, 4
cmp qword [rdi + 0x10], r15
sbb edx, edx
not edx
and edx, 8
cmp qword [rdi + 0x18], r15
sbb eax, eax
not eax
and eax, 8
add edx, eax
cmp qword [rdi + 0x38], r15
sbb eax, eax
not eax
and eax, 8
add edx, eax
add edx, dword [rdi + 0x28]
add edx, ecx
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
movzx edx, word [rdi + 0x2c]
mov rcx, r14
call fcn.18000d650
movzx edx, word [rdi + 0x2e]
mov rcx, r14
call fcn.18000d650
mov edx, dword [rdi + 0x34]
mov rcx, r14
call fcn.18000d650
movzx edx, word [rdi + 0x36]
mov rcx, r14
call fcn.18000d650
mov rcx, r14
cmp qword [rdi + 0x38], r15
jb 0x180006411
mov edx, r15d
call fcn.18000d650
mov eax, r15d
jmp 0x180006421
mov edx, dword [rdi + 0x38]
call fcn.18000d650
mov rax, qword [rdi + 0x38]
shr rax, 0x10
mov edx, eax
mov rcx, r14
call fcn.18000d650
mov r8d, dword [rdi + 0x20]
lea rdx, [rdi + 0x50]
mov rcx, r14
call fcn.18000d720
cmp qword [rdi + 0x38], r15
jae 0x180006451
cmp qword [rdi + 0x18], r15
jae 0x180006451
cmp qword [rdi + 0x10], r15
jb 0x180006542
mov edx, 1
mov rcx, r14
call fcn.18000d650
cmp qword [rdi + 0x38], r15
mov rcx, r14
sbb edx, edx
not edx
and edx, 8
cmp qword [rdi + 0x10], r15
sbb eax, eax
not eax
and eax, 8
add edx, eax
cmp qword [rdi + 0x18], r15
sbb eax, eax
not eax
and eax, 8
add edx, eax
call fcn.18000d650
cmp qword [rdi + 0x18], r15
jb 0x1800064c8
mov edx, dword [rdi + 0x18]
mov rcx, r14
call fcn.18000d650
mov rdx, qword [rdi + 0x18]
mov rcx, r14
shr rdx, 0x10
call fcn.18000d650
mov rdx, qword [rdi + 0x18]
mov rcx, r14
shr rdx, 0x20
call fcn.18000d650
movzx edx, word [rdi + 0x1e]
mov rcx, r14
call fcn.18000d650
cmp qword [rdi + 0x10], r15
jb 0x180006505
mov edx, dword [rdi + 0x10]
mov rcx, r14
call fcn.18000d650
mov rdx, qword [rdi + 0x10]
mov rcx, r14
shr rdx, 0x10
call fcn.18000d650
mov rdx, qword [rdi + 0x10]
mov rcx, r14
shr rdx, 0x20
call fcn.18000d650
movzx edx, word [rdi + 0x16]
mov rcx, r14
call fcn.18000d650
cmp qword [rdi + 0x38], r15
jb 0x180006542
mov edx, dword [rdi + 0x38]
mov rcx, r14
call fcn.18000d650
mov rdx, qword [rdi + 0x38]
mov rcx, r14
shr rdx, 0x10
call fcn.18000d650
mov rdx, qword [rdi + 0x38]
mov rcx, r14
shr rdx, 0x20
call fcn.18000d650
movzx edx, word [rdi + 0x3e]
mov rcx, r14
call fcn.18000d650
mov ecx, dword [rdi + 0x28]
test ecx, ecx
je 0x18000655b
mov rdx, qword [rdi + 0x48]
mov r8d, ecx
mov rcx, r14
call fcn.18000d720
mov ecx, dword [rdi + 0x28]
cmp qword [rdi + 0x38], r15
jae 0x180006572
cmp qword [rdi + 0x18], r15
jae 0x180006572
mov eax, 0x2e
cmp qword [rdi + 0x10], r15
jb 0x18000657b
cmp qword [rdi + 0x10], r15
mov eax, 0x32
sbb r8d, r8d
not r8d
and r8d, 8
cmp qword [rdi + 0x18], r15
sbb edx, edx
not edx
and edx, 8
add edx, eax
cmp qword [rdi + 0x38], r15
sbb eax, eax
add edx, r8d
not eax
mov r8d, 0x8000
and eax, 8
inc r13
add eax, edx
xor edx, edx
add eax, ecx
mov rcx, rdi
add eax, dword [rdi + 0x20]
add qword [r14 + 0x18], rax
mov rbx, qword [rdi + 0x158]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdi, rbx
test rbx, rbx
jne 0x180006294
mov rcx, qword [r14 + 0x18]
cmp rcx, r15
jb 0x180006861
mov rbp, qword [r14 + 0x20]
mov edx, 0x6064b50
add rbp, rcx
mov rcx, r14
call fcn.18000d650
mov edx, 0x606
mov rcx, r14
call fcn.18000d650
mov edx, 0x2c
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
mov edx, esi
mov rcx, r14
call fcn.18000d650
mov edx, 0x2d
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
mov edx, r13d
mov rcx, r14
call fcn.18000d650
mov rsi, r13
mov rcx, r14
shr rsi, 0x10
mov edx, esi
call fcn.18000d650
mov rdi, r13
mov rcx, r14
shr rdi, 0x20
mov edx, edi
call fcn.18000d650
mov rbx, r13
mov rcx, r14
shr rbx, 0x30
mov edx, ebx
call fcn.18000d650
mov edx, r13d
mov rcx, r14
call fcn.18000d650
mov edx, esi
mov rcx, r14
call fcn.18000d650
mov edx, edi
mov rcx, r14
call fcn.18000d650
mov edx, ebx
mov rcx, r14
call fcn.18000d650
mov rdi, qword [r14 + 0x18]
mov rcx, r14
sub rdi, r12
mov edx, edi
call fcn.18000d650
mov rsi, rdi
mov rcx, r14
shr rsi, 0x10
mov edx, esi
call fcn.18000d650
mov rdx, rdi
mov rcx, r14
shr rdx, 0x20
call fcn.18000d650
mov rdx, rdi
mov rcx, r14
shr rdx, 0x30
call fcn.18000d650
mov rbx, qword [r14 + 0x20]
mov rcx, r14
add rbx, r12
mov edx, ebx
call fcn.18000d650
mov r12, rbx
mov rcx, r14
shr r12, 0x10
mov edx, r12d
call fcn.18000d650
mov rdx, rbx
mov rcx, r14
shr rdx, 0x20
call fcn.18000d650
mov rdx, rbx
mov rcx, r14
shr rdx, 0x30
call fcn.18000d650
add qword [r14 + 0x18], 0x38
mov edx, 0x7064b50
mov rcx, r14
call fcn.18000d650
mov edx, 0x706
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
mov edx, ebp
mov rcx, r14
call fcn.18000d650
mov rdx, rbp
mov rcx, r14
shr rdx, 0x10
call fcn.18000d650
mov rdx, rbp
mov rcx, r14
shr rdx, 0x20
call fcn.18000d650
shr rbp, 0x30
mov rcx, r14
mov edx, ebp
call fcn.18000d650
mov edx, 1
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
add qword [r14 + 0x18], 0x14
mov edx, 0x6054b50
mov rcx, r14
call fcn.18000d650
mov edx, 0x605
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
cmp r13, 0xff
mov rcx, r14
cmovae r13d, r15d
mov edx, r13d
call fcn.18000d650
mov edx, r13d
mov rcx, r14
call fcn.18000d650
cmp rdi, r15
jb 0x180006831
mov esi, r15d
mov edi, r15d
mov edx, edi
mov rcx, r14
call fcn.18000d650
mov edx, esi
mov rcx, r14
call fcn.18000d650
cmp rbx, r15
jb 0x18000684f
mov ebx, r15d
jmp 0x180006852
mov r15d, r12d
mov edx, ebx
mov rcx, r14
call fcn.18000d650
mov edx, r15d
jmp 0x1800068dc
mov edx, 0x6054b50
mov rcx, r14
call fcn.18000d650
mov edx, 0x605
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
mov edx, r13d
mov rcx, r14
call fcn.18000d650
mov edx, r13d
mov rcx, r14
call fcn.18000d650
mov ebx, dword [r14 + 0x18]
mov rcx, r14
sub ebx, r12d
mov edx, ebx
call fcn.18000d650
shr ebx, 0x10
mov rcx, r14
mov edx, ebx
call fcn.18000d650
mov eax, dword [r14 + 0x20]
mov rcx, r14
add r12, rax
mov edx, r12d
call fcn.18000d650
shr r12, 0x10
mov edx, r12d
mov rcx, r14
call fcn.18000d650
xor edx, edx
mov rcx, r14
call fcn.18000d650
add qword [r14 + 0x18], 0x16
or dword [r14], 8
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret