Function at 0x180001190
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x18000120e
movsxd rax, dword [rsi + 0x3c]
cmp dword [rsi + rax], 0x4550
jne 0x18000120e
add rax, rsi
movzx r15d, word [rax + 6]
test r15, r15
je 0x18000120e
movzx ecx, word [rax + 0x14]
lea rdi, [rax + rcx]
add rdi, 0x18
lea rbx, str..text
xor r14d, r14d
nop word [rax + rax]
mov rcx, rbx
mov rdx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x180001bf6
add rdi, 0x28
dec r15
jne 0x1800011f0
jmp 0x180001211
xor r14d, r14d
mov edi, eax
lea rax, [r14 + 6]
mov rbx, r14
add rbx, rdi
jae 0x18000130e
movzx edx, byte [0x180005006]
movzx r8d, byte [section..data]
movzx r9d, byte [0x180005001]
movzx r10d, byte [0x180005002]
movzx r11d, byte [0x180005003]
movzx esi, byte [0x180005004]
movzx ebp, byte [0x180005005]
mov rcx, r14
jmp 0x18000126f
dec rcx
dec rax
cmp rcx, rbx
jb 0x180001423
cmp r8b, 0xff
je 0x18000127b
cmp byte [rax - 6], r8b
jne 0x180001260
cmp dl, 0xff
je 0x180001284
cmp byte [rax], dl
jne 0x180001260
cmp r9b, 0xff
je 0x180001290
cmp byte [rax - 5], r9b
jne 0x180001260
cmp dl, 0xff
je 0x180001299
cmp byte [rax], dl
jne 0x180001260
cmp r10b, 0xff
je 0x1800012a5
cmp byte [rax - 4], r10b
jne 0x180001260
cmp dl, 0xff
je 0x1800012ae
cmp byte [rax], dl
jne 0x180001260
cmp r11b, 0xff
je 0x1800012ba
cmp byte [rax - 3], r11b
jne 0x180001260
cmp dl, 0xff
je 0x1800012c3
cmp byte [rax], dl
jne 0x180001260
cmp sil, 0xff
je 0x1800012cf
cmp byte [rax - 2], sil
jne 0x180001260
cmp dl, 0xff
je 0x1800012d8
cmp byte [rax], dl
jne 0x180001260
cmp bpl, 0xff
je 0x1800012e8
cmp byte [rax - 1], bpl
jne 0x180001260
cmp dl, 0xff
je 0x180001403
cmp byte [rax], dl
jne 0x180001260
cmp byte [rax], dl
jne 0x180001260
cmp byte [rax], dl
jne 0x180001260
jmp 0x180001403
cmp rbx, r14
jbe 0x180001423
movzx edx, byte [0x180005006]
movzx r8d, byte [section..data]
movzx r9d, byte [0x180005001]
movzx r10d, byte [0x180005002]
movzx r11d, byte [0x180005003]
movzx esi, byte [0x180005004]
movzx ebp, byte [0x180005005]
xor ecx, ecx
jmp 0x18000135c
inc rcx
cmp rdi, rcx
je 0x180001423
cmp r8b, 0xff
je 0x180001369
cmp byte [rax + rcx - 6], r8b
jne 0x180001350
cmp dl, 0xff
je 0x180001373
cmp byte [rax + rcx], dl
jne 0x180001350
cmp r9b, 0xff
je 0x180001380
cmp byte [rax + rcx - 5], r9b
jne 0x180001350
cmp dl, 0xff
je 0x18000138a
cmp byte [rax + rcx], dl
jne 0x180001350
cmp r10b, 0xff
je 0x180001397
cmp byte [rax + rcx - 4], r10b
jne 0x180001350
cmp dl, 0xff
je 0x1800013a1
cmp byte [rax + rcx], dl
jne 0x180001350
cmp r11b, 0xff
je 0x1800013ae
cmp byte [rax + rcx - 3], r11b
jne 0x180001350
cmp dl, 0xff
je 0x1800013b8
cmp byte [rax + rcx], dl
jne 0x180001350
cmp sil, 0xff
je 0x1800013c5
cmp byte [rax + rcx - 2], sil
jne 0x180001350
cmp dl, 0xff
je 0x1800013cf
cmp byte [rax + rcx], dl
jne 0x180001350
cmp bpl, 0xff
je 0x1800013e0
cmp byte [rax + rcx - 1], bpl
jne 0x180001350
cmp dl, 0xff
je 0x180001400
cmp byte [rax + rcx], dl
jne 0x180001350
cmp byte [rax + rcx], dl
jne 0x180001350
cmp byte [rax + rcx], dl
jne 0x180001350
add rcx, r14
test rcx, rcx
je 0x180001423
mov eax, dword [rcx + 0x15]
mov dword [rcx + rax + 0x1a], 0
mov rax, qword gs:[0x30]
and byte [rax + 0x17ef], 0xef
mov r15, qword gs:[0x60]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180001a56
mov rsi, rax
lea rdx, str.RtlLeaveCriticalSection
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call r12
mov rcx, qword [r15 + 0x110]
call rax
lea rdx, str.LdrFastFailInLoaderCallout
mov rcx, rsi
call r12
test rax, rax
je 0x1800015af
lea rcx, [rax + 0x18]
add rax, 0x1d
mov ecx, dword [rcx]
mov dword [rax + rcx], 2
lea rdx, str.LdrGetDllFullName
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180001a56
lea rcx, [rax + 6]
mov rdx, rax
sub rdx, 0xffffffffffffff80
jb 0x180001713
movzx r9d, byte [0x180005017]
movzx r10d, byte [0x180005011]
movzx r11d, byte [0x180005012]
movzx ebx, byte [0x180005013]
movzx esi, byte [0x180005014]
movzx edi, byte [0x180005015]
movzx ebp, byte [0x180005016]
mov r14, rcx
mov r8, rax
jmp 0x1800014ff
dec r8
dec r14
cmp r8, rdx
jb 0x180001831
cmp r10b, 0xff
je 0x18000150b
cmp byte [r14 - 6], r10b
jne 0x1800014f0
cmp r9b, 0xff
je 0x180001516
cmp byte [r14], r9b
jne 0x1800014f0
cmp r11b, 0xff
je 0x180001522
cmp byte [r14 - 5], r11b
jne 0x1800014f0
cmp r9b, 0xff
je 0x18000152d
cmp byte [r14], r9b
jne 0x1800014f0
cmp bl, 0xff
je 0x180001538
cmp byte [r14 - 4], bl
jne 0x1800014f0
cmp r9b, 0xff
je 0x180001543
cmp byte [r14], r9b
jne 0x1800014f0
cmp sil, 0xff
je 0x18000154f
cmp byte [r14 - 3], sil
jne 0x1800014f0
cmp r9b, 0xff
je 0x18000155a
cmp byte [r14], r9b
jne 0x1800014f0
cmp dil, 0xff
je 0x180001566
cmp byte [r14 - 2], dil
jne 0x1800014f0
cmp r9b, 0xff
je 0x180001575
cmp byte [r14], r9b
jne 0x1800014f0
cmp bpl, 0xff
je 0x180001585
cmp byte [r14 - 1], bpl
jne 0x1800014f0
cmp r9b, 0xff
je 0x180001828
cmp byte [r14], r9b
jne 0x1800014f0
cmp byte [r14], r9b
jne 0x1800014f0
cmp byte [r14], r9b
jne 0x1800014f0
jmp 0x180001828
lea rax, [r14 + 9]
cmp rbx, r14
jae 0x180001a67
movzx ecx, byte [0x180005010]
movzx edx, byte [0x180005007]
movzx r8d, byte [0x180005008]
movzx r9d, byte [0x180005009]
movzx r10d, byte [0x18000500a]
movzx r11d, byte [0x18000500b]
movzx edi, byte [0x18000500c]
movzx ebp, byte [0x18000500d]
movzx r15d, byte [0x18000500e]
movzx r12d, byte [0x18000500f]
jmp 0x18000161f
dec r14
dec rax
cmp r14, rbx
jb 0x180001489
cmp dl, 0xff
je 0x180001629
cmp byte [rax - 9], dl
jne 0x180001610
cmp cl, 0xff
je 0x180001632
cmp byte [rax], cl
jne 0x180001610
cmp r8b, 0xff
je 0x18000163e
cmp byte [rax - 8], r8b
jne 0x180001610
cmp cl, 0xff
je 0x180001647
cmp byte [rax], cl
jne 0x180001610
cmp r9b, 0xff
je 0x180001653
cmp byte [rax - 7], r9b
jne 0x180001610
cmp cl, 0xff
je 0x18000165c
cmp byte [rax], cl
jne 0x180001610
cmp r10b, 0xff
je 0x180001668
cmp byte [rax - 6], r10b
jne 0x180001610
cmp cl, 0xff
je 0x180001671
cmp byte [rax], cl
jne 0x180001610
cmp r11b, 0xff
je 0x18000167d
cmp byte [rax - 5], r11b
jne 0x180001610
cmp cl, 0xff
je 0x180001686
cmp byte [rax], cl
jne 0x180001610
cmp dil, 0xff
je 0x180001696
cmp byte [rax - 4], dil
jne 0x180001610
cmp cl, 0xff
je 0x1800016a3
cmp byte [rax], cl
jne 0x180001610
cmp bpl, 0xff
je 0x1800016b3
cmp byte [rax - 3], bpl
jne 0x180001610
cmp cl, 0xff
je 0x1800016c0
cmp byte [rax], cl
jne 0x180001610
cmp r15b, 0xff
je 0x1800016d0
cmp byte [rax - 2], r15b
jne 0x180001610
cmp cl, 0xff
je 0x1800016dd
cmp byte [rax], cl
jne 0x180001610
cmp r12b, 0xff
je 0x1800016ed
cmp byte [rax - 1], r12b
jne 0x180001610
cmp cl, 0xff
je 0x180001bdd
cmp byte [rax], cl
jne 0x180001610
cmp byte [rax], cl
jne 0x180001610
cmp byte [rax], cl
jne 0x180001610
jmp 0x180001bdd
jae 0x18000193a
movzx r9d, byte [0x180005017]
movzx r10d, byte [0x180005011]
movzx r11d, byte [0x180005012]
movzx ebx, byte [0x180005013]
movzx esi, byte [0x180005014]
movzx edi, byte [0x180005015]
movzx ebp, byte [0x180005016]
xor r8d, r8d
jmp 0x180001770
inc r8
cmp r8, 0x80
je 0x180001831
cmp r10b, 0xff
je 0x18000177d
cmp byte [rcx + r8 - 6], r10b
jne 0x180001760
cmp r9b, 0xff
je 0x180001789
cmp byte [rcx + r8], r9b
jne 0x180001760
cmp r11b, 0xff
je 0x180001796
cmp byte [rcx + r8 - 5], r11b
jne 0x180001760
cmp r9b, 0xff
je 0x1800017a2
cmp byte [rcx + r8], r9b
jne 0x180001760
cmp bl, 0xff
je 0x1800017ae
cmp byte [rcx + r8 - 4], bl
jne 0x180001760
cmp r9b, 0xff
je 0x1800017ba
cmp byte [rcx + r8], r9b
jne 0x180001760
cmp sil, 0xff
je 0x1800017c7
cmp byte [rcx + r8 - 3], sil
jne 0x180001760
cmp r9b, 0xff
je 0x1800017d3
cmp byte [rcx + r8], r9b
jne 0x180001760
cmp dil, 0xff
je 0x1800017e0
cmp byte [rcx + r8 - 2], dil
jne 0x180001760
cmp r9b, 0xff
je 0x1800017f0
cmp byte [rcx + r8], r9b
jne 0x180001760
cmp bpl, 0xff
je 0x180001801
cmp byte [rcx + r8 - 1], bpl
jne 0x180001760
cmp r9b, 0xff
je 0x180001825
cmp byte [rcx + r8], r9b
jne 0x180001760
cmp byte [rcx + r8], r9b
jne 0x180001760
cmp byte [rcx + r8], r9b
jne 0x180001760
add r8, rax
test r8, r8
jne 0x180001a41
cmp rax, 0xffffffffffffff80
jb 0x18000193a
movzx r9d, byte [0x18000501e]
movzx r10d, byte [0x180005018]
movzx r11d, byte [0x180005019]
movzx ebx, byte [0x18000501a]
movzx esi, byte [0x18000501b]
movzx edi, byte [0x18000501c]
movzx ebp, byte [0x18000501d]
mov r8, rax
jmp 0x18000188f
dec r8
dec rcx
cmp r8, rdx
jb 0x180001a56
cmp r10b, 0xff
je 0x18000189b
cmp byte [rcx - 6], r10b
jne 0x180001880
cmp r9b, 0xff
je 0x1800018a6
cmp byte [rcx], r9b
jne 0x180001880
cmp r11b, 0xff
je 0x1800018b2
cmp byte [rcx - 5], r11b
jne 0x180001880
cmp r9b, 0xff
je 0x1800018bd
cmp byte [rcx], r9b
jne 0x180001880
cmp bl, 0xff
je 0x1800018c7
cmp byte [rcx - 4], bl
jne 0x180001880
cmp r9b, 0xff
je 0x1800018d2
cmp byte [rcx], r9b
jne 0x180001880
cmp sil, 0xff
je 0x1800018de
cmp byte [rcx - 3], sil
jne 0x180001880
cmp r9b, 0xff
je 0x1800018e9
cmp byte [rcx], r9b
jne 0x180001880
cmp dil, 0xff
je 0x1800018f5
cmp byte [rcx - 2], dil
jne 0x180001880
cmp r9b, 0xff
je 0x180001900
cmp byte [rcx], r9b
jne 0x180001880
cmp bpl, 0xff
je 0x180001910
cmp byte [rcx - 1], bpl
jne 0x180001880
cmp r9b, 0xff
je 0x180001a3c
cmp byte [rcx], r9b
jne 0x180001880
cmp byte [rcx], r9b
jne 0x180001880
cmp byte [rcx], r9b
jne 0x180001880
jmp 0x180001a3c
cmp rax, 0xffffffffffffff7f
ja 0x180001a56
movzx edx, byte [0x18000501e]
movzx r8d, byte [0x180005018]
movzx r9d, byte [0x180005019]
movzx r10d, byte [0x18000501a]
movzx r11d, byte [0x18000501b]
movzx ebx, byte [0x18000501c]
movzx edi, byte [0x18000501d]
xor esi, esi
jmp 0x180001990
inc rsi
cmp rsi, 0x80
je 0x180001a56
cmp r8b, 0xff
je 0x18000199d
cmp byte [rcx + rsi - 6], r8b
jne 0x180001980
cmp dl, 0xff
je 0x1800019a7
cmp byte [rcx + rsi], dl
jne 0x180001980
cmp r9b, 0xff
je 0x1800019b4
cmp byte [rcx + rsi - 5], r9b
jne 0x180001980
cmp dl, 0xff
je 0x1800019be
cmp byte [rcx + rsi], dl
jne 0x180001980
cmp r10b, 0xff
je 0x1800019cb
cmp byte [rcx + rsi - 4], r10b
jne 0x180001980
cmp dl, 0xff
je 0x1800019d5
cmp byte [rcx + rsi], dl
jne 0x180001980
cmp r11b, 0xff
je 0x1800019e2
cmp byte [rcx + rsi - 3], r11b
jne 0x180001980
cmp dl, 0xff
je 0x1800019ec
cmp byte [rcx + rsi], dl
jne 0x180001980
cmp bl, 0xff
je 0x1800019f7
cmp byte [rcx + rsi - 2], bl
jne 0x180001980
cmp dl, 0xff
je 0x180001a05
cmp byte [rcx + rsi], dl
jne 0x180001980
cmp dil, 0xff
je 0x180001a16
cmp byte [rcx + rsi - 1], dil
jne 0x180001980
cmp dl, 0xff
je 0x180001a36
cmp byte [rcx + rsi], dl
jne 0x180001980
cmp byte [rcx + rsi], dl
jne 0x180001980
cmp byte [rcx + rsi], dl
jne 0x180001980
add rax, rsi
mov r8, rax
test r8, r8
je 0x180001a56
mov eax, dword [r8 + 3]
mov rax, qword [r8 + rax + 7]
mov rax, qword [rax + 0x98]
add qword [rax + 0x38], 2
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jbe 0x180001489
movzx ecx, byte [0x180005010]
movzx edx, byte [0x180005007]
movzx r8d, byte [0x180005008]
movzx r9d, byte [0x180005009]
movzx r10d, byte [0x18000500a]
movzx r11d, byte [0x18000500b]
movzx ebx, byte [0x18000500c]
movzx ebp, byte [0x18000500d]
movzx r12d, byte [0x18000500e]
movzx r13d, byte [0x18000500f]
xor r15d, r15d
jmp 0x180001acc
inc r15
cmp rdi, r15
je 0x180001489
cmp dl, 0xff
je 0x180001ad8
cmp byte [rax + r15 - 9], dl
jne 0x180001ac0
cmp cl, 0xff
je 0x180001ae3
cmp byte [rax + r15], cl
jne 0x180001ac0
cmp r8b, 0xff
je 0x180001af0
cmp byte [rax + r15 - 8], r8b
jne 0x180001ac0
cmp cl, 0xff
je 0x180001afb
cmp byte [rax + r15], cl
jne 0x180001ac0
cmp r9b, 0xff
je 0x180001b08
cmp byte [rax + r15 - 7], r9b
jne 0x180001ac0
cmp cl, 0xff
je 0x180001b13
cmp byte [rax + r15], cl
jne 0x180001ac0
cmp r10b, 0xff
je 0x180001b20
cmp byte [rax + r15 - 6], r10b
jne 0x180001ac0
cmp cl, 0xff
je 0x180001b2b
cmp byte [rax + r15], cl
jne 0x180001ac0
cmp r11b, 0xff
je 0x180001b38
cmp byte [rax + r15 - 5], r11b
jne 0x180001ac0
cmp cl, 0xff
je 0x180001b47
cmp byte [rax + r15], cl
jne 0x180001ac0
cmp bl, 0xff
je 0x180001b57
cmp byte [rax + r15 - 4], bl
jne 0x180001ac0
cmp cl, 0xff
je 0x180001b66
cmp byte [rax + r15], cl
jne 0x180001ac0
cmp bpl, 0xff
je 0x180001b77
cmp byte [rax + r15 - 3], bpl
jne 0x180001ac0
cmp cl, 0xff
je 0x180001b86
cmp byte [rax + r15], cl
jne 0x180001ac0
cmp r12b, 0xff
je 0x180001b97
cmp byte [rax + r15 - 2], r12b
jne 0x180001ac0
cmp cl, 0xff
je 0x180001ba6
cmp byte [rax + r15], cl
jne 0x180001ac0
cmp r13b, 0xff
je 0x180001bb7
cmp byte [rax + r15 - 1], r13b
jne 0x180001ac0
cmp cl, 0xff
je 0x180001bda
cmp byte [rax + r15], cl
jne 0x180001ac0
cmp byte [rax + r15], cl
jne 0x180001ac0
cmp byte [rax + r15], cl
jne 0x180001ac0
add r14, r15
test r14, r14
je 0x180001489
lea rcx, [r14 + 5]
add r14, 9
mov rax, r14
jmp 0x180001480
mov eax, dword [rdi + 8]
mov ecx, dword [rdi + 0xc]
add rsi, rcx
mov r14, rsi
jmp 0x180001211