Function at 0x14043b350
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x88
mov rdi, rdx
mov r14, r8
mov rsi, rcx
mov rcx, rdi
lea rdx, [rsp + 0x48]
mov r8d, 0x30
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14043b45f
mov rbx, qword [rsp + 0x50]
movzx eax, word [rbx]
cmp eax, 0x5a4d
jne 0x14043b45f
movsxd r8, dword [rbx + 0x3c]
xor bpl, bpl
add r8, rbx
xor eax, eax
xor dl, dl
movzx r9d, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rcx, [r8 + r9 + 0x18]
test r10d, r10d
jbe 0x14043b45f
mov dword [rsp + 0x30], r12d
mov r12d, eax
mov qword [rsp + 0x78], rsi
mov sil, dl
mov qword [rsp + 0x28], rdi
mov rdi, rcx
mov qword [rsp + 0x20], r14
mov r14, r8
mov rcx, rdi
lea rdx, [0x1405bc318]
mov r8d, 7
call fcn.140441ad0
test eax, eax
jne 0x14043b419
inc r12d
mov r15, rdi
movzx r9d, word [r14 + 6]
add rdi, 0x28
mov bpl, 1
cmp r12d, r9d
jae 0x14043b4ad
test sil, sil
jne 0x14043b443
mov rcx, rdi
lea rdx, [0x1405bc320]
mov r8d, 6
call fcn.140441ad0
test eax, eax
jne 0x14043b443
mov sil, 1
add rdi, 0x28
inc r12d
jmp 0x14043b44a
add rdi, 0x28
inc r12d
movzx r9d, word [r14 + 6]
cmp r12d, r9d
jae 0x14043bbb3
test bpl, bpl
jne 0x14043b419
jmp 0x14043b3e5
mov rcx, rsi
lea rdx, str.Unknown
call fcn.14048a8e0
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.14048a8e0
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.14048a8e0
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r12d, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x28]
mov r14, qword [rsp + 0x20]
mov eax, dword [r15 + 8]
cmp rax, 0x1a
jb 0x14043b45f
mov edx, dword [r15 + 0xc]
add rbx, rdx
test r14, r14
je 0x14043b4da
mov r13, qword [r14]
add rbx, r13
xor r15d, r15d
mov rbp, rbx
jmp 0x14043b4e8
add rbx, r10
mov dl, byte [rbx]
test dl, dl
jne 0x14043b4f6
mov r10d, 1
jmp 0x14043b547
cmp dl, 0xa
jne 0x14043b9ad
test r13, r13
je 0x14043b50f
cmp r13, qword [rbx + 8]
jbe 0x14043b50f
mov r9, r13
jmp 0x14043b512
xor r9d, r9d
movzx edx, word [rbx + 1]
cmp edx, 2
jne 0x14043bb65
cmp byte [rbx + 3], 0
ja 0x14043bb65
mov edx, dword [rbx + 0x14]
add rdx, r9
mov r8, qword [rbx + 8]
add rdx, r8
mov r10d, dword [rbx + 4]
cmp rdi, rdx
jae 0x14043b547
add r8, r9
cmp rdi, r8
jae 0x14043b555
add r15, r10
cmp r15, rax
jae 0x14043b9fb
jmp 0x14043b4e5
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], r9
cmp byte [rbx], 0xa
jne 0x14043b95f
movzx eax, word [rbx + 1]
cmp eax, 2
jne 0x14043b57a
cmp byte [rbx + 3], 0
jbe 0x14043b5c8
mov rcx, rsi
lea rdx, str.Unknown
call fcn.14048a8e0
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.14048a8e0
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.14048a8e0
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, word [rbx + 0x1a]
lea rdx, [rbx + 0x10]
mov r8d, 4
lea rcx, [rsp + 0x40]
mov r14d, dword [rbx + 4]
lea r13, [rbx + 0x1a]
mov qword [rcx - 0x20], r13
lea r9, [rbx + 0x1c]
mov qword [rcx - 0x10], rax
mov r13d, 0x1a
mov qword [rcx - 0x18], r9
call fcn.1404407e0
mov edx, dword [rsp + 0x40]
test edx, edx
jbe 0x14043b65a
mov eax, edx
mov r8d, 1
mov r10, qword [rsp + 0x20]
xor r9d, r9d
shr eax, 1
je 0x14043b649
xor r8d, r8d
movzx r11d, word [r10]
inc r9d
lea r10, [r10 + r11 + 2]
lea r13, [r13 + r11 + 2]
movzx r11d, word [r10]
lea r8, [r8 + r11 + 2]
lea r10, [r10 + r11 + 2]
cmp r9d, eax
jb 0x14043b61d
add r13, r8
lea r8d, [r9 + r9 + 1]
dec r8d
cmp r8d, edx
jae 0x14043b65a
movzx eax, word [r10]
lea r13, [r13 + rax + 2]
imul rax, r14, 0x1d
mov qword [rsp + 0x78], rsi
lea r11, [r13 + rbx]
add r13, r15
xor r15d, r15d
mov r10, qword [rsp + 0x38]
xor r8d, r8d
mov rsi, qword [rsp + 0x28]
add rbx, rax
mov r9, qword [rsp + 0x30]
cmp r13, rbx
je 0x14043bb12
movzx r14d, byte [r11]
mov eax, r14d
and eax, 0xc0
cmp eax, 0x80
jne 0x14043b6c4
mov al, byte [r11]
inc r8
and al, 0x3f
movzx r13d, al
lea r10, [r10 + r13 + 1]
cmp r10, rdi
jae 0x14043b7af
inc r11
mov r13, r11
sub r13, rbp
jmp 0x14043b683
cmp eax, 0xc0
jne 0x14043b6f8
mov r13b, byte [r11]
and r13b, 0x3f
movzx r14d, r13b
movsx rax, byte [r11 + 1]
add r8, rax
lea r10, [r10 + r14 + 1]
cmp r10, rdi
jae 0x14043b7af
add r11, 2
mov r13, r11
sub r13, rbp
jmp 0x14043b683
cmp r14d, 0xd
ja 0x14043b901
lea rdx, [0x140000000]
movzx eax, word [rdx + r14*2 + 0x5bc2c4]
lea rax, [rdx + rax + 0x43b71c]
jmp rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r9
mov rsi, qword [rsp + 0x78]
lea rdx, str._I64u
lea rcx, [rsi + 0x208]
call fcn.14036c680
test r15, r15
je 0x14043ba9c
mov rcx, rsi
mov rdx, r15
mov r8, r12
call fcn.1404407e0
mov r12d, r12d
mov byte [r12 + rsi], 0
mov rdx, qword [rsp + 0x28]
lea rcx, [rsi + 0x104]
mov r8, qword [rsp + 0x30]
call fcn.1404407e0
mov rax, qword [rsp + 0x30]
mov byte [rax + rsi + 0x104], 0
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rsi, qword [rsp + 0x78]
mov rcx, rsi
lea rdx, str.Unknown
call fcn.14048a8e0
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.14048a8e0
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.14048a8e0
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, rsi
lea rdx, str.Unknown
call fcn.14048a8e0
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.14048a8e0
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.14048a8e0
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, rsi
lea rdx, str.Unknown
call fcn.14048a8e0
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.14048a8e0
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.14048a8e0
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, rsi
lea rdx, str.Unknown
call fcn.14048a8e0
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.14048a8e0
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.14048a8e0
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rcx, str.Unknown
call fcn.14048a5a0
mov rcx, rsi
lea rdx, str.Unknown
mov r8, rax
call fcn.1404407e0
jmp 0x14043b7f0
mov rsi, qword [rsp + 0x78]
mov rcx, rsi
lea rdx, str.Unknown
call fcn.14048a8e0
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.14048a8e0
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.14048a8e0
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, rsi
lea rdx, str.Unknown
call fcn.14048a8e0
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.14048a8e0
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.14048a8e0
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r12d, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x28]
mov r14, qword [rsp + 0x20]
test bpl, bpl
jne 0x14043b4c1
jmp 0x14043b45f