Function at 0x14000f5ac
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x478
xor eax, eax
mov r14, rcx
and qword [rcx], rax
and dword [rcx + 8], eax
lea rcx, str.shell32.dll
mov dword [rsp + 0x4d0], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x14000f62f
mov rdx, qword [0x140019fd8]
lea rcx, [rsp + 0x60]
add rdx, 0x272
call fcn.140001b70
lea rdx, str.shell32.dll
lea rcx, [rsp + 0x60]
call fcn.140001ac8
xor r8d, r8d
lea rcx, [rsp + 0x60]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14000f62f
mov eax, 0xc0000135
jmp 0x14000f6a3
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x14000f69e
movzx ecx, word [rax + 0x14]
lea rdx, [rax + 0x18]
movzx r8d, word [rax + 6]
add rdx, rcx
test r8d, r8d
je 0x14000f69e
lea rdi, str..text
mov r9d, 6
mov rax, rdi
cmp rdx, rdi
je 0x14000f6b7
test rdx, rdx
je 0x14000f694
mov r10, rdx
sub r10, rdi
movsx ecx, byte [r10 + rax]
dec r9
movsx r11d, byte [rax]
inc rax
test cl, cl
je 0x14000f68f
cmp cl, r11b
jne 0x14000f68f
test r9, r9
jne 0x14000f672
sub ecx, r11d
je 0x14000f6b7
add rdx, 0x28
add r8d, 0xffffffff
jne 0x14000f659
mov eax, 0xc0000141
add rsp, 0x478
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edi, dword [rdx + 0xc]
mov r12d, dword [rdx + 8]
add rdi, rbx
je 0x14000f69e
test r12d, r12d
je 0x14000f69e
mov rax, qword [0x140019fd8]
lea r13, [0x140019db0]
xor ebx, ebx
xor ecx, ecx
mov dword [rsp + 0x4c8], ecx
mov edx, dword [rax + 8]
mov dword [rsp + 0x24], edx
mov rax, qword [r13]
cmp edx, dword [rax]
jb 0x14000f7e8
cmp edx, dword [rax + 4]
ja 0x14000f7e8
mov rsi, qword [rax + 0x10]
mov eax, dword [rax + 8]
and dword [rsp + 0x4c0], 0
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
test eax, eax
je 0x14000f7e3
mov rdx, r12
mov rax, qword [rsi]
mov rbp, rdi
mov rsi, rdx
mov rcx, qword [rax]
mov eax, dword [rax + 8]
mov qword [rsp + 0x30], rcx
mov r15d, eax
mov dword [rsp + 0x4d0], eax
test eax, eax
je 0x14000f7ae
cmp rdx, rax
jb 0x14000f7ae
movzx eax, byte [rcx]
mov dword [rsp + 0x4d8], eax
mov r8, rsi
mov edx, eax
mov rcx, rbp
call sub.VCRUNTIME140D.dll_memchr
mov rbx, rax
test rax, rax
je 0x14000f7ab
sub rbp, rax
add rsi, rbp
cmp rsi, r15
jb 0x14000f7ab
mov rdx, qword [rsp + 0x30]
mov r8, r15
mov rcx, rax
call sub.VCRUNTIME140D.dll_memcmp
test eax, eax
je 0x14000f798
lea rbp, [rbx + 1]
sub rsi, 1
je 0x14000f7ab
mov eax, dword [rsp + 0x4d8]
jmp 0x14000f751
mov rdx, r12
cmp rbx, rdi
jb 0x14000f7ae
lea rax, [r12 + rdi]
cmp rbx, rax
jbe 0x14000f803
jmp 0x14000f7ae
mov rdx, r12
mov eax, dword [rsp + 0x4c0]
xor ebx, ebx
mov rsi, qword [rsp + 0x28]
inc eax
add rsi, 8
mov dword [rsp + 0x4c0], eax
mov qword [rsp + 0x28], rsi
cmp eax, dword [rsp + 0x20]
jb 0x14000f720
mov ecx, dword [rsp + 0x4c8]
mov edx, dword [rsp + 0x24]
test rbx, rbx
jne 0x14000f803
inc ecx
add r13, 8
mov dword [rsp + 0x4c8], ecx
cmp ecx, 0xa
jb 0x14000f6e8
test rbx, rbx
je 0x14000f87d
mov eax, dword [rsp + 0x4d0]
test eax, eax
je 0x14000f87d
add rbx, rax
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14000110c
test dword [rsp + 0x59], 0x1000
je 0x14000f832
mov eax, 0xc00000e5
jmp 0x14000f6a3
cmp byte [rsp + 0x38], 5
jne 0x14000f873
cmp byte [rbx], 0xe8
jne 0x14000f873
movsxd rax, dword [rbx + 1]
lea rcx, [rbx + 5]
add rcx, rax
cmp rcx, rdi
jb 0x14000f869
lea rax, [rdi + r12]
cmp rcx, rax
ja 0x14000f869
mov qword [r14], rcx
xor eax, eax
mov dword [r14 + 8], 1
jmp 0x14000f6a3
mov eax, 0xc0000018
jmp 0x14000f6a3
mov eax, 0xc000090b
jmp 0x14000f6a3
mov eax, 0xc0000225
jmp 0x14000f6a3