Function at 0x140086650
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x360
mov rax, qword [0x1402e64c0]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov dword [rsp + 0x38], 0
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 0x2cc
rep stosb byte [rdi], al
mov dword [rsp + 0x80], 0x10037
mov rcx, qword [rsp + 0x370]
call fcn.140088380
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x140086afb
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x130]
mov dword [rax], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x124]
mov dword [rax + 0xc], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x12c]
mov dword [rax + 4], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x128]
mov dword [rax + 8], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x120]
mov dword [rax + 0x18], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x11c]
mov dword [rax + 0x1c], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x144]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x134]
mov dword [rax + 0x14], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x138]
mov dword [rax + 0x2c], ecx
mov rax, qword [rsp + 0x378]
movzx ecx, word [rsp + 0x13c]
mov word [rax + 0x10e], cx
mov rax, qword [rsp + 0x378]
movzx ecx, word [rsp + 0x118]
mov word [rax + 0x110], cx
mov rax, qword [rsp + 0x378]
movzx ecx, word [rsp + 0x114]
mov word [rax + 0x112], cx
mov rax, qword [rsp + 0x378]
movzx ecx, word [rsp + 0x110]
mov word [rax + 0x114], cx
mov rax, qword [rsp + 0x378]
movzx ecx, word [rsp + 0x10c]
mov word [rax + 0x116], cx
mov rax, qword [rsp + 0x378]
movzx ecx, word [rsp + 0x148]
mov word [rax + 0x10c], cx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x84]
mov dword [rax + 0x30], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x88]
mov dword [rax + 0x34], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x8c]
mov dword [rax + 0x38], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x90]
mov dword [rax + 0x3c], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x94]
mov dword [rax + 0x48], ecx
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x98]
mov dword [rax + 0x4c], ecx
mov eax, dword [rsp + 0x140]
or eax, 2
mov rcx, qword [rsp + 0x378]
mov dword [rcx + 0x28], eax
lea rax, [rsp + 0x14c]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x20]
movzx ecx, word [rcx]
mov word [rax + 0xf0], cx
mov rax, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x20]
movzx ecx, word [rcx + 2]
mov word [rax + 0xf2], cx
mov rcx, qword [rsp + 0x20]
call fcn.140088dc0
mov rcx, qword [rsp + 0x378]
mov word [rcx + 0xf4], ax
mov rax, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x20]
movzx ecx, word [rcx + 6]
mov word [rax + 0xf6], cx
mov rax, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 8]
mov dword [rax + 0xfc], ecx
mov rax, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x20]
movzx ecx, word [rcx + 0xc]
mov word [rax + 0xf8], cx
mov rax, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0x10]
mov dword [rax + 0x100], ecx
mov rax, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x20]
movzx ecx, word [rcx + 0x14]
mov word [rax + 0xfa], cx
mov rax, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0x18]
mov dword [rax + 0x104], ecx
mov rax, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x20]
mov ecx, dword [rcx + 0x1c]
mov dword [rax + 0x108], ecx
mov rax, qword [rsp + 0x20]
add rax, 0x20
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x378]
add rax, 0x50
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x30], 0
jmp 0x1400869cd
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
add rax, 0xa
mov qword [rsp + 0x50], rax
cmp dword [rsp + 0x30], 8
jae 0x1400869eb
mov r8d, 0xa
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call fcn.140226460
jmp 0x1400869a7
mov rax, qword [rsp + 0x20]
add rax, 0xa0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x378]
add rax, 0x118
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x34], 0
jmp 0x140086a3e
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x58]
add rax, 0x10
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x60]
add rax, 0x20
mov qword [rsp + 0x60], rax
cmp dword [rsp + 0x34], 8
jae 0x140086a5c
mov r8d, 0x10
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call fcn.140226460
jmp 0x140086a18
lea rax, [rsp + 0x28]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea r8, [rsp + 0x28]
mov edx, dword [rsp + 0x110]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadSelectorEntry]
test eax, eax
je 0x140086ab4
movzx eax, word [rsp + 0x2a]
movzx ecx, byte [rsp + 0x2c]
shl ecx, 0x10
or eax, ecx
movzx ecx, byte [rsp + 0x2f]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0x3c], eax
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x3c]
mov dword [rax + 0x20], ecx
lea r8, [rsp + 0x28]
mov edx, dword [rsp + 0x10c]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadSelectorEntry]
test eax, eax
je 0x140086afb
movzx eax, word [rsp + 0x2a]
movzx ecx, byte [rsp + 0x2c]
shl ecx, 0x10
or eax, ecx
movzx ecx, byte [rsp + 0x2f]
shl ecx, 0x18
or eax, ecx
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x378]
mov ecx, dword [rsp + 0x40]
mov dword [rax + 0x24], ecx
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.1401c2c80
add rsp, 0x360
pop rdi
ret