Function at 0x14043ada0
Capabilities:
Enumerate pe sections

Disassembly:
push r14
push r15
sub rsp, 0x378
mov r15, r8
mov rax, qword [0x14194d6d8]
mov r14, rdx
xor rax, rsp
mov qword [rsp + 0x368], rax
test r9, r9
je 0x14043ac7f
mov qword [r9], 0
mov r8d, 0x30
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x14043acc9
mov byte [r14], 0
mov rcx, qword [rsp + 0x368]
mov qword [rsp + 0x368], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x14043ad8f
add rsp, 0x378
pop r15
pop r14
ret
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x260]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x14043ad1a
mov byte [r14], 0
mov rcx, qword [rsp + 0x368]
mov qword [rsp + 0x368], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x14043ad8f
add rsp, 0x378
pop r15
pop r14
ret
mov r10, rsp
xor edx, edx
xor r8d, r8d
lea rcx, [rsp + 0x260]
lea r9, [rsp + 0x160]
lea rax, [rsp + 0x60]
mov qword [r10 + 0x20], rax
call fcn.14048b620
mov rcx, r14
lea rdx, [rsp + 0x160]
mov r8, r15
call fcn.1404544c0
mov rcx, r14
lea rdx, [rsp + 0x60]
mov r8, r15
call fcn.14048a660
mov rcx, qword [rsp + 0x368]
mov qword [rsp + 0x368], 0
xor rcx, rsp
cmp rcx, qword [0x14194d6d8]
jne 0x14043ad8f
add rsp, 0x378
pop r15
pop r14
ret
call fcn.14043dac0
nop
nop dword [rax]
nop dword [rax]
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x88
mov rdi, rdx
mov r13, r8
mov rsi, rcx
mov rcx, rdi
lea rdx, [rsp + 0x48]
mov r8d, 0x30
mov r12d, r12d
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14043aea2
mov rbx, qword [rsp + 0x50]
movzx eax, word [rbx]
cmp eax, 0x5a4d
jne 0x14043aea2
movsxd rcx, dword [rbx + 0x3c]
xor r14b, r14b
add rcx, rbx
xor eax, eax
xor dl, dl
movzx ebp, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rbp, [rcx + rbp + 0x18]
test r8d, r8d
jbe 0x14043aea2
mov qword [rsp + 0x78], rsi
mov sil, dl
mov qword [rsp + 0x28], rdi
mov edi, eax
mov qword [rsp + 0x20], r13
mov r13, rcx
mov rcx, rbp
lea rdx, [0x1405bc318]
mov r8d, 7
call fcn.140441ad0
test eax, eax
jne 0x14043ae5e
inc edi
mov r15, rbp
movzx r8d, word [r13 + 6]
add rbp, 0x28
mov r14b, 1
cmp edi, r8d
jae 0x14043aef0
test sil, sil
jne 0x14043ae87
mov rcx, rbp
lea rdx, [0x1405bc320]
mov r8d, 6
call fcn.140441ad0
test eax, eax
jne 0x14043ae87
mov sil, 1
add rbp, 0x28
inc edi
jmp 0x14043ae8d
add rbp, 0x28
inc edi
movzx r8d, word [r13 + 6]
cmp edi, r8d
jae 0x14043b32d
test r14b, r14b
jne 0x14043ae5e
jmp 0x14043ae2b
mov rcx, rsi
lea rdx, str.Unknown
call fcn.14048a8e0
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.14048a8e0
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.14048a8e0
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x28]
mov r13, qword [rsp + 0x20]
mov eax, dword [r15 + 8]
cmp rax, 0x1a
jb 0x14043aea2
mov edx, dword [r15 + 0xc]
add rbx, rdx
add rbx, r13
xor r15d, r15d
mov rbp, rbx
jmp 0x14043af1e
add rbx, r10
mov dl, byte [rbx]
test dl, dl
jne 0x14043af2c
mov r10d, 1
jmp 0x14043af7d
cmp dl, 0xa
jne 0x14043aea2
test r13, r13
je 0x14043af45
cmp r13, qword [rbx + 8]
jbe 0x14043af45
mov r9, r13
jmp 0x14043af48
xor r9d, r9d
movzx edx, word [rbx + 1]
cmp edx, 2
jne 0x14043aea2
cmp byte [rbx + 3], 0
ja 0x14043aea2
mov edx, dword [rbx + 0x14]
add rdx, r9
mov r8, qword [rbx + 8]
add rdx, r8
mov r10d, dword [rbx + 4]
cmp rdi, rdx
jae 0x14043af7d
add r8, r9
cmp rdi, r8
jae 0x14043af8b
add r15, r10
cmp r15, rax
jae 0x14043aea2
jmp 0x14043af1b
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], r9
cmp byte [rbx], 0xa
jne 0x14043aea2
movzx eax, word [rbx + 1]
cmp eax, 2
jne 0x14043aea2
cmp byte [rbx + 3], 0
ja 0x14043aea2
movzx eax, word [rbx + 0x1a]
lea rdx, [rbx + 0x10]
mov r8d, 4
lea rcx, [rsp + 0x40]
mov r14d, dword [rbx + 4]
lea r13, [rbx + 0x1a]
mov qword [rcx - 0x20], r13
lea r9, [rbx + 0x1c]
mov qword [rcx - 0x10], rax
mov r13d, 0x1a
mov qword [rcx - 0x18], r9
call fcn.1404407e0
mov edx, dword [rsp + 0x40]
test edx, edx
jbe 0x14043b04a
mov eax, edx
mov r8d, 1
mov r10, qword [rsp + 0x20]
xor r9d, r9d
shr eax, 1
je 0x14043b039
xor r8d, r8d
movzx r11d, word [r10]
inc r9d
lea r10, [r10 + r11 + 2]
lea r13, [r13 + r11 + 2]
movzx r11d, word [r10]
lea r8, [r8 + r11 + 2]
lea r10, [r10 + r11 + 2]
cmp r9d, eax
jb 0x14043b00d
add r13, r8
lea r8d, [r9 + r9 + 1]
dec r8d
cmp r8d, edx
jae 0x14043b04a
movzx eax, word [r10]
lea r13, [r13 + rax + 2]
imul rax, r14, 0x1d
mov qword [rsp + 0x78], rsi
lea r11, [r13 + rbx]
add r13, r15
xor r15d, r15d
mov r10, qword [rsp + 0x38]
xor r8d, r8d
mov rsi, qword [rsp + 0x28]
add rbx, rax
mov r9, qword [rsp + 0x30]
cmp r13, rbx
je 0x14043b2f1
movzx r14d, byte [r11]
mov eax, r14d
and eax, 0xc0
cmp eax, 0x80
jne 0x14043b0b4
mov al, byte [r11]
inc r8
and al, 0x3f
movzx r13d, al
lea r10, [r10 + r13 + 1]
cmp r10, rdi
jae 0x14043b19f
inc r11
mov r13, r11
sub r13, rbp
jmp 0x14043b073
cmp eax, 0xc0
jne 0x14043b0e8
mov r13b, byte [r11]
and r13b, 0x3f
movzx r14d, r13b
movsx rax, byte [r11 + 1]
add r8, rax
lea r10, [r10 + r14 + 1]
cmp r10, rdi
jae 0x14043b19f
add r11, 2
mov r13, r11
sub r13, rbp
jmp 0x14043b073
cmp r14d, 0xd
ja 0x14043b2dc
lea rdx, [0x140000000]
movzx eax, word [rdx + r14*2 + 0x5bc2a8]
lea rax, [rdx + rax + 0x43b10c]
jmp rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r9
mov rsi, qword [rsp + 0x78]
lea rdx, str._I64u
lea rcx, [rsi + 0x208]
call fcn.14036c680
test r15, r15
je 0x14043b30a
mov rcx, rsi
mov rdx, r15
mov r8, r12
call fcn.1404407e0
mov r12d, r12d
mov byte [r12 + rsi], 0
mov rdx, qword [rsp + 0x28]
lea rcx, [rsi + 0x104]
mov r8, qword [rsp + 0x30]
call fcn.1404407e0
mov rax, qword [rsp + 0x30]
mov byte [rax + rsi + 0x104], 0
jmp 0x14043aeda
mov rsi, qword [rsp + 0x78]
jmp 0x14043aea2
mov rsi, qword [rsp + 0x78]
mov rcx, rsi
lea rdx, str.Unknown
call fcn.14048a8e0
jmp 0x14043aeb1
lea rcx, str.Unknown
call fcn.14048a5a0
mov rcx, rsi
lea rdx, str.Unknown
mov r8, rax
call fcn.1404407e0
jmp 0x14043b1e0
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x28]
mov r13, qword [rsp + 0x20]
test r14b, r14b
jne 0x14043aeff
jmp 0x14043aea2