Function at 0x140004bf0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r11d, dword [r8 + 0x90]
mov rsi, r8
mov r12, rdx
mov r13, rcx
test r11d, r11d
je 0x140004ce0
movzx eax, word [r8 + 0x14]
lea r9, [r8 + 0x18]
movzx ebx, word [r8 + 6]
add r9, rax
xor r10d, r10d
test ebx, ebx
je 0x140004c60
nop dword [rax]
mov edx, dword [r9 + 0xc]
cmp r11d, edx
jb 0x140004c54
mov ecx, dword [r9 + 8]
add ecx, edx
cmp r11d, ecx
jb 0x140004c79
inc r10d
add r9, 0x28
cmp r10d, ebx
jl 0x140004c40
lea rcx, str.Failed_To_Get_IMPORT_DESCRIPTOR__n
call fcn.140001260
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004cee
mov ecx, dword [r9 + 0x14]
sub r11d, edx
mov eax, r11d
add rax, r12
add rcx, rax
je 0x140004c60
cmp dword [rcx + 0x10], 0
lea r15, [rcx + 0x10]
je 0x140004ce0
nop word [rax + rax]
movzx eax, word [rsi + 0x14]
lea rdx, [rsi + 0x18]
movzx r11d, word [rsi + 6]
add rdx, rax
mov r10d, dword [r15 - 4]
xor r8d, r8d
test r11d, r11d
je 0x140004ce0
nop dword [rax]
mov r9d, dword [rdx + 0xc]
cmp r10d, r9d
jb 0x140004cd4
mov ecx, dword [rdx + 8]
add ecx, r9d
cmp r10d, ecx
jb 0x140004d0d
inc r8d
add rdx, 0x28
cmp r8d, r11d
jl 0x140004cc0
mov r8, r13
mov rdx, rsi
mov rcx, r12
call fcn.140004a50
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r14d, dword [rdx + 0x14]
sub r10d, r9d
mov eax, r10d
add rax, r12
add r14, rax
je 0x140004ce0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
test rax, rax
je 0x140004e44
movzx ecx, word [rsi + 0x14]
lea rdx, [rsi + 0x18]
movzx r11d, word [rsi + 6]
add rdx, rcx
mov r10d, dword [r15]
xor r8d, r8d
test r11d, r11d
je 0x140004d74
nop
mov r9d, dword [rdx + 0xc]
cmp r10d, r9d
jb 0x140004d68
mov ecx, dword [rdx + 8]
add ecx, r9d
cmp r10d, ecx
jb 0x140004dfd
inc r8d
add rdx, 0x28
cmp r8d, r11d
jl 0x140004d50
xor edi, edi
mov r10, qword [rdi]
test r10, r10
je 0x140004dea
nop
movzx eax, word [rsi + 0x14]
xor r8d, r8d
movzx r11d, word [rsi + 6]
add rax, 0x18
add rax, rsi
test r11d, r11d
je 0x140004dc0
nop dword [rax + rax]
mov r9d, dword [rax + 0xc]
cmp r10d, r9d
jb 0x140004db4
mov edx, dword [rax + 8]
add edx, r9d
cmp r10d, edx
jb 0x140004e11
inc r8d
add rax, 0x28
cmp r8d, r11d
jl 0x140004da0
xor edx, edx
lea rbx, [rdx + 2]
mov rcx, rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi], rax
test rax, rax
je 0x140004e20
mov rax, qword [rdi + 8]
add rdi, 8
mov r10d, eax
test rax, rax
jne 0x140004d80
add r15, 0x14
cmp dword [r15], 0
jne 0x140004ca0
jmp 0x140004ce0
mov edi, dword [rdx + 0x14]
sub r10d, r9d
mov eax, r10d
add rax, r12
add rdi, rax
jmp 0x140004d76
mov edx, dword [rax + 0x14]
sub r10d, r9d
lea rax, [r12 + r10]
add rdx, rax
jmp 0x140004dc2
mov r8, rbx
lea rcx, str.Failed_to_get__s__s_n
mov rdx, r14
call fcn.140001260
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
jmp 0x140004cf0
mov rdx, r14
lea rcx, str.Failed_to_load_image_in_memory:__s_n
call fcn.140001260
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
jmp 0x140004cf0