Function at 0x1401e0390
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xd88
mov rax, qword [0x140328b80]
xor rax, rsp
mov qword [rsp + 0xd60], rax
movsxd r12, dword [rsp + 0xde0]
mov rbx, r9
mov r9, r8
mov qword [rsp + 0x40], r8
mov r13, rdx
mov r15, rcx
mov eax, 0x10000
xor edi, edi
mov dword [rbx + rax*4], edi
sub rax, 1
jns 0x1401e03d3
movzx edx, byte [rdx]
lea r10d, [r12 - 1]
movsxd r11, r10d
shl edx, 8
mov rsi, r11
cmp r11, 3
jl 0x1401e0498
lea r10, [r11 + 1]
shr r10, 2
lea r9, [r9 + r11*2]
lea r8, [r13 - 2]
mov eax, r10d
add r8, r11
add r9, 0xfffffffffffffffc
neg eax
lea r11d, [r11 + rax*4]
nop word [rax + rax]
mov word [r9 + 4], di
lea r9, [r9 - 8]
movzx ecx, byte [r8 + 2]
lea r8, [r8 - 4]
sar edx, 8
shl ecx, 8
or ecx, edx
movsxd rax, ecx
sar ecx, 8
inc dword [rbx + rax*4]
mov word [r9 + 0xa], di
movzx edx, byte [r8 + 5]
shl edx, 8
or edx, ecx
movsxd rax, edx
sar edx, 8
inc dword [rbx + rax*4]
mov word [r9 + 8], di
movzx ecx, byte [r8 + 4]
shl ecx, 8
or ecx, edx
movsxd rax, ecx
sar ecx, 8
inc dword [rbx + rax*4]
mov word [r9 + 6], di
movzx edx, byte [r8 + 3]
shl edx, 8
or edx, ecx
movsxd rax, edx
inc dword [rbx + rax*4]
sub r10, 1
jne 0x1401e0420
mov r9, qword [rsp + 0x40]
lea r10d, [r12 - 1]
movsxd r8, r11d
test r11d, r11d
js 0x1401e04c2
mov eax, edx
mov word [r9 + r8*2], di
movzx ecx, byte [r8 + r13]
sar eax, 8
shl ecx, 8
mov edx, ecx
or edx, eax
movsxd rax, edx
inc dword [rbx + rax*4]
sub r8, 1
jns 0x1401e04a0
movzx eax, byte [r13]
mov byte [r12 + r13], al
mov word [r9 + r12*2], di
movzx eax, byte [r13 + 1]
mov byte [r12 + r13 + 1], al
mov word [r9 + r12*2 + 2], di
movzx eax, byte [r13 + 2]
mov byte [r12 + r13 + 2], al
mov word [r9 + r12*2 + 4], di
movzx eax, byte [r13 + 3]
mov byte [r12 + r13 + 3], al
mov word [r9 + r12*2 + 6], di
movzx eax, byte [r13 + 4]
mov byte [r12 + r13 + 4], al
mov word [r9 + r12*2 + 8], di
movzx eax, byte [r13 + 5]
mov byte [r12 + r13 + 5], al
mov word [r9 + r12*2 + 0xa], di
movzx eax, byte [r13 + 6]
mov byte [r12 + r13 + 6], al
mov word [r9 + r12*2 + 0xc], di
movzx eax, byte [r13 + 7]
mov byte [r12 + r13 + 7], al
mov word [r9 + r12*2 + 0xe], di
movzx eax, byte [r13 + 8]
mov byte [r12 + r13 + 8], al
mov word [r9 + r12*2 + 0x10], di
movzx eax, byte [r13 + 9]
mov byte [r12 + r13 + 9], al
mov word [r9 + r12*2 + 0x12], di
movzx eax, byte [r13 + 0xa]
mov byte [r12 + r13 + 0xa], al
mov word [r9 + r12*2 + 0x14], di
movzx eax, byte [r13 + 0xb]
mov byte [r12 + r13 + 0xb], al
mov word [r9 + r12*2 + 0x16], di
movzx eax, byte [r13 + 0xc]
mov byte [r12 + r13 + 0xc], al
mov word [r9 + r12*2 + 0x18], di
movzx eax, byte [r13 + 0xd]
mov byte [r12 + r13 + 0xd], al
mov word [r9 + r12*2 + 0x1a], di
movzx eax, byte [r13 + 0xe]
mov byte [r12 + r13 + 0xe], al
mov word [r9 + r12*2 + 0x1c], di
movzx eax, byte [r13 + 0xf]
mov byte [r12 + r13 + 0xf], al
mov word [r9 + r12*2 + 0x1e], di
movzx eax, byte [r13 + 0x10]
mov byte [r12 + r13 + 0x10], al
mov word [r9 + r12*2 + 0x20], di
movzx eax, byte [r13 + 0x11]
mov byte [r12 + r13 + 0x11], al
mov word [r9 + r12*2 + 0x22], di
movzx eax, byte [r13 + 0x12]
mov byte [r12 + r13 + 0x12], al
mov word [r9 + r12*2 + 0x24], di
movzx eax, byte [r13 + 0x13]
mov byte [r12 + r13 + 0x13], al
mov word [r9 + r12*2 + 0x26], di
movzx eax, byte [r13 + 0x14]
mov byte [r12 + r13 + 0x14], al
mov word [r9 + r12*2 + 0x28], di
movzx eax, byte [r13 + 0x15]
mov byte [r12 + r13 + 0x15], al
mov word [r9 + r12*2 + 0x2a], di
movzx eax, byte [r13 + 0x16]
mov byte [r12 + r13 + 0x16], al
mov word [r9 + r12*2 + 0x2c], di
movzx eax, byte [r13 + 0x17]
mov byte [r12 + r13 + 0x17], al
mov word [r9 + r12*2 + 0x2e], di
movzx eax, byte [r13 + 0x18]
mov byte [r12 + r13 + 0x18], al
mov word [r9 + r12*2 + 0x30], di
movzx eax, byte [r13 + 0x19]
mov byte [r12 + r13 + 0x19], al
mov word [r9 + r12*2 + 0x32], di
movzx eax, byte [r13 + 0x1a]
mov byte [r12 + r13 + 0x1a], al
mov word [r9 + r12*2 + 0x34], di
movzx eax, byte [r13 + 0x1b]
lea r8, [rbx + 8]
mov byte [r12 + r13 + 0x1b], al
mov word [r9 + r12*2 + 0x36], di
movzx eax, byte [r13 + 0x1c]
mov byte [r12 + r13 + 0x1c], al
mov word [r9 + r12*2 + 0x38], di
movzx eax, byte [r13 + 0x1d]
mov byte [r12 + r13 + 0x1d], al
mov word [r9 + r12*2 + 0x3a], di
movzx eax, byte [r13 + 0x1e]
mov byte [r12 + r13 + 0x1e], al
mov word [r9 + r12*2 + 0x3c], di
movzx eax, byte [r13 + 0x1f]
mov byte [r12 + r13 + 0x1f], al
mov word [r9 + r12*2 + 0x3e], di
movzx eax, byte [r13 + 0x20]
mov byte [r12 + r13 + 0x20], al
mov word [r9 + r12*2 + 0x40], di
movzx eax, byte [r13 + 0x21]
mov byte [r12 + r13 + 0x21], al
mov word [r9 + r12*2 + 0x42], di
mov r9d, 0x4000
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov eax, dword [r8 - 8]
add dword [r8 - 4], eax
mov edx, dword [r8 - 4]
add edx, dword [r8]
mov dword [r8], edx
lea r8, [r8 + 0x10]
add ecx, edx
add dword [r8 - 8], ecx
mov dword [r8 - 0xc], ecx
sub r9, 1
jne 0x1401e06f0
movzx r8d, byte [r13]
mov r9d, r10d
shl r8w, 8
cmp r10d, 3
jl 0x1401e07e7
lea r11d, [r10 - 2]
movzx edi, r8w
lea r10, [r13 - 2]
add r10, rsi
movzx edx, byte [r10 + 2]
lea r10, [r10 - 4]
movzx eax, dx
shr rdi, 8
shl ax, 8
movzx ecx, ax
or rcx, rdi
mov eax, dword [rbx + rcx*4]
dec eax
mov dword [rbx + rcx*4], eax
cdqe
mov dword [r15 + rax*4], r9d
sub r9d, 4
movzx r8d, byte [r10 + 5]
movzx eax, r8w
shl ax, 8
movzx ecx, ax
or rcx, rdx
mov eax, dword [rbx + rcx*4]
dec eax
mov dword [rbx + rcx*4], eax
movsxd rcx, eax
lea eax, [r11 + 1]
mov dword [r15 + rcx*4], eax
movzx edx, byte [r10 + 4]
movzx eax, dx
shl ax, 8
movzx ecx, ax
or rcx, r8
mov eax, dword [rbx + rcx*4]
dec eax
mov dword [rbx + rcx*4], eax
cdqe
mov dword [r15 + rax*4], r11d
movzx r8d, byte [r10 + 3]
shl r8w, 8
or r8w, dx
movzx edi, r8w
mov eax, dword [rbx + rdi*4]
dec eax
mov dword [rbx + rdi*4], eax
movsxd rcx, eax
lea eax, [r11 - 1]
sub r11d, 4
mov dword [r15 + rcx*4], eax
cmp r9d, 3
jge 0x1401e0740
xor edi, edi
test r9d, r9d
js 0x1401e0834
movsxd rdx, r9d
add rdx, r13
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx - 1]
shl cx, 8
movzx eax, r8w
shr ax, 8
movzx r8d, cx
or r8w, ax
movzx eax, r8w
mov ecx, dword [rbx + rax*4]
dec ecx
mov dword [rbx + rax*4], ecx
movsxd rax, ecx
mov dword [r15 + rax*4], r9d
sub r9d, 1
jns 0x1401e0800
mov ecx, edi
mov rax, rdi
nop dword [rax]
cmp rax, 0x100
jae 0x1401e0ca9
mov dword [rsp + rax*4 + 0x60], ecx
inc ecx
mov byte [rsp + rax + 0xc60], 0
inc rax
cmp ecx, 0xff
jle 0x1401e0840
mov qword [rsp + 0xd80], rbp
mov r10d, 1
mov qword [rsp + 0xd78], r14
nop dword [rax + rax]
lea r10d, [r10 + r10*2]
inc r10d
cmp r10d, 0x100
jle 0x1401e0880
mov eax, 0x55555556
imul r10d
mov r10d, edx
shr r10d, 0x1f
add r10d, edx
mov ebp, r10d
cmp r10d, 0xff
jg 0x1401e0951
movsxd rdi, r10d
mov r9, rdi
nop dword [rax + rax]
mov r14d, dword [rsp + rdi*4 + 0x60]
mov r8d, ebp
mov ecx, r14d
mov rax, rdi
shl ecx, 8
movsxd rdx, ecx
mov rcx, rdi
sub rcx, r9
mov r11d, dword [rbx + rdx*4 + 0x400]
sub r11d, dword [rbx + rdx*4]
mov edx, dword [rsp + rcx*4 + 0x60]
shl edx, 8
movsxd rcx, edx
mov edx, dword [rbx + rcx*4 + 0x400]
sub edx, dword [rbx + rcx*4]
cmp edx, r11d
jbe 0x1401e093b
lea esi, [r10 - 1]
mov rdx, rax
sub r8d, r10d
sub rdx, r9
mov ecx, dword [rsp + rdx*4 + 0x60]
mov dword [rsp + rax*4 + 0x60], ecx
mov rax, rdx
cmp r8d, esi
jle 0x1401e093b
mov rcx, rdx
sub rcx, r9
mov edx, dword [rsp + rcx*4 + 0x60]
shl edx, 8
movsxd rcx, edx
mov edx, dword [rbx + rcx*4 + 0x400]
sub edx, dword [rbx + rcx*4]
cmp edx, r11d
ja 0x1401e0903
inc ebp
mov dword [rsp + rax*4 + 0x60], r14d
inc rdi
cmp ebp, 0xff
jle 0x1401e08c0
cmp r10d, 1
jne 0x1401e0890
mov r14, qword [rsp + 0x40]
xor ebp, ebp
mov qword [rsp + 0x48], rbp
nop word [rax + rax]
movsxd rax, dword [rsp + rbp*4 + 0x60]
xor edi, edi
mov dword [rsp + 0x40], eax
mov rbp, rax
nop
cmp rdi, rbp
je 0x1401e09f2
mov rax, rbp
shl rax, 8
add rax, rdi
mov ecx, dword [rbx + rax*4]
lea rsi, [rbx + rax*4]
bt ecx, 0x15
jb 0x1401e09ec
mov eax, dword [rsi + 4]
btr ecx, 0x15
btr eax, 0x15
dec eax
cmp eax, ecx
jle 0x1401e09ec
mov rdx, qword [rsp + 0xdf0]
mov r9d, r12d
mov qword [rsp + 0x38], rdx
mov r8, r14
mov dword [rsp + 0x30], 2
mov rdx, r13
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, r15
call fcn.1401dfb10
mov rax, qword [rsp + 0xdf0]
cmp dword [rax], 0
jl 0x1401e0c78
or dword [rsi], 0x200000
inc rdi
cmp rdi, 0xff
jle 0x1401e0980
lea rax, [rsp + 0xc60]
add rax, rbp
mov qword [rsp + 0x50], rax
cmp byte [rax], 0
je 0x1401e0a1d
mov ecx, 0x3ee
call fcn.1401abaf0
lea rbp, [rbp*4]
xor ecx, ecx
lea rdi, [rbx + rbp]
mov rdx, rdi
nop
mov eax, dword [rdx]
lea rdx, [rdx + 0x400]
btr eax, 0x15
mov dword [rsp + rcx + 0x460], eax
mov eax, dword [rdx - 0x3fc]
btr eax, 0x15
dec eax
mov dword [rsp + rcx + 0x860], eax
add rcx, 4
cmp rcx, 0x3fc
jle 0x1401e0a30
mov r11d, dword [rsp + 0x40]
mov eax, r11d
shl eax, 8
cdqe
mov r8d, dword [rbx + rax*4]
lea rax, [rbx + rax*4]
btr r8d, 0x15
mov qword [rsp + 0x40], rax
cmp r8d, dword [rsp + rbp + 0x460]
jge 0x1401e0ae0
movsxd rax, r8d
lea r9, [r15 + rax*4]
mov eax, dword [r9]
lea edx, [rax - 1]
test edx, edx
jns 0x1401e0aa5
lea edx, [r12 - 1]
add edx, eax
movsxd rax, edx
movzx r10d, byte [rax + r13]
cmp byte [rsp + r10 + 0xc60], 0
jne 0x1401e0acf
movsxd rcx, dword [rsp + r10*4 + 0x460]
lea eax, [rcx + 1]
mov dword [r15 + rcx*4], edx
mov dword [rsp + r10*4 + 0x460], eax
inc r8d
add r9, 4
cmp r8d, dword [rsp + rbp + 0x460]
jl 0x1401e0a94
mov ecx, dword [rsp + rbp + 0x860]
shl r11d, 8
movsxd rax, r11d
lea rsi, [rbx + rax*4]
mov r8d, dword [rsi + 0x400]
btr r8d, 0x15
dec r8d
cmp r8d, ecx
jle 0x1401e0b5e
movsxd rax, r8d
lea r9, [r15 + rax*4]
nop dword [rax]
mov eax, dword [r9]
lea edx, [rax - 1]
test edx, edx
jns 0x1401e0b21
lea edx, [r12 - 1]
add edx, eax
movsxd rax, edx
movzx r10d, byte [rax + r13]
cmp byte [rsp + r10 + 0xc60], 0
jne 0x1401e0b4b
movsxd rcx, dword [rsp + r10*4 + 0x860]
lea eax, [rcx - 1]
mov dword [r15 + rcx*4], edx
mov dword [rsp + r10*4 + 0x860], eax
mov ecx, dword [rsp + rbp + 0x860]
dec r8d
sub r9, 4
cmp r8d, ecx
jg 0x1401e0b10
mov edx, dword [rsp + rbp + 0x460]
lea eax, [rdx - 1]
cmp eax, ecx
je 0x1401e0b83
test edx, edx
jne 0x1401e0b79
lea eax, [r12 - 1]
cmp ecx, eax
je 0x1401e0b83
mov ecx, 0x3ef
call fcn.1401abaf0
mov eax, 0x80
nop dword [rax + rax]
or dword [rdi], 0x200000
or dword [rdi + 0x400], 0x200000
lea rdi, [rdi + 0x800]
sub rax, 1
jne 0x1401e0b90
mov rax, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov byte [rax], 1
cmp rbp, 0xff
jge 0x1401e0c63
mov r8, qword [rsp + 0x40]
xor r10d, r10d
mov edx, dword [rsi + 0x400]
btr edx, 0x15
mov r8d, dword [r8]
btr r8d, 0x15
sub edx, r8d
cmp edx, 0xfffe
jle 0x1401e0c01
nop dword [rax]
inc r10d
mov eax, edx
mov ecx, r10d
sar eax, cl
cmp eax, 0xfffe
jg 0x1401e0bf0
lea edi, [rdx - 1]
movsxd r9, edi
test edi, edi
js 0x1401e0c4c
movsxd rcx, r8d
add rcx, r9
lea r11, [r15 + rcx*4]
nop word [rax + rax]
movsxd rdx, dword [r11]
mov r8d, r9d
mov ecx, r10d
sar r8d, cl
mov word [r14 + rdx*2], r8w
cmp edx, 0x22
jge 0x1401e0c42
lea eax, [r12 + rdx]
movsxd rdx, eax
mov word [r14 + rdx*2], r8w
sub r11, 4
sub r9d, 1
jns 0x1401e0c20
mov ecx, r10d
sar edi, cl
cmp edi, 0xffff
jle 0x1401e0c63
mov ecx, 0x3ea
call fcn.1401abaf0
inc rbp
mov qword [rsp + 0x48], rbp
cmp rbp, 0xff
jle 0x1401e0970
mov rbp, qword [rsp + 0xd80]
mov r14, qword [rsp + 0xd78]
mov rcx, qword [rsp + 0xd60]
xor rcx, rsp
call fcn.1401e1950
add rsp, 0xd88
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1401e1728
int3