Function at 0x2d9e3bebf0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rbp + 0x58], rax
mov rax, qword [rcx + 0x18]
mov rsi, rdx
cmp dword [rax + 0xd0], 0
jbe 0x2d9e3bedc5
cmp dword [rax + 0xd4], 0
jbe 0x2d9e3bedc5
lea rcx, [0x2d9e408d30]
mov qword [rsp + 0x170], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x2d9e3bedbd
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x114
call fcn.2d9e3e3840
lea rdx, [0x2d9e408d38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x2d9e3bedbd
lea rcx, [rsp + 0x20]
call rax
test eax, eax
jne 0x2d9e3bedbd
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x2d9e3bedbd
movsxd rdx, dword [rbx + 0x3c]
add rdx, rbx
cmp dword [rdx], 0x4550
jne 0x2d9e3bedbd
movzx eax, word [rdx + 0x14]
lea rcx, [rdx + 0x18]
movzx r8d, word [rdx + 6]
add rcx, rax
xor eax, eax
test r8d, r8d
je 0x2d9e3bedbd
nop dword [rax + rax]
test dword [rcx + 0x24], 0x20000000
jne 0x2d9e3bece9
add rcx, 0x28
inc eax
cmp eax, r8d
jl 0x2d9e3becd0
jmp 0x2d9e3bedbd
mov r9d, dword [rcx + 0xc]
mov edx, dword [rcx + 0x10]
add r9, rbx
je 0x2d9e3bedbd
test edx, edx
je 0x2d9e3bedbd
mov eax, dword [rsp + 0x24]
cmp eax, 0xa
jne 0x2d9e3beede
cmp dword [rsp + 0x28], 0
jne 0x2d9e3bedbd
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0x3fab
jbe 0x2d9e3bee11
cmp ecx, 0x532c
mov qword [rsp + 0x178], rdi
lea rax, [rbp + 0x40]
mov dword [rbp + 0x40], 0x8d443374
lea r11, [rbp + 0x50]
mov word [rbp + 0x44], 0x943
cmovb r11, rax
mov dword [rbp + 0x50], 0x8d442e74
cmp ecx, 0x47ba
mov word [rbp + 0x54], 0x943
mov edi, 0x46
lea ebx, [rdx - 6]
mov eax, 0x44
cmovb edi, eax
xor r10d, r10d
nop word [rax + rax]
xor edx, edx
mov r8, r11
nop word [rax + rax]
movzx eax, byte [r8]
lea ecx, [rdx + r10]
cmp byte [rcx + r9], al
jne 0x2d9e3beda8
inc edx
inc r8
cmp edx, 6
jb 0x2d9e3bed90
cmp edx, 6
je 0x2d9e3bede2
inc r10d
cmp r10d, ebx
jbe 0x2d9e3bed80
mov rdi, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x170]
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.2d9e3da7d0
mov rsi, qword [rsp + 0x180]
add rsp, 0x160
pop rbp
ret
mov eax, edi
mov ebx, r10d
sub rbx, rax
add rbx, r9
je 0x2d9e3bedb5
xor ecx, ecx
mov edx, 0x98
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
mov qword [rax + 0x30], rsi
call rbx
jmp 0x2d9e3bedb5
lea eax, [rcx - 0x3ad7]
cmp eax, 0x4d4
ja 0x2d9e3bee6e
mov dword [rbp + 0x40], 0x8d443374
lea r11d, [rdx - 6]
mov word [rbp + 0x44], 0x943
xor r10d, r10d
xor edx, edx
lea r8, [rbp + 0x40]
nop dword [rax + rax]
movzx eax, byte [r8]
lea ecx, [rdx + r10]
cmp byte [rcx + r9], al
jne 0x2d9e3bee58
inc edx
inc r8
cmp edx, 6
jb 0x2d9e3bee40
cmp edx, 6
je 0x2d9e3befc0
inc r10d
cmp r10d, r11d
jbe 0x2d9e3bee32
jmp 0x2d9e3bedbd
cmp ecx, 0x3ad7
jae 0x2d9e3bedbd
mov dword [rbp + 0x40], 0x9438d44
lea r11d, [rdx - 9]
mov dword [rbp + 0x44], 0x244c8d4c
xor r10d, r10d
mov byte [rbp + 0x48], 0x38
nop dword [rax]
nop word [rax + rax]
xor edx, edx
lea r8, [rbp + 0x40]
nop word [rax + rax]
movzx eax, byte [r8]
lea ecx, [rdx + r10]
cmp byte [rcx + r9], al
jne 0x2d9e3beec8
inc edx
inc r8
cmp edx, 9
jb 0x2d9e3beeb0
cmp edx, 9
je 0x2d9e3befc0
inc r10d
cmp r10d, r11d
jbe 0x2d9e3beea0
jmp 0x2d9e3bedbd
cmp eax, 6
jne 0x2d9e3bedbd
mov eax, dword [rsp + 0x28]
cmp eax, 3
je 0x2d9e3bee7a
cmp eax, 2
jne 0x2d9e3bef50
mov dword [rbp + 0x40], 0x30798b48
lea r11d, [rdx - 8]
mov dword [rbp + 0x44], 0x1668d45
xor r10d, r10d
nop word [rax + rax]
xor edx, edx
lea r8, [rbp + 0x40]
nop word [rax + rax]
movzx eax, byte [r8]
lea ecx, [rdx + r10]
cmp byte [rcx + r9], al
jne 0x2d9e3bef38
inc edx
inc r8
cmp edx, 8
jb 0x2d9e3bef20
cmp edx, 8
je 0x2d9e3bef4a
inc r10d
cmp r10d, r11d
jbe 0x2d9e3bef10
jmp 0x2d9e3bedbd
lea rbx, [r9 - 0x49]
jmp 0x2d9e3befc4
cmp eax, 1
jne 0x2d9e3bedbd
mov dword [rbp + 0x40], 0xa0ec8148
lea r11d, [rdx - 0xa]
mov dword [rbp + 0x44], 0x48000000
xor r10d, r10d
mov word [rbp + 0x48], 0xd98b
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
lea r8, [rbp + 0x40]
nop word [rax + rax]
movzx eax, byte [r8]
lea ecx, [rdx + r10]
cmp byte [rcx + r9], al
jne 0x2d9e3befa8
inc edx
inc r8
cmp edx, 0xa
jb 0x2d9e3bef90
cmp edx, 0xa
je 0x2d9e3befba
inc r10d
cmp r10d, r11d
jbe 0x2d9e3bef80
jmp 0x2d9e3bedbd
lea rbx, [r9 - 0x10]
jmp 0x2d9e3befc4
lea rbx, [r9 - 0x43]
mov eax, r10d
add rbx, rax
je 0x2d9e3bedbd
xor ecx, ecx
mov edx, 0x98
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
mov qword [rax + 0x30], rsi
call rbx
jmp 0x2d9e3bedbd