Function at 0x1400011c0
Capabilities:
Enumerate pe sections
Get system information on windows
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
cmp rdx, 0x3f
ja 0x1400011e0
mov ecx, 0xd
jmp 0x1400013f1
mov r15, rcx
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x1400013ec
mov rbx, rdx
movsxd r13, dword [r15 + 0x3c]
lea rax, [r13 + 0x108]
cmp rax, rdx
ja 0x1400011d6
cmp dword [r15 + r13], 0x4550
jne 0x1400013ec
add r13, r15
movzx eax, word [r13 + 4]
cmp eax, 0x8664
jne 0x1400013ec
mov r12, r9
mov r9d, dword [r13 + 0x38]
test r9b, 1
jne 0x1400013ec
mov r14, r8
movzx edx, word [r13 + 6]
test edx, edx
je 0x140001264
movzx ecx, word [r13 + 0x14]
add rcx, r13
add rcx, 0x18
test edx, edx
mov r8d, 1
cmovne r8d, edx
cmp dx, 1
jne 0x140001268
xor ebp, ebp
jmp 0x1400012ad
xor ebp, ebp
jmp 0x1400012cb
mov edx, r8d
and edx, 0xfffffffe
neg edx
xor ebp, ebp
mov eax, dword [rcx + 0xc]
mov esi, dword [rcx + 0x10]
lea edi, [rax + rsi]
add rax, r9
test esi, esi
cmove rdi, rax
cmp rdi, rbp
cmovbe rdi, rbp
mov eax, dword [rcx + 0x38]
mov esi, dword [rcx + 0x34]
lea ebp, [rsi + rax]
add rsi, r9
test eax, eax
cmove rbp, rsi
cmp rbp, rdi
cmovbe rbp, rdi
add rcx, 0x50
add edx, 2
jne 0x140001272
test r8b, 1
je 0x1400012cb
mov eax, dword [rcx + 0xc]
mov ecx, dword [rcx + 0x10]
add r9, rax
add eax, ecx
test ecx, ecx
cmove rax, r9
cmp rax, rbp
cmova rbp, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x4c]
mov ecx, dword [r13 + 0x50]
lea rsi, [rax + rcx]
add rsi, 0xffffffffffffffff
lea rcx, [rax + rbp]
add rcx, 0xffffffffffffffff
neg rax
and rsi, rax
and rax, rcx
cmp rsi, rax
jne 0x1400013ec
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [r13 + 0x30]
mov qword [rsp + 0x20], rbp
mov rdx, rsi
mov r8d, 0x3000
mov r9d, 4
call r14
mov rdi, rax
test rax, rax
jne 0x140001350
mov qword [rsp + 0x20], rbp
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x3000
mov r9d, 4
call r14
mov rdi, rax
test rax, rax
je 0x14000153a
mov qword [rsp + 0x30], r13
xor r13d, r13d
mov rax, rdi
shr rax, 0x20
lea rcx, [rdi + rsi]
shr rcx, 0x20
cmp rax, rcx
jae 0x14000140d
mov ecx, 0x10
call fcn.140366b00
test rax, rax
je 0x1400014b0
mov rbp, rax
mov qword [rax], r13
mov qword [rax + 8], rdi
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x3000
mov r9d, 4
call r14
mov rdi, rax
mov r13, rbp
test rax, rax
jne 0x140001358
mov rdi, qword [rsp + 0xf8]
mov rcx, qword [rbp + 8]
xor edx, edx
mov r8d, 0x8000
mov r9, rdi
call r12
mov rsi, qword [rbp]
mov rcx, rbp
call fcn.140366b30
mov rbp, rsi
test rsi, rsi
jne 0x1400013c1
jmp 0x14000153a
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebp, ebp
mov rax, rbp
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x78
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1400014f6
mov rbp, rax
mov qword [rax + 8], rdi
mov rsi, qword [rsp + 0x30]
movzx eax, word [rsi + 0x16]
shr eax, 0xd
and eax, 1
mov dword [rbp + 0x20], eax
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], r12
mov rax, qword [rsp + 0xe0]
mov qword [rbp + 0x38], rax
mov rax, qword [rsp + 0xe8]
mov qword [rbp + 0x40], rax
mov rax, qword [rsp + 0xf0]
mov qword [rbp + 0x48], rax
mov rcx, qword [rsp + 0xf8]
mov qword [rbp + 0x58], rcx
mov eax, dword [rsp + 0x4c]
mov dword [rbp + 0x68], eax
mov qword [rbp + 0x70], r13
mov edx, dword [rsi + 0x54]
cmp rdx, rbx
jbe 0x140001544
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call fcn.140001ae0
jmp 0x1400013f7
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
mov rdi, qword [rsp + 0xf8]
mov r9, rdi
call r12
test r13, r13
je 0x14000153a
mov rcx, qword [r13 + 8]
xor edx, edx
mov r8d, 0x8000
mov r9, rdi
call r12
mov rsi, qword [r13]
mov rcx, r13
call fcn.140366b30
mov r13, rsi
test rsi, rsi
jne 0x1400014ce
jmp 0x14000153a
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
mov rdi, qword [rsp + 0xf8]
mov r9, rdi
call r12
test r13, r13
je 0x14000153a
mov rcx, qword [r13 + 8]
xor edx, edx
mov r8d, 0x8000
mov r9, rdi
call r12
mov rsi, qword [r13]
mov rcx, r13
call fcn.140366b30
mov r13, rsi
test rsi, rsi
jne 0x140001514
mov ecx, 0xe
jmp 0x1400013f1
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov r8d, 0x1000
mov r9d, 4
call r14
mov r14, rax
mov r8d, dword [rsi + 0x54]
mov rcx, rax
mov rdx, r15
call fcn.140355910
movsxd rax, dword [r15 + 0x3c]
lea rcx, [r14 + rax]
mov qword [rbp], rcx
mov qword [rsp + 0x40], rdi
mov qword [r14 + rax + 0x30], rdi
mov rsi, qword [rbp]
cmp word [rsi + 6], 0
je 0x140001666
mov r12, qword [rbp + 8]
movzx eax, word [rsi + 0x14]
lea rdi, [rsi + rax]
add rdi, 0x2c
xor r13d, r13d
jmp 0x1400015d3
mov ecx, dword [rdi - 8]
add rcx, r12
mov dword [rdi - 0xc], ecx
xor edx, edx
mov r8, rsi
call fcn.140355760
add r13d, 1
mov rsi, qword [rbp]
movzx eax, word [rsi + 6]
add rdi, 0x28
cmp r13d, eax
jae 0x140001666
mov edx, dword [rdi - 4]
test rdx, rdx
je 0x14000162b
mov eax, dword [rdi]
add eax, edx
cmp rax, rbx
ja 0x140001498
mov rax, qword [rbp + 0x58]
mov ecx, dword [rdi - 8]
add rcx, r12
mov qword [rsp + 0x20], rax
mov r8d, 0x1000
mov r9d, 4
call qword [rbp + 0x28]
test rax, rax
je 0x1400014a3
mov esi, dword [rdi - 8]
mov r8d, dword [rdi - 4]
add rsi, r12
mov edx, dword [rdi]
add rdx, r15
mov rcx, rsi
call fcn.140355910
mov dword [rdi - 0xc], esi
jmp 0x1400015ba
mov rax, qword [rsp + 0x30]
mov esi, dword [rax + 0x38]
test esi, esi
jle 0x1400015ba
mov rax, qword [rbp + 0x58]
mov ecx, dword [rdi - 8]
add rcx, r12
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov r8d, 0x1000
mov r9d, 4
call qword [rbp + 0x28]
test rax, rax
jne 0x1400015a7
jmp 0x1400014a3
mov r10, qword [rsi + 0x30]
mov r8d, 1
mov rax, qword [rsp + 0x30]
sub r10, qword [rax + 0x30]
je 0x140001701
cmp dword [rsi + 0xb4], 0
je 0x1400016fe
mov r9, qword [rbp + 8]
mov edx, dword [rsi + 0xb0]
mov ebx, dword [r9 + rdx]
test ebx, ebx
je 0x140001701
add rdx, r9
jmp 0x1400016a9
mov ebx, dword [rsi + rdx]
add rdx, rsi
test ebx, ebx
je 0x1400016f8
mov esi, dword [rdx + 4]
mov eax, esi
and eax, 0xfffffffe
cmp eax, 8
je 0x14000169f
mov ebx, ebx
add rbx, r9
xor edi, edi
jmp 0x1400016d8
add qword [rbx + rsi], r10
add rdi, 1
mov eax, edi
mov esi, dword [rdx + 4]
lea rcx, [rsi - 8]
shr rcx, 1
cmp rcx, rax
jbe 0x14000169f
movzx esi, word [rdx + rdi*2 + 8]
mov eax, esi
shr eax, 0xc
and esi, 0xfff
cmp eax, 0xa
je 0x1400016bf
cmp eax, 3
jne 0x1400016c3
add dword [rbx + rsi], r10d
jmp 0x1400016c3
mov rsi, qword [rbp]
jmp 0x140001701
xor r8d, r8d
mov dword [rbp + 0x24], r8d
cmp dword [rsi + 0x94], 0
je 0x14000172e
mov r12, qword [rbp + 8]
mov r15d, dword [rsi + 0x90]
add r15, r12
mov edx, 0x14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x14000177c
mov rdx, qword [rbp]
movzx edi, word [rdx + 0x14]
mov r13d, dword [rdx + 0x34]
shl r13, 0x20
mov ecx, dword [rdx + rdi + 0x20]
mov ebx, dword [rdx + rdi + 0x28]
or rcx, r13
mov eax, dword [rbp + 0x68]
mov r10, rax
neg r10
mov r8d, dword [rdx + rdi + 0x3c]
test ebx, ebx
jne 0x140001862
test r8b, 0x40
jne 0x14000185f
xor ebx, ebx
test r8b, r8b
jns 0x140001862
mov ebx, dword [rdx + 0x24]
jmp 0x140001862
lea r13, [r12 + 2]
jmp 0x140001799
add r15, 0x14
mov edx, 0x14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000172e
mov ecx, dword [r15 + 0xc]
test rcx, rcx
je 0x14000172e
mov rdx, qword [rbp + 0x58]
add rcx, r12
call qword [rbp + 0x38]
test rax, rax
je 0x140001abf
mov rdi, rax
movsxd rax, dword [rbp + 0x18]
lea rdx, [rax*8 + 8]
mov rcx, qword [rbp + 0x10]
call fcn.14036d610
test rax, rax
je 0x140001ac9
mov qword [rbp + 0x10], rax
movsxd rcx, dword [rbp + 0x18]
lea edx, [rcx + 1]
mov dword [rbp + 0x18], edx
mov qword [rax + rcx*8], rdi
mov ebx, dword [r15]
test rbx, rbx
je 0x1400017fc
add rbx, r12
mov esi, dword [r15 + 0x10]
add rsi, r12
jmp 0x140001806
mov ebx, dword [r15 + 0x10]
add rbx, r12
mov rsi, rbx
mov rdx, qword [rbx]
test rdx, rdx
je 0x140001783
xor r14d, r14d
mov rax, qword [rbp + 0x40]
mov r8, qword [rbp + 0x58]
test rdx, rdx
js 0x140001827
add rdx, r13
jmp 0x14000182a
movzx edx, dx
mov rcx, rdi
call rax
mov qword [rsi + r14], rax
test rax, rax
je 0x14000184b
mov rdx, qword [rbx + r14 + 8]
add r14, 8
test rdx, rdx
jne 0x140001815
jmp 0x140001783
mov rdx, qword [rbp + 0x58]
mov rcx, rdi
call qword [rbp + 0x48]
mov ecx, 0x7f
jmp 0x14000149d
mov ebx, dword [rdx + 0x20]
and r10, rcx
mov r11d, ebx
cmp word [rdx + 6], 2
jb 0x1400019b3
lea rsi, [rdx + rdi]
add rsi, 0x18
add rsi, 0x4c
mov r15d, 2
mov r12d, dword [rsi - 0x1c]
mov ebx, dword [rsi - 0x14]
or r12, r13
mov edi, eax
mov r14, rdi
neg r14
and r14, r12
test ebx, ebx
jne 0x1400018b2
mov eax, dword [rsi]
test al, 0x40
jne 0x1400018af
xor ebx, ebx
test al, al
jns 0x1400018b2
mov ebx, dword [rdx + 0x24]
jmp 0x1400018b2
mov ebx, dword [rdx + 0x20]
mov ebx, ebx
cmp r10, r14
je 0x140001925
lea rax, [r11 + rcx]
cmp rax, r14
ja 0x140001925
test r11, r11
je 0x140001987
test r8d, 0x2000000
jne 0x14000194e
mov eax, r8d
shr eax, 0x1d
and eax, 1
mov edx, r8d
shr edx, 0x1e
and edx, 1
mov r9d, r8d
shr r9d, 0x1f
shl rax, 4
lea rdi, [0x1404ae880]
add rax, rdi
lea rax, [rax + rdx*8]
shr r8d, 0x11
and r8d, 0x200
or r8d, dword [rax + r9*4]
mov rdx, r11
lea r9, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001987
jmp 0x1400014a3
mov eax, dword [rsi]
mov edi, r8d
and edi, eax
or eax, r8d
mov r8d, eax
and r8d, 0xfdffffff
test edi, 0x2000000
cmovne r8d, eax
add r12, rbx
sub r12, rcx
mov rbx, r12
jmp 0x140001994
cmp rcx, r10
jne 0x140001987
cmp dword [rdx + 0x38], edi
je 0x140001977
mov rax, r11
shr rax, 0x20
je 0x14000196b
mov rax, r11
xor edx, edx
div rdi
jmp 0x140001972
mov eax, r11d
xor edx, edx
div edi
test rdx, rdx
jne 0x140001987
mov r9, qword [rbp + 0x58]
mov rdx, r11
mov r8d, 0x4000
call qword [rbp + 0x30]
mov r8d, dword [rsi]
mov rdx, qword [rbp]
mov r10, r14
mov rcx, r12
movzx eax, word [rdx + 6]
cmp r15d, eax
jae 0x1400019b0
mov eax, dword [rbp + 0x68]
add r15d, 1
add rsi, 0x28
mov r11, rbx
jmp 0x140001885
mov r11, rbx
test r11, r11
je 0x140001a29
test r8d, 0x2000000
jne 0x140001a11
mov eax, r8d
shr eax, 0x1d
and eax, 1
mov edx, r8d
shr edx, 0x1e
and edx, 1
mov ebx, r8d
shr ebx, 0x1f
shl rax, 4
lea rdi, [0x1404ae880]
add rdi, rax
lea rax, [rdi + rdx*8]
shr r8d, 0x11
and r8d, 0x200
or r8d, dword [rax + rbx*4]
lea r9, [rsp + 0x3c]
mov rdx, r11
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001a29
jmp 0x1400014a3
cmp rcx, r10
jne 0x140001a29
mov r9, qword [rbp + 0x58]
mov rcx, r10
mov rdx, r11
mov r8d, 0x4000
call qword [rbp + 0x30]
mov rcx, qword [rbp]
mov eax, dword [rcx + 0xd0]
test rax, rax
je 0x140001a6f
mov rsi, qword [rbp + 8]
mov rdi, qword [rsi + rax + 0x18]
test rdi, rdi
je 0x140001a6f
mov rax, qword [rdi]
test rax, rax
je 0x140001a6f
add rdi, 8
mov rcx, rsi
mov edx, 1
xor r8d, r8d
call rax
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x140001a52
mov rcx, qword [rbp]
mov ebx, dword [rcx + 0x28]
test rbx, rbx
je 0x140001a9f
mov rcx, qword [rsp + 0x40]
add rbx, rcx
cmp dword [rbp + 0x20], 0
je 0x140001aac
mov edx, 1
xor r8d, r8d
call rbx
test eax, eax
je 0x140001ab5
mov dword [rbp + 0x1c], 1
jmp 0x1400013f9
mov qword [rbp + 0x60], 0
jmp 0x1400013f9
mov qword [rbp + 0x60], rbx
jmp 0x1400013f9
mov ecx, 0x45a
jmp 0x14000149d
mov ecx, 0x7e
jmp 0x14000149d
mov rdx, qword [rbp + 0x58]
mov rcx, rdi
call qword [rbp + 0x48]
mov ecx, 0xe
jmp 0x14000149d