Function at 0x1400069a0
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov ebx, ecx
lea r14, [0x14000d8e8]
xor r12d, r12d
mov qword [rsp + 0x20], r14
mov ecx, 4
mov r13, r8
mov qword [rsp + 0x28], rcx
mov ebp, r12d
cmp ebx, 0x295a
ja 0x140006ad9
je 0x140006afd
cmp ebx, 0x1db1
je 0x140006a4d
cmp ebx, 0x23f0
je 0x140006a36
cmp ebx, 0x2580
je 0x140006afd
cmp ebx, 0x2800
je 0x140006afd
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rdi, r13
lea r15, [0x14000d048]
mov esi, 8
mov r14, rcx
jmp 0x140006bcf
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r9d, r12d
movzx ecx, word [rax + 0x14]
lea rdx, [rax + 0x18]
add rdx, rcx
movzx ecx, word [rax + 6]
test ecx, ecx
je 0x140006a87
nop dword [rax]
cmp dword [rdx], 0x45474150
jne 0x140006a7e
cmp byte [rdx + 4], bpl
je 0x140006acd
add rdx, 0x28
add ecx, 0xffffffff
jne 0x140006a70
mov rdi, r12
mov rax, rdi
lea rdx, [0x14000d068]
neg rax
lea r15, [0x14000d1d8]
mov rax, rdi
sbb esi, esi
and esi, 8
neg rax
mov rax, r14
sbb ecx, ecx
add ecx, 4
test rdi, rdi
mov dword [rsp + 0x28], ecx
cmove rdx, r14
cmove r15, r12
mov qword [rsp + 0x20], rdx
mov r14, r12
jmp 0x140006bcf
mov edi, dword [rdx + 0xc]
mov r9d, dword [rdx + 8]
add rdi, r13
jmp 0x140006a8a
cmp ebx, 0x3839
je 0x140006afd
cmp ebx, 0x3ad7
je 0x140006afd
cmp ebx, 0x3fab
je 0x140006afd
cmp ebx, 0x42ee
jne 0x140006a17
mov rdi, qword [0x14000d940]
lea r15, [0x14000d060]
mov esi, 5
test rdi, rdi
je 0x140006b68
lea r9, str.SeValidateImageData
nop dword [rax]
mov rax, qword [rdi + 8]
cmp r9, rax
je 0x140006bb4
test rax, rax
je 0x140006b60
mov r8, r9
sub r8, rax
nop dword [rax + rax]
movzx ecx, word [r8 + rax]
movzx edx, word [rax]
lea rax, [rax + 2]
test cx, cx
je 0x140006b56
cmp cx, dx
je 0x140006b40
movzx eax, dx
movzx ecx, cx
sub ecx, eax
je 0x140006bb4
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140006b20
mov rdi, r12
mov r14d, 1
test rdi, rdi
jne 0x140006bc9
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r9d, r12d
movzx ecx, word [rax + 0x14]
lea rdx, [rax + 0x18]
add rdx, rcx
movzx ecx, word [rax + 6]
test ecx, ecx
je 0x140006bac
cmp dword [rdx], 0x45474150
jne 0x140006ba3
cmp byte [rdx + 4], bpl
je 0x140006bba
add rdx, 0x28
add ecx, 0xffffffff
jne 0x140006b95
mov rdi, r12
mov ebp, r14d
jmp 0x140006bcf
mov rdi, qword [rdi + 0x10]
jmp 0x140006b6b
mov edi, dword [rdx + 0xc]
mov ebp, r14d
mov r9d, dword [rdx + 8]
add rdi, r13
jmp 0x140006bcf
mov r9d, 0x200
test rdi, rdi
je 0x140006a17
test r9d, r9d
je 0x140006a17
test ebp, ebp
je 0x140006c3b
cmp ebx, 0x3839
ja 0x140006c15
je 0x140006c07
cmp ebx, 0x2580
je 0x140006c07
cmp ebx, 0x2800
je 0x140006c07
cmp ebx, 0x295a
jne 0x140006c3b
lea r15, [0x14000d040]
mov esi, 6
jmp 0x140006c4c
cmp ebx, 0x3ad7
je 0x140006c2d
cmp ebx, 0x3fab
je 0x140006c2d
cmp ebx, 0x42ee
jne 0x140006c3b
lea r15, [0x14000d184]
mov esi, 6
jmp 0x140006c4c
test r15, r15
je 0x140006a17
test esi, esi
je 0x140006a17
mov ebp, esi
mov rbx, rdi
mov esi, r9d
test rbp, rbp
je 0x140006cf9
cmp rsi, rbp
jb 0x140006cf9
sub rsi, rbp
nop dword [rax]
movzx edx, byte [r15]
mov r8, rsi
sub r8, rbx
mov rcx, rbx
add r8, rdi
call fcn.140007e70
mov rbx, rax
test rax, rax
je 0x140006cf9
mov r8, rbp
mov rdx, r15
mov rcx, rax
call fcn.140008640
test eax, eax
je 0x140006cb8
inc rbx
mov rax, rsi
sub rax, rbx
add rax, rdi
jne 0x140006c70
test r12, r12
setne al
jmp 0x140006a19
mov r12, rbx
test rbx, rbx
je 0x140006cf9
mov rcx, qword [rsp + 0x80]
sub ebx, r13d
mov r8d, ebx
mov rdx, r13
call qword [sym.imp.ntdll.dll_RtlAddressInSectionTable]
mov rcx, qword [rsp + 0x88]
sub r14, r13
add rax, r14
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov dword [rcx + 0x10], eax
test r12, r12
setne al
jmp 0x140006a19