Function at 0x1400013b0
Capabilities:
Enumerate pe sections
Get system information on windows
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
cmp rdx, 0x3f
ja 0x1400013d0
mov ecx, 0xd
jmp 0x1400015e1
mov r15, rcx
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x1400015dc
mov rbx, rdx
movsxd r13, dword [r15 + 0x3c]
lea rax, [r13 + 0x108]
cmp rax, rdx
ja 0x1400013c6
cmp dword [r15 + r13], 0x4550
jne 0x1400015dc
add r13, r15
movzx eax, word [r13 + 4]
cmp eax, 0x8664
jne 0x1400015dc
mov r12, r9
mov r9d, dword [r13 + 0x38]
test r9b, 1
jne 0x1400015dc
mov r14, r8
movzx edx, word [r13 + 6]
test edx, edx
je 0x140001454
movzx ecx, word [r13 + 0x14]
add rcx, r13
add rcx, 0x18
test edx, edx
mov r8d, 1
cmovne r8d, edx
cmp dx, 1
jne 0x140001458
xor ebp, ebp
jmp 0x14000149d
xor ebp, ebp
jmp 0x1400014bb
mov edx, r8d
and edx, 0xfffffffe
neg edx
xor ebp, ebp
mov eax, dword [rcx + 0xc]
mov esi, dword [rcx + 0x10]
lea edi, [rax + rsi]
add rax, r9
test esi, esi
cmove rdi, rax
cmp rdi, rbp
cmovbe rdi, rbp
mov eax, dword [rcx + 0x38]
mov esi, dword [rcx + 0x34]
lea ebp, [rsi + rax]
add rsi, r9
test eax, eax
cmove rbp, rsi
cmp rbp, rdi
cmovbe rbp, rdi
add rcx, 0x50
add edx, 2
jne 0x140001462
test r8b, 1
je 0x1400014bb
mov eax, dword [rcx + 0xc]
mov ecx, dword [rcx + 0x10]
add r9, rax
add eax, ecx
test ecx, ecx
cmove rax, r9
cmp rax, rbp
cmova rbp, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x4c]
mov ecx, dword [r13 + 0x50]
lea rsi, [rax + rcx]
add rsi, 0xffffffffffffffff
lea rcx, [rax + rbp]
add rcx, 0xffffffffffffffff
neg rax
and rsi, rax
and rax, rcx
cmp rsi, rax
jne 0x1400015dc
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [r13 + 0x30]
mov qword [rsp + 0x20], rbp
mov rdx, rsi
mov r8d, 0x3000
mov r9d, 4
call r14
mov rdi, rax
test rax, rax
jne 0x140001540
mov qword [rsp + 0x20], rbp
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x3000
mov r9d, 4
call r14
mov rdi, rax
test rax, rax
je 0x14000172a
mov qword [rsp + 0x30], r13
xor r13d, r13d
mov rax, rdi
shr rax, 0x20
lea rcx, [rdi + rsi]
shr rcx, 0x20
cmp rax, rcx
jae 0x1400015fd
mov ecx, 0x10
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x1400016a0
mov rbp, rax
mov qword [rax], r13
mov qword [rax + 8], rdi
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x3000
mov r9d, 4
call r14
mov rdi, rax
mov r13, rbp
test rax, rax
jne 0x140001548
mov rdi, qword [rsp + 0xf8]
mov rcx, qword [rbp + 8]
xor edx, edx
mov r8d, 0x8000
mov r9, rdi
call r12
mov rsi, qword [rbp]
mov rcx, rbp
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rbp, rsi
test rsi, rsi
jne 0x1400015b1
jmp 0x14000172a
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebp, ebp
mov rax, rbp
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1400016e6
mov rbp, rax
mov qword [rax + 8], rdi
mov rsi, qword [rsp + 0x30]
movzx eax, word [rsi + 0x16]
shr eax, 0xd
and eax, 1
mov dword [rbp + 0x20], eax
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x30], r12
mov rax, qword [rsp + 0xe0]
mov qword [rbp + 0x38], rax
mov rax, qword [rsp + 0xe8]
mov qword [rbp + 0x40], rax
mov rax, qword [rsp + 0xf0]
mov qword [rbp + 0x48], rax
mov rcx, qword [rsp + 0xf8]
mov qword [rbp + 0x58], rcx
mov eax, dword [rsp + 0x4c]
mov dword [rbp + 0x68], eax
mov qword [rbp + 0x70], r13
mov edx, dword [rsi + 0x54]
cmp rdx, rbx
jbe 0x140001734
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rbp
call fcn.140001cd0
jmp 0x1400015e7
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
mov rdi, qword [rsp + 0xf8]
mov r9, rdi
call r12
test r13, r13
je 0x14000172a
mov rcx, qword [r13 + 8]
xor edx, edx
mov r8d, 0x8000
mov r9, rdi
call r12
mov rsi, qword [r13]
mov rcx, r13
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov r13, rsi
test rsi, rsi
jne 0x1400016be
jmp 0x14000172a
mov rcx, rdi
xor edx, edx
mov r8d, 0x8000
mov rdi, qword [rsp + 0xf8]
mov r9, rdi
call r12
test r13, r13
je 0x14000172a
mov rcx, qword [r13 + 8]
xor edx, edx
mov r8d, 0x8000
mov r9, rdi
call r12
mov rsi, qword [r13]
mov rcx, r13
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov r13, rsi
test rsi, rsi
jne 0x140001704
mov ecx, 0xe
jmp 0x1400015e1
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov r8d, 0x1000
mov r9d, 4
call r14
mov r14, rax
mov r8d, dword [rsi + 0x54]
mov rcx, rax
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
movsxd rax, dword [r15 + 0x3c]
lea rcx, [r14 + rax]
mov qword [rbp], rcx
mov qword [rsp + 0x40], rdi
mov qword [r14 + rax + 0x30], rdi
mov rsi, qword [rbp]
cmp word [rsi + 6], 0
je 0x140001856
mov r12, qword [rbp + 8]
movzx eax, word [rsi + 0x14]
lea rdi, [rsi + rax]
add rdi, 0x2c
xor r13d, r13d
jmp 0x1400017c3
mov ecx, dword [rdi - 8]
add rcx, r12
mov dword [rdi - 0xc], ecx
xor edx, edx
mov r8, rsi
call sub.VCRUNTIME140.dll_memset
add r13d, 1
mov rsi, qword [rbp]
movzx eax, word [rsi + 6]
add rdi, 0x28
cmp r13d, eax
jae 0x140001856
mov edx, dword [rdi - 4]
test rdx, rdx
je 0x14000181b
mov eax, dword [rdi]
add eax, edx
cmp rax, rbx
ja 0x140001688
mov rax, qword [rbp + 0x58]
mov ecx, dword [rdi - 8]
add rcx, r12
mov qword [rsp + 0x20], rax
mov r8d, 0x1000
mov r9d, 4
call qword [rbp + 0x28]
test rax, rax
je 0x140001693
mov esi, dword [rdi - 8]
mov r8d, dword [rdi - 4]
add rsi, r12
mov edx, dword [rdi]
add rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi - 0xc], esi
jmp 0x1400017aa
mov rax, qword [rsp + 0x30]
mov esi, dword [rax + 0x38]
test esi, esi
jle 0x1400017aa
mov rax, qword [rbp + 0x58]
mov ecx, dword [rdi - 8]
add rcx, r12
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov r8d, 0x1000
mov r9d, 4
call qword [rbp + 0x28]
test rax, rax
jne 0x140001797
jmp 0x140001693
mov r10, qword [rsi + 0x30]
mov r8d, 1
mov rax, qword [rsp + 0x30]
sub r10, qword [rax + 0x30]
je 0x1400018f1
cmp dword [rsi + 0xb4], 0
je 0x1400018ee
mov r9, qword [rbp + 8]
mov edx, dword [rsi + 0xb0]
mov ebx, dword [r9 + rdx]
test ebx, ebx
je 0x1400018f1
add rdx, r9
jmp 0x140001899
mov ebx, dword [rsi + rdx]
add rdx, rsi
test ebx, ebx
je 0x1400018e8
mov esi, dword [rdx + 4]
mov eax, esi
and eax, 0xfffffffe
cmp eax, 8
je 0x14000188f
mov ebx, ebx
add rbx, r9
xor edi, edi
jmp 0x1400018c8
add qword [rbx + rsi], r10
add rdi, 1
mov eax, edi
mov esi, dword [rdx + 4]
lea rcx, [rsi - 8]
shr rcx, 1
cmp rcx, rax
jbe 0x14000188f
movzx esi, word [rdx + rdi*2 + 8]
mov eax, esi
shr eax, 0xc
and esi, 0xfff
cmp eax, 0xa
je 0x1400018af
cmp eax, 3
jne 0x1400018b3
add dword [rbx + rsi], r10d
jmp 0x1400018b3
mov rsi, qword [rbp]
jmp 0x1400018f1
xor r8d, r8d
mov dword [rbp + 0x24], r8d
cmp dword [rsi + 0x94], 0
je 0x14000191e
mov r12, qword [rbp + 8]
mov r15d, dword [rsi + 0x90]
add r15, r12
mov edx, 0x14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x14000196c
mov rdx, qword [rbp]
movzx edi, word [rdx + 0x14]
mov r13d, dword [rdx + 0x34]
shl r13, 0x20
mov ecx, dword [rdx + rdi + 0x20]
mov ebx, dword [rdx + rdi + 0x28]
or rcx, r13
mov eax, dword [rbp + 0x68]
mov r10, rax
neg r10
mov r8d, dword [rdx + rdi + 0x3c]
test ebx, ebx
jne 0x140001a52
test r8b, 0x40
jne 0x140001a4f
xor ebx, ebx
test r8b, r8b
jns 0x140001a52
mov ebx, dword [rdx + 0x24]
jmp 0x140001a52
lea r13, [r12 + 2]
jmp 0x140001989
add r15, 0x14
mov edx, 0x14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14000191e
mov ecx, dword [r15 + 0xc]
test rcx, rcx
je 0x14000191e
mov rdx, qword [rbp + 0x58]
add rcx, r12
call qword [rbp + 0x38]
test rax, rax
je 0x140001caf
mov rdi, rax
movsxd rax, dword [rbp + 0x18]
lea rdx, [rax*8 + 8]
mov rcx, qword [rbp + 0x10]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
test rax, rax
je 0x140001cb9
mov qword [rbp + 0x10], rax
movsxd rcx, dword [rbp + 0x18]
lea edx, [rcx + 1]
mov dword [rbp + 0x18], edx
mov qword [rax + rcx*8], rdi
mov ebx, dword [r15]
test rbx, rbx
je 0x1400019ec
add rbx, r12
mov esi, dword [r15 + 0x10]
add rsi, r12
jmp 0x1400019f6
mov ebx, dword [r15 + 0x10]
add rbx, r12
mov rsi, rbx
mov rdx, qword [rbx]
test rdx, rdx
je 0x140001973
xor r14d, r14d
mov rax, qword [rbp + 0x40]
mov r8, qword [rbp + 0x58]
test rdx, rdx
js 0x140001a17
add rdx, r13
jmp 0x140001a1a
movzx edx, dx
mov rcx, rdi
call rax
mov qword [rsi + r14], rax
test rax, rax
je 0x140001a3b
mov rdx, qword [rbx + r14 + 8]
add r14, 8
test rdx, rdx
jne 0x140001a05
jmp 0x140001973
mov rdx, qword [rbp + 0x58]
mov rcx, rdi
call qword [rbp + 0x48]
mov ecx, 0x7f
jmp 0x14000168d
mov ebx, dword [rdx + 0x20]
and r10, rcx
mov r11d, ebx
cmp word [rdx + 6], 2
jb 0x140001ba3
lea rsi, [rdx + rdi]
add rsi, 0x18
add rsi, 0x4c
mov r15d, 2
mov r12d, dword [rsi - 0x1c]
mov ebx, dword [rsi - 0x14]
or r12, r13
mov edi, eax
mov r14, rdi
neg r14
and r14, r12
test ebx, ebx
jne 0x140001aa2
mov eax, dword [rsi]
test al, 0x40
jne 0x140001a9f
xor ebx, ebx
test al, al
jns 0x140001aa2
mov ebx, dword [rdx + 0x24]
jmp 0x140001aa2
mov ebx, dword [rdx + 0x20]
mov ebx, ebx
cmp r10, r14
je 0x140001b15
lea rax, [r11 + rcx]
cmp rax, r14
ja 0x140001b15
test r11, r11
je 0x140001b77
test r8d, 0x2000000
jne 0x140001b3e
mov eax, r8d
shr eax, 0x1d
and eax, 1
mov edx, r8d
shr edx, 0x1e
and edx, 1
mov r9d, r8d
shr r9d, 0x1f
shl rax, 4
lea rdi, [0x140003060]
add rax, rdi
lea rax, [rax + rdx*8]
shr r8d, 0x11
and r8d, 0x200
or r8d, dword [rax + r9*4]
mov rdx, r11
lea r9, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001b77
jmp 0x140001693
mov eax, dword [rsi]
mov edi, r8d
and edi, eax
or eax, r8d
mov r8d, eax
and r8d, 0xfdffffff
test edi, 0x2000000
cmovne r8d, eax
add r12, rbx
sub r12, rcx
mov rbx, r12
jmp 0x140001b84
cmp rcx, r10
jne 0x140001b77
cmp dword [rdx + 0x38], edi
je 0x140001b67
mov rax, r11
shr rax, 0x20
je 0x140001b5b
mov rax, r11
xor edx, edx
div rdi
jmp 0x140001b62
mov eax, r11d
xor edx, edx
div edi
test rdx, rdx
jne 0x140001b77
mov r9, qword [rbp + 0x58]
mov rdx, r11
mov r8d, 0x4000
call qword [rbp + 0x30]
mov r8d, dword [rsi]
mov rdx, qword [rbp]
mov r10, r14
mov rcx, r12
movzx eax, word [rdx + 6]
cmp r15d, eax
jae 0x140001ba0
mov eax, dword [rbp + 0x68]
add r15d, 1
add rsi, 0x28
mov r11, rbx
jmp 0x140001a75
mov r11, rbx
test r11, r11
je 0x140001c19
test r8d, 0x2000000
jne 0x140001c01
mov eax, r8d
shr eax, 0x1d
and eax, 1
mov edx, r8d
shr edx, 0x1e
and edx, 1
mov ebx, r8d
shr ebx, 0x1f
shl rax, 4
lea rdi, [0x140003060]
add rdi, rax
lea rax, [rdi + rdx*8]
shr r8d, 0x11
and r8d, 0x200
or r8d, dword [rax + rbx*4]
lea r9, [rsp + 0x3c]
mov rdx, r11
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001c19
jmp 0x140001693
cmp rcx, r10
jne 0x140001c19
mov r9, qword [rbp + 0x58]
mov rcx, r10
mov rdx, r11
mov r8d, 0x4000
call qword [rbp + 0x30]
mov rcx, qword [rbp]
mov eax, dword [rcx + 0xd0]
test rax, rax
je 0x140001c5f
mov rsi, qword [rbp + 8]
mov rdi, qword [rsi + rax + 0x18]
test rdi, rdi
je 0x140001c5f
mov rax, qword [rdi]
test rax, rax
je 0x140001c5f
add rdi, 8
mov rcx, rsi
mov edx, 1
xor r8d, r8d
call rax
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x140001c42
mov rcx, qword [rbp]
mov ebx, dword [rcx + 0x28]
test rbx, rbx
je 0x140001c8f
mov rcx, qword [rsp + 0x40]
add rbx, rcx
cmp dword [rbp + 0x20], 0
je 0x140001c9c
mov edx, 1
xor r8d, r8d
call rbx
test eax, eax
je 0x140001ca5
mov dword [rbp + 0x1c], 1
jmp 0x1400015e9
mov qword [rbp + 0x60], 0
jmp 0x1400015e9
mov qword [rbp + 0x60], rbx
jmp 0x1400015e9
mov ecx, 0x45a
jmp 0x14000168d
mov ecx, 0x7e
jmp 0x14000168d
mov rdx, qword [rbp + 0x58]
mov rcx, rdi
call qword [rbp + 0x48]
mov ecx, 0xe
jmp 0x14000168d