Function at 0x180023700
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
xor r15d, r15d
mov rsi, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
je 0x180023a07
cmp dword [r8], 0x94
jb 0x180023a07
movzx edi, word [r8 + 0x4e]
mov r12d, 0x8000
mov r9d, dword [0x1801596d4]
mov r13d, 0x100
and r9d, 4
or r9d, 0x7b
shl r9d, 8
mov eax, r9d
or eax, r12d
and edi, eax
mov dword [rcx + 0x118], edi
test edi, r9d
jne 0x180023a21
test dword [rsi + 0x90], 0x1000
je 0x180023830
or dword [rbx + 0x68], r12d
test dword [rsi + 0x90], 0x2000
je 0x180023830
mov rcx, qword [rbx + 0x30]
lea rax, [rbp - 0x10]
lea r9, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r8w, 0xd
mov dl, 1
call fcn.18001014c
mov r8, qword [rbp - 0x10]
test eax, eax
cmovs r8, r15
test r8, r8
je 0x180023830
movzx eax, word [r14 + 0x14]
lea rdx, [r14 + 0x18]
movzx r9d, word [r14 + 6]
add rdx, rax
mov ecx, r15d
test r9d, r9d
je 0x180023830
mov r10d, dword [r8 + 0xc]
mov eax, r10d
sub eax, dword [rdx + 0xc]
cmp eax, dword [rdx + 8]
jb 0x1800237f9
inc ecx
add rdx, 0x28
cmp ecx, r9d
jb 0x1800237e1
jmp 0x180023830
mov ecx, dword [rdx + 0xc]
add rcx, qword [rbx + 0x30]
mov qword [rbp - 0x18], rcx
mov edx, dword [rdx + 8]
mov qword [rbp - 0x20], rdx
call fcn.180075bec
lea rcx, [rbp + 0x50]
mov r9d, 2
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x20]
or rcx, 0xffffffffffffffff
lea rdx, [rbp - 0x18]
call sym.ntdll.dll_NtProtectVirtualMemory
call sym.ntdll.dll_LdrControlFlowGuardEnforced
mov edi, 0xe
test eax, eax
je 0x180023863
movzx eax, word [r14 + 0x5e]
bt ax, di
setb cl
test dword [rsi + 0x90], r13d
setne al
test al, cl
jne 0x180023863
mov rdx, r14
mov rcx, rbx
call fcn.18007a318
call sym.ntdll.dll_LdrControlFlowGuardEnforced
test eax, eax
je 0x180023a07
movzx eax, word [r14 + 0x5e]
bt ax, di
setb cl
test dword [rsi + 0x90], r13d
setne al
test al, cl
je 0x180023a07
mov r14, qword [rsi + 0x70]
lea rdi, [fcn.18008b450]
lea r12, [fcn.18008b400]
test r14, r14
je 0x1800abc15
mov rcx, qword [rbx + 0x30]
cmp r14, rcx
jb 0x1800abc15
mov eax, dword [rbx + 0x40]
add rcx, 0xfffffffffffffff8
add rcx, rax
cmp r14, rcx
jae 0x1800abc15
cmp qword [r14], r15
je 0x1800abc15
lea rax, [rbp + 0x50]
mov qword [rbp - 0x18], r14
or r13, 0xffffffffffffffff
mov qword [rbp - 0x20], 8
mov rcx, r13
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x18]
call sym.ntdll.dll_NtProtectVirtualMemory
test eax, eax
js 0x180023a09
call fcn.18001f704
test eax, eax
jne 0x180023a33
mov rax, r12
mov qword [r14], rax
lea r8, [rbp - 0x20]
mov r9d, dword [rbp + 0x50]
lea rax, [rbp + 0x50]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov rcx, r13
call sym.ntdll.dll_NtProtectVirtualMemory
test eax, eax
js 0x180023a09
mov rdi, qword [rsi + 0x78]
lea r12, [0x18008b4f0]
lea r13, [0x18008b4a0]
test rdi, rdi
je 0x180023a7d
mov rcx, qword [rbx + 0x30]
cmp rdi, rcx
jb 0x180023a7d
mov eax, dword [rbx + 0x40]
add rcx, 0xfffffffffffffff8
add rcx, rax
cmp rdi, rcx
jae 0x180023a7d
cmp qword [rdi], r15
je 0x180023a7d
lea rax, [rbp + 0x50]
mov qword [rbp - 0x18], rdi
or rbx, 0xffffffffffffffff
mov qword [rbp - 0x20], 8
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x18]
call sym.ntdll.dll_NtProtectVirtualMemory
test eax, eax
js 0x180023a09
call fcn.18001f704
test eax, eax
jne 0x180023a4b
mov rax, r13
mov qword [rdi], rax
lea r8, [rbp - 0x20]
mov r9d, dword [rbp + 0x50]
lea rax, [rbp + 0x50]
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call sym.ntdll.dll_NtProtectVirtualMemory
test eax, eax
js 0x180023a09
test r14, r14
je 0x180023a6f
lea rax, [fcn.18008b400]
cmp qword [r14], rax
jne 0x180023a63
test rdi, rdi
je 0x180023a07
cmp qword [rdi], r13
jne 0x180023a76
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18007c368
test al, al
je 0x180023774
jmp 0x1800abbf8
test dword [rsi + 0x90], 0x4000
mov rax, rdi
jne 0x180023919
jmp 0x180023916
test dword [rsi + 0x90], 0x4000
mov rax, r12
jne 0x1800239c8
jmp 0x1800239c5
lea rax, [fcn.18008b450]
cmp qword [r14], rax
je 0x1800239fd
mov eax, 0xc000003e
jmp 0x180023a09
cmp qword [rdi], r12
je 0x180023a07
jmp 0x180023a6f
mov rdi, r15
jmp 0x1800239ec
cmp rbx, qword [0x18015bf88]
jne 0x1800abc07
bts edi, 9
jmp 0x1800abc0a
or edi, r13d
mov dword [rbx + 0x118], edi
jmp 0x180023774
mov r14, r15
jmp 0x180023941