Function at 0x140065710
Capabilities:
Enumerate pe sections

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov r14d, edx
mov rax, qword [0x140596f00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], 0
dec r14d
xor ebp, ebp
cmp r14d, 0x13
ja 0x140065984
mov rbx, rcx
test rcx, rcx
je 0x140065984
mov edi, r9d
test r9d, r9d
je 0x140065984
mov eax, r14d
shl rax, 4
cmp qword [rbx + rax], 0
je 0x140065984
mov rsi, r8
add rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, edi
cmp r14d, 9
jbe 0x140065861
shl rcx, 3
lea r14, [rcx + rcx*2]
xor ebp, ebp
mov rcx, rax
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140065984
mov rdi, rax
mov rcx, qword [rbx]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x38], 0
mov edx, 0x222100
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x44]
mov eax, 0xaaaaaaab
imul rax, rcx
shr rax, 0x24
mov dword [rsp + 0x44], eax
cmp rcx, 0x18
jb 0x14006596c
cmp eax, 2
mov ecx, 1
cmovae ecx, eax
add rsi, 0x10
shl rcx, 3
lea rax, [rcx + rcx*2]
xor ecx, ecx
nop word cs:[rax + rax]
movzx edx, word [rdi + rcx + 2]
mov word [rsi - 0xe], dx
movzx edx, word [rdi + rcx + 4]
mov word [rsi - 0x10], dx
movzx edx, word [rdi + rcx + 6]
mov word [rsi - 0xc], dx
mov edx, dword [rdi + rcx + 0xc]
mov dword [rsi - 8], edx
mov edx, dword [rdi + rcx + 0x10]
mov dword [rsi - 4], edx
mov edx, dword [rdi + rcx + 0x14]
mov dword [rsi], edx
add rsi, 0x14
add rcx, 0x18
cmp rax, rcx
jne 0x140065820
jmp 0x14006596c
shl rcx, 2
lea r14, [rcx + rcx*2]
xor ebp, ebp
mov rcx, rax
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140065984
mov rdi, rax
mov rcx, qword [rbx]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x38], 0
mov edx, 0x222100
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x44]
mov edx, 0xaaaaaaab
imul rdx, rcx
shr rdx, 0x23
mov dword [rsp + 0x44], edx
cmp rcx, 0xc
jb 0x14006596c
cmp edx, 2
mov eax, 1
cmovae eax, edx
cmp ecx, 0x18
jae 0x1400658e9
xor ecx, ecx
jmp 0x140065949
mov edx, eax
and edx, 0xfffffffe
mov r8, rdi
add r8, 2
xor ecx, ecx
nop word [rax + rax]
movzx r9d, word [r8]
mov word [rsi + rcx*8], r9w
movzx r9d, word [r8 + 2]
mov word [rsi + rcx*8 + 2], r9w
mov r9d, dword [r8 + 6]
mov dword [rsi + rcx*8 + 4], r9d
movzx r9d, word [r8 + 0xc]
mov word [rsi + rcx*8 + 8], r9w
movzx r9d, word [r8 + 0xe]
mov word [rsi + rcx*8 + 0xa], r9w
mov r9d, dword [r8 + 0x12]
mov dword [rsi + rcx*8 + 0xc], r9d
add rcx, 2
add r8, 0x18
cmp rdx, rcx
jne 0x140065900
test al, 1
je 0x14006596c
lea rax, [rcx + rcx*2]
movzx edx, word [rdi + rax*4 + 2]
mov word [rsi + rcx*8], dx
movzx edx, word [rdi + rax*4 + 4]
mov word [rsi + rcx*8 + 2], dx
mov eax, dword [rdi + rax*4 + 8]
mov dword [rsi + rcx*8 + 4], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140128080
mov eax, ebp
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret