Function at 0x14000f6d0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm6
mov r8, qword [sym.Snaffler_ruylopez.exe_NTIseqLbyteT__6H5Oh5UUvVCLiakt9aTwtUQ_]
mov rax, qword [r8 + 0x18]
mov qword [rsp + 0xf0], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0xf8], rdx
mov edx, 0x10
mov dword [rsp + 0x84], 0
test rcx, rcx
je 0x14000f729
lea rdx, [rcx + 0xf]
neg rcx
and rdx, rcx
imul rax, qword [rax], 0x16
jo 0x14000fbd0
add rdx, rax
jo 0x14000fbd0
mov rcx, r8
lea rdi, [0x14009ef63]
call sym.Snaffler_ruylopez.exe_newObj
mov r11d, 0xffffc3e3
movdqa xmm0, xmmword [0x1400a2ea0]
mov edx, 0x2fe59164
mov word [rax + 0x24], r11w
lea rcx, [0x14009f020]
mov rbp, rax
lea r13, [rax + 0x10]
movups xmmword [rax], xmm0
movdqa xmm0, xmmword [0x1400a2eb0]
mov dword [rax + 0x20], 0xff410000
movups xmmword [rax + 0x10], xmm0
call sym.Snaffler_ruylopez.exe_thisisStrange__nimstrenc_4
mov edx, 0x36004d8c
mov rcx, rax
call sym.Snaffler_ruylopez.exe_calcTheThings__76oader_88
mov qword [rsp + 0x50], rdi
mov rcx, rdi
test rax, rax
je 0x14000f7bc
lea rdx, [rax + 0x10]
cmp qword [rax], 0
cmove rdx, qword [rsp + 0x50]
mov qword [rsp + 0x50], rdx
mov rcx, rdx
mov rax, qword [sym.Snaffler_ruylopez.exe_MyCreateFileA__76oader_985]
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [rax]
xor edx, edx
mov rcx, rax
mov r14, rax
mov rax, qword [sym.Snaffler_ruylopez.exe_MyGetFileSize__76oader_986]
call qword [rax]
mov ebx, eax
mov rax, qword [sym.Snaffler_ruylopez.exe_ws2k12__76oader_197]
mov r10d, dword [rax]
test r10d, r10d
jne 0x14000fab5
mov rax, qword [sym.Snaffler_ruylopez.exe_MyGetProcessHeap__76oader_767]
call qword [rax]
movsxd r8, ebx
xor edx, edx
mov rcx, rax
mov rax, qword [sym.Snaffler_ruylopez.exe_MyRtlAllocateHeap__76oader_987]
call qword [rax]
mov r12, rax
mov rax, qword [sym.Snaffler_ruylopez.exe_MyReadFile__76oader_988]
mov rcx, r14
mov r8d, ebx
mov rdx, r12
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x84]
call qword [rax]
movsxd r10, dword [r12 + 0x3c]
lea r14, [r12 + r10]
mov eax, dword [r14 + 0x88]
movzx ebx, word [r14 + 0x14]
mov dword [rsp + 0x40], eax
lea rax, [r14 + 0x18]
mov rcx, rax
add rax, rbx
cmp word [r14 + 6], 0
mov qword [rsp + 0x58], rax
je 0x14000fbc8
xor edi, edi
mov qword [rsp + 0x48], rbp
mov rsi, rax
mov rbp, r14
movdqa xmm6, xmmword [0x1400a2ec0]
mov r14d, edi
mov rdi, rcx
jmp 0x14000f8af
mov rsi, rbx
movzx ebx, word [rbp + 0x14]
lea eax, [r14 + r14*4]
mov rcx, qword [sym.Snaffler_ruylopez.exe_strDesc__system_2412]
add rbx, rdi
mov edx, 0x19
shl eax, 3
movzx eax, ax
add rbx, rax
call sym.Snaffler_ruylopez.exe_newObj
lea rcx, [0x14009f000]
movups xmmword [rax], xmm6
movzx edx, byte [rbx]
mov r15, rax
mov byte [rax + 0x10], dl
movzx edx, byte [rbx + 1]
mov byte [rax + 0x11], dl
movzx edx, byte [rbx + 2]
mov byte [rax + 0x12], dl
movzx edx, byte [rbx + 3]
mov byte [rax + 0x13], dl
movzx edx, byte [rbx + 4]
mov byte [rax + 0x14], dl
movzx edx, byte [rbx + 5]
mov byte [rax + 0x15], dl
movzx edx, byte [rbx + 6]
mov byte [rax + 0x16], dl
movzx edx, byte [rbx + 7]
mov byte [rax + 0x17], dl
mov edx, 0xe7a1364
call sym.Snaffler_ruylopez.exe_calcTheThings__76oader_88
mov rcx, r15
mov rdx, rax
call sym.Snaffler_ruylopez.exe_nsuFindStr.constprop.0
test rax, rax
cmovs rbx, rsi
add r14d, 1
cmp word [rbp + 6], r14w
ja 0x14000f8a8
mov rbp, qword [rsp + 0x48]
movsxd rcx, dword [rsp + 0x40]
movsxd rdx, dword [rbx + 0xc]
movsxd rax, dword [rbx + 0x14]
add rcx, r12
sub rcx, rdx
lea r8, [rcx + rax]
movsxd rcx, dword [r8 + 0x1c]
movsxd rsi, dword [r8 + 0x20]
mov r9d, dword [r8 + 0x18]
add rcx, r12
add rsi, r12
sub rcx, rdx
sub rsi, rdx
lea rdi, [rcx + rax]
add rsi, rax
mov qword [rsp + 0x68], rdi
test r9d, r9d
jle 0x14000fae0
mov rdi, qword [rsp + 0xf8]
lea rcx, [rbp + 0x11]
xor r14d, r14d
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r8
mov r15, qword [rsp + 0xf0]
sub rdi, rcx
mov r12, qword [rsp + 0xf8]
mov qword [rsp + 0x70], rdi
mov rdi, qword [rsp + 0x68]
lea rcx, [rdi + 4]
sub rcx, rsi
mov qword [rsp + 0x78], rcx
jmp 0x14000f9fe
test rcx, rcx
je 0x14000f9e1
mov rdx, r15
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14000fa15
mov rax, qword [rsp + 0x48]
add rsi, 4
cmp dword [rax + 0x18], edi
jle 0x14000fae0
movsxd rdx, dword [rbx + 0xc]
movsxd rax, dword [rbx + 0x14]
mov r14d, edi
movsxd rcx, dword [rsi]
add rcx, qword [rsp + 0x40]
lea edi, [r14 + 1]
sub rcx, rdx
add rcx, rax
cmp rcx, r15
jne 0x14000f9d0
mov r11, qword [sym.Snaffler_ruylopez.exe_ws2k12__76oader_197]
mov rdx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x78]
mov r8d, dword [r11]
movsxd rcx, dword [rdx + 0xc]
movsxd rax, dword [rax + rsi]
movsxd rdx, dword [rdx + 0x14]
test r8d, r8d
je 0x14000fa49
mov r9, qword [rsp + 0x68]
lea eax, [r14 + 8]
cdqe
movsxd rax, dword [r9 + rax*4]
add rax, qword [rsp + 0x40]
sub rax, rcx
mov rcx, qword [rsp + 0x50]
add rax, rdx
movzx edx, byte [rax + 4]
mov byte [rbp + 0x14], dl
movzx edx, byte [rax + 5]
mov byte [rbp + 0x15], dl
movzx edx, byte [rax + 6]
mov byte [rbp + 0x16], dl
movzx eax, byte [rax + 7]
mov byte [rbp + 0x17], al
mov rax, qword [str._b_v_]
call qword [rax]
mov rdx, r15
mov rcx, rax
mov rax, qword [sym.Snaffler_ruylopez.exe_MyGetProcAddress__76oader_768]
call qword [rax]
mov edx, 1
jmp 0x14000faa6
add rdx, 1
add rax, 1
cmp rdx, 0x28
je 0x14000fafc
cmp byte [rax], 0xf
jne 0x14000fa98
cmp byte [rax + 1], 5
jne 0x14000fa98
mov edx, eax
jmp 0x14000fb00
mov rax, qword [sym.Snaffler_ruylopez.exe_Dl_1342179665_]
call qword [rax]
movsxd r8, ebx
xor edx, edx
mov rcx, rax
mov rax, qword [sym.Snaffler_ruylopez.exe_Dl_1342179648_]
call qword [rax]
mov r12, rax
jmp 0x14000f82f
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
xor eax, eax
mov rcx, rax
mov byte [rbp + 0x1b], ah
mov r14d, eax
mov r11d, eax
shr rcx, 0x38
mov r10, rax
mov r9, rax
mov r8, rax
mov qword [rsp + 0x60], rcx
shr r14d, 0x10
lea rcx, [rbp + 0x1a]
shr r11d, 0x18
mov qword [rsp + 0x88], rax
movzx eax, byte [rsp + 0x60]
shr r10, 0x20
shr r9, 0x28
shr r8, 0x30
cmp qword [rsp + 0x70], 0xe
mov byte [rbp + 0x1a], dl
mov byte [rcx + 2], r14b
mov byte [rcx + 3], r11b
mov byte [rcx + 4], r10b
mov byte [rcx + 5], r9b
mov byte [rcx + 6], r8b
mov byte [rcx + 7], al
jbe 0x14000fba6
movdqu xmm1, xmmword [rbp + 0x10]
movups xmmword [r12], xmm1
movzx eax, byte [r13 + 0x10]
mov byte [r12 + 0x10], al
movzx eax, byte [r13 + 0x11]
mov byte [r12 + 0x11], al
movzx eax, byte [r13 + 0x12]
mov byte [r12 + 0x12], al
movzx eax, byte [r13 + 0x13]
mov byte [r12 + 0x13], al
movzx eax, byte [r13 + 0x14]
mov byte [r12 + 0x14], al
jmp 0x14000f9e1
xor eax, eax
nop dword [rax + rax]
movzx edx, byte [rbp + rax + 0x10]
mov byte [r12 + rax], dl
add rax, 1
cmp rax, 0x15
jne 0x14000fbb0
jmp 0x14000f9e1
mov rbx, rax
jmp 0x14000f944
call sym.Snaffler_ruylopez.exe_raiseOverflow
nop
nop word cs:[rax + rax]