Function at 0x140020cc0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x609c
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14002108e
mov r8, rax
mov qword [rsp + 0x30], rdi
mov edx, 0xc138
lea rcx, str.000000000100010201000202010102030101030301010304010104040101040502010405010105050201040601010506020105060102050601010606010206060201050701010607020106070102060701010707010207070202060803020608010207080202070801020808020207090302070901020809020208090103080902030809010209090302070A0402070A0202080A0302080A0202090A0103090A0203090A01020A0A01030A0A0302080B0402080B0302090B0203090B0204090B02020A0B01030A0B02030A0B01020B0B01030B0B0402080C0402090C03020A0C03030A0C02040A0C03040A0C02020B0C01030B0C02030B0C01040B0C02040B0C01030C0C0503090D04030A0D03030B0D02040B0D03040B0D01030C0D02030C0D01040C0D02040C0D01030D0D05030A0E04030B0E03030C0E04030C0E01040C0E02040C0E03040C0E03050C0E03030D0E01040D0E02040D0E03040D0E01030E0E01040E0E06030A0F05030B0F04030C0F04040C0F03030D0F01040D0F03040D0F02050D0F03050D0F04050D0F01040E0F02040E0F03040E0F01030F0F01040F0F06030B1005030C1004030D1005030D1004040D1003050D1004050D1004060D1003030E1004030E1003040E1001050E1002050E1003050E1001040F1002040F1001050F1002050F10010310100104101006030C1107030C1105030D1104030E1105030E1104040E1104050E1103060E1104060E1103040F1104040F1101050F1102050F1103050F1101041011010510110205101101041111020411110105111107040C1206040D1205040E1204040F1205040F1205050F1202060F1203060F1204060F1205060F1204041012020510120305101204051012010610120105111201041212020412120105121207040D1306040E1305040F1306040F1305050F1305060F1304070F1305070F1304041013050410130205111304051113010611130306111304061113010512130106121302041313010513130205131308040D1407040E1408040E1406040F1407040F140504101406041014050710140404111405041114040511140106111404061114020711140307111401061214020612140306121404061214020513140204141401051414020514140106141408040E1507040F150604101507041015060510150504111506041115060611150307111504071115060711150508111506081115050512150306121504061215050612150207121504071215020613150306131502061415020515150206151509040E1608040F1609040F16070410160804101607041116060611160607111606081116060412160505121603081216040812160505131605061316020713160307131604071316050713160207141602061516020516160206161609050F1708051017070511170805111706051217070512170706121704081217050912170609121705051317060513170506131702081317030813170506141702071417040714170507141702061517020715170205171702061717090510180A0510180805121807051318070713180708131806091318070913180605141805061418060614180208141802071518030715180507151804081518050815180207161802061718020717180205181802061818020718180A051019090511190A051119080512190905121907051319080513190806131908071319080813190709131908091319070A131906051419070514190309141905091419070A1419060615190607151905081519060815190207161902081619030816190408161902071719020718190205191902061919020719190A05111A0B05111A0A05121A0905131A0806131A0805141A060A141A080A141A0705151A0309151A050A151A0606161A0607161A0608161A0209161A0509161A0609161A0208171A0308171A0408171A0207181A0208181A0207191A02061A1A02071A1A0B05111B0B05121B0905131B0A05131B0905141B0906141B0907141B0808141B0805151B0806151B0809151B050A151B060A151B080A151B070B151B080B151B0706161B0707161B030A161B0608171B0209171B0409171B0509171B0609171B0209181B0208191B02071A1B02081A1B02061B1B02071B1B02081B1B0C05121C0B05131C0A05141C0906151C090A151C070B151C090B151C0806161C0706171C0707171C0708171C0209171C0709171C0309181C0509181C0208191C0209191C02091A1C02081B1C02061C1C03061C1C02071C1C02081C1C0C06121D0B06131D0A06141D0B06141D0906151D0A06151D0A07151D0908151D0906161D0909161D060B161D090B161D090C161D0806171D0906171D0807171D050B171D0708181D0709181D030A181D060A181D070A181D0309191D0409191D050A191D02091A1D02081B1D02091B1D03061D1D02071D1D03071D1D02081D1D0C06131E0D06131E0C06141E0B06151E0A06161E0A07161E0A0A161E0A0B161E0A0C161E0906171E060C171E080C171E0807181E0808181E020B181E050B181E0808191E0809191E020A191E060A191E080A191E03091A1E040A1A1E02091B1E020A1B1E02091C1E02081D1E03061E1E02071E1E03071E1E02081E1E02091E1E0D06131F0C06141F0D06141F0C06151F0B06161F0B07161F0B08161F0A06171F0A09171F080D171F090D171F0A0D171F0906181F0907181F0808191F080A191F020B191F020A1A1F050A1A1F070B1A1F080B1A1F020A1B1F040A1B1F02091C1F020A1C1F02091D1F020A1D1F02091E1F02071F1F03071F1F02081F1F0E0614200D0615200C0616200B0617200B0B17200B0C17200B0D1720
call fcn.140020740
mov edx, 2
mov ecx, 0x4000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
je 0x140021080
mov rcx, rax
call fcn.140020380
lea r8, [rdi + 4]
mov r9d, 0x80
lea rcx, [rsi + 8]
nop
mov r10d, 2
nop word [rax + rax]
movzx eax, word [r8 - 4]
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 - 2]
mov dword [rcx - 8], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8]
mov dword [rcx - 4], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 2]
mov dword [rcx], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 4]
mov dword [rcx + 4], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 6]
mov dword [rcx + 8], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 8]
mov dword [rcx + 0xc], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0xa]
mov dword [rcx + 0x10], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0xc]
mov dword [rcx + 0x14], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0xe]
mov dword [rcx + 0x18], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x10]
mov dword [rcx + 0x1c], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x12]
mov dword [rcx + 0x20], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x14]
mov dword [rcx + 0x24], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x16]
mov dword [rcx + 0x28], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x18]
mov dword [rcx + 0x2c], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x1a]
mov dword [rcx + 0x30], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x1c]
mov dword [rcx + 0x34], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x1e]
mov dword [rcx + 0x38], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x20]
mov dword [rcx + 0x3c], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x22]
mov dword [rcx + 0x40], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x24]
mov dword [rcx + 0x44], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x26]
mov dword [rcx + 0x48], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x28]
mov dword [rcx + 0x4c], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x2a]
mov dword [rcx + 0x50], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x2c]
mov dword [rcx + 0x54], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x2e]
mov dword [rcx + 0x58], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x30]
mov dword [rcx + 0x5c], edx
mov edx, dword [rbx + rax*4]
mov dword [rcx + 0x60], edx
movzx eax, word [r8 + 0x32]
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x34]
mov dword [rcx + 0x64], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x36]
mov dword [rcx + 0x68], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x38]
mov dword [rcx + 0x6c], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x3a]
mov dword [rcx + 0x70], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x3c]
mov dword [rcx + 0x74], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x3e]
mov dword [rcx + 0x78], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x40]
mov dword [rcx + 0x7c], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x42]
mov dword [rcx + 0x80], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x44]
mov dword [rcx + 0x84], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x46]
mov dword [rcx + 0x88], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x48]
mov dword [rcx + 0x8c], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x4a]
mov dword [rcx + 0x90], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x4c]
mov dword [rcx + 0x94], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x4e]
mov dword [rcx + 0x98], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x50]
mov dword [rcx + 0x9c], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x52]
mov dword [rcx + 0xa0], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x54]
mov dword [rcx + 0xa4], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x56]
mov dword [rcx + 0xa8], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x58]
mov dword [rcx + 0xac], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x5a]
mov dword [rcx + 0xb0], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x5c]
mov dword [rcx + 0xb4], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x5e]
mov dword [rcx + 0xb8], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x60]
mov dword [rcx + 0xbc], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x62]
mov dword [rcx + 0xc0], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x64]
mov dword [rcx + 0xc4], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x66]
mov dword [rcx + 0xc8], edx
mov edx, dword [rbx + rax*4]
mov dword [rcx + 0xcc], edx
movzx eax, word [r8 + 0x68]
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x6a]
mov dword [rcx + 0xd0], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x6c]
mov dword [rcx + 0xd4], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x6e]
mov dword [rcx + 0xd8], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x70]
mov dword [rcx + 0xdc], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x72]
mov dword [rcx + 0xe0], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x74]
mov dword [rcx + 0xe4], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x76]
mov dword [rcx + 0xe8], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x78]
mov dword [rcx + 0xec], edx
mov edx, dword [rbx + rax*4]
movzx eax, word [r8 + 0x7a]
sub r8, 0xffffffffffffff80
mov dword [rcx + 0xf0], edx
mov edx, dword [rbx + rax*4]
mov dword [rcx + 0xf4], edx
add rcx, 0x100
sub r10, 1
jne 0x140020d40
sub r9, 1
jne 0x140020d30
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret