Function at 0x1800016d8
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov eax, dword [rcx + 0x10]
xor r15d, r15d
and dword [rsp + 0x30], r15d
mov r10d, r8d
test byte [rcx + 0xf8], 2
mov rdi, rdx
mov rbx, rcx
mov dword [rsp + 0x40], eax
je 0x180001732
cmp qword [rcx + 0x108], r15
je 0x180001732
mov r9d, r8d
lea edx, [r15 + 2]
lea r8, [0x18002f936]
call fcn.180001000
mov r10d, dword [rsp + 0xb0]
test rdi, rdi
je 0x180001e76
cmp r10d, 0x18
jl 0x180001e76
mov ebp, 1
mov eax, dword [rbx]
sub r10d, 0x18
movzx r13d, byte [rdi + 0xb]
movzx esi, byte [rdi + 0xf]
movzx ecx, byte [rdi + 0x13]
movzx r9d, byte [rdi + 0x17]
mov r14b, byte [rdi + 4]
movzx edx, byte [rdi + 7]
movzx r8d, byte [rdi + 6]
mov dword [rsp + 0x3c], eax
mov al, byte [rdi + 5]
mov byte [rsp + 0xa0], al
movzx eax, byte [rdi + 0xa]
shl r13d, 8
add r13d, eax
shl esi, 8
movzx eax, byte [rdi + 9]
shl r9d, 8
shl ecx, 8
shl r13d, 8
add r13d, eax
mov dword [rsp + 0xb0], r10d
movzx eax, byte [rdi + 8]
shl r13d, 8
add r13d, eax
movzx eax, byte [rdi + 0xe]
add esi, eax
mov dword [rsp + 0x38], r13d
movzx eax, byte [rdi + 0xd]
shl esi, 8
add esi, eax
movzx eax, byte [rdi + 0xc]
shl esi, 8
add esi, eax
movzx eax, byte [rdi + 0x12]
add ecx, eax
movzx eax, byte [rdi + 0x11]
shl ecx, 8
add ecx, eax
movzx eax, byte [rdi + 0x10]
shl ecx, 8
add eax, ecx
mov dword [rsp + 0x34], eax
movzx eax, byte [rdi + 0x16]
add r9d, eax
movzx eax, byte [rdi + 0x15]
shl r9d, 8
add r9d, eax
movzx eax, byte [rdi + 0x14]
shl r9d, 8
add r9d, eax
lea rax, [rdi + 0x18]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xb8], r9d
cmp r10d, r9d
jl 0x180001e6f
test r9d, r9d
js 0x180001e6f
lea eax, [r14 - 0x51]
cmp al, 3
ja 0x180001e68
lea rdi, [rbx + 0xa8]
mov r12d, edx
mov rcx, qword [rdi]
shl r12d, 8
add r12d, r8d
mov dword [rbx + 0x40], r12d
cmp rcx, rdi
je 0x1800018b3
mov ebp, dword [rsp + 0x34]
mov r13, qword [rcx]
mov eax, ebp
sub eax, dword [rcx + 0x24]
test eax, eax
jle 0x1800018a1
mov rax, qword [rcx + 8]
mov qword [r13 + 8], rax
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
mov qword [rdx], rax
and qword [rcx], 0
and qword [rcx + 8], 0
mov rax, qword [0x1800347a0]
test rax, rax
je 0x180001890
call rax
jmp 0x180001896
call qword [sym.imp.msvcrt.dll_free]
dec dword [rbx + 0x60]
mov rcx, r13
cmp r13, rdi
jne 0x180001859
mov r13d, dword [rsp + 0x38]
mov ebp, 1
mov r10d, dword [rsp + 0xb0]
mov r8, qword [rdi]
cmp r8, rdi
je 0x1800018c1
mov eax, dword [r8 + 0x24]
jmp 0x1800018c4
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], eax
cmp r14b, 0x52
jne 0x180001a2e
mov r9d, dword [rbx + 0x4c]
sub r9d, r13d
js 0x180001960
mov r10d, dword [rbx + 0x2c]
test r10d, r10d
jne 0x1800018fa
mov eax, r9d
mov dword [rbx + 0x2c], r9d
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [rbx + 0x28], eax
jmp 0x18000193f
mov ecx, r9d
mov eax, r10d
sub eax, r9d
sub ecx, r10d
cmovns eax, ecx
mov ecx, dword [rbx + 0x28]
lea edx, [rcx + rcx*2]
add eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov ecx, eax
mov dword [rbx + 0x28], eax
imul eax, r10d, 7
add eax, r9d
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [rbx + 0x2c], eax
mov r9d, eax
cmp eax, ebp
jge 0x18000193f
mov dword [rbx + 0x2c], ebp
mov r9d, ebp
shl ecx, 2
mov eax, 0xea60
cmp dword [rbx + 0x50], ecx
cmovae ecx, dword [rbx + 0x50]
add ecx, r9d
cmp dword [rbx + 0x34], ecx
cmovae ecx, dword [rbx + 0x34]
cmp ecx, eax
cmovbe eax, ecx
mov dword [rbx + 0x30], eax
cmp esi, dword [rbx + 0x10]
js 0x1800019b8
cmp esi, dword [rbx + 0x14]
jns 0x1800019b8
jmp 0x180001977
cmp esi, dword [r8 + 0x24]
je 0x18000197e
js 0x1800019b8
mov r8, qword [r8]
cmp r8, rdi
jne 0x18000196c
jmp 0x1800019b8
mov rdx, qword [r8]
mov rcx, r8
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
mov rax, qword [r8]
mov rdx, qword [r8 + 8]
mov qword [rdx], rax
and qword [r8], 0
and qword [r8 + 8], 0
mov rax, qword [0x1800347a0]
test rax, rax
je 0x1800019af
call rax
jmp 0x1800019b5
call qword [sym.imp.msvcrt.dll_free]
dec dword [rbx + 0x60]
mov rax, qword [rdi]
cmp rax, rdi
je 0x1800019c5
mov eax, dword [rax + 0x24]
jmp 0x1800019c8
mov eax, dword [rbx + 0x14]
cmp dword [rsp + 0x30], 0
mov dword [rbx + 0x10], eax
jne 0x1800019db
mov dword [rsp + 0x30], ebp
mov r15d, esi
jmp 0x1800019e6
mov eax, esi
sub eax, r15d
test eax, eax
cmovg r15d, esi
test byte [rbx + 0xf8], 0x20
je 0x180001d60
cmp qword [rbx + 0x108], 0
je 0x180001d60
mov ecx, dword [rbx + 0x4c]
lea r8, [0x18002f936]
mov eax, dword [rbx + 0x30]
sub ecx, r13d
mov dword [rsp + 0x28], eax
mov r9d, esi
mov dword [rsp + 0x20], ecx
mov edx, 0x20
mov rcx, rbx
call fcn.180001000
jmp 0x180001d60
cmp r14b, 0x51
jne 0x180001cf9
test byte [rbx + 0xf8], 0x10
je 0x180001a67
cmp qword [rbx + 0x108], 0
je 0x180001a67
mov r9d, esi
mov dword [rsp + 0x20], r13d
lea r8, [0x18002f936]
mov edx, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.180001000
mov eax, esi
sub eax, dword [rbx + 0x3c]
cmp eax, dword [rbx + 0x18]
jns 0x180001d60
mov eax, dword [rbx + 0xd0]
lea ecx, [rax + 1]
cmp ecx, dword [rbx + 0xd4]
jbe 0x180001b37
mov edi, 8
cmp ecx, edi
jbe 0x180001a99
add edi, edi
cmp edi, ecx
jb 0x180001a93
mov rax, qword [0x1800347a8]
mov ecx, edi
shl rcx, 3
test rax, rax
je 0x180001aaf
call rax
jmp 0x180001ab5
call qword [sym.imp.msvcrt.dll_malloc]
mov r14, rax
test rax, rax
je 0x180001e03
mov rcx, qword [rbx + 0xc8]
test rcx, rcx
je 0x180001b24
xor r8d, r8d
cmp dword [rbx + 0xd0], r8d
jbe 0x180001b0e
xor r9d, r9d
lea r10d, [r8 + r8]
mov rax, qword [rbx + 0xc8]
lea edx, [r9 + r10]
add r9d, ebp
mov ecx, dword [rax + rdx*4]
mov dword [r14 + rdx*4], ecx
cmp r9d, 2
jl 0x180001ae0
add r8d, ebp
cmp r8d, dword [rbx + 0xd0]
jb 0x180001ad9
mov rcx, qword [rbx + 0xc8]
mov rax, qword [0x1800347a0]
test rax, rax
je 0x180001b1e
call rax
jmp 0x180001b24
call qword [sym.imp.msvcrt.dll_free]
mov eax, dword [rbx + 0xd0]
mov qword [rbx + 0xc8], r14
mov dword [rbx + 0xd4], edi
lea ecx, [rax + rax]
mov rax, qword [rbx + 0xc8]
mov dword [rax + rcx*4], esi
mov dword [rax + rcx*4 + 4], r13d
add dword [rbx + 0xd0], ebp
cmp esi, dword [rbx + 0x18]
js 0x180001d60
movsxd rcx, dword [rsp + 0xb8]
add rcx, 0x48
cmp qword [0x1800347a8], 0
lfence
je 0x180001b79
call qword [0x1800347a8]
jmp 0x180001b7f
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
mov eax, dword [rsp + 0x3c]
mov dword [rdi + 0x10], eax
movzx eax, byte [rsp + 0xa0]
mov dword [rdi + 0x18], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0x28], eax
mov eax, dword [rsp + 0xb8]
mov dword [rdi + 0x14], 0x51
mov dword [rdi + 0x1c], r12d
mov dword [rdi + 0x20], r13d
mov dword [rdi + 0x24], esi
mov dword [rdi + 0x2c], eax
test eax, eax
je 0x180001bd6
lfence
mov rdx, qword [rsp + 0xa8]
lea rcx, [rdi + 0x40]
mov r8d, eax
call qword [sym.imp.ntdll.dll_memcpy]
mov esi, dword [rdi + 0x24]
mov eax, esi
sub eax, dword [rbx + 0x18]
cmp eax, dword [rbx + 0x3c]
jns 0x180001cd9
cmp esi, dword [rbx + 0x18]
js 0x180001cd9
mov rcx, qword [rbx + 0xc0]
lea r14, [rbx + 0xb8]
jmp 0x180001c13
cmp dword [rcx + 0x24], esi
je 0x180001cb3
mov eax, esi
sub eax, dword [rcx + 0x24]
test eax, eax
jg 0x180001c18
mov rcx, qword [rcx + 8]
cmp rcx, r14
jne 0x180001bfd
mov qword [rdi], rdi
mov qword [rdi + 8], rcx
mov rax, qword [rcx]
mov qword [rdi], rax
mov rax, qword [rcx]
mov qword [rax + 8], rdi
mov qword [rcx], rdi
add dword [rbx + 0x5c], ebp
mov rdx, qword [r14]
cmp r14, rdx
je 0x180001d60
mov eax, dword [rbx + 0x18]
cmp dword [rdx + 0x24], eax
jne 0x180001d60
mov eax, dword [rbx + 0x3c]
cmp dword [rbx + 0x64], eax
jae 0x180001d60
mov rcx, qword [rdx]
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov qword [rcx], rax
and qword [rdx], 0
and qword [rdx + 8], 0
mov rax, qword [rbx + 0xa0]
dec dword [rbx + 0x5c]
mov qword [rdx + 8], rax
lea rax, [rbx + 0x98]
mov qword [rdx], rax
mov rax, qword [rbx + 0xa0]
mov qword [rax], rdx
add dword [rbx + 0x18], ebp
add dword [rbx + 0x64], ebp
mov eax, dword [rbx + 0x18]
mov qword [rbx + 0xa0], rdx
mov rdx, qword [r14]
cmp r14, rdx
jne 0x180001c41
jmp 0x180001d60
cmp qword [0x1800347a0], 0
mov rcx, rdi
lfence
je 0x180001cce
call qword [0x1800347a0]
jmp 0x180001c32
call qword [sym.imp.msvcrt.dll_free]
jmp 0x180001c32
cmp qword [0x1800347a0], 0
mov rcx, rdi
lfence
je 0x180001cf1
call qword [0x1800347a0]
jmp 0x180001d60
call qword [sym.imp.msvcrt.dll_free]
jmp 0x180001d60
cmp r14b, 0x53
jne 0x180001d2c
or dword [rbx + 0x48], 2
test byte [rbx + 0xf8], 0x40
je 0x180001d68
cmp qword [rbx + 0x108], 0
je 0x180001d68
lea r8, [0x18002f936]
mov edx, 0x40
mov rcx, rbx
call fcn.180001000
jmp 0x180001d60
cmp r14b, 0x54
jne 0x180001e68
test byte [rbx + 0xf8], 0x80
je 0x180001d68
cmp qword [rbx + 0x108], 0
je 0x180001d68
mov r9d, r12d
lea r8, [0x18002f936]
mov edx, 0x80
mov rcx, rbx
call fcn.180001000
mov r10d, dword [rsp + 0xb0]
mov ecx, dword [rsp + 0xb8]
mov rdi, qword [rsp + 0xa8]
sub r10d, ecx
add rdi, rcx
cmp r10d, 0x18
jge 0x18000174a
cmp dword [rsp + 0x30], 0
je 0x180001dbf
cmp r15d, dword [rbx + 0x10]
js 0x180001dbf
cmp r15d, dword [rbx + 0x14]
jns 0x180001dbf
lea rdx, [rbx + 0xa8]
mov rcx, qword [rdx]
cmp rcx, rdx
je 0x180001dbf
cmp r15d, dword [rcx + 0x24]
mov r8, qword [rcx]
js 0x180001dbf
je 0x180001db7
add dword [rcx + 0x38], ebp
mov rcx, r8
cmp r8, rdx
jne 0x180001da9
mov eax, dword [rbx + 0x10]
sub eax, dword [rsp + 0x40]
test eax, eax
jle 0x180001e64
mov r11d, dword [rbx + 0x44]
mov r9d, dword [rbx + 0x40]
cmp r11d, r9d
jae 0x180001e64
mov r8d, dword [rbx + 8]
mov r10d, dword [rbx + 0x80]
cmp r11d, dword [rbx + 0x24]
jae 0x180001e0a
lea ecx, [r11 + 1]
lea eax, [r10 + r8]
mov dword [rbx + 0x44], ecx
mov dword [rbx + 0x80], eax
jmp 0x180001e50
call qword [sym.imp.msvcrt.dll_abort]
int3
cmp r10d, r8d
mov eax, r8d
cmovb r10d, r8d
imul eax, r8d
xor edx, edx
div r10d
mov edx, r8d
add eax, r10d
shr edx, 4
add edx, eax
lea eax, [r11 + 1]
imul eax, r8d
mov dword [rbx + 0x80], edx
cmp eax, edx
ja 0x180001e64
lea eax, [r8 - 1]
add eax, edx
test r8d, r8d
cmovne ebp, r8d
xor edx, edx
div ebp
mov ecx, eax
mov dword [rbx + 0x44], eax
cmp ecx, r9d
jbe 0x180001e64
mov dword [rbx + 0x44], r9d
imul r9d, r8d
mov dword [rbx + 0x80], r9d
xor eax, eax
jmp 0x180001e79
mov eax, 0xfffffffd
jmp 0x180001e79
mov eax, 0xfffffffe
jmp 0x180001e79
or eax, 0xffffffff
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret