Function at 0x140002bfd
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x1400d3940
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
sub rsp, 0x88
mov rdi, rdx
mov r14, r8
mov rsi, rcx
mov rcx, rdi
lea rdx, [rsp + 0x48]
mov r8d, 0x30
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400d3a4f
mov rbx, qword [rsp + 0x50]
movzx eax, word [rbx]
cmp eax, 0x5a4d
jne 0x1400d3a4f
movsxd r8, dword [rbx + 0x3c]
xor bpl, bpl
add r8, rbx
xor eax, eax
xor dl, dl
movzx r9d, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rcx, [r8 + r9 + 0x18]
test r10d, r10d
jbe 0x1400d3a4f
mov dword [rsp + 0x30], r12d
mov r12d, eax
mov qword [rsp + 0x78], rsi
mov sil, dl
mov qword [rsp + 0x28], rdi
mov rdi, rcx
mov qword [rsp + 0x20], r14
mov r14, r8
mov rcx, rdi
lea rdx, str..trace
mov r8d, 7
call fcn.140002c98
test eax, eax
jne 0x1400d3a09
inc r12d
mov r15, rdi
movzx r9d, word [r14 + 6]
add rdi, 0x28
mov bpl, 1
cmp r12d, r9d
jae 0x1400d3a9d
test sil, sil
jne 0x1400d3a33
mov rcx, rdi
lea rdx, str..text
mov r8d, 6
call fcn.140002c98
test eax, eax
jne 0x1400d3a33
mov sil, 1
add rdi, 0x28
inc r12d
jmp 0x1400d3a3a
add rdi, 0x28
inc r12d
movzx r9d, word [r14 + 6]
cmp r12d, r9d
jae 0x1400d41d3
test bpl, bpl
jne 0x1400d3a09
jmp 0x1400d39d5
mov rcx, rsi
lea rdx, str.Unknown
call fcn.140002964
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.140002964
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.140002964
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r12d, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x28]
mov r14, qword [rsp + 0x20]
mov eax, dword [r15 + 8]
cmp rax, 0x1a
jb 0x1400d3a4f
mov edx, dword [r15 + 0xc]
add rbx, rdx
test r14, r14
je 0x1400d3aca
mov r13, qword [r14]
add rbx, r13
xor r15d, r15d
mov rbp, rbx
jmp 0x1400d3ad8
add rbx, r10
mov dl, byte [rbx]
test dl, dl
jne 0x1400d3ae6
mov r10d, 1
jmp 0x1400d3b37
cmp dl, 0xa
jne 0x1400d3fb2
test r13, r13
je 0x1400d3aff
cmp r13, qword [rbx + 8]
jbe 0x1400d3aff
mov r9, r13
jmp 0x1400d3b02
xor r9d, r9d
movzx edx, word [rbx + 1]
cmp edx, 2
jne 0x1400d4185
cmp byte [rbx + 3], 0
ja 0x1400d4185
mov edx, dword [rbx + 0x14]
add rdx, r9
mov r8, qword [rbx + 8]
add rdx, r8
mov r10d, dword [rbx + 4]
cmp rdi, rdx
jae 0x1400d3b37
add r8, r9
cmp rdi, r8
jae 0x1400d3b45
add r15, r10
cmp r15, rax
jae 0x1400d4000
jmp 0x1400d3ad5
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x38], r9
cmp byte [rbx], 0xa
jne 0x1400d3f64
movzx eax, word [rbx + 1]
cmp eax, 2
jne 0x1400d3b6a
cmp byte [rbx + 3], 0
jbe 0x1400d3bb8
mov rcx, rsi
lea rdx, str.Unknown
call fcn.140002964
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.140002964
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.140002964
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx eax, word [rbx + 0x1a]
lea rdx, [rbx + 0x10]
mov r8d, 4
lea rcx, [rsp + 0x40]
mov r14d, dword [rbx + 4]
lea r13, [rbx + 0x1a]
mov qword [rcx - 0x20], r13
lea r9, [rbx + 0x1c]
mov qword [rcx - 0x10], rax
mov r13d, 0x1a
mov qword [rcx - 0x18], r9
call fcn.140002cde
mov edx, dword [rsp + 0x40]
test edx, edx
jbe 0x1400d3c4c
mov eax, edx
mov r8d, 1
shr eax, 1
xor r9d, r9d
mov r10, qword [rsp + 0x20]
test eax, eax
jbe 0x1400d3c3b
xor r8d, r8d
movzx r11d, word [r10]
inc r9d
lea r10, [r10 + r11 + 2]
lea r13, [r13 + r11 + 2]
movzx r11d, word [r10]
lea r8, [r8 + r11 + 2]
lea r10, [r10 + r11 + 2]
cmp r9d, eax
jb 0x1400d3c0f
add r13, r8
lea r8d, [r9 + r9 + 1]
dec r8d
cmp r8d, edx
jae 0x1400d3c4c
movzx eax, word [r10]
lea r13, [r13 + rax + 2]
imul rax, r14, 0x1d
mov qword [rsp + 0x78], rsi
lea r11, [rbx + r13]
add r13, r15
xor r15d, r15d
mov r10, qword [rsp + 0x38]
xor r8d, r8d
mov rsi, qword [rsp + 0x28]
add rbx, rax
mov r9, qword [rsp + 0x30]
cmp r13, rbx
je 0x1400d4132
movzx r14d, byte [r11]
mov eax, r14d
and eax, 0xc0
cmp eax, 0x80
jne 0x1400d3cb5
mov al, byte [r11]
inc r8
and al, 0x3f
movzx r13d, al
lea r10, [r10 + r13 + 1]
cmp r10, rdi
jae 0x1400d3da0
inc r11
mov r13, r11
sub r13, rbp
jmp 0x1400d3c74
cmp eax, 0xc0
jne 0x1400d3ce9
mov r13b, byte [r11]
and r13b, 0x3f
movzx r14d, r13b
movsx rax, byte [r11 + 1]
add r8, rax
lea r10, [r10 + r14 + 1]
cmp r10, rdi
jae 0x1400d3da0
add r11, 2
mov r13, r11
sub r13, rbp
jmp 0x1400d3c74
cmp r14d, 0xd
ja 0x1400d3f06
lea rdx, [0x140000000]
movzx eax, word [rdx + r14*2 + 0x1526bc]
lea rax, [rdx + rax + 0xd3d0d]
jmp rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r9
mov rsi, qword [rsp + 0x78]
cmp qword [0x14016fbe0], 0
je 0x1400d40c4
mov rax, qword [0x14016fcc0]
lea rdx, str._I64u
lea rcx, [rsi + 0x208]
call rax
test r15, r15
je 0x1400d40a1
mov rcx, rsi
mov rdx, r15
mov r8, r12
call fcn.140002cde
mov r12d, r12d
mov byte [r12 + rsi], 0
mov rdx, qword [rsp + 0x28]
lea rcx, [rsi + 0x104]
mov r8, qword [rsp + 0x30]
call fcn.140002cde
mov rax, qword [rsp + 0x30]
mov byte [rax + rsi + 0x104], 0
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rsi, qword [rsp + 0x78]
mov rcx, rsi
lea rdx, str.Unknown
call fcn.140002964
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.140002964
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.140002964
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, rsi
lea rdx, str.Unknown
call fcn.140002964
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.140002964
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.140002964
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, rsi
lea rdx, str.Unknown
call fcn.140002964
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.140002964
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.140002964
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, rsi
lea rdx, str.Unknown
call fcn.140002964
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.140002964
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.140002964
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rcx, str.Unknown
call fcn.140002900
mov rcx, rsi
lea rdx, str.Unknown
mov r8, rax
call fcn.140002cde
jmp 0x1400d3df3
mov qword [rsp + 0x20], r8
call fcn.140002eb4
mov r8, qword [rsp + 0x20]
mov rax, qword [0x14016fcc0]
jmp 0x1400d3dc4
mov rsi, qword [rsp + 0x78]
mov rcx, rsi
lea rdx, str.Unknown
call fcn.140002964
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.140002964
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.140002964
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, rsi
lea rdx, str.Unknown
call fcn.140002964
lea rdx, str.Unknown
lea rcx, [rsi + 0x104]
call fcn.140002964
add rsi, 0x208
lea rdx, str.Unknown
mov rcx, rsi
call fcn.140002964
xor eax, eax
add rsp, 0x88
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov r12d, dword [rsp + 0x30]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x28]
mov r14, qword [rsp + 0x20]
test bpl, bpl
jne 0x1400d3ab1
jmp 0x1400d3a4f