Function at 0x18007e6a0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa0
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, qword [rbp + 0x7f]
mov rdi, r8
mov r8d, r9d
mov dword [rbp - 0x41], r9d
mov r15d, r9d
mov qword [rbp - 0x29], rcx
add r9d, 0x2b5
mov r12, rcx
mov ecx, 0x43
cmp r8d, r9d
jae 0x18007e916
lea ebx, [rcx + 0x11]
mov r11d, 0x5448
lea esi, [rcx - 0x15]
lea r10d, [rcx - 0x12]
nop word [rax + rax]
cmp r8d, 0xfa
ja 0x18007e85d
je 0x18007e854
mov eax, r8d
sub eax, 2
je 0x18007e7e2
sub eax, 0x3f
je 0x18007e792
sub eax, 0x53
je 0x18007e76b
sub eax, 0x27
je 0x18007e761
cmp eax, 0x18
jne 0x18007e909
mov eax, dword [r14 + 0x1018]
inc eax
and eax, 0xfff
mov dword [r14 + 0x1018], eax
jmp 0x18007e909
mov word [rbp - 0x11], r11w
jmp 0x18007e909
mov rcx, qword [r12]
movzx eax, byte [rdx]
mov byte [rdi + rcx], al
inc qword [r12]
mov ecx, dword [r14 + 0x1018]
movzx eax, byte [rdx]
mov byte [rcx + r14 + 0x18], al
mov ecx, 0x43
jmp 0x18007e909
movzx eax, byte [rdi + 0x11]
movzx ecx, byte [rdi + 0x10]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0x13]
shl ecx, 8
or ecx, eax
mov dword [r14 + 0xc], ecx
movzx eax, byte [rdi + 0xd]
movzx ecx, byte [rdi + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0xf]
shl ecx, 8
or ecx, eax
mov dword [r14 + 0x10], ecx
mov ecx, 0x43
jmp 0x18007e909
movzx eax, byte [rdi + 0x1d]
movzx ecx, byte [rdi + 0x1c]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0x1f]
shl ecx, 8
or ecx, eax
mov dword [r14], ecx
movzx eax, byte [rdi + 0x19]
movzx ecx, byte [rdi + 0x18]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0x1b]
shl ecx, 8
or ecx, eax
mov dword [r14 + 4], ecx
movzx eax, byte [rdi + 0x15]
movzx ecx, byte [rdi + 0x14]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0x17]
shl ecx, 8
or ecx, eax
mov dword [r14 + 8], ecx
mov ecx, 0x43
jmp 0x18007e909
mov word [rbp - 0xf], bx
jmp 0x18007e909
mov eax, r8d
sub eax, 0x139
je 0x18007e902
sub eax, 0x3f
je 0x18007e8f3
sub eax, 0x3f
je 0x18007e8ae
sub eax, 0x3f
je 0x18007e893
cmp eax, 0x3f
jne 0x18007e909
mov word [rbp - 0x1d], 0x65
mov word [rbp + 7], cx
jmp 0x18007e909
movzx eax, word [0x1800b8022]
mov word [rbp - 0x20], ax
movzx eax, byte [0x1800b8024]
mov byte [rbp - 0x1e], al
mov byte [rbp - 0x1d], 0
jmp 0x18007e909
lea rcx, [rbp - 0x19]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18007e8b5
movzx eax, word [0x1800b8080]
mov word [rcx], ax
movzx eax, byte [0x1800b8082]
mov byte [rcx + 2], al
mov ecx, 0x43
movzx eax, word [0x1800a8248]
mov word [rbp - 0x17], ax
movzx eax, byte [0x1800a824a]
mov byte [rbp - 0x15], al
mov byte [rbp - 0x21], 0x63
jmp 0x18007e909
mov word [rbp - 0xb], si
mov word [rbp - 0xa], r10w
mov byte [rbp - 0x19], 0
jmp 0x18007e909
mov dword [rbp - 0xe], 0x312f50
add r8d, 0x3f
cmp r8d, r9d
jb 0x18007e710
imul r13d, r15d, 0x78
mov dword [rbp - 0x31], r13d
cmp r15d, r13d
ja 0x18007ee26
mov eax, 0x6f
lea esi, [r15 + r15*4]
add esi, esi
mov dword [rbp - 0x39], esi
lea r8d, [rax - 1]
lea r9d, [rax - 6]
lea r10d, [rax + 5]
cmp r15d, 0x16a5
ja 0x18007eb02
je 0x18007ea8b
cmp r15d, 0xbb
ja 0x18007ea61
je 0x18007ea4c
cmp r15d, 2
je 0x18007ea24
cmp r15d, 0x16
je 0x18007e996
cmp r15d, 0x2a
jne 0x18007ee16
test r12, r12
je 0x18007ee16
mov eax, dword [rbp - 0x35]
mov dword [r12], eax
jmp 0x18007ee11
movzx ecx, byte [rdi + 4]
mov r9, r14
movzx eax, byte [rdi + 5]
xor edx, edx
shl ecx, 8
mov r8d, 0x81
or ecx, eax
mov qword [rsp + 0x30], 0
movzx eax, byte [rdi + 6]
shl ecx, 8
or ecx, eax
mov qword [rsp + 0x28], 0
movzx eax, byte [rdi + 7]
shl ecx, 8
or ecx, eax
mov qword [rsp + 0x20], 0
mov dword [r14 + 0x18], ecx
movzx ecx, byte [rdi]
movzx eax, byte [rdi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 3]
shl ecx, 8
or ecx, eax
mov dword [r14 + 0x1c], ecx
xor ecx, ecx
call fcn.180078310
mov r8, r14
mov dword [rbp - 0x41], eax
mov edx, 0x17
lea rcx, [rbp - 0x41]
call fcn.18007e170
mov dword [rbp - 0x35], eax
jmp 0x18007ee03
movzx eax, byte [rdi + 9]
movzx ecx, byte [rdi + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0xb]
shl ecx, 8
or ecx, eax
mov dword [r14 + 0x14], ecx
jmp 0x18007ee11
mov word [rbp + 8], ax
mov word [rbp + 9], r8w
mov dword [rbp + 0xa], 0x63656e
jmp 0x18007ee16
cmp r15d, 0x809
je 0x18007ea81
cmp r15d, 0xf57
jne 0x18007ee16
mov word [rbp + 0xe], r9w
jmp 0x18007ee16
mov word [rbp + 0xd], r10w
jmp 0x18007ee16
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov word [rbp + 0xf], ax
mov rax, rdx
sub rax, rcx
mov word [rbp + 0x10], r8w
cmp rax, 3
jb 0x18007eade
lea rax, [rcx + 3]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18007eabc
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 3
mov rcx, rbx
lea rdx, [0x1800b8094]
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp 0x18007ee03
xor r8d, r8d
mov qword [rsp + 0x20], 3
lea r9, [0x1800b8094]
mov rcx, rdi
lea edx, [r8 + 3]
call fcn.180002ba0
jmp 0x18007ee03
cmp r15d, 0x1df3
je 0x18007ed5e
cmp r15d, 0x2541
je 0x18007eca2
cmp r15d, 0x2c8f
je 0x18007ec44
cmp r15d, 0x33dd
je 0x18007eb88
cmp r15d, 0x3b2b
jne 0x18007ee16
cmp qword [0x1800c2f88], 0x10
lea rdx, [0x1800c2f70]
mov r8, qword [0x1800c2f80]
mov rcx, rdi
cmovae rdx, qword [0x1800c2f70]
call fcn.18001d460
cmp qword [0x1800c2f88], 0x10
lea rdx, [0x1800c2f70]
mov r8, qword [0x1800c2f80]
cmovae rdx, qword [0x1800c2f70]
jmp 0x18007edfb
cmp qword [r14 + 0x58], 0x10
lea r8, [r14 + 0x40]
jb 0x18007eb96
mov r8, qword [r8]
lea r9, str.User_Agent
mov edx, 0x11d
mov rcx, rdi
call fcn.180004300
cmp qword [r14 + 0x70], 0
je 0x18007ee03
mov ebx, 0x37
mov r12d, 0x696b
lea esi, [rbx + 0x38]
lea r13d, [rbx + 0x2e]
lea r15d, [rbx + 0xc]
nop dword [rax + rax]
mov eax, ebx
sub eax, 0x37
je 0x18007ec24
sub eax, 1
je 0x18007ec1a
sub eax, 1
je 0x18007ec13
sub eax, 1
je 0x18007ec0c
cmp eax, 1
jne 0x18007ec29
cmp qword [r14 + 0x78], 0x10
lea r8, [r14 + 0x60]
jb 0x18007ebf9
mov r8, qword [r8]
lea r9, [rbp - 1]
mov edx, 0x11d
mov rcx, rdi
call fcn.180004300
jmp 0x18007ec29
mov word [rbp + 4], r13w
jmp 0x18007ec29
mov word [rbp + 2], r12w
jmp 0x18007ec29
mov word [rbp], si
mov word [rbp + 1], si
jmp 0x18007ec29
mov word [rbp - 1], r15w
inc ebx
cmp ebx, 0x3c
jb 0x18007ebd0
mov r15d, dword [rbp - 0x41]
mov r12, qword [rbp - 0x29]
mov r13d, dword [rbp - 0x31]
mov esi, dword [rbp - 0x39]
jmp 0x18007ee03
cmp qword [0x1800c2f88], 0x10
lea rdx, [0x1800c2f70]
mov r8, qword [0x1800c2f80]
mov rcx, rdi
cmovae rdx, qword [0x1800c2f70]
call fcn.18001d460
cmp qword [r14 + 0x18], 0x10
mov r8, r14
jb 0x18007ec77
mov r8, qword [r14]
lea r9, [rbp - 0x19]
mov edx, 0x11d
mov rcx, rdi
call fcn.180004300
lea r9, [rbp + 7]
mov edx, 0x11d
lea r8, [rbp - 0x21]
mov rcx, rdi
call fcn.180004300
jmp 0x18007ee03
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18007eccb
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18007ecc3
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x18007ecdd
xor r8d, r8d
mov r9b, 0x20
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002a40
lea rax, [rbp - 0x11]
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x18007ecf0
mov rdx, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18007ed3f
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18007ed20
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rcx, rbx
lea rdx, [rbp - 0x11]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
mov esi, dword [rbp - 0x39]
jmp 0x18007ee03
lea r9, [rbp - 0x11]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.180002ba0
mov esi, dword [rbp - 0x39]
jmp 0x18007ee03
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18007ed87
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18007ed7f
mov rax, qword [rdi]
mov word [rax + rcx], 0x20
jmp 0x18007ed99
xor r8d, r8d
mov r9b, 0x20
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002a40
cmp qword [r14 + 0x38], 0x10
lea rax, [r14 + 0x20]
jb 0x18007eda8
mov rax, qword [r14 + 0x20]
cmp byte [rax], 0x2f
je 0x18007ede8
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x18007edd6
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x18007edce
mov rax, qword [rdi]
mov word [rax + rcx], reloc.SHELL32.dll_PathMakeUniqueName
jmp 0x18007ede8
xor r8d, r8d
mov r9b, reloc.SHELL32.dll_PathMakeUniqueName
mov rcx, rdi
lea edx, [r8 + 1]
call fcn.180002a40
cmp qword [r14 + 0x38], 0x10
lea rdx, [r14 + 0x20]
jb 0x18007edf7
mov rdx, qword [r14 + 0x20]
mov r8, qword [r14 + 0x30]
mov rcx, rdi
call fcn.18001d460
mov r10d, 0x74
lea r9d, [r10 - 0xb]
lea r8d, [r10 - 6]
mov eax, 0x6f
add r15d, esi
mov dword [rbp - 0x41], r15d
cmp r15d, r13d
jbe 0x18007e941
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1800a1820
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret