Function at 0x18002ecc0
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rdi
push r12
push r13
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0xa0]
mov r12, r9
mov r13, r8
mov r15, rdx
mov rbx, rcx
cmp eax, 0x39
jb 0x18002f099
mov rdi, qword [rsp + 0x98]
mov r11d, eax
movzx eax, byte [rdi + 0xe]
movzx r10d, byte [rdi + 0xf]
shl r10, 8
or r10, rax
movzx eax, byte [rdi + 0xd]
shl r10, 8
or r10, rax
movzx eax, byte [rdi + 0xc]
shl r10, 8
or r10, rax
add r10, 0x10
cmp r10, r11
jne 0x18002f099
movzx eax, byte [rdi + 0x1e]
movzx edx, byte [rdi + 0x1f]
shl edx, 8
or edx, eax
movzx eax, byte [rdi + 0x1d]
shl edx, 8
or edx, eax
movzx eax, byte [rdi + 0x1c]
shl edx, 8
or edx, eax
add edx, 0x20
mov eax, edx
add rax, 0x1c
cmp rax, r11
ja 0x18002f099
add edx, 4
mov ecx, edx
add edx, 4
add rcx, rdi
movzx eax, byte [rcx + 2]
movzx r8d, byte [rcx + 3]
shl r8d, 8
or r8d, eax
movzx eax, byte [rcx + 1]
shl r8d, 8
or r8d, eax
movzx eax, byte [rcx]
shl r8d, 8
or r8d, eax
je 0x18002edd1
mov r9d, edx
nop dword [rax]
movzx eax, byte [r9 + rdi + 2]
add edx, 4
movzx ecx, byte [r9 + rdi + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + rdi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + rdi]
shl ecx, 8
or ecx, eax
add edx, ecx
mov r9d, edx
lea rax, [rdx + 0x10]
cmp rax, r11
ja 0x18002f099
add r8d, 0xffffffff
jne 0x18002ed90
mov eax, edx
add rax, 0x10
cmp rax, r11
jne 0x18002f099
movzx eax, byte [rdi + 0x16]
movzx ecx, byte [rdi + 0x17]
shl rcx, 8
or rcx, rax
mov qword [rsp + 0x80], r14
movzx eax, byte [rdi + 0x15]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdi + 0x14]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdi + 0x13]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdi + 0x12]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdi + 0x11]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdi + 0x10]
shl rcx, 8
or rcx, rax
mov qword [rbx], rcx
movzx eax, byte [rdi + 0x1a]
movzx ecx, byte [rdi + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdi + 0x18]
shl ecx, 8
or ecx, eax
mov rax, qword [rsp + 0x90]
mov dword [rax], ecx
lea rax, [rdi + 0x20]
movzx ebx, byte [rdi + 0x1f]
mov qword [rsp + 0x20], rax
movzx eax, byte [rdi + 0x1e]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdi + 0x1d]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdi + 0x1c]
shl ebx, 8
or ebx, eax
add ebx, 0x20
mov ecx, ebx
add ebx, 4
add rcx, rdi
movzx eax, byte [rcx + 2]
movzx edx, byte [rcx + 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [rcx]
mov ecx, ebx
add ebx, 4
add rcx, rdi
shl edx, 8
or edx, eax
mov dword [rsp + 0x28], edx
movzx eax, byte [rcx + 2]
movzx r14d, byte [rcx + 3]
shl r14d, 8
or r14d, eax
movzx eax, byte [rcx + 1]
shl r14d, 8
or r14d, eax
movzx eax, byte [rcx]
shl r14d, 8
or r14d, eax
mov dword [rsp + 0x2c], r14d
cmp r14d, 1
jne 0x18002ef2d
mov ecx, ebx
add ebx, 4
add rcx, rdi
movzx eax, byte [rcx + 2]
movzx edx, byte [rcx + 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [rcx]
shl edx, 8
or edx, eax
mov eax, ebx
add rax, rdi
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x30], rax
add ebx, edx
jmp 0x18002efbc
mov qword [rsp + 0x70], rbp
mov ecx, r14d
shl rcx, 2
mov qword [rsp + 0x78], rsi
mov ebp, r14d
call fcn.18022c454
lea rcx, [r14*8]
mov qword [rsp + 0x38], rax
mov rsi, rax
call fcn.18022c454
mov qword [rsp + 0x30], rax
mov r8, rax
test r14d, r14d
je 0x18002efb2
nop dword [rax + rax]
movzx eax, byte [rbx + rdi + 2]
lea r8, [r8 + 8]
movzx edx, byte [rbx + rdi + 3]
lea rsi, [rsi + 4]
shl edx, 8
or edx, eax
movzx eax, byte [rbx + rdi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [rbx + rdi]
add ebx, 4
shl edx, 8
or edx, eax
mov eax, ebx
mov dword [rsi - 4], edx
add rax, rdi
mov qword [r8 - 8], rax
add ebx, dword [rsi - 4]
sub rbp, 1
jne 0x18002ef70
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movups xmm0, xmmword [rsp + 0x20]
mov r14, qword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x30]
mov ecx, ebx
add rcx, rdi
movzx eax, byte [rcx + 6]
movzx edx, byte [rcx + 7]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 5]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 4]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 3]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 2]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 1]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx]
shl rdx, 8
lea ecx, [rbx + 8]
or rdx, rax
add rcx, rdi
mov qword [r13], rdx
movzx eax, byte [rcx + 6]
movzx edx, byte [rcx + 7]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 5]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 4]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 3]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 2]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 1]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx]
shl rdx, 8
or rdx, rax
mov qword [r12], rdx
xor eax, eax
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm1
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, reloc.WS2_32.dll_shutdown
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rbx
ret