Function at 0x140001800
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov r15, rcx
mov edi, r8d
mov ecx, 0x6870a8f
mov r14, rdx
call fcn.1400014a0
mov ecx, 0x3e8557
mov rbx, rax
call fcn.1400014a0
mov edx, 0x3fb260df
mov rcx, rax
call fcn.140001540
mov edx, 0x38ec8d55
mov rcx, rbx
mov r12, rax
call fcn.140001540
movsxd rbx, dword [r14 + 0x3c]
lea rdx, [rsp + 0x40]
add rbx, r14
mov qword [rsp + 0x30], rax
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rbx + 0x18]
movzx eax, word [rbx + 0x14]
lea rcx, [rbx + 0x98]
movups xmm1, xmmword [rbx + 0x28]
add rax, 0x18
movups xmmword [rdx - 0x80], xmm0
add rax, rbx
movups xmm0, xmmword [rbx + 0x38]
mov qword [rsp + 0x130], rax
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rbx + 0x48]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rbx + 0x58]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rbx + 0x68]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rbx + 0x78]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx]
movups xmmword [rdx - 0x20], xmm0
movups xmm0, xmmword [rbx + 0x88]
movups xmmword [rdx - 0x10], xmm0
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm1
movups xmm1, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm0
movups xmm0, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm1
movups xmm1, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm0
movups xmm0, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm1
movups xmm1, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm0
movups xmmword [rdx + 0x60], xmm1
mov ebp, dword [rsp + 0x78]
mov ecx, ebp
call fcn.140001c84
mov r13, rax
test edi, edi
je 0x140001972
mov r9d, 4
mov r8d, 0x1000
mov edx, ebp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor esi, esi
mov r9d, ebp
mov r8, rax
mov qword [rsp + 0x20], rsi
mov rdx, r14
mov rcx, r15
mov rbx, rax
call r12
mov r8, qword [rsp + 0x130]
mov rdx, rbx
mov rcx, r14
call fcn.1400013a0
test eax, eax
sete sil
mov eax, esi
jmp 0x140001acc
xor esi, esi
mov r9, rbp
mov r8, r13
mov qword [rsp + 0x20], rsi
mov rdx, r14
mov rcx, r15
call r12
test eax, eax
je 0x1400019a7
mov edx, eax
lea rcx, str.Error:_NtReadVirtualMemoryCustom_failed_with_error_code__d_n
call fcn.140001070
mov rcx, r13
call fcn.140002a78
jmp 0x140001ac7
movzx r8d, word [rbx + 6]
movzx edx, si
cmp si, r8w
jae 0x140001abb
movzx r9d, word [rbx + 0x14]
lea r10, str..text
nop word [rax + rax]
movzx eax, dx
lea rcx, [rax + rax*4]
mov rax, rsi
lea rdi, [r9 + rcx*8]
add rdi, rbx
movzx ecx, byte [rdi + rax + 0x18]
inc rax
cmp cl, byte [r10 + rax - 1]
jne 0x140001aae
cmp rax, 6
jne 0x1400019e1
mov dword [rsp + 0x130], esi
lea r9, [rsp + 0x130]
mov ecx, dword [rdi + 0x24]
lea r8d, [rax + 0x3a]
mov edx, dword [rdi + 0x20]
add rcx, r14
call qword [rsp + 0x30]
mov eax, dword [rdi + 0x24]
mov ebp, dword [rdi + 0x20]
lea r15, [rax - 0x400]
lea rsi, [rbp + 0x3ff]
shr rsi, 0xa
lea r12, [rax - 0x400]
test rsi, rsi
je 0x140001a84
mov ebx, 0x400
nop dword [rax]
nop word [rax + rax]
cmp rbx, rbp
lea rdx, [r15 + r13]
mov r8, rbx
lea rcx, [r12 + r14]
cmovae r8, rbp
add rdx, rbx
sub r8, rbx
add rcx, rbx
add r8, 0x400
call sub.VCRUNTIME140.dll_memcpy
add rbx, 0x400
sub rsi, 1
jne 0x140001a50
mov ecx, dword [rdi + 0x24]
lea r9, [rsp + 0x130]
mov edx, dword [rdi + 0x20]
add rcx, r14
mov r8d, dword [rsp + 0x130]
call qword [rsp + 0x30]
test eax, eax
jne 0x140001af7
lea rcx, str.____Failed_to_restore_memory_protection_for_DLL._n
jmp 0x140001ac2
inc dx
cmp dx, r8w
jb 0x1400019d0
lea rcx, str.____Failed_to_find_.text_section_of_DLL._n
call fcn.140001070
mov eax, 1
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140001c60
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, r13
call fcn.140002a78
xor eax, eax
jmp 0x140001acc