Function at 0x407650
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push rbp
xor r8d, r8d
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
mov rsi, rcx
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x2b0
movsxd r14, dword [rcx + 0x3c]
lea rdx, [rsp + 0x70]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x70], 0
lea rdi, [rcx + r14]
mov rcx, 0xffffffffffffffff
mov eax, dword [rdi + 0x50]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x68], rax
call fcn.00409d20
mov ebx, eax
mov dword [rsp + 0x40], eax
xor eax, eax
test ebx, ebx
jne 0x4079a2
mov rcx, qword [rsp + 0x70]
mov r8d, dword [rdi + 0x54]
mov rdx, rsi
mov rax, rcx
sub rax, qword [rdi + 0x30]
mov qword [rsp + 0x58], rax
call fcn.00407c90
mov rax, rdi
lea rdi, [rdi + 0x18]
mov r12, qword [rsp + 0x48]
movzx ebx, word [rax + 0x14]
mov qword [rsp + 0x38], rdi
add rbx, rdi
xor edi, edi
cmp word [rax + 6], 0
je 0x40772c
mov edx, dword [rbx + 0x14]
mov r8d, dword [rbx + 0x10]
add rdi, 1
add rbx, 0x28
mov ecx, dword [rbx - 0x1c]
add rcx, qword [rsp + 0x70]
add rdx, rsi
call fcn.00407c90
movzx eax, word [r12 + 6]
cmp rax, rdi
ja 0x407702
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x70]
xor ebx, ebx
lea r12, [rsp + 0xa0]
mov edi, dword [rax + 0xb4]
mov eax, dword [rax + 0xb0]
add rax, rdx
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x50], rax
test edi, edi
je 0x407831
mov rsi, qword [rsp + 0x50]
mov r13d, ebx
lea r10d, [rbx + 8]
mov rcx, r10
add r13, rsi
add r10, rsi
mov eax, dword [r13 + 4]
sub rax, 8
shr rax, 1
test eax, eax
je 0x4079b3
sub eax, 1
lea esi, [rbx + 0xa]
mov r15, r10
lea rdi, [r10 + rax*2 + 2]
sub esi, r10d
nop dword [rax]
lea ebx, [rsi + r15]
test byte [r15 + 1], 0xf0
je 0x40781a
movzx r10d, word [r15]
mov r9d, 8
mov r8, r12
mov rcx, 0xffffffffffffffff
and r10d, 0xfff
mov r14d, r10d
add r14d, dword [r13]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0xa0], 0
add rdx, r14
call fcn.0040a8a0
test eax, eax
jne 0x4079a0
mov rcx, qword [rsp + 0x70]
mov rdx, r12
mov r8d, 8
mov rax, qword [rsp + 0x58]
add qword [rsp + 0xa0], rax
add rcx, r14
call fcn.00407c90
mov rdx, qword [rsp + 0x70]
add r15, 2
cmp rdi, r15
jne 0x4077a0
cmp dword [rsp + 0x44], ebx
ja 0x407760
mov qword [rsp + 0x78], 0
mov rax, qword [rsp + 0x48]
mov edi, dword [rax + 0x90]
add rdi, rdx
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x4079c4
lea rsi, [rsp + 0x64]
lea r14, [rsp + 0x90]
mov rbx, qword [0x004113e0]
lea r12, [rsp + 0xa0]
mov qword [rsp + 0x50], rsi
lea r13, [rsp + 0x80]
mov qword [rsp + 0x58], r14
jmp 0x407897
add rdi, 0x14
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x4079c4
mov rdx, qword [rsp + 0x70]
mov esi, eax
mov rax, qword [rbx]
add rsi, rdx
mov rcx, rsi
mov r15, qword [rax + 0x130]
call fcn.00409b70
mov r9, rsi
mov r8, qword [rsp + 0x50]
mov rcx, r12
add eax, 1
mov edx, 0x208
mov dword [rsp + 0x20], eax
call r15
test eax, eax
jne 0x4079a0
mov rax, qword [rbx]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x128]
mov rax, qword [rbx]
xor edx, edx
xor ecx, ecx
lea r9, [rsp + 0x78]
mov r8, r13
call qword [rax + pe_nt_image_headers64]
test eax, eax
jne 0x4079a0
cmp qword [rsp + 0x78], 0
je 0x407883
mov edx, dword [rdi + 0x10]
mov r15, qword [rsp + 0x70]
mov esi, dword [rdi]
add r15, rdx
mov rax, qword [r15]
sub rsi, rdx
test rax, rax
je 0x407883
mov r14, r15
jmp 0x407954
mov rax, qword [rbx]
movzx r8d, word [rdx]
mov r9, r14
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [rax + 0x68]
add r14, 8
mov rax, qword [r14]
test rax, rax
je 0x407883
lea rdx, [r14 + rsi]
test rax, rax
js 0x407930
add rax, qword [rsp + 0x70]
lea r15, [rax + 2]
mov rcx, r15
call fcn.00409b70
mov r9, r14
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov word [rsp + 0x90], ax
mov rcx, qword [rsp + 0x78]
mov word [rsp + 0x92], ax
mov rax, qword [rbx]
mov qword [rsp + 0x98], r15
call qword [rax + 0x68]
jmp 0x407944
xor eax, eax
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ebx, ecx
cmp dword [rsp + 0x44], ebx
ja 0x407760
jmp 0x407831
mov rax, qword [rsp + 0x48]
movzx ebx, word [rax + 0x14]
add rbx, qword [rsp + 0x38]
cmp word [rax + 6], 0
je 0x407b02
lea r12, [rsp + 0x90]
lea rsi, [rsp + 0x64]
mov r14, rax
mov r13d, dword [rsp + 0x40]
lea rdi, [rsp + 0xa0]
jmp 0x407a74
test eax, eax
js 0x407a8c
mov dword [rsp + 0x64], 1
mov r9d, 1
test eax, 0x4000000
je 0x407a25
or r9d, 0x200
mov dword [rsp + 0x64], r9d
mov eax, edx
mov r8, r12
mov rdx, rdi
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x90], rax
mov eax, dword [rbx + 0xc]
mov qword [rsp + 0x20], rsi
add rax, qword [rsp + 0x70]
mov qword [rsp + 0xa0], rax
call fcn.0040a440
test eax, eax
jne 0x4079a0
movzx eax, word [r14 + 6]
add r13d, 1
add rbx, 0x28
cmp eax, r13d
jle 0x407b02
mov edx, dword [rbx + 0x10]
test edx, edx
je 0x407a5e
mov eax, dword [rbx + 0x24]
mov ecx, eax
and ecx, 0x60000000
je 0x4079fc
mov r10d, eax
mov r11d, eax
and r10d, 0x20000000
setne r9b
and r11d, 0x40000000
setne r8b
test ecx, ecx
jne 0x407ad9
test eax, eax
js 0x407b7d
test r10d, r10d
jne 0x407b90
test r8b, r8b
je 0x407b90
mov dword [rsp + 0x64], 2
mov r9d, 2
jmp 0x407a12
test r10d, r10d
jne 0x407bb4
test r8b, r8b
je 0x407bb4
test eax, eax
jns 0x407ac6
mov dword [rsp + 0x64], 4
mov r9d, 4
jmp 0x407a12
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call fcn.0040a110
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0xd4]
test eax, eax
je 0x407bad
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
mov eax, dword [rax + 0xd0]
mov rbx, qword [rax + rcx + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x407b5e
add rbx, 8
xor r8d, r8d
mov edx, 1
call rax
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x70]
test rax, rax
jne 0x407b43
mov rax, qword [rsp + 0x48]
xor r8d, r8d
mov edx, 1
mov eax, dword [rax + 0x28]
add rax, rcx
call rax
mov rax, qword [rsp + 0x70]
jmp 0x4079a2
mov dword [rsp + 0x64], 8
mov r9d, 8
jmp 0x407a12
test r11d, r11d
jne 0x407bf6
test r9b, r9b
je 0x407c00
mov dword [rsp + 0x64], 0x10
mov r9d, 0x10
jmp 0x407a12
mov rcx, qword [rsp + 0x70]
jmp 0x407b5e
test r11d, r11d
jne 0x407bd5
test r9b, r9b
je 0x407c00
test eax, eax
jns 0x407b9a
mov dword [rsp + 0x64], pe_nt_image_headers64
mov r9d, pe_nt_image_headers64
jmp 0x407a12
test r9b, r9b
je 0x407c00
test r8b, r8b
je 0x407c00
test eax, eax
jns 0x407c10
mov dword [rsp + 0x64], 0x40
mov r9d, 0x40
jmp 0x407a12
test r9b, r9b
je 0x407c00
test r8b, r8b
jne 0x407c10
mov dword [rsp + 0x64], 0
xor r9d, r9d
jmp 0x407a12
mov dword [rsp + 0x64], 0x20
mov r9d, 0x20
jmp 0x407a12