Function at 0x14000f9e8
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x498
xor eax, eax
mov r13, rcx
and qword [rcx], rax
and dword [rcx + 8], eax
lea rcx, str.shell32.dll
mov dword [rsp + 0x4f8], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
jne 0x14000fa74
mov rdx, qword [0x14002eae0]
lea rcx, [rsp + 0x80]
add rdx, 0x272
call fcn.140001af4
lea rdx, str.shell32.dll
lea rcx, [rsp + 0x80]
call fcn.140001ab8
xor r8d, r8d
lea rcx, [rsp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
jne 0x14000fa74
mov eax, 0xc0000135
jmp 0x14000fae8
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x14000fae3
movzx edx, word [rax + 0x14]
movzx r8d, word [rax + 6]
add rdx, 0x18
add rdx, rax
test r8d, r8d
je 0x14000fae3
lea rdi, str..text
mov r9d, 6
mov rax, rdi
cmp rdx, rdi
je 0x14000fafc
test rdx, rdx
je 0x14000fad9
mov r10, rdx
sub r10, rdi
movsx ecx, byte [r10 + rax]
dec r9
movsx r11d, byte [rax]
inc rax
test cl, cl
je 0x14000fad4
cmp cl, r11b
jne 0x14000fad4
test r9, r9
jne 0x14000fab7
cmp ecx, r11d
je 0x14000fafc
add rdx, 0x28
add r8d, 0xffffffff
jne 0x14000fa9e
mov eax, 0xc0000141
add rsp, 0x498
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edi, dword [rdx + 0xc]
mov esi, dword [rdx + 8]
add rdi, rbx
je 0x14000fae3
test esi, esi
je 0x14000fae3
mov rax, qword [0x14002eae0]
lea rcx, [0x14002d860]
xor ebx, ebx
mov qword [rsp + 0x40], rcx
xor edx, edx
mov dword [rsp + 0x4f0], edx
mov r8d, dword [rax + 8]
mov dword [rsp + 0x30], r8d
mov rax, qword [rcx]
cmp r8d, dword [rax]
jb 0x14000fc3f
cmp r8d, dword [rax + 4]
ja 0x14000fc3f
mov r15, qword [rax + 0x10]
mov eax, dword [rax + 8]
and dword [rsp + 0x4e8], 0
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x2c], eax
test eax, eax
je 0x14000fc3a
mov edx, esi
mov qword [rsp + 0x20], rdx
mov rax, qword [r15]
mov rbp, rdx
mov r15, rdi
mov r14d, dword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x4f8], r14d
test r14d, r14d
je 0x14000fbff
cmp rdx, r14
jb 0x14000fbff
movzx eax, byte [rcx]
mov dword [rsp + 0x28], eax
mov r8, rbp
mov edx, eax
mov rcx, r15
call fcn.14001a2f0
mov rbx, rax
test rax, rax
je 0x14000fbfa
sub r15, rax
add rbp, r15
cmp rbp, r14
jb 0x14000fbfa
mov rdx, qword [rsp + 0x48]
mov r8, r14
mov rcx, rax
call fcn.14001a210
test eax, eax
je 0x14000fbe1
lea r15, [rbx + 1]
sub rbp, 1
je 0x14000fbfa
mov eax, dword [rsp + 0x28]
jmp 0x14000fb9d
mov rdx, qword [rsp + 0x20]
mov ecx, esi
cmp rbx, rdi
jb 0x14000fbf6
lea rax, [rdx + rdi]
cmp rbx, rax
jbe 0x14000fc5f
mov esi, ecx
jmp 0x14000fbff
mov rdx, qword [rsp + 0x20]
mov eax, dword [rsp + 0x4e8]
xor ebx, ebx
mov r15, qword [rsp + 0x38]
inc eax
add r15, 8
mov dword [rsp + 0x4e8], eax
mov qword [rsp + 0x38], r15
cmp eax, dword [rsp + 0x2c]
jb 0x14000fb6f
mov rcx, qword [rsp + 0x40]
mov edx, dword [rsp + 0x4f0]
mov r8d, dword [rsp + 0x30]
test rbx, rbx
jne 0x14000fc5f
inc edx
add rcx, 8
mov dword [rsp + 0x4f0], edx
mov qword [rsp + 0x40], rcx
cmp edx, 0xb
jb 0x14000fb32
test rbx, rbx
je 0x14000fcdb
mov eax, dword [rsp + 0x4f8]
test eax, eax
je 0x14000fcdb
add rbx, rax
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400010f0
test dword [rsp + 0x71], 0x1000
je 0x14000fc8e
mov eax, 0xc00000e5
jmp 0x14000fae8
cmp byte [rsp + 0x50], 5
jne 0x14000fcd1
cmp byte [rbx], 0xe8
jne 0x14000fcd1
movsxd rcx, dword [rbx + 1]
add rcx, 5
add rcx, rbx
cmp rcx, rdi
jb 0x14000fcc7
mov eax, esi
add rax, rdi
cmp rcx, rax
ja 0x14000fcc7
mov qword [r13], rcx
xor eax, eax
mov dword [r13 + 8], 1
jmp 0x14000fae8
mov eax, 0xc0000018
jmp 0x14000fae8
mov eax, 0xc000090b
jmp 0x14000fae8
mov eax, 0xc0000225
jmp 0x14000fae8