Function at 0x140040e60
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov r15, qword [rdx]
mov r12, qword [rdx + 0x10]
mov esi, dword [rdx + 0x18]
movzx eax, byte [r15 + 4]
movzx ebx, byte [r15 + 0x11]
mov rdi, rcx
movzx ecx, byte [r15 + 5]
movsxd r14, dword [rdi + 0x34]
mov dword [rsp + 0x88], eax
mov eax, ecx
mov r13d, ecx
and ecx, 4
mov dword [rsp + 0x24], ecx
movzx ecx, byte [r15 + 0xd]
and eax, 1
shl rcx, 8
mov dword [rsp + 0x20], eax
movzx eax, byte [r15 + 0xc]
or rcx, rax
movzx eax, byte [r15 + 0xb]
shl ebx, 8
shl rcx, 8
xor ebp, ebp
and r13d, 2
or rcx, rax
movzx eax, byte [r15 + 0xa]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 9]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 6]
shl rcx, 8
or rcx, rax
movzx eax, byte [r15 + 0x10]
or ebx, eax
movzx eax, byte [r15 + 0xf]
mov qword [rsp + 0x28], rcx
movzx ecx, byte [r15 + 0x15]
shl ebx, 8
or ebx, eax
movzx eax, byte [r15 + 0xe]
shl ecx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [r15 + 0x14]
or ecx, eax
movzx eax, byte [r15 + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [r15 + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [r15 + 0x1a]
mov dword [rsp + 0x90], eax
movsxd rax, dword [rdi + 0x10]
mov dword [rsp + 0x98], ecx
test eax, eax
je 0x140040f83
sub dword [rdi + 0xc], eax
je 0x140040f80
mov rcx, qword [rdi]
movsxd r8, dword [rdi + 0xc]
lea rdx, [rcx + rax]
call sub.msvcrt.dll_memmove
mov dword [rdi + 0x10], ebp
test r14d, r14d
je 0x140040fc9
mov eax, dword [rdi + 0x2c]
sub eax, r14d
je 0x140040fbe
mov rcx, qword [rdi + 0x18]
movsxd r8, eax
lea rdx, [rcx + r14*4]
shl r8, 2
call sub.msvcrt.dll_memmove
mov eax, dword [rdi + 0x2c]
mov rcx, qword [rdi + 0x20]
sub eax, r14d
lea rdx, [rcx + r14*8]
movsxd r8, eax
shl r8, 3
call sub.msvcrt.dll_memmove
sub dword [rdi + 0x2c], r14d
sub dword [rdi + 0x30], r14d
mov dword [rdi + 0x34], ebp
cmp ebx, dword [rdi + 0x160]
je 0x140040fd9
or eax, 0xffffffff
jmp 0x1400411da
cmp dword [rsp + 0x88], ebp
jg 0x140040fd1
movsxd rbx, dword [rsp + 0x90]
mov eax, dword [rdi + 0x2c]
mov r8d, dword [rdi + 0x28]
lea ecx, [rbx + rax + 1]
cmp r8d, ecx
jg 0x14004102b
mov rcx, qword [rdi + 0x18]
lea eax, [r8 + rbx + 0x21]
movsxd rdx, eax
mov dword [rdi + 0x28], eax
shl rdx, 2
call sub.msvcrt.dll_realloc
movsxd rdx, dword [rdi + 0x28]
mov rcx, qword [rdi + 0x20]
shl rdx, 3
mov qword [rdi + 0x18], rax
call sub.msvcrt.dll_realloc
mov qword [rdi + 0x20], rax
mov r10d, dword [rdi + 0x164]
mov r14d, dword [rsp + 0x98]
cmp r14d, r10d
je 0x140041090
movsxd r9, dword [rdi + 0x30]
mov rcx, r9
cmp r9d, dword [rdi + 0x2c]
jge 0x140041074
mov rax, qword [rdi + 0x18]
mov edx, dword [rdi + 0xc]
lea r8, [rax + r9*4]
nop word [rax + rax]
movzx eax, byte [r8]
inc ecx
add r8, 4
sub edx, eax
mov dword [rdi + 0xc], edx
cmp ecx, dword [rdi + 0x2c]
jl 0x140041060
mov dword [rdi + 0x2c], r9d
cmp r10d, 0xffffffff
je 0x140041090
mov rax, qword [rdi + 0x18]
mov dword [rax + r9*4], 0x400
inc dword [rdi + 0x2c]
inc dword [rdi + 0x30]
cmp dword [rsp + 0x20], ebp
je 0x1400410dd
movsxd rax, dword [rdi + 0x2c]
cmp eax, 1
jl 0x1400410b0
mov rcx, rax
mov rax, qword [rdi + 0x18]
cmp dword [rax + rcx*4 - 4], 0x400
jne 0x1400410dd
xor r13d, r13d
xor edx, edx
test rbx, rbx
jle 0x1400410dd
nop word [rax + rax]
movzx ecx, byte [r15 + rdx + 0x1b]
inc ebp
add r12, rcx
sub esi, ecx
cmp ecx, 0xff
jl 0x1400410dd
inc rdx
cmp rdx, rbx
jl 0x1400410c0
test esi, esi
je 0x14004111b
mov eax, dword [rdi + 0xc]
mov edx, dword [rdi + 8]
lea ecx, [rsi + rax]
cmp edx, ecx
jg 0x140041106
mov rcx, qword [rdi]
lea eax, [rdx + rsi + 0x400]
movsxd rdx, eax
mov dword [rdi + 8], eax
call sub.msvcrt.dll_realloc
mov qword [rdi], rax
movsxd rcx, dword [rdi + 0xc]
movsxd r8, esi
mov rdx, r12
add rcx, qword [rdi]
call sub.msvcrt.dll_memcpy
add dword [rdi + 0xc], esi
movsxd rdx, ebp
or r9d, 0xffffffff
cmp rdx, rbx
jge 0x1400411a6
nop word [rax + rax]
movsxd rcx, dword [rdi + 0x2c]
mov rax, qword [rdi + 0x18]
movzx r8d, byte [r15 + rdx + 0x1b]
mov dword [rax + rcx*4], r8d
movsxd rcx, dword [rdi + 0x2c]
mov rax, qword [rdi + 0x20]
mov qword [rax + rcx*8], 0xffffffffffffffff
test r13d, r13d
je 0x140041169
movsxd rcx, dword [rdi + 0x2c]
mov rax, qword [rdi + 0x18]
or dword [rax + rcx*4], 0x100
xor r13d, r13d
cmp r8d, 0xff
jge 0x140041176
mov r9d, dword [rdi + 0x2c]
inc dword [rdi + 0x2c]
mov eax, dword [rdi + 0x2c]
inc rdx
cmp r8d, 0xff
jge 0x14004118b
mov dword [rdi + 0x30], eax
cmp rdx, rbx
jl 0x140041130
cmp r9d, 0xffffffff
je 0x1400411a6
mov rax, qword [rdi + 0x20]
mov rdx, qword [rsp + 0x28]
movsxd rcx, r9d
mov qword [rax + rcx*8], rdx
cmp dword [rsp + 0x24], 0
je 0x1400411ce
movsxd rax, dword [rdi + 0x2c]
mov dword [rdi + 0x158], 1
test eax, eax
jle 0x1400411ce
mov rcx, rax
mov rax, qword [rdi + 0x18]
or dword [rax + rcx*4 - 4], 0x200
lea eax, [r14 + 1]
mov dword [rdi + 0x164], eax
xor eax, eax
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret