Function at 0x14011c420
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x38
xor eax, eax
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov rsi, qword [rcx]
mov ecx, dword [rcx + 8]
cmp ecx, 0x24
jne 0x14011c457
cmp word [rsi + 0x10], 0x2d
jne 0x14011c457
cmp word [rsi + 0x1a], 0x2d
jne 0x14011c457
cmp word [rsi + 0x24], 0x2d
jne 0x14011c457
cmp word [rsi + 0x2e], 0x2d
je 0x14011c47c
cmp ecx, 0x24
jne 0x14011c466
mov rcx, rbx
mov edx, 4
jmp 0x14011c46e
mov rcx, rbx
mov edx, 8
call fcn.140162340
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
movzx eax, word [rsi + 0xc]
movzx r9d, word [rsi + 0xe]
movzx edx, al
lea r8, [0x14007bd40]
add rdx, r8
movzx edx, byte [rdx]
movsx rdx, dl
movzx r8d, r9b
shl edx, 4
lea rcx, [0x14007bd40]
add r8, rcx
movzx r8d, byte [r8]
movsx r8, r8b
or edx, r8d
or eax, r9d
sar eax, 8
mov r9d, 0xffffffff
test eax, eax
cmovne edx, r9d
mov byte [rbx], dl
lea rax, [rbx + 1]
movzx r9d, word [rsi + 8]
movzx r8d, word [rsi + 0xa]
movzx ecx, r9b
lea r10, [0x14007bd40]
add rcx, r10
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
lea r11, [0x14007bd40]
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 2]
movzx r9d, word [rsi + 4]
movzx r8d, word [rsi + 6]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 3]
movzx r9d, word [rsi]
movzx r8d, word [rsi + 2]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 4]
movzx r9d, word [rsi + 0x16]
movzx r8d, word [rsi + 0x18]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 5]
movzx r9d, word [rsi + 0x12]
movzx r8d, word [rsi + 0x14]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 6]
movzx r9d, word [rsi + 0x20]
movzx r8d, word [rsi + 0x22]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 7]
movzx r9d, word [rsi + 0x1c]
movzx r8d, word [rsi + 0x1e]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 8]
movzx r9d, word [rsi + 0x26]
movzx r8d, word [rsi + 0x28]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 9]
movzx r9d, word [rsi + 0x2a]
movzx r8d, word [rsi + 0x2c]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 0xa]
movzx r9d, word [rsi + 0x30]
movzx r8d, word [rsi + 0x32]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 0xb]
movzx r9d, word [rsi + 0x34]
movzx r8d, word [rsi + 0x36]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 0xc]
movzx r9d, word [rsi + 0x38]
movzx r8d, word [rsi + 0x3a]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 0xd]
movzx r9d, word [rsi + 0x3c]
movzx r8d, word [rsi + 0x3e]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 0xe]
movzx r9d, word [rsi + 0x40]
movzx r8d, word [rsi + 0x42]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
lea rax, [rbx + 0xf]
movzx r9d, word [rsi + 0x44]
movzx r8d, word [rsi + 0x46]
movzx ecx, r9b
add rcx, r11
movzx ecx, byte [rcx]
movsx rcx, cl
movzx r10d, r8b
shl ecx, 4
add r10, r11
movzx r10d, byte [r10]
movsx r10, r10b
or ecx, r10d
or r9d, r8d
sar r9d, 8
mov r8d, 0xffffffff
test r9d, r9d
cmovne ecx, r8d
or edx, ecx
mov byte [rax], cl
test edx, edx
jl 0x14011c92d
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
ret
mov dword [rsp + 0x20], 0x24
mov r9d, 0x2b
mov edx, 0x58
mov r8d, pe_nt_image_headers64
mov rcx, rsi
call fcn.1401b9520
test eax, eax
jl 0x14011c97c
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x30], 0x24
lea rcx, [rsp + 0x28]
mov rdx, rbx
call fcn.14011d7c4
test eax, eax
je 0x14011c97c
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
ret
mov rcx, rbx
mov edx, 7
call fcn.140162340
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret