Function at 0x1400127f0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001282a
mov eax, 0xc0000001
jmp 0x140012a71
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x78]
cmp dword [rax + 0x3c], ecx
jb 0x140012842
mov eax, 0xc0000001
jmp 0x140012a71
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4550
je 0x140012872
mov eax, 0xc0000001
jmp 0x140012a71
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x48]
cmp qword [rsp + 0x38], rax
jb 0x1400128a0
mov eax, 0xc0000001
jmp 0x140012a71
mov dword [rsp + 0x30], 0
jmp 0x1400128b4
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x30], eax
jge 0x140012a6c
movsxd rax, dword [rsp + 0x30]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
lea rcx, [0x140013de0]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x1400128f8
inc rax
test dl, dl
jne 0x1400128e5
xor eax, eax
jmp 0x1400128fd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140012a67
movsxd rax, dword [rsp + 0x30]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax + 0x14]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rdx + rcx + 0x10]
add rax, rcx
cmp rax, qword [rsp + 0x48]
jb 0x140012948
mov eax, 0xc0000001
jmp 0x140012a71
lfence
movsxd rax, dword [rsp + 0x30]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax + 0x10]
movsxd rcx, dword [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rdx + rcx + 0x14]
mov rdx, qword [rsp + 0x70]
add rdx, rcx
mov rcx, rdx
movsxd rdx, dword [rsp + 0x30]
imul rdx, rdx, 0x28
mov r8, qword [rsp + 0x38]
mov edx, dword [r8 + rdx + 0xc]
add edx, 0x400000
mov edx, edx
mov qword [rsp + 0x58], rdx
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
movsxd rcx, dword [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rdx + rcx + 0x10]
cmp rax, rcx
jne 0x140012a60
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rsp + 0x50]
mov edx, 9
mov rcx, 0xfffffffffffffffe
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationThread]
test eax, eax
jne 0x140012a57
movsxd rax, dword [rsp + 0x30]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax + 0xc]
add eax, 0x400000
mov eax, eax
cmp qword [rsp + 0x50], rax
jb 0x140012a4e
movsxd rax, dword [rsp + 0x30]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax + 0xc]
movsxd rcx, dword [rsp + 0x30]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 0x38]
mov ecx, dword [rdx + rcx + 0x10]
lea eax, [rax + rcx + 0x400000]
mov eax, eax
cmp qword [rsp + 0x50], rax
jae 0x140012a4e
xor eax, eax
jmp 0x140012a71
mov eax, 0xc0000001
jmp 0x140012a71
mov eax, 0xc0000001
jmp 0x140012a71
mov eax, 0xc0000001
jmp 0x140012a71
jmp 0x1400128aa
mov eax, 0xc0000001
add rsp, 0x68
ret