Function at 0x10029ab4
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov r12d, r9d
mov r11d, r8d
mov rdi, rdx
mov r13, rcx
mov eax, dword [rdx]
mov dword [rcx], eax
cmp eax, 0x454c4946
je 0x10029b06
cmp eax, 2
jbe 0x10029afa
cmp eax, 0x44414142
je 0x10029afa
xor ebx, ebx
jmp 0x10029aff
mov ebx, 1
mov al, bl
jmp 0x10029e8f
movzx r9d, word [rdx + 4]
movzx r8d, word [rdx + 6]
test r9b, 1
jne 0x10029e8d
lea edx, [r9 + r8*2]
mov ecx, r11d
mov eax, 1
shl eax, cl
sub eax, 2
cmp edx, eax
ja 0x10029e8d
xor ebx, ebx
cmp r8d, ebx
je 0x10029e8d
lea eax, [r8 - 1]
cmp eax, r12d
jne 0x10029e8d
movzx ebp, word [r9 + rdi]
lea edx, [rbx + 1]
cmp r8d, edx
jbe 0x10029b8a
lea r10, [r9 + rdi + 2]
mov ecx, r11d
mov eax, edx
shl eax, cl
mov ecx, eax
cmp word [rax + rdi - 2], bp
jne 0x10029b83
movzx eax, word [r10]
mov word [rcx + rdi - 2], ax
inc edx
add r10, 2
cmp edx, r8d
jb 0x10029b5d
jmp 0x10029b8a
xor al, al
jmp 0x10029e8f
movzx eax, word [rdi + 0x10]
mov word [r13 + 4], ax
movzx r15d, word [rdi + 0x14]
movzx eax, word [rdi + 0x16]
mov word [r13 + 6], ax
mov edx, dword [rdi + 0x18]
mov r8d, dword [rdi + 0x1c]
mov rax, qword [rdi + 0x20]
mov qword [r13 + 8], rax
cmp r9d, 0x30
jb 0x10029bc9
mov eax, dword [rsp + 0x120]
cmp dword [rdi + 0x2c], eax
je 0x10029bc9
xor al, al
jmp 0x10029e8f
mov ecx, r11d
shl r12d, cl
cmp r15d, r12d
jae 0x10029e89
test r15b, 7
jne 0x10029e89
cmp edx, r12d
ja 0x10029e89
cmp r8d, r12d
jne 0x10029e89
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x54], ebx
mov edx, 3
lea rcx, [rsp + 0x48]
call fcn.1000178c
lea r11, [0x100fafe8]
mov qword [rsp + 0x58], r11
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
mov ebp, r12d
sub ebp, r15d
mov edx, r15d
add rdx, rdi
mov r8d, ebp
lea rcx, [rsp + 0x40]
call fcn.10027594
cmp eax, ebx
je 0x10029e6d
cmp ebp, eax
jb 0x10029e6d
add r15d, eax
mov eax, dword [rsp + 0x40]
cmp eax, 0xffffffff
je 0x10029e1e
sub eax, 0x10
je 0x10029dc3
sub eax, 0x20
je 0x10029d24
sub eax, 0x50
je 0x10029cd5
mov r14, qword [rsp + 0x128]
cmp r14, rbx
je 0x10029dfd
mov ecx, 0x68
call fcn.10002fd0
mov qword [rsp + 0x100], rax
cmp rax, rbx
je 0x10029cb0
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.100289f0
mov rbp, rax
jmp 0x10029cb3
mov rbp, rbx
mov rcx, r14
call fcn.10001a24
movsxd rcx, dword [r14 + 0xc]
mov rax, qword [r14 + 0x10]
mov qword [rax + rcx*8], rbp
inc dword [r14 + 0xc]
mov rbp, qword [rsp + 0x68]
jmp 0x10029e02
mov ecx, 0x68
call fcn.10002fd0
mov qword [rsp + 0x100], rax
cmp rax, rbx
je 0x10029cfe
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.100289f0
mov r14, rax
jmp 0x10029d01
mov r14, rbx
lea rcx, [r13 + 0x18]
call fcn.10001a24
movsxd rcx, dword [r13 + 0x24]
mov rax, qword [r13 + 0x28]
mov qword [rax + rcx*8], r14
inc dword [r13 + 0x24]
mov rbp, qword [rsp + 0x68]
jmp 0x10029e02
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
mov edx, 3
lea rcx, [rsp + 0x28]
call fcn.1000178c
nop
mov r8d, dword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.100273a0
cmp al, bl
je 0x10029e34
mov ecx, 0x20
call fcn.10002fd0
mov qword [rsp + 0x100], rax
cmp rax, rbx
je 0x10029d8e
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.10027158
mov qword [rsp + 0x100], rax
jmp 0x10029d96
mov qword [rsp + 0x100], rbx
lea rcx, [r13 + 0x38]
call fcn.10001a24
movsxd rcx, dword [r13 + 0x44]
mov rax, qword [r13 + 0x48]
mov rdx, qword [rsp + 0x100]
mov qword [rax + rcx*8], rdx
inc dword [r13 + 0x44]
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
jmp 0x10029e02
cmp dword [rsp + 0x60], 0x24
jb 0x10029e55
mov rbp, qword [rsp + 0x68]
mov rax, qword [rbp]
mov qword [r13 + 0x78], rax
mov rax, qword [rbp + 8]
mov qword [r13 + 0x80], rax
mov rax, qword [rbp + 0x18]
mov qword [r13 + 0x88], rax
mov eax, dword [rbp + 0x20]
mov dword [r13 + 0x90], eax
jmp 0x10029e02
mov rbp, qword [rsp + 0x68]
mov rcx, rbp
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
cmp r15d, r12d
jae 0x10029e85
jmp 0x10029bf4
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
jmp 0x10029e85
mov rcx, qword [rsp + 0x28]
call sub.msvcrt.dll_free
nop
mov rcx, rbp
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
xor al, al
jmp 0x10029e8f
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
xor al, al
jmp 0x10029e8f
mov rcx, qword [rsp + 0x68]
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x48]
call sub.msvcrt.dll_free
xor al, al
jmp 0x10029e8f
mov al, 1
jmp 0x10029e8f
xor al, al
jmp 0x10029e8f
xor al, al
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret