Function at 0x14004f450
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x18], r8b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
movzx edi, r8b
mov r13, rdx
mov r14, rcx
test rdx, rdx
je 0x14004f910
mov eax, 0xffff
mov word [rsp + 0x1a8], ax
cmp rdx, rax
jae 0x14004f49b
mov word [rsp + 0x1a8], dx
jmp 0x14004f4c1
cmp byte [rdx], 0x23
jne 0x14004f4c1
lea rcx, [rdx + 1]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
lea ecx, [rax - 1]
cmp ecx, 0xfffd
ja 0x14004f4c1
mov word [rsp + 0x1a8], ax
movzx r13d, ax
test r14, r14
je 0x14004f910
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x14004f910
movsxd rcx, dword [r14 + 0x3c]
cmp dword [r14 + rcx], 0x4550
lea r15, [r14 + rcx]
jne 0x14004f910
xor r10d, r10d
mov dword [rsp + 0x40], r10d
mov dword [rsp + 0x1b8], r10d
test ecx, ecx
jle 0x14004f515
cmp ecx, 0x10000000
jae 0x14004f515
lea rdx, [r15 + 4]
lea r9, [r15 + 0x18]
jmp 0x14004f51c
lea r9, [r14 + 0x14]
mov rdx, r14
movzx ecx, word [r9]
sub ecx, 0x107
je 0x14004f910
sub ecx, 4
je 0x14004f549
cmp ecx, 0x100
jne 0x14004f910
cmp dword [r9 + 0x6c], r10d
jbe 0x14004f597
lea rax, [r9 + 0x70]
jmp 0x14004f553
cmp dword [r9 + 0x5c], r10d
jbe 0x14004f597
lea rax, [r9 + 0x60]
cmp dword [rax], r10d
je 0x14004f597
cmp dword [rax + 4], r10d
je 0x14004f597
mov qword [rsp + 0x30], r9
lea r8, [rsp + 0x1b8]
mov r9d, dword [r9 + 0x3c]
mov rcx, r14
mov qword [rsp + 0x28], rdx
movzx edx, dil
mov qword [rsp + 0x20], rax
call fcn.14004f930
mov r10d, dword [rsp + 0x1b8]
mov rbp, rax
mov dword [rsp + 0x40], r10d
jmp 0x14004f599
xor ebp, ebp
test rbp, rbp
je 0x14004f910
test r10d, r10d
je 0x14004f910
mov ecx, dword [rbp + 0x14]
test ecx, ecx
je 0x14004f910
cmp r10d, 0x28
ja 0x14004f5da
mov eax, dword [rbp + 0x18]
cmp ecx, eax
cmova eax, ecx
imul r10d, eax, 0xff
add r10d, dword [rbp + 0x24]
sub r10d, ebp
add r10d, r14d
mov dword [rsp + 0x40], r10d
movzx ecx, byte [rsp + 0x1b0]
mov r8d, dword [rbp + 0x20]
mov ebx, dword [rbp + 0x1c]
mov edi, dword [rbp + 0x24]
test cl, cl
je 0x14004f60a
lea rdx, [r14 + r8]
add rbx, r14
mov qword [rsp + 0x1b8], rdx
lea rax, [r14 + rdi]
mov qword [rsp + 0x48], rbx
jmp 0x14004f651
mov rdx, r14
mov rcx, r15
call fcn.14004fa00
mov r8d, ebx
mov qword [rsp + 0x1b8], rax
mov rdx, r14
mov rcx, r15
call fcn.14004fa00
mov r8d, edi
mov qword [rsp + 0x48], rax
mov rdx, r14
mov rcx, r15
mov rbx, rax
call fcn.14004fa00
movzx ecx, byte [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1b8]
xor r12d, r12d
mov qword [rsp + 0x50], rax
cmp dword [rbp + 0x14], r12d
jbe 0x14004f910
nop dword [rax]
nop word [rax + rax]
movzx esi, word [rax + r12*2]
mov ebx, dword [rbx + rsi*4]
test ebx, ebx
je 0x14004f8a6
mov r9d, dword [rdx + r12*4]
test cl, cl
je 0x14004f7cf
lea rdi, [r14 + rbx]
lea r10, [r14 + r9]
cmp rdi, rbp
jbe 0x14004f866
mov eax, dword [rsp + 0x40]
add rax, rbp
cmp rdi, rax
jae 0x14004f866
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14004f6b4
inc ebx
cmp ebx, 0x100
jae 0x14004f8a6
mov r8d, ebx
lea rcx, [rsp + 0x60]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
test ebx, ebx
je 0x14004f8a6
lea rcx, [rsp + 0x60]
nop word [rax + rax]
cmp byte [rcx], 0x2e
lea edx, [rax + 1]
je 0x14004f706
inc rcx
mov eax, edx
cmp edx, ebx
jb 0x14004f6f0
jmp 0x14004f8a6
mov ebx, edx
mov byte [rsp + rax + 0x60], 0
add rbx, rdi
je 0x14004f8a6
cmp byte [rbx], 0x23
jne 0x14004f781
lea rcx, [rbx + 1]
test rcx, rcx
je 0x14004f8a6
movzx edi, word [rsp + 0x1a8]
mov eax, 0xffff
cmp di, ax
jae 0x14004f8a6
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ebx, eax
lea ecx, [rbx - 1]
cmp ecx, 0xfffe
ja 0x14004f8a6
cmp ebx, edi
jne 0x14004f8a6
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movzx r8d, byte [rsp + 0x1b0]
mov rcx, rax
movzx edx, bx
call fcn.14004f450
jmp 0x14004f912
mov r8, rbx
mov rax, r13
sub r8, r13
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14004f7a3
inc rax
test ecx, ecx
jne 0x14004f790
test edx, edx
jne 0x14004f8a6
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movzx r8d, byte [rsp + 0x1b0]
mov rdx, rbx
mov rcx, rax
call fcn.14004f450
jmp 0x14004f912
movzx r10d, word [r15 + 6]
test r10d, r10d
je 0x14004f816
movzx r11d, word [r15 + 0x14]
xor edx, edx
add r11, 0x18
add r11, r15
test r10d, r10d
je 0x14004f816
nop dword [rax]
lea rcx, [rdx + rdx*4]
lea r8, [r11 + rcx*8]
mov ecx, dword [r11 + rcx*8 + 0xc]
cmp r9d, ecx
jb 0x14004f80f
add ecx, dword [r8 + 0x10]
cmp r9d, ecx
jb 0x14004f8ce
inc edx
cmp edx, r10d
jb 0x14004f7f0
xor r10d, r10d
movzx r9d, word [r15 + 6]
test r9d, r9d
je 0x14004f864
movzx r11d, word [r15 + 0x14]
xor edx, edx
add r11, 0x18
add r11, r15
test r9d, r9d
je 0x14004f864
nop word [rax + rax]
lea rcx, [rdx + rdx*4]
lea r8, [r11 + rcx*8]
mov ecx, dword [r11 + rcx*8 + 0xc]
cmp ebx, ecx
jb 0x14004f85d
add ecx, dword [r8 + 0x10]
cmp ebx, ecx
jb 0x14004f8ed
inc edx
cmp edx, r9d
jb 0x14004f840
xor edi, edi
mov eax, 0xffff
cmp r13, rax
jbe 0x14004f897
mov rax, r13
sub r10, r13
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x14004f893
inc rax
test ecx, ecx
jne 0x14004f880
test edx, edx
je 0x14004f90b
movzx eax, word [rsp + 0x1a8]
lea ecx, [rsi + 1]
cmp ecx, eax
je 0x14004f90b
inc r12d
cmp r12d, dword [rbp + 0x14]
jae 0x14004f910
movzx ecx, byte [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1b8]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x50]
jmp 0x14004f670
test r8, r8
je 0x14004f816
sub r9d, dword [r8 + 0xc]
mov r10d, dword [r8 + 0x14]
mov eax, r9d
add rax, r14
add r10, rax
jmp 0x14004f819
test r8, r8
je 0x14004f864
sub ebx, dword [r8 + 0xc]
mov edi, dword [r8 + 0x14]
mov eax, ebx
add rax, r14
add rdi, rax
jmp 0x14004f866
mov rax, rdi
jmp 0x14004f912
xor eax, eax
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret