Function at 0x180002ee8
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xd8
movsxd rbx, dword [rcx + 0x3c]
mov rax, qword [rbp + 0x77]
xor r11d, r11d
add rbx, rcx
mov qword [rax], r11
mov rax, qword [rbp + 0x7f]
mov dword [rax], r11d
movzx eax, word [rbx + 0x14]
mov r15, rcx
lea rdi, [rbx + 0x18]
mov esi, r9d
add rdi, rax
movzx eax, word [rbx + 6]
lea r14d, [rax + rax*4]
mov qword [rbp - 0x61], rdi
shl r14d, 3
sub r14d, ecx
add r14d, edi
mov ecx, r14d
shr ecx, 0xc
mov eax, ecx
shl eax, 0xc
cmp eax, r14d
jne 0x180002f65
mov r10d, r14d
jmp 0x180002f6d
lea r10d, [rcx + 1]
shl r10d, 0xc
mov ecx, r14d
mov dword [rsp + 0x2c], r10d
shr ecx, 9
mov eax, ecx
shl eax, 9
cmp eax, r14d
je 0x180002f8a
lea r14d, [rcx + 1]
shl r14d, 9
mov ecx, dword [rdi + 8]
lea r8d, [rcx + r9]
mov edx, r8d
mov dword [rbp - 0x75], r8d
shr edx, 0xc
mov eax, edx
shl eax, 0xc
cmp eax, r8d
jne 0x180002faa
mov r9d, r8d
jmp 0x180002fb2
lea r9d, [rdx + 1]
shl r9d, 0xc
lea eax, [r9 + r10]
mov edx, r8d
mov dword [rsp + 0x24], r9d
shr edx, 9
mov dword [rsp + 0x30], eax
mov eax, edx
shl eax, 9
cmp eax, r8d
jne 0x180002fd4
mov eax, r8d
jmp 0x180002fda
lea eax, [rdx + 1]
shl eax, 9
lea edx, [rax + r14]
mov dword [rsp + 0x38], eax
mov dword [rbp + 0x5f], edx
mov edx, ecx
shr edx, 0xc
mov eax, edx
shl eax, 0xc
cmp eax, ecx
je 0x180002ff9
lea ecx, [rdx + 1]
shl ecx, 0xc
mov r12d, r9d
lea r8, [rbp - 0x19]
mov qword [rbp - 0x19], r11
sub r12d, ecx
mov rcx, r15
mov qword [rbp - 0x11], r11
mov dword [rbp - 9], r11d
call fcn.180002d28
mov r10, qword [rbp - 0x19]
xor r11d, r11d
mov rdx, r10
test r10, r10
je 0x180003076
mov r8d, dword [rdx + 0x18]
mov ecx, dword [rdi + 0xc]
cmp r8d, ecx
jb 0x180003045
add ecx, dword [rdi + 8]
lea eax, [r8 + rsi]
cmp r8d, ecx
jb 0x180003042
lea eax, [r8 + r12]
mov dword [rdx + 0x18], eax
mov r8d, dword [rdi + 0xc]
mov r9d, dword [rbx + 0x34]
mov ecx, dword [rdx + 0x1c]
lea eax, [r9 + r8]
cmp ecx, eax
jb 0x18000306d
lea eax, [r9 + r8]
add eax, dword [rdi + 8]
cmp ecx, eax
lea eax, [rcx + rsi]
jb 0x18000306a
lea eax, [rcx + r12]
mov dword [rdx + 0x1c], eax
mov rdx, qword [rdx + 0x10]
test rdx, rdx
jne 0x180003026
mov rbx, r11
mov rsi, r11
mov qword [rbp - 0x49], r11
mov dword [rbp - 0x39], r11d
mov r13, r10
mov qword [rbp - 0x41], rbx
test r10, r10
je 0x180003131
mov r15d, dword [r13 + 0x18]
mov rax, rsi
and r15d, 0xfffff000
test rsi, rsi
je 0x1800030b6
cmp dword [rax + 0x18], r15d
je 0x1800030e9
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1800030a7
mov rcx, qword [0x180013580]
xor edx, edx
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
test rax, rax
je 0x1800030ee
lea rcx, [0x1800103c0]
mov qword [rax + 8], r11
mov qword [rax + 0x10], r11
mov qword [rax], rcx
mov qword [rax + 0x18], r11
jmp 0x1800030f1
inc dword [rax + 0x1c]
jmp 0x18000311c
mov rax, r11
test rbx, rbx
je 0x1800030fc
mov qword [rbx + 0x10], rax
jmp 0x180003103
mov rsi, rax
mov qword [rbp - 0x49], rax
inc dword [rbp - 0x39]
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r11
mov rbx, rax
mov dword [rax + 0x18], r15d
mov dword [rax + 0x1c], 1
mov r13, qword [r13 + 0x10]
test r13, r13
jne 0x180003094
mov r15, qword [rbp + 0x57]
mov qword [rbp - 0x41], rbx
mov ebx, r11d
mov rcx, rsi
mov dword [rsp + 0x20], ebx
test rsi, rsi
je 0x18000315d
mov eax, dword [rcx + 0x1c]
lea ebx, [rbx + rax*2]
add ebx, 8
test al, 1
je 0x180003150
add ebx, 2
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x180003140
mov dword [rsp + 0x20], ebx
lea r9, [rbp - 0x31]
lea r8, [rbp - 0x79]
mov rcx, r15
mov qword [rbp - 0x31], r11
mov qword [rbp - 0x29], r11
mov dword [rbp - 0x21], r11d
call fcn.180006788
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x31]
call fcn.180006d0c
mov edx, dword [rdi + 0x30]
mov r13d, dword [rsp + 0x30]
mov ecx, edx
mov dword [rbp - 0x69], r13d
mov dword [rbp - 0x6d], edx
shr ecx, 0xc
mov eax, ecx
shl eax, 0xc
cmp eax, edx
jne 0x1800031a9
mov r15d, edx
jmp 0x1800031b1
lea r15d, [rcx + 1]
shl r15d, 0xc
mov ecx, dword [rdi + 0x38]
mov r9d, dword [rbp + 0x5f]
add r13d, r15d
mov dword [rsp + 0x34], ecx
test ecx, ecx
je 0x1800031e9
mov edx, ecx
mov dword [rsp + 0x40], r9d
shr edx, 9
mov eax, edx
shl eax, 9
cmp eax, ecx
je 0x1800031e0
lea ecx, [rdx + 1]
shl ecx, 9
mov dword [rsp + 0x34], ecx
add r9d, ecx
mov dword [rbp + 0x5f], r9d
jmp 0x1800031f4
and dword [rsp + 0x40], 0
xor ecx, ecx
mov dword [rsp + 0x34], ecx
mov r8d, dword [rdi + 0x58]
mov dword [rbp - 0x51], r13d
mov edx, r8d
mov dword [rbp - 0x65], r8d
shr edx, 0xc
mov eax, edx
shl eax, 0xc
cmp eax, r8d
jne 0x180003215
mov r11d, r8d
jmp 0x18000321d
lea r11d, [rdx + 1]
shl r11d, 0xc
mov edx, dword [rdi + 0x60]
add r13d, r11d
mov dword [rsp + 0x3c], edx
test edx, edx
je 0x180003254
mov r8d, edx
mov dword [rbp - 0x7d], r9d
shr r8d, 9
mov eax, r8d
shl eax, 9
cmp eax, edx
je 0x18000324b
lea edx, [r8 + 1]
shl edx, 9
mov dword [rsp + 0x3c], edx
add r9d, edx
mov dword [rbp + 0x5f], r9d
jmp 0x18000325e
and dword [rbp - 0x7d], 0
xor edx, edx
mov dword [rsp + 0x3c], edx
mov r9d, dword [rsp + 0x28]
mov dword [rbp - 0x55], r13d
mov r8d, r9d
shr r8d, 0xc
mov eax, r8d
shl eax, 0xc
cmp eax, r9d
jne 0x18000327e
mov r10d, r9d
jmp 0x180003286
lea r10d, [r8 + 1]
shl r10d, 0xc
add r13d, r10d
mov r8d, r9d
shr r8d, 9
mov dword [rsp + 0x30], r13d
mov r13d, dword [rbp + 0x5f]
mov eax, r8d
mov dword [rbp - 0x59], r13d
shl eax, 9
cmp eax, r9d
jne 0x1800032ad
mov edi, r9d
jmp 0x1800032b4
lea edi, [r8 + 1]
shl edi, 9
add r13d, edi
mov r8d, ebx
mov dword [rsp + 0x44], edi
shr r8d, 0xc
mov dword [rbp + 0x5f], r13d
mov eax, r8d
shl eax, 0xc
cmp eax, ebx
jne 0x1800032d5
mov r9d, ebx
jmp 0x1800032dd
lea r9d, [r8 + 1]
shl r9d, 0xc
mov r8d, ebx
shr r8d, 9
mov eax, r8d
shl eax, 9
cmp eax, ebx
jne 0x1800032f2
mov eax, ebx
jmp 0x1800032f9
lea eax, [r8 + 1]
shl eax, 9
mov dword [rsp + 0x48], eax
add eax, edi
lea r8d, [r9 + r10]
add r8d, r11d
add eax, edx
xor edx, edx
add r8d, r15d
add eax, ecx
mov rcx, qword [0x180013580]
add r8d, dword [rsp + 0x24]
add eax, dword [rsp + 0x38]
add r8d, dword [rsp + 0x2c]
lea edi, [rax + r14]
mov dword [rbp - 0x71], eax
mov dword [rsp + 0x24], r8d
mov r8d, edi
mov dword [rbp - 0x79], edi
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test edi, edi
je 0x180003352
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.ntdll.dll_memset
mov rdx, qword [rbp + 0x57]
mov r8d, r14d
mov rcx, r15
call fcn.18000cbb0
movsxd rdi, dword [r15 + 0x3c]
add rdi, r15
movzx eax, word [rdi + 0x14]
lea r13, [rdi + 0x18]
add r13, rax
mov eax, dword [rsp + 0x2c]
mov dword [r13 + 0xc], eax
mov eax, dword [rbp - 0x75]
mov dword [r13 + 0x14], r14d
mov dword [r13 + 8], eax
mov eax, dword [rsp + 0x38]
mov dword [r13 + 0x10], eax
mov rax, qword [rbp + 0x67]
test rax, rax
je 0x1800033cf
mov r8d, dword [rbp + 0x6f]
lea rcx, [r14 + r15]
mov rdx, rax
mov ebx, r14d
call fcn.18000cbb0
mov rax, qword [rbp - 0x61]
mov edx, dword [rax + 0x14]
mov ecx, dword [rbp + 0x6f]
mov r14, qword [rbp + 0x57]
mov r8d, dword [rax + 0x10]
add rcx, rbx
add rdx, r14
add rcx, r15
mov rbx, rax
call fcn.18000cbb0
jmp 0x1800033fe
mov rbx, qword [rbp - 0x61]
mov ecx, dword [rbp + 0x6f]
mov eax, dword [rbx + 0x14]
mov r8d, dword [rbx + 0x10]
neg ecx
add rax, qword [rbp + 0x57]
btr ecx, 0x1f
mov edx, ecx
sub r8d, ecx
mov ecx, r14d
add rdx, rax
add rcx, r15
call fcn.18000cbb0
mov r14, qword [rbp + 0x57]
mov eax, dword [rbp - 0x69]
mov dword [r13 + 0x34], eax
mov eax, dword [rbp - 0x6d]
mov dword [r13 + 0x30], eax
mov eax, dword [rsp + 0x34]
mov dword [r13 + 0x38], eax
mov eax, dword [rsp + 0x40]
mov dword [r13 + 0x3c], eax
mov edx, dword [rbx + 0x3c]
mov r8d, dword [rbx + 0x38]
lea rcx, [r15 + rax]
add rdx, r14
call fcn.18000cbb0
mov eax, dword [rbp - 0x51]
mov dword [r13 + 0x5c], eax
mov eax, dword [rbp - 0x65]
mov dword [r13 + 0x58], eax
mov eax, dword [rsp + 0x3c]
mov dword [r13 + 0x60], eax
mov eax, dword [rbp - 0x7d]
mov dword [r13 + 0x64], eax
mov edx, dword [rbx + 0x64]
mov r8d, dword [rbx + 0x60]
lea rcx, [r15 + rax]
add rdx, r14
call fcn.18000cbb0
mov eax, dword [rsp + 0x28]
mov r9d, dword [rbp - 0x55]
mov dword [r13 + 0x80], eax
mov eax, dword [rsp + 0x44]
lea rcx, [rbp - 0x31]
mov dword [r13 + 0x88], eax
mov eax, dword [rbp - 0x59]
mov dword [r13 + 0x84], r9d
lea rdx, [r15 + rax]
mov dword [r13 + 0x8c], eax
call fcn.180006f2c
mov eax, dword [rsp + 0x30]
mov edx, dword [rbp + 0x5f]
mov ecx, dword [rsp + 0x48]
mov dword [r13 + 0xac], eax
mov eax, dword [rsp + 0x20]
xor r14d, r14d
mov dword [r13 + 0xa8], eax
mov dword [r13 + 0xb0], ecx
mov dword [r13 + 0xb4], edx
lea rbx, [r15 + rdx]
test rsi, rsi
je 0x180003566
mov eax, dword [rsi + 0x18]
mov dword [rbx], eax
mov eax, dword [rsi + 0x1c]
lea ecx, [rax*2 + 8]
test al, 1
je 0x1800034e8
add ecx, 2
mov rax, qword [rbp - 0x19]
mov dword [rbx + 4], ecx
add rbx, 8
mov r14, rax
test rax, rax
je 0x180003544
mov eax, dword [r14 + 0x18]
and eax, 0xfffff000
cmp eax, dword [rsi + 0x18]
jne 0x18000353b
movzx eax, word [r14 + 0x18]
mov ecx, 0x3000
sub ax, word [rsi + 0x18]
or ax, cx
mov rcx, r13
mov word [rbx], ax
movzx edx, word [rdi + 6]
mov r8d, dword [r14 + 0x18]
add rbx, 2
call fcn.180002cec
mov edx, eax
mov eax, dword [r14 + 0x1c]
mov dword [rdx + r15], eax
mov r14, qword [r14 + 0x10]
test r14, r14
jne 0x1800034fb
xor r14d, r14d
test byte [rsi + 0x1c], 1
je 0x180003555
mov word [rbx], r14w
add rbx, 2
mov rsi, qword [rsi + 0x10]
test rsi, rsi
jne 0x1800034d2
mov eax, dword [rsp + 0x20]
add dword [rdi + 0xd8], r12d
add dword [rdi + 0x80], r12d
add dword [rdi + 0x88], r12d
mov ecx, dword [rsp + 0x28]
mov dword [rdi + 0x8c], ecx
add dword [rdi + 0xa0], r12d
mov dword [rdi + 0xa4], eax
movzx edx, word [rdi + 6]
mov r8d, dword [rdi + 0xd8]
mov rcx, r13
call fcn.180002cec
mov edx, eax
mov eax, dword [rdi + 0xdc]
add rdx, r15
add rax, rdx
mov rcx, rdx
cmp rdx, rax
je 0x1800035d0
add dword [rcx], r12d
mov eax, dword [rdi + 0xdc]
add rcx, 4
add rax, rdx
cmp rcx, rax
jne 0x1800035bb
movzx edx, word [rdi + 6]
mov r8d, dword [rdi + 0x80]
mov rcx, r13
call fcn.180002cec
mov ebx, eax
add rbx, r15
jmp 0x18000362b
add dword [rbx], r12d
add dword [rbx + 0x10], r12d
add dword [rbx + 0xc], r12d
movzx edx, word [rdi + 6]
mov r8d, dword [rbx]
mov rcx, r13
call fcn.180002cec
mov r8d, r14d
mov edx, eax
add rdx, r15
mov ecx, dword [rdx]
test ecx, ecx
je 0x180003627
mov rax, rdx
js 0x18000361a
add dword [rax], r12d
inc r8d
lea rax, [rdx + r8*4]
mov ecx, dword [rax]
test ecx, ecx
jne 0x180003615
add rbx, 0x14
cmp dword [rbx], r14d
jne 0x1800035ea
mov ecx, dword [rsp + 0x24]
mov eax, dword [rbp + 0x6f]
mov dword [rdi + 0x58], r14d
add dword [rdi + 0x28], eax
mov rax, qword [rbp + 0x77]
mov dword [rdi + 0x50], ecx
mov ecx, dword [rbp - 0x71]
mov qword [rax], r15
mov rax, qword [rbp + 0x7f]
mov dword [rdi + 0x20], ecx
mov ecx, dword [rbp - 0x79]
mov dword [rax], ecx
lea rcx, [rbp - 0x31]
call fcn.18000cc74
lea rcx, [rbp - 0x49]
call fcn.18000cc74
lea rcx, [rbp - 0x19]
call fcn.18000cc74
mov eax, 1
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret