Function at 0x140011810
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x1c0
mov rax, qword [0x14049b9c0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rax, qword [r8 + 0x360]
mov rsi, r8
mov qword [rsp + 0xd8], rax
mov rbx, rdx
mov rax, qword [rdx + 0x48]
mov rdi, rcx
mov qword [rsp + 0xe0], rdx
cmp qword [rdx + 0x40], rax
jb 0x14001186f
mov edx, 1
mov rcx, rbx
call fcn.14003d440
test eax, eax
jne 0x140011c17
mov rax, qword [rbx + 0x40]
lea rcx, [rsp + 0xc8]
mov byte [rax], 0x23
inc qword [rbx + 0x40]
movsxd rax, dword [rdi + 0x18]
mov qword [rsp + 0xc8], rax
call sub.api_ms_win_crt_time_l1_1_0.dll__localtime64
mov r10, rax
mov r9d, dword [rax + 0x10]
mov r8d, dword [rax + 0x14]
inc r9d
mov eax, 0x51eb851f
imul r8d
mov eax, dword [r10]
mov dword [rsp + 0x38], eax
mov eax, dword [r10 + 4]
mov dword [rsp + 0x30], eax
mov eax, dword [r10 + 8]
sar edx, 5
mov ecx, edx
mov dword [rsp + 0x28], eax
mov eax, dword [r10 + 0xc]
shr ecx, 0x1f
add edx, ecx
mov dword [rsp + 0x20], eax
imul ecx, edx, 0x64
lea rdx, str._02d_02d_02d__2d:_02d:_02d
sub r8d, ecx
mov rcx, rbx
call fcn.14003d9d0
test al, al
jne 0x140011c17
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x100]
call fcn.140055e10
mov r8d, dword [rdi + 0x30]
lea rdx, str._server_id__lu__end_log_pos__s
mov r9, rax
mov rcx, rbx
call fcn.14003d9d0
test al, al
jne 0x140011c17
mov eax, dword [rdi + 0x40]
test eax, eax
je 0x140011990
cmp eax, 0xff
je 0x140011990
mov r9d, dword [rdi + 0x44]
lea r8, str.0x_08x
mov edx, recv
lea rcx, [rsp + 0xf0]
call fcn.140051970
mov edx, dword [rdi + 0x40]
lea rcx, reloc.WS2_32.dll_bind
mov rbp, rax
call fcn.14003b700
mov r8, rax
lea rdx, [0x140099500]
mov rcx, rbx
call fcn.14003d9d0
test al, al
jne 0x140011c17
mov r8, rbp
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14003d9d0
test al, al
jne 0x140011c17
cmp qword [rsi + 0x360], 0
je 0x140011bf7
mov dl, 0xa
mov rcx, rbx
call fcn.1400194b0
mov r13, qword [rdi + 0x10]
mov rcx, rdi
mov rax, qword [rdi]
movzx edx, byte [rsi + 0x354]
mov qword [rsp + 0xd0], r13
mov ebp, dword [r13 + 9]
call qword [rax + 0x20]
lea rdx, str._Position_n
mov rcx, rbx
sub rbp, rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rbp
call fcn.14003d9d0
test al, al
jne 0x140011c17
lea rdx, str.___________Timestamp___Type_Master_ID___Size________Master_Pos__Flags_n
mov rcx, rbx
call fcn.14003d9d0
test al, al
jne 0x140011c17
movzx eax, byte [r13 + 0x12]
movzx ecx, byte [r13 + 0x11]
movzx edx, byte [r13 + 0x10]
movzx r8d, byte [r13 + 0xf]
movzx r9d, byte [r13 + 0xe]
movzx edi, byte [r13 + 0xa]
movzx ebp, byte [r13 + 8]
movzx r10d, byte [r13 + 0xd]
movzx r11d, byte [r13 + 0xc]
movzx ebx, byte [r13 + 0xb]
movzx esi, byte [r13 + 9]
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0xa8], ecx
lea rcx, [rsp + 0x120]
mov dword [rsp + 0xa0], edx
mov edx, 0x78
mov dword [rsp + 0x98], r8d
lea r8, str.__8llx___02x__02x__02x__02x__02x____02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x__02x_n
mov dword [rsp + 0x90], r9d
mov dword [rsp + 0x88], r10d
mov dword [rsp + 0x80], r11d
mov dword [rsp + 0x78], ebx
mov dword [rsp + 0x70], edi
mov rdi, qword [rsp + 0xd0]
mov dword [rsp + 0x68], esi
mov dword [rsp + 0x60], ebp
mov rbp, qword [rsp + 0xd8]
movzx eax, byte [rdi + 3]
mov r9, rbp
mov qword [rsp + 0x208], r12
movzx r12d, byte [r13 + 5]
mov qword [rsp + 0x1b8], r14
movzx r14d, byte [r13 + 7]
mov dword [rsp + 0x58], r14d
mov qword [rsp + 0x1b0], r15
movzx r15d, byte [r13 + 6]
movzx r13d, byte [r13 + 4]
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], eax
movzx eax, byte [rdi + 2]
mov dword [rsp + 0x30], eax
movzx eax, byte [rdi + 1]
mov dword [rsp + 0x28], eax
movzx eax, byte [rdi]
mov dword [rsp + 0x20], eax
call fcn.140051970
mov rbx, qword [rsp + 0xe0]
mov rsi, rax
mov r15, qword [rsp + 0x1b0]
mov r14, qword [rsp + 0x1b8]
mov r12, qword [rsp + 0x208]
mov rcx, qword [rbx + 0x40]
lea rdx, [rcx + rax]
cmp rdx, qword [rbx + 0x48]
ja 0x140011b5c
test rax, rax
je 0x140011b77
mov r8, rax
lea rdx, [rsp + 0x120]
call fcn.140092830
add qword [rbx + 0x40], rsi
jmp 0x140011b77
mov r8, rsi
lea rdx, [rsp + 0x120]
mov rcx, rbx
call fcn.14003c880
test eax, eax
jne 0x140011c17
mov rcx, qword [rbx + 0x40]
lea rax, [rcx + 2]
cmp rax, qword [rbx + 0x48]
ja 0x140011b91
mov word [rcx], 0xa23
add qword [rbx + 0x40], 2
jmp 0x140011baa
mov r8d, 2
lea rdx, [0x1400994c4]
mov rcx, rbx
call fcn.14003c880
test eax, eax
jne 0x140011c17
mov rax, qword [rsp + 0xe8]
mov rcx, rbx
mov r9, qword [rsp + 0xf0]
lea r8, [rax + rdi]
lea rdx, [rax + rbp]
call fcn.14000b280
test al, al
jne 0x140011c17
mov rcx, qword [rbx + 0x40]
lea rax, [rcx + 9]
cmp rax, qword [rbx + 0x48]
ja 0x140011bfb
movsd xmm0, qword [str._Event:]
movsd qword [rcx], xmm0
movzx eax, byte [0x140099520]
mov byte [rcx + 8], al
add qword [rbx + 0x40], 9
xor al, al
jmp 0x140011c19
mov r8d, 9
lea rdx, str._Event:
mov rcx, rbx
call fcn.14003c880
test eax, eax
setne al
jmp 0x140011c19
mov al, 1
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14008e500
add rsp, 0x1c0
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret