Function at 0x140002cea
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push rbp
sub rsp, 0x380
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x294], 0x60
mov eax, dword [rbp + 0x294]
mov rax, qword gs:[rax]
mov qword [rbp + 0x288], rax
mov rax, qword [rbp + 0x288]
mov qword [rbp + 0x2e0], rax
cmp qword [rbp + 0x2e0], 0
jne 0x140002d37
mov eax, 0
jmp 0x14000325c
mov qword [rbp + 0x2d8], 0
mov qword [rbp + 0x2f8], 0
mov dword [rbp + 0x2d4], 0
mov qword [rbp + 0x280], 0
mov qword [rbp + 0x2c8], 0
mov qword [rbp + 0x278], 0
mov qword [rbp + 0x2f0], 0
mov qword [rbp + 0x270], 0
mov dword [rbp + 0x26c], 0
mov rax, qword [rbp + 0x2e0]
mov rax, qword [rax + 0x18]
add rax, 0x20
mov qword [rbp + 0x2d8], rax
mov rax, qword [rbp + 0x2d8]
mov rax, qword [rax]
mov qword [rbp + 0x2f8], rax
jmp 0x140003243
mov rax, qword [rbp + 0x2f8]
sub rax, 0x10
mov qword [rbp + 0x2c0], rax
mov rax, qword [rbp + 0x2c0]
add rax, 0x48
add rax, 0x10
mov qword [rbp + 0x2b8], rax
mov qword [rbp + 0x260], 0xffffffffffffffff
mov dword [rbp + 0x24c], 0xa2c81cbf
movabs rax, 0xce8c72c8cda657e3
mov qword [rbp + 0x240], rax
mov dword [rbp + 0x248], 0xa2946fd3
lea rdx, [rbp + 0x24c]
lea rax, [rbp + 0x240]
mov r9d, 4
mov r8, rdx
mov edx, 0xc
mov rcx, rax
call fcn.140002c7e
lea rax, [rbp + 0x220]
mov edx, 0x18
mov rcx, rax
call fcn.140001935
lea rdx, [rbp + 0x240]
lea rax, [rbp + 0x220]
mov r8d, 0xc
mov rcx, rax
call fcn.1400018bf
mov rax, rbp
mov edx, 0x208
mov rcx, rax
call fcn.140001935
lea rdx, [rbp + 0x220]
mov rax, rbp
mov rcx, rax
call fcn.1400017fe
mov rax, qword [rbp + 0x2b8]
mov rdx, qword [rax + 8]
mov rax, rbp
mov rcx, rax
call fcn.140001847
mov rdx, rbp
lea rax, [rbp + 0x250]
mov rcx, rax
call fcn.140001657
mov dword [rbp - 0x30], 0x30
mov qword [rbp - 0x28], 0
mov dword [rbp - 0x18], 0x40
lea rax, [rbp + 0x250]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x260]
mov r8, rdx
mov edx, 0xc
mov rcx, rax
call fcn.140002a5c
mov dword [rbp + 0x2b4], eax
cmp dword [rbp + 0x2b4], 0
js 0x140002f22
mov rax, qword [rbp + 0x260]
cmp rax, 0xffffffffffffffff
jne 0x140002f32
mov qword [rbp + 0x280], 0
jmp 0x140002fb3
mov qword [rbp + 0x218], 0
mov rax, qword [rbp + 0x260]
lea rcx, [rbp + 0x280]
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
lea rdx, [rbp + 0x218]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rcx
mov rdx, 0xffffffffffffffff
mov rcx, rax
call fcn.14000279b
mov dword [rbp + 0x2b4], eax
cmp dword [rbp + 0x2b4], 0
jns 0x140002fb3
mov qword [rbp + 0x280], 0
mov rax, qword [rbp + 0x2c0]
mov rax, qword [rax + 0x30]
mov qword [rbp + 0x2c8], rax
mov rax, qword [rbp + 0x280]
test rax, rax
je 0x140003232
cmp qword [rbp + 0x2c8], 0
je 0x140003232
mov rax, qword [rbp + 0x2c8]
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x2a8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x14000300b
mov eax, 0
jmp 0x14000325c
mov rax, qword [rbp + 0x2a8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x2c8]
add rax, rdx
mov qword [rbp + 0x2a0], rax
mov rax, qword [rbp + 0x2a0]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140003043
mov eax, 0
jmp 0x14000325c
mov dword [rbp + 0x2ec], 0
jmp 0x1400030f9
mov rax, qword [rbp + 0x2a0]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0x2a0]
lea rcx, [rdx + rax]
mov eax, dword [rbp + 0x2ec]
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
add rax, 0x18
mov qword [rbp + 0x298], rax
mov rax, qword [rbp + 0x298]
mov eax, dword [rax]
or eax, 0x20202020
cmp eax, 0x7865742e
jne 0x1400030f2
mov rax, qword [rbp + 0x298]
mov eax, dword [rax + 8]
mov eax, eax
mov qword [rbp + 0x270], rax
mov rax, qword [rbp + 0x298]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp + 0x2c8]
add rax, rdx
mov qword [rbp + 0x278], rax
mov rax, qword [rbp + 0x298]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp + 0x280]
add rax, rdx
mov qword [rbp + 0x2f0], rax
add dword [rbp + 0x2ec], 1
mov rax, qword [rbp + 0x2a0]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp + 0x2ec], eax
jl 0x140003052
mov rax, qword [rbp + 0x270]
test rax, rax
je 0x140003135
mov rax, qword [rbp + 0x278]
test rax, rax
je 0x140003135
cmp qword [rbp + 0x2f0], 0
jne 0x14000313f
mov eax, 0
jmp 0x14000325c
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x210], rax
lea rcx, [rbp + 0x270]
lea rax, [rbp + 0x210]
lea rdx, [rbp + 0x26c]
mov qword [rsp + 0x20], rdx
mov r9d, pe_nt_image_headers64
mov r8, rcx
mov rdx, rax
mov rcx, 0xffffffffffffffff
call fcn.1400024ca
mov dword [rbp + 0x2b4], eax
mov rcx, qword [rbp + 0x270]
mov rax, qword [rbp + 0x278]
mov rdx, qword [rbp + 0x2f0]
mov r8, rcx
mov rcx, rax
call fcn.1400016c5
mov r8d, dword [rbp + 0x26c]
lea rcx, [rbp + 0x270]
lea rax, [rbp + 0x278]
lea rdx, [rbp + 0x26c]
mov qword [rsp + 0x20], rdx
mov r9d, r8d
mov r8, rcx
mov rdx, rax
mov rcx, 0xffffffffffffffff
call fcn.1400024ca
mov dword [rbp + 0x2b4], eax
mov rax, qword [rbp + 0x280]
mov rdx, rax
mov rcx, 0xffffffffffffffff
call fcn.1400029a4
mov dword [rbp + 0x2b4], eax
cmp dword [rbp + 0x2b4], 0
jns 0x14000320d
mov eax, 0
jmp 0x14000325c
mov rax, qword [rbp + 0x260]
mov rcx, rax
call fcn.14000290c
mov dword [rbp + 0x2b4], eax
cmp dword [rbp + 0x2b4], 0
jns 0x140003232
mov eax, 0
jmp 0x14000325c
mov rax, qword [rbp + 0x2f8]
mov rax, qword [rax]
mov qword [rbp + 0x2f8], rax
mov rax, qword [rbp + 0x2f8]
cmp rax, qword [rbp + 0x2d8]
jne 0x140002dc4
mov eax, 1
add rsp, 0x380
pop rbp
ret