Function at 0x7ff7626a05e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x178
movzx edi, r8b
mov rbp, rdx
mov rsi, rcx
test rdx, rdx
je 0x7ff7626a0abe
mov eax, 0xffff
mov word [rsp + 0x1d8], ax
cmp rdx, rax
jae 0x7ff7626a0631
mov word [rsp + 0x1d8], dx
jmp 0x7ff7626a065e
cmp byte [rdx], 0x23
jne 0x7ff7626a065e
lea rcx, [rdx + 1]
call qword [sym.imp.ucrtbase.dll_atoi]
lea ecx, [rax - 1]
cmp ecx, 0xfffd
ja 0x7ff7626a065e
movzx ebp, ax
mov qword [rsp + 0x1c8], rbp
mov word [rsp + 0x1d8], ax
test rsi, rsi
je 0x7ff7626a0abe
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x7ff7626a0abe
movsxd rcx, dword [rsi + 0x3c]
cmp dword [rsi + rcx], 0x4550
lea r13, [rsi + rcx]
jne 0x7ff7626a0abe
xor r10d, r10d
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x40], r10d
test ecx, ecx
jle 0x7ff7626a06ad
cmp ecx, 0x10000000
jae 0x7ff7626a06ad
lea rdx, [r13 + 4]
lea r9, [r13 + 0x18]
jmp 0x7ff7626a06b4
lea r9, [rsi + 0x14]
mov rdx, rsi
movzx ecx, word [r9]
sub ecx, 0x107
je 0x7ff7626a0abe
sub ecx, 4
je 0x7ff7626a06e1
cmp ecx, 0x100
jne 0x7ff7626a0abe
cmp dword [r9 + 0x6c], r10d
jbe 0x7ff7626a0729
lea rax, [r9 + 0x70]
jmp 0x7ff7626a06eb
cmp dword [r9 + 0x5c], r10d
jbe 0x7ff7626a0729
lea rax, [r9 + 0x60]
cmp dword [rax], r10d
je 0x7ff7626a0729
cmp dword [rax + 4], r10d
je 0x7ff7626a0729
mov qword [rsp + 0x30], r9
lea r8, [rsp + 0x40]
mov r9d, dword [r9 + 0x3c]
mov rcx, rsi
mov qword [rsp + 0x28], rdx
movzx edx, dil
mov qword [rsp + 0x20], rax
call fcn.7ff7626a0ae0
mov r10d, dword [rsp + 0x40]
mov r14, rax
mov dword [rsp + 0x50], r10d
jmp 0x7ff7626a072c
xor r14d, r14d
test r14, r14
je 0x7ff7626a0abe
test r10d, r10d
je 0x7ff7626a0abe
mov ecx, dword [r14 + 0x14]
test ecx, ecx
je 0x7ff7626a0abe
cmp r10d, 0x28
ja 0x7ff7626a076f
mov eax, dword [r14 + 0x18]
cmp ecx, eax
cmova eax, ecx
imul r10d, eax, 0xff
add r10d, dword [r14 + 0x24]
sub r10d, r14d
add r10d, esi
mov dword [rsp + 0x50], r10d
movzx ecx, byte [rsp + 0x1d0]
mov r8d, dword [r14 + 0x20]
mov ebx, dword [r14 + 0x1c]
mov edi, dword [r14 + 0x24]
test cl, cl
je 0x7ff7626a079e
add rbx, rsi
lea rdx, [rsi + rdi]
mov qword [rsp + 0x58], rbx
lea r15, [rsi + r8]
mov qword [rsp + 0x48], rdx
jmp 0x7ff7626a07e0
mov rdx, rsi
mov rcx, r13
call fcn.7ff7626a0bb0
mov r8d, ebx
mov rdx, rsi
mov rcx, r13
mov r15, rax
call fcn.7ff7626a0bb0
mov r8d, edi
mov qword [rsp + 0x58], rax
mov rdx, rsi
mov rcx, r13
mov rbx, rax
call fcn.7ff7626a0bb0
movzx ecx, byte [rsp + 0x1d0]
mov rdx, rax
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x40], eax
cmp dword [r14 + 0x14], eax
jbe 0x7ff7626a0abe
lea r9, [r14 + 0x14]
mov qword [rsp + 0x60], r9
nop dword [rax]
movzx r12d, word [rdx + rax*2]
mov r11d, dword [rbx + r12*4]
test r11d, r11d
je 0x7ff7626a08a0
mov r9d, dword [r15 + rax*4]
test cl, cl
je 0x7ff7626a098f
mov edi, r11d
add r9, rsi
add rdi, qword [rsp + 0x1c0]
mov r8, rdi
cmp rdi, r14
jbe 0x7ff7626a0a65
mov eax, dword [rsp + 0x50]
add rax, r14
cmp rdi, rax
jae 0x7ff7626a0a65
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x7ff7626a0850
inc ebx
cmp ebx, 0x100
jae 0x7ff7626a0ab1
mov r8d, ebx
lea rcx, [rsp + 0x70]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy_1
xor eax, eax
test ebx, ebx
je 0x7ff7626a0893
lea rcx, [rsp + 0x70]
cmp byte [rcx], 0x2e
lea edx, [rax + 1]
je 0x7ff7626a08d1
inc rcx
mov eax, edx
cmp edx, ebx
jb 0x7ff7626a0882
mov rbp, qword [rsp + 0x1c8]
mov rdx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
inc eax
mov dword [rsp + 0x40], eax
cmp eax, dword [rcx]
jae 0x7ff7626a0abe
mov rsi, qword [rsp + 0x1c0]
movzx ecx, byte [rsp + 0x1d0]
mov rbx, qword [rsp + 0x58]
jmp 0x7ff7626a0800
mov ebx, edx
mov byte [rsp + rax + 0x70], 0
add rbx, rdi
je 0x7ff7626a0893
cmp byte [rbx], 0x23
jne 0x7ff7626a093c
lea rcx, [rbx + 1]
test rcx, rcx
je 0x7ff7626a0893
movzx edi, word [rsp + 0x1d8]
mov eax, 0xffff
cmp di, ax
jae 0x7ff7626a0893
call qword [sym.imp.ucrtbase.dll_atoi]
mov ebx, eax
lea ecx, [rbx - 1]
cmp ecx, 0xfffe
ja 0x7ff7626a0893
cmp ebx, edi
jne 0x7ff7626a0893
lea rcx, [rsp + 0x70]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
movzx r8d, byte [rsp + 0x1d0]
mov rcx, rax
movzx edx, bx
call fcn.7ff7626a05e0
jmp 0x7ff7626a0ac0
mov rbp, qword [rsp + 0x1c8]
mov r8, rbx
mov rax, rbp
sub r8, rbp
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x7ff7626a0963
inc rax
test ecx, ecx
jne 0x7ff7626a0950
test edx, edx
jne 0x7ff7626a089b
lea rcx, [rsp + 0x70]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
movzx r8d, byte [rsp + 0x1d0]
mov rdx, rbx
mov rcx, rax
call fcn.7ff7626a05e0
jmp 0x7ff7626a0ac0
movzx r10d, word [r13 + 6]
test r10d, r10d
je 0x7ff7626a09cc
movzx ebx, word [r13 + 0x14]
xor r8d, r8d
add rbx, 0x18
add rbx, r13
test r10d, r10d
je 0x7ff7626a09cc
lea rdx, [rbx + 0x10]
mov ecx, dword [rdx - 4]
cmp r9d, ecx
jb 0x7ff7626a09c0
add ecx, dword [rdx]
cmp r9d, ecx
jb 0x7ff7626a0a11
inc r8d
add rdx, 0x28
cmp r8d, r10d
jb 0x7ff7626a09b1
movzx r10d, word [r13 + 6]
xor r9d, r9d
test r10d, r10d
je 0x7ff7626a0a0c
movzx ebx, word [r13 + 0x14]
xor r8d, r8d
add rbx, 0x18
add rbx, r13
test r10d, r10d
je 0x7ff7626a0a0c
lea rdx, [rbx + 0x10]
mov ecx, dword [rdx - 4]
cmp r11d, ecx
jb 0x7ff7626a0a00
add ecx, dword [rdx]
cmp r11d, ecx
jb 0x7ff7626a0a45
inc r8d
add rdx, 0x28
cmp r8d, r10d
jb 0x7ff7626a09f1
xor r8d, r8d
jmp 0x7ff7626a0a6d
lea rcx, [r8 + r8*4]
lea rdx, [rbx + rcx*8]
test rdx, rdx
je 0x7ff7626a09cc
sub r9d, dword [rdx + 0xc]
movzx ebx, word [r13 + 0x14]
movzx r10d, word [r13 + 6]
add rbx, 0x18
mov eax, r9d
add rbx, r13
mov r9d, dword [rdx + 0x14]
add rax, rsi
add r9, rax
xor r8d, r8d
jmp 0x7ff7626a09ed
lea rcx, [r8 + r8*4]
lea rdx, [rbx + rcx*8]
test rdx, rdx
je 0x7ff7626a0a0c
sub r11d, dword [rdx + 0xc]
mov r8d, dword [rdx + 0x14]
mov eax, r11d
add rax, rsi
add r8, rax
jmp 0x7ff7626a0a6d
mov rbp, qword [rsp + 0x1c8]
mov eax, 0xffff
cmp rbp, rax
jbe 0x7ff7626a0a97
mov rax, rbp
sub r9, rbp
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x7ff7626a0a93
inc rax
test ecx, ecx
jne 0x7ff7626a0a80
test edx, edx
je 0x7ff7626a0aac
movzx eax, word [rsp + 0x1d8]
lea ecx, [r12 + 1]
cmp ecx, eax
jne 0x7ff7626a089b
mov rax, r8
jmp 0x7ff7626a0ac0
mov rbp, qword [rsp + 0x1c8]
jmp 0x7ff7626a08a0
xor eax, eax
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret