Function at 0x180007980
Capabilities:
Enumerate pe sections
Get file size
Read file via mapping

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x180007c4f
mov qword [rsp + 0x60], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, eax
mov dword [rsp + 0xb8], eax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
lea r8d, [rbx + 2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r12, rax
test rax, rax
je 0x180007c27
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x180007c27
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x20], 1
mov r9, rax
xor r8d, r8d
mov rdx, r14
call fcn.180007830
test al, al
je 0x180007c14
movsxd rsi, dword [rdi + 0x3c]
add rsi, rdi
mov qword [rsp + 0xc8], rsi
movzx eax, word [rsi + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x180007a7f
mov ecx, 0x20b
cmp ax, cx
jne 0x180007c14
mov ebx, 1
mov eax, dword [rsi + 0x50]
mov edx, eax
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov qword [rsp + 0xc0], rax
test ebx, ebx
jne 0x180007b70
movzx r9d, word [rsi + 0x14]
movzx esi, word [rsi + 6]
lea ecx, [rsi*4 + 3]
add ecx, esi
lea edx, [r9 + rcx*8]
mov r8d, dword [rdi + 0x3c]
add r8d, edx
mov rbx, qword [rsp + 0xc8]
add rbx, 0x18
add rbx, r9
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], esi
mov rdx, rdi
mov rcx, rax
call fcn.18004c130
nop dword [rax]
test esi, esi
je 0x180007b1a
mov r8d, dword [rbx + 0x10]
mov edx, dword [rbx + 0x14]
add rdx, rdi
mov ecx, dword [rbx + 0xc]
add rcx, r15
call fcn.18004c130
add rbx, 0x28
mov qword [rsp + 0x48], rbx
dec esi
mov dword [rsp + 0x40], esi
jmp 0x180007af0
jmp 0x180007b4c
mov r9, rdi
mov r8, r12
mov edx, r13d
mov rcx, r14
call fcn.18000dc30
mov rax, r15
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movzx r9d, word [rsi + 0x14]
movzx esi, word [rsi + 6]
lea ecx, [rsi*4 + 3]
add ecx, esi
lea edx, [r9 + rcx*8]
mov r8d, dword [rdi + 0x3c]
add r8d, edx
mov rbx, qword [rsp + 0xc8]
add rbx, 0x18
add rbx, r9
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], esi
mov rdx, rdi
mov rcx, r15
call fcn.18004c130
test esi, esi
je 0x180007bda
mov r8d, dword [rbx + 0x10]
mov edx, dword [rbx + 0x14]
add rdx, rdi
mov ecx, dword [rbx + 0xc]
add rcx, r15
call fcn.18004c130
add rbx, 0x28
mov qword [rsp + 0x48], rbx
dec esi
mov dword [rsp + 0x40], esi
jmp 0x180007bb0
jmp 0x180007b4c
mov r9, rdi
mov r8, r12
mov edx, r13d
mov rcx, r14
call fcn.18000dc30
jmp 0x180007c4f
lea rdx, [rsp + 0xb8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x180007c4f
test byte [rsp + 0xb8], 2
jne 0x180007c4f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret