Function at 0x180001ea8
Capabilities:
Enumerate pe sections
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x180021008]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
mov qword [rsp + 0x28], rdx
xor r12d, r12d
mov r15, r8
mov rbp, rdx
mov r13, rcx
mov ebx, r12d
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
test r8, r8
je 0x180001f07
cmp r8, 0x40
jae 0x180001f0c
lea ecx, [r12 + 0xd]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdi, r12
jmp 0x180001f30
movsxd rcx, dword [rdx + 0x3c]
lea rax, [rcx + 0x108]
test rax, rax
je 0x180001f2c
cmp r15, rax
jae 0x180001f58
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
or rdi, 0xffffffffffffffff
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180002e60
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rsi, [rcx + rdx]
mov r14d, 0xc1
mov edx, dword [rsi + 0x38]
test dl, 1
je 0x180001f76
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [rsi + 0x38]
movzx ecx, word [rsi + 0x14]
add rcx, 0x24
cmp r12w, word [rsi + 6]
jae 0x180001fb4
movzx r9d, word [rsi + 6]
add rcx, rsi
mov eax, dword [rcx + 4]
mov r8d, dword [rcx]
test eax, eax
jne 0x180001f9d
lea eax, [r8 + rdx]
jmp 0x180001fa0
add eax, r8d
cmp rax, rbx
cmovbe rax, rbx
add rcx, 0x28
mov rbx, rax
sub r9, 1
jne 0x180001f8d
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x34]
lea r8d, [rdx - 1]
lea edi, [rdx - 1]
not r8d
add edi, dword [rsi + 0x50]
lea rcx, [rdx - 1]
add rcx, rbx
and rdi, r8
and rcx, r8
cmp rdi, rcx
je 0x180001fea
mov ecx, r14d
jmp 0x180001f26
mov rcx, qword [rsi + 0x30]
mov ebx, 0x3000
mov r8d, ebx
mov r9d, 4
mov rdx, rdi
call qword [r13]
mov r14, rax
test rax, rax
jne 0x18000202b
lea r9d, [rax + 4]
mov r8d, ebx
mov rdx, rdi
xor ecx, ecx
call qword [r13]
mov r14, rax
test rax, rax
jne 0x18000202b
lea ecx, [rax + 0xe]
jmp 0x180001f26
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x50]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x18000206c
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea ecx, [rdi + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x180001f33
mov qword [rax + 8], r14
movzx eax, word [rsi + 0x16]
shr eax, 0xd
and eax, 1
mov qword [rdi + 0x40], r12
mov dword [rdi + 0x20], eax
lea rax, [0x180001e60]
mov qword [rdi + 0x28], rax
lea rax, [0x180001e78]
mov qword [rdi + 0x30], rax
lea rax, [0x180001e94]
mov qword [rdi + 0x38], rax
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0x50], eax
mov edx, dword [rsi + 0x54]
test rdx, rdx
je 0x18000223a
cmp r15, rdx
jb 0x1800022ca
mov r9d, 4
mov r8d, 0x1000
mov rcx, r14
call qword [r13]
mov r8d, dword [rsi + 0x54]
mov rdx, rbp
mov rcx, rax
mov rbx, rax
call fcn.180006790
movsxd rcx, dword [rbp + 0x3c]
mov r8d, r12d
add rcx, rbx
mov dword [rsp + 0x20], r12d
mov qword [rdi], rcx
mov qword [rcx + 0x30], r14
mov rcx, qword [rdi]
movzx eax, word [rcx + 0x14]
lea rbp, [rcx + 0x18]
add rbp, rax
je 0x18000223a
mov r12, qword [rdi + 8]
xor ebx, ebx
test r12, r12
je 0x18000223a
mov dword [rsp + 0x24], ebx
cmp bx, word [rcx + 6]
jae 0x18000223a
add rbp, 0xc
mov edx, dword [rbp + 4]
test edx, edx
jne 0x18000217a
cmp dword [rsi + 0x38], ebx
jbe 0x1800021d7
mov ebx, dword [rsi + 0x38]
lea r9d, [rdx + 4]
mov ecx, dword [rbp]
mov edx, ebx
add rcx, r12
mov r8d, 0x1000
call qword [r13]
test rax, rax
je 0x18000223a
mov ecx, dword [rbp]
mov r8d, ebx
add rcx, r12
xor edx, edx
mov dword [rbp - 4], ecx
call fcn.180004910
mov r8d, dword [rsp + 0x20]
jmp 0x1800021d5
mov eax, dword [rbp + 8]
add eax, edx
je 0x18000223a
cmp r15, rax
jb 0x1800022ca
mov ecx, dword [rbp]
mov r9d, 4
add rcx, r12
mov r8d, 0x1000
call qword [r13]
test rax, rax
je 0x18000223a
mov ebx, dword [rbp]
mov edx, dword [rbp + 8]
add rbx, r12
mov r8d, dword [rbp + 4]
mov rcx, rbx
add rdx, qword [rsp + 0x28]
call fcn.180006790
mov r8d, 1
mov dword [rbp - 4], ebx
mov dword [rsp + 0x20], r8d
xor ebx, ebx
mov edx, dword [rsp + 0x24]
add rbp, 0x28
mov rax, qword [rdi]
inc edx
mov dword [rsp + 0x24], edx
movzx ecx, word [rax + 6]
cmp edx, ecx
jl 0x18000212e
test r8d, r8d
je 0x18000223a
mov r8, qword [rax + 0x30]
sub r8, qword [rsi + 0x30]
je 0x18000220d
mov rdx, rdi
call fcn.180001c24
jmp 0x180002212
mov eax, 1
mov rdx, rdi
mov dword [rdi + 0x24], eax
call fcn.180001ce4
mov rdx, rdi
test eax, eax
jne 0x18000222e
call fcn.1800022d4
jmp 0x180001f2c
mov rcx, r13
call fcn.180001a88
test eax, eax
jne 0x18000223f
mov rdx, rdi
jmp 0x180002224
mov rcx, qword [rdi]
mov eax, dword [rcx + 0xd0]
test eax, eax
je 0x18000227f
mov rsi, qword [rdi + 8]
mov rbx, qword [rax + rsi + 0x18]
test rbx, rbx
je 0x18000227d
mov rax, qword [rbx]
test rax, rax
je 0x18000227d
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 1]
call rax
lea rbx, [rbx + 8]
mov rax, qword [rbx]
test rax, rax
jne 0x180002262
mov rcx, qword [rdi]
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1800022c1
mov eax, dword [rcx + 0x28]
add rax, r14
cmp dword [rdi + 0x20], ebx
je 0x1800022b8
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 1]
call rax
test eax, eax
jne 0x1800022ac
mov ecx, 0x45a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x18000223a
mov dword [rdi + 0x1c], 1
jmp 0x180001f30
mov qword [rdi + 0x48], rax
jmp 0x180001f30
mov qword [rdi + 0x48], rbx
jmp 0x180001f30
mov ecx, 0xd
jmp 0x1800022a4