Function at 0x404d70
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push rbp
xor r8d, r8d
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
mov rsi, rcx
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x2b0
movsxd r14, dword [rcx + 0x3c]
lea rdx, [rsp + 0x70]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x70], 0
lea rdi, [rcx + r14]
mov rcx, 0xffffffffffffffff
mov eax, dword [rdi + 0x50]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x68], rax
call fcn.004075c0
mov ebx, eax
mov dword [rsp + 0x40], eax
xor eax, eax
test ebx, ebx
jne 0x4050c2
mov rcx, qword [rsp + 0x70]
mov r8d, dword [rdi + 0x54]
mov rdx, rsi
mov rax, rcx
sub rax, qword [rdi + 0x30]
mov qword [rsp + 0x58], rax
call fcn.004053b0
mov rax, rdi
lea rdi, [rdi + 0x18]
mov r12, qword [rsp + 0x48]
movzx ebx, word [rax + 0x14]
mov qword [rsp + 0x38], rdi
add rbx, rdi
xor edi, edi
cmp word [rax + 6], 0
je 0x404e4c
mov edx, dword [rbx + 0x14]
mov r8d, dword [rbx + 0x10]
add rdi, 1
add rbx, 0x28
mov ecx, dword [rbx - 0x1c]
add rcx, qword [rsp + 0x70]
add rdx, rsi
call fcn.004053b0
movzx eax, word [r12 + 6]
cmp rax, rdi
ja 0x404e22
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x70]
xor ebx, ebx
lea r12, [rsp + 0xa0]
mov edi, dword [rax + 0xb4]
mov eax, dword [rax + 0xb0]
add rax, rdx
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x50], rax
test edi, edi
je 0x404f51
mov rsi, qword [rsp + 0x50]
mov r13d, ebx
lea r10d, [rbx + 8]
mov rcx, r10
add r13, rsi
add r10, rsi
mov eax, dword [r13 + 4]
sub rax, 8
shr rax, 1
test eax, eax
je 0x4050d3
sub eax, 1
lea esi, [rbx + 0xa]
mov r15, r10
lea rdi, [r10 + rax*2 + 2]
sub esi, r10d
nop dword [rax]
lea ebx, [rsi + r15]
test byte [r15 + 1], 0xf0
je 0x404f3a
movzx r10d, word [r15]
mov r9d, 8
mov r8, r12
mov rcx, 0xffffffffffffffff
and r10d, 0xfff
mov r14d, r10d
add r14d, dword [r13]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0xa0], 0
add rdx, r14
call fcn.00407ac0
test eax, eax
jne 0x4050c0
mov rcx, qword [rsp + 0x70]
mov rdx, r12
mov r8d, 8
mov rax, qword [rsp + 0x58]
add qword [rsp + 0xa0], rax
add rcx, r14
call fcn.004053b0
mov rdx, qword [rsp + 0x70]
add r15, 2
cmp rdi, r15
jne 0x404ec0
cmp dword [rsp + 0x44], ebx
ja 0x404e80
mov qword [rsp + 0x78], 0
mov rax, qword [rsp + 0x48]
mov edi, dword [rax + 0x90]
add rdi, rdx
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x4050e4
lea rsi, [rsp + 0x64]
lea r14, [rsp + 0x90]
mov rbx, qword [0x00411cb0]
lea r12, [rsp + 0xa0]
mov qword [rsp + 0x50], rsi
lea r13, [rsp + 0x80]
mov qword [rsp + 0x58], r14
jmp 0x404fb7
add rdi, 0x14
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x4050e4
mov rdx, qword [rsp + 0x70]
mov esi, eax
mov rax, qword [rbx]
add rsi, rdx
mov rcx, rsi
mov r15, qword [rax + 0x128]
call fcn.00407510
mov r9, rsi
mov r8, qword [rsp + 0x50]
mov rcx, r12
add eax, 1
mov edx, 0x208
mov dword [rsp + 0x20], eax
call r15
test eax, eax
jne 0x4050c0
mov rax, qword [rbx]
mov rdx, r12
mov rcx, r13
call qword [rax + 0x120]
mov rax, qword [rbx]
xor edx, edx
xor ecx, ecx
lea r9, [rsp + 0x78]
mov r8, r13
call qword [rax + pe_nt_image_headers64]
test eax, eax
jne 0x4050c0
cmp qword [rsp + 0x78], 0
je 0x404fa3
mov edx, dword [rdi + 0x10]
mov r15, qword [rsp + 0x70]
mov esi, dword [rdi]
add r15, rdx
mov rax, qword [r15]
sub rsi, rdx
test rax, rax
je 0x404fa3
mov r14, r15
jmp 0x405074
mov rax, qword [rbx]
movzx r8d, word [rdx]
mov r9, r14
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [rax + 0x68]
add r14, 8
mov rax, qword [r14]
test rax, rax
je 0x404fa3
lea rdx, [r14 + rsi]
test rax, rax
js 0x405050
add rax, qword [rsp + 0x70]
lea r15, [rax + 2]
mov rcx, r15
call fcn.00407510
mov r9, r14
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov word [rsp + 0x90], ax
mov rcx, qword [rsp + 0x78]
mov word [rsp + 0x92], ax
mov rax, qword [rbx]
mov qword [rsp + 0x98], r15
call qword [rax + 0x68]
jmp 0x405064
xor eax, eax
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ebx, ecx
cmp dword [rsp + 0x44], ebx
ja 0x404e80
jmp 0x404f51
mov rax, qword [rsp + 0x48]
movzx ebx, word [rax + 0x14]
add rbx, qword [rsp + 0x38]
cmp word [rax + 6], 0
je 0x405222
lea r12, [rsp + 0x90]
lea rsi, [rsp + 0x64]
mov r14, rax
mov r13d, dword [rsp + 0x40]
lea rdi, [rsp + 0xa0]
jmp 0x405194
test eax, eax
js 0x4051ac
mov dword [rsp + 0x64], 1
mov r9d, 1
test eax, 0x4000000
je 0x405145
or r9d, 0x200
mov dword [rsp + 0x64], r9d
mov eax, edx
mov r8, r12
mov rdx, rdi
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x90], rax
mov eax, dword [rbx + 0xc]
mov qword [rsp + 0x20], rsi
add rax, qword [rsp + 0x70]
mov qword [rsp + 0xa0], rax
call fcn.004078e0
test eax, eax
jne 0x4050c0
movzx eax, word [r14 + 6]
add r13d, 1
add rbx, 0x28
cmp eax, r13d
jle 0x405222
mov edx, dword [rbx + 0x10]
test edx, edx
je 0x40517e
mov eax, dword [rbx + 0x24]
mov ecx, eax
and ecx, 0x60000000
je 0x40511c
mov r10d, eax
mov r11d, eax
and r10d, 0x20000000
setne r9b
and r11d, 0x40000000
setne r8b
test ecx, ecx
jne 0x4051f9
test eax, eax
js 0x40529d
test r10d, r10d
jne 0x4052b0
test r8b, r8b
je 0x4052b0
mov dword [rsp + 0x64], 2
mov r9d, 2
jmp 0x405132
test r10d, r10d
jne 0x4052d4
test r8b, r8b
je 0x4052d4
test eax, eax
jns 0x4051e6
mov dword [rsp + 0x64], 4
mov r9d, 4
jmp 0x405132
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call fcn.00407750
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0xd4]
test eax, eax
je 0x4052cd
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x70]
mov eax, dword [rax + 0xd0]
mov rbx, qword [rax + rcx + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x40527e
add rbx, 8
xor r8d, r8d
mov edx, 1
call rax
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x70]
test rax, rax
jne 0x405263
mov rax, qword [rsp + 0x48]
xor r8d, r8d
mov edx, 1
mov eax, dword [rax + 0x28]
add rax, rcx
call rax
mov rax, qword [rsp + 0x70]
jmp 0x4050c2
mov dword [rsp + 0x64], 8
mov r9d, 8
jmp 0x405132
test r11d, r11d
jne 0x405316
test r9b, r9b
je 0x405320
mov dword [rsp + 0x64], 0x10
mov r9d, 0x10
jmp 0x405132
mov rcx, qword [rsp + 0x70]
jmp 0x40527e
test r11d, r11d
jne 0x4052f5
test r9b, r9b
je 0x405320
test eax, eax
jns 0x4052ba
mov dword [rsp + 0x64], pe_nt_image_headers64
mov r9d, pe_nt_image_headers64
jmp 0x405132
test r9b, r9b
je 0x405320
test r8b, r8b
je 0x405320
test eax, eax
jns 0x405330
mov dword [rsp + 0x64], 0x40
mov r9d, 0x40
jmp 0x405132
test r9b, r9b
je 0x405320
test r8b, r8b
jne 0x405330
mov dword [rsp + 0x64], 0
xor r9d, r9d
jmp 0x405132
mov dword [rsp + 0x64], 0x20
mov r9d, 0x20
jmp 0x405132