Function at 0x14017ccf4
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r13, qword [0x140422748]
mov r14d, 1
mov rsi, rdx
mov eax, r14d
lea rbx, [r13 + 0x70]
lock xadd dword [rbx + 0x4c], eax
add eax, r14d
xor r15d, r15d
test eax, eax
jle 0x14017cd5c
mov rcx, qword [rbx + 0x40]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, r14d
lock xadd dword [rbx + 0x4c], eax
add eax, r14d
test eax, eax
jg 0x14017cd38
mov r8, qword [rsp + 0xb0]
lea r12, [r13 + 0x60]
mov rcx, qword [r12]
cmp rcx, r12
je 0x14017cdc6
mov rdx, qword [rcx + 0x478]
cmp rsi, rdx
jbe 0x14017cd83
mov eax, dword [rcx + 0x480]
add rax, rdx
cmp rsi, rax
jb 0x14017cd88
mov rcx, qword [rcx]
jmp 0x14017cd64
mov rdx, rsi
call fcn.14017d2f4
mov edi, eax
test rbx, rbx
je 0x14017cdb4
or ecx, 0xffffffff
lock xadd dword [rbx + 0x4c], ecx
sub ecx, r14d
jle 0x14017cdb4
mov rcx, qword [rbx + 0x38]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, edi
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test rbx, rbx
je 0x14017cde8
or eax, 0xffffffff
lock xadd dword [rbx + 0x4c], eax
sub eax, r14d
jle 0x14017cde8
mov rcx, qword [rbx + 0x38]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lock add dword [rbx + 0x34], r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, r15d
cmp dword [rbx + 0x30], r15d
je 0x14017ce11
cmp dword [rbx + 0x2c], eax
je 0x14017ce11
mov ecx, dword [rbx + 0x30]
mov dword [rbx + 0x30], r15d
add dword [rbx + 0x30], r14d
mov dword [rbx + 0x2c], eax
test ecx, ecx
je 0x14017ce23
neg ecx
lock xadd dword [rbx + 0x34], ecx
mov r14d, 0x40000000
mov edi, r15d
mov eax, r14d
xchg dword [rbx + 0x4c], eax
add eax, r14d
mov dword [rbx + 0x48], eax
test eax, eax
jle 0x14017ce50
mov rcx, qword [rbx + 0x38]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc edi
cmp edi, dword [rbx + 0x48]
jl 0x14017ce3c
mov rcx, qword [r12]
mov r15d, 0xc0000000
cmp rcx, r12
je 0x14017ce86
mov rdx, qword [rcx + 0x478]
cmp rsi, rdx
jbe 0x14017ce79
mov eax, dword [rcx + 0x480]
add rax, rdx
cmp rsi, rax
jb 0x14017ce7e
mov rcx, qword [rcx]
jmp 0x14017ce5a
mov rdx, rsi
jmp 0x14017d1a2
cmp qword [r13], r13
jne 0x14017ceab
mov edx, 1
mov rcx, r13
call fcn.14017c930
mov esi, eax
test eax, eax
js 0x14017d224
mov rsi, qword [rsp + 0xa8]
lea rdi, [r13 + 0x10]
lock inc dword [rdi + 0x34]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
mov ecx, r8d
cmp dword [rdi + 0x30], r8d
je 0x14017ceda
cmp dword [rdi + 0x2c], eax
je 0x14017ceda
mov ecx, dword [rdi + 0x30]
mov dword [rdi + 0x30], r8d
inc dword [rdi + 0x30]
mov dword [rdi + 0x2c], eax
test ecx, ecx
je 0x14017ceeb
neg ecx
lock xadd dword [rdi + 0x34], ecx
mov eax, r14d
xchg dword [rdi + 0x4c], eax
add eax, r14d
mov r14d, r8d
mov dword [rdi + 0x48], eax
test eax, eax
jle 0x14017cf14
mov rcx, qword [rdi + 0x38]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc r14d
cmp r14d, dword [rdi + 0x48]
jl 0x14017cefe
mov r14, qword [r13]
cmp qword [r14 + 8], r13
jne 0x14017d25c
mov rax, qword [r14]
cmp qword [rax + 8], r14
jne 0x14017d25c
mov qword [r13], rax
mov ecx, r15d
mov qword [rax + 8], r13
xchg dword [rdi + 0x4c], ecx
mov edx, dword [rdi + 0x48]
add edx, r15d
add edx, ecx
test edx, edx
jle 0x14017cf56
mov rcx, qword [rdi + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
dec dword [rdi + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [rdi + 0x34]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
test rax, rax
jne 0x14017cf9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x14017d166
cmp dword [rsp + 0x50], 0x1000000
jne 0x14017d022
mov rax, qword [rsp + 0x30]
mov ecx, 0x5a4d
mov qword [rsp + 0x20], rax
cmp word [rax], cx
jne 0x14017d022
movsxd rsi, dword [rax + 0x3c]
add rsi, rax
cmp rsi, qword [rsp + 0xa8]
ja 0x14017d022
cmp dword [rsi], 0x4550
jne 0x14017d022
mov ecx, edx
mov dword [rsp + 0xa0], edx
cmp dx, word [rsi + 6]
jae 0x14017d022
mov eax, ecx
lea rcx, [rax + rax*4]
movzx eax, word [rsi + 0x14]
add rax, 0x18
mov qword [rsp + 0xb8], rcx
add rax, rsi
lea rcx, [rax + rcx*8]
call fcn.1401865bc
cmp al, 1
je 0x14017d0ec
mov ecx, dword [rsp + 0xa0]
movzx eax, word [rsi + 6]
inc ecx
mov dword [rsp + 0xa0], ecx
cmp ecx, eax
jb 0x14017cfe0
mov esi, 1
xor r12d, r12d
lea rcx, [r14 + 0x10]
lea rax, [0x14038c328]
mov qword [rcx], rax
lea rax, [r14 + 0x28]
mov word [rax], r12w
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], r12
mov qword [rax + 0x38], r12
mov qword [rax + 0x48], r12
mov qword [rax + 0x30], rax
lea rax, [r14 + 0x78]
mov qword [r14 + 0x478], r12
mov qword [r14 + 0x488], r12
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], 0x400
lock inc dword [rdi + 0x34]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, r12d
cmp dword [rdi + 0x30], r12d
je 0x14017d09d
cmp dword [rdi + 0x2c], eax
je 0x14017d09d
mov ecx, dword [rdi + 0x30]
mov dword [rdi + 0x30], r12d
inc dword [rdi + 0x30]
mov dword [rdi + 0x2c], eax
test ecx, ecx
je 0x14017d0ae
neg ecx
lock xadd dword [rdi + 0x34], ecx
mov eax, 0x40000000
xchg dword [rdi + 0x4c], eax
add eax, 0x40000000
mov dword [rdi + 0x48], eax
test eax, eax
jle 0x14017d0d8
mov rcx, qword [rdi + 0x38]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc r12d
cmp r12d, dword [rdi + 0x48]
jl 0x14017d0c2
mov rax, qword [r13 + 8]
cmp qword [rax], r13
je 0x14017d1e7
mov ecx, 3
int 0x29
movzx eax, word [rsi + 0x14]
mov rcx, qword [rsp + 0xb8]
add rax, rsi
add rcx, 3
lea r8, [rax + rcx*8]
test r8, r8
je 0x14017d022
mov eax, dword [rsi + 0x50]
mov rcx, qword [rsp + 0x20]
mov qword [r14 + 0x478], rcx
mov dword [r14 + 0x480], eax
mov edx, dword [r8 + 0xc]
add rdx, rcx
lea rcx, [r14 + 0x28]
mov qword [r14 + 0x488], rdx
mov r8d, dword [r8 + 0x10]
call fcn.140186638
mov esi, eax
test eax, eax
js 0x14017d027
mov rax, qword [r14 + 0x488]
movups xmm0, xmmword [rax + 0xc]
movups xmmword [r14 + 0x490], xmm0
movups xmm1, xmmword [rax + 0x1c]
movups xmmword [r14 + 0x4a0], xmm1
test esi, esi
js 0x14017d027
cmp esi, 1
je 0x14017d027
mov rax, qword [r12 + 8]
cmp qword [rax], r12
je 0x14017d188
mov ecx, 3
int 0x29
mov rdx, qword [rsp + 0xa8]
mov rcx, r14
mov qword [r14], r12
mov qword [r14 + 8], rax
mov qword [rax], r14
mov qword [r12 + 8], r14
mov r8, qword [rsp + 0xb0]
call fcn.14017d2f4
xchg dword [rbx + 0x4c], r15d
mov edx, dword [rbx + 0x48]
mov edi, eax
add edx, 0xc0000000
add edx, r15d
test edx, edx
jle 0x14017d1d2
mov rcx, qword [rbx + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
dec dword [rbx + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [rbx + 0x34]
jmp 0x14017cdb4
mov qword [r14], r13
mov ecx, r15d
mov qword [r14 + 8], rax
mov qword [rax], r14
mov qword [r13 + 8], r14
xchg dword [rdi + 0x4c], ecx
mov edx, dword [rdi + 0x48]
add edx, r15d
add edx, ecx
test edx, edx
jle 0x14017d214
mov rcx, qword [rdi + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
dec dword [rdi + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [rdi + 0x34]
xchg dword [rbx + 0x4c], r15d
mov edx, dword [rbx + 0x48]
add edx, 0xc0000000
add edx, r15d
test edx, edx
jle 0x14017d245
mov rcx, qword [rbx + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
dec dword [rbx + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [rbx + 0x34]
mov eax, esi
jmp 0x14017cdb6
mov ecx, 3
int 0x29
int3