Function at 0x140002048
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0xaa0
mov dword [rsp + 0x80], 0
lea rax, [rsp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov qword [rsp + 0x120], 0
lea rax, [rsp + 0x128]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x840], ax
mov r8d, 0x104
lea rdx, [rsp + 0x840]
xor ecx, ecx
call qword [0x140007220]
mov dword [rsp + 0x358], eax
cmp dword [rsp + 0x358], 0
jne 0x1400020c9
jmp 0x14000296d
xor eax, eax
mov word [rsp + 0x140], ax
lea rax, [rsp + 0x142]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov byte [rsp + 0x118], 0
mov eax, dword [rsp + 0xab0]
mov dword [rsp + 0xa90], eax
cmp dword [rsp + 0xa90], 0
je 0x14000211d
cmp dword [rsp + 0xa90], 1
je 0x14000213b
cmp dword [rsp + 0xa90], 3
je 0x140002159
jmp 0x140002177
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x140]
call fcn.140001f88
mov byte [rsp + 0x118], al
jmp 0x14000217c
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x140]
call fcn.140001fc8
mov byte [rsp + 0x118], al
jmp 0x14000217c
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x140]
call fcn.140002008
mov byte [rsp + 0x118], al
jmp 0x14000217c
jmp 0x14000296d
movzx eax, byte [rsp + 0x118]
test eax, eax
jne 0x14000218d
jmp 0x14000296d
lea rax, [rsp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x140]
call qword [0x140007210]
test eax, eax
jne 0x1400021e8
jmp 0x14000296d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0x840]
call qword [0x140007108]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0xffffffffffffffff
jne 0x14000222f
jmp 0x14000296d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [0x1400072a8]
mov dword [rsp + 0x100], eax
cmp dword [rsp + 0x100], 0xffffffff
je 0x140002257
cmp dword [rsp + 0x100], 0
jne 0x140002267
mov rcx, qword [rsp + 0x50]
call qword [0x140007100]
jmp 0x14000296d
mov eax, dword [rsp + 0x100]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [0x140007160]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
jne 0x1400022a1
mov rcx, qword [rsp + 0x50]
call qword [0x140007100]
jmp 0x14000296d
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x138]
mov r8d, dword [rsp + 0x100]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call qword [0x140007168]
test eax, eax
jne 0x1400022f1
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007178]
mov rcx, qword [rsp + 0x50]
call qword [0x140007100]
jmp 0x14000296d
mov rcx, qword [rsp + 0x50]
call qword [0x140007100]
mov qword [rsp + 0x370], 0
lea rax, [rsp + 0x378]
mov rdi, rax
xor eax, eax
mov ecx, 0x4c8
rep stosb byte [rdi], al
mov dword [rsp + 0x3a0], 0x10000b
lea rdx, [rsp + 0x370]
mov rcx, qword [rsp + 0x128]
call qword [0x140007330]
test eax, eax
jne 0x140002359
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007178]
jmp 0x14000296d
mov qword [rsp + 0x110], 0
mov rax, qword [rsp + 0x3f8]
add rax, 0x10
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x110]
mov rdx, rax
mov rcx, qword [rsp + 0x120]
call qword [0x1400072e8]
lea rcx, str.ntdll
call qword [0x140007328]
mov qword [rsp + 0xf8], rax
lea rdx, str.NtUnmapViewOfSection
mov rcx, qword [rsp + 0xf8]
call qword [0x1400070a8]
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x120]
call qword [rsp + 0x68]
test eax, eax
je 0x1400023f8
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007178]
jmp 0x14000296d
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, eax
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x120]
call qword [0x140007320]
mov qword [rsp + 0x360], rax
cmp qword [rsp + 0x360], 0
jne 0x14000247b
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007178]
jmp 0x14000296d
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax + 0x54]
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x120]
call qword [0x1400072e0]
test eax, eax
jne 0x1400024c9
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007178]
jmp 0x14000296d
mov dword [rsp + 0xa50], 0
jmp 0x1400024e6
mov eax, dword [rsp + 0xa50]
inc eax
mov dword [rsp + 0xa50], eax
mov rax, qword [rsp + 0xf0]
movzx eax, word [rax + 6]
cmp dword [rsp + 0xa50], eax
jge 0x1400025a7
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0xa50]
imul rcx, rcx, 0x28
lea rax, [rax + rcx + 0x108]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov eax, dword [rax + 0x10]
mov rcx, qword [rsp + 0x108]
mov ecx, dword [rcx + 0x14]
mov rdx, qword [rsp + 0x60]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x108]
mov edx, dword [rdx + 0xc]
mov rdi, qword [rsp + 0x360]
add rdi, rdx
mov rdx, rdi
mov qword [rsp + 0x20], 0
mov r9d, eax
mov r8, rcx
mov rcx, qword [rsp + 0x120]
call qword [0x1400072e0]
test eax, eax
jne 0x1400025a2
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007178]
jmp 0x14000296d
jmp 0x1400024d6
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax + 0x30]
mov rcx, qword [rsp + 0x110]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x110]
mov qword [rax + 0x30], rcx
mov dword [rsp + 0xa54], 0
jmp 0x140002600
mov eax, dword [rsp + 0xa54]
inc eax
mov dword [rsp + 0xa54], eax
mov rax, qword [rsp + 0xf0]
movzx eax, word [rax + 6]
cmp dword [rsp + 0xa54], eax
jge 0x140002898
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rsp + 0xa54]
imul rcx, rcx, 0x28
lea rax, [rax + rcx + 0x108]
mov qword [rsp + 0x108], rax
mov r8d, 6
lea rdx, str..reloc
mov rcx, qword [rsp + 0x108]
call qword [0x140007318]
cmp rax, 6
je 0x14000266c
jmp 0x1400025f0
mov rax, qword [rsp + 0x108]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0xa5c], eax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax + 0xb0]
mov qword [rsp + 0xa60], rax
mov dword [rsp + 0xa58], 0
mov eax, dword [rsp + 0xa64]
cmp dword [rsp + 0xa58], eax
jae 0x140002893
mov eax, dword [rsp + 0xa58]
mov ecx, dword [rsp + 0xa5c]
add ecx, eax
mov eax, ecx
mov eax, eax
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa70], rax
mov eax, dword [rsp + 0xa58]
add rax, 8
mov dword [rsp + 0xa58], eax
mov rax, qword [rsp + 0xa70]
mov eax, dword [rax + 4]
sub rax, 8
xor edx, edx
mov ecx, 2
div rcx
mov dword [rsp + 0xa68], eax
mov eax, dword [rsp + 0xa58]
mov ecx, dword [rsp + 0xa5c]
add ecx, eax
mov eax, ecx
mov eax, eax
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa78], rax
mov dword [rsp + 0xa80], 0
jmp 0x140002751
mov eax, dword [rsp + 0xa80]
inc eax
mov dword [rsp + 0xa80], eax
mov eax, dword [rsp + 0xa68]
cmp dword [rsp + 0xa80], eax
jae 0x14000288e
mov eax, dword [rsp + 0xa58]
add rax, 2
mov dword [rsp + 0xa58], eax
movsxd rax, dword [rsp + 0xa80]
mov rcx, qword [rsp + 0xa78]
movzx eax, word [rcx + rax*2]
shr ax, 0xc
and ax, 0xf
movzx eax, ax
test eax, eax
jne 0x14000279c
jmp 0x140002741
movsxd rax, dword [rsp + 0xa80]
mov ecx, 0xfff
mov rdx, qword [rsp + 0xa78]
movzx eax, word [rdx + rax*2]
and ax, cx
movzx eax, ax
mov rcx, qword [rsp + 0xa70]
add eax, dword [rcx]
mov dword [rsp + 0xa84], eax
mov qword [rsp + 0xa88], 0
mov eax, dword [rsp + 0xa84]
mov rcx, qword [rsp + 0x110]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0xa88]
mov rdx, rax
mov rcx, qword [rsp + 0x120]
call qword [0x1400072e8]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xa88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xa88], rax
mov eax, dword [rsp + 0xa84]
mov rcx, qword [rsp + 0x110]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0xa88]
mov rdx, rax
mov rcx, qword [rsp + 0x120]
call qword [0x1400072e0]
test eax, eax
jne 0x140002889
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007178]
jmp 0x14000296d
jmp 0x140002741
jmp 0x1400026a0
jmp 0x1400025f0
mov rax, qword [rsp + 0xf0]
add rax, 0x30
mov rcx, qword [rsp + 0x3f8]
add rcx, 0x10
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rax
mov rdx, rcx
mov rcx, qword [rsp + 0x120]
call qword [0x1400072e0]
mov rax, qword [rsp + 0xf0]
mov eax, dword [rax + 0x28]
mov rcx, qword [rsp + 0x360]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x350], rax
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x3f0], rax
lea rdx, [rsp + 0x370]
mov rcx, qword [rsp + 0x128]
call qword [0x140007310]
test eax, eax
jne 0x140002933
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007178]
jmp 0x14000296d
mov rcx, qword [rsp + 0x128]
call qword [0x140007308]
test eax, eax
jne 0x14000295a
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007178]
jmp 0x14000296d
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [0x140007178]
add rsp, 0xaa0
pop rdi
ret