Function at 0x207956cc0
Capabilities:
Enumerate pe sections
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
movsxd r13, dword [rcx + 0x3c]
mov r12, qword [rsp + 0x118]
lea rax, [r13 + 0x108]
mov qword [rsp + 0xe0], rcx
mov rbp, r8
mov qword [rsp + 0xe8], rdx
mov qword [rsp + 0xf8], r9
cmp rax, rdx
ja 0x207957150
add r13, qword [rsp + 0xe0]
cmp dword [r13], 0x4550
jne 0x207957140
cmp word [r13 + 4], 0x8664
jne 0x207957140
mov r9d, dword [r13 + 0x38]
test r9b, 1
jne 0x207957140
movzx eax, word [r13 + 0x14]
movzx edx, word [r13 + 6]
lea rax, [r13 + rax + 0x18]
test edx, edx
je 0x207957190
sub edx, 1
xor ebx, ebx
lea rdx, [rdx + rdx*4]
lea r8, [rax + rdx*8 + 0x28]
mov ecx, dword [rax + 0x10]
mov edx, dword [rax + 0xc]
test ecx, ecx
jne 0x207957120
add rdx, r9
cmp rbx, rdx
cmovb rbx, rdx
add rax, 0x28
cmp r8, rax
jne 0x207956d60
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov edx, dword [rsp + 0x64]
mov esi, dword [r13 + 0x50]
lea rax, [rdx - 1]
neg rdx
add rsi, rax
add rax, rbx
and rsi, rdx
and rax, rdx
cmp rsi, rax
jne 0x207957140
mov rcx, qword [r13 + 0x30]
mov r9d, 4
mov qword [rsp + 0x20], r12
mov rdx, rsi
mov r8d, 0x3000
call rbp
mov r15, rax
test rax, rax
je 0x207957160
xor ebx, ebx
jmp 0x207956e31
mov ecx, 0x10
call sub.msvcrt.dll_malloc
mov r14, rax
mov rdi, rax
test rax, rax
je 0x207957561
movq xmm1, r15
movq xmm0, rbx
mov rdx, rsi
xor ecx, ecx
punpcklqdq xmm0, xmm1
mov r9d, 4
mov r8d, 0x3000
movups xmmword [rax], xmm0
mov qword [rsp + 0x20], r12
call rbp
mov r15, rax
test rax, rax
je 0x2079570d0
mov rbx, r14
mov rdx, r15
lea rax, [r15 + rsi]
mov rdi, r15
shr rdx, 0x20
shr rax, 0x20
cmp rdx, rax
jb 0x207956de0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x78
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x207957442
mov qword [rax + 8], r15
movzx eax, word [r13 + 0x16]
movq xmm0, rbp
movhps xmm0, qword [rsp + 0xf8]
mov qword [rsi + 0x58], r12
shr ax, 0xd
movups xmmword [rsi + 0x28], xmm0
movq xmm0, qword [rsp + 0x100]
and eax, 1
mov qword [rsi + 0x70], rbx
mov dword [rsi + 0x20], eax
mov rax, qword [rsp + 0x110]
movhps xmm0, qword [rsp + 0x108]
movups xmmword [rsi + 0x38], xmm0
mov edx, dword [r13 + 0x54]
mov qword [rsi + 0x48], rax
mov eax, dword [rsp + 0x64]
mov dword [rsi + 0x68], eax
cmp qword [rsp + 0xe8], rdx
jb 0x207957378
mov r9d, 4
mov r8d, 0x1000
mov rcx, r15
mov qword [rsp + 0x20], r12
call rbp
mov r8d, dword [r13 + 0x54]
mov rdx, qword [rsp + 0xe0]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rbx, qword [rsi + 8]
mov rcx, rax
mov rax, qword [rsp + 0xe0]
movsxd r8, dword [rax + 0x3c]
add r8, rcx
movzx eax, word [r8 + 0x14]
mov qword [rsi], r8
mov qword [r8 + 0x30], r15
lea rbp, [r8 + rax + 0x18]
movzx eax, word [r8 + 6]
test ax, ax
je 0x207956fa2
xor edi, edi
mov edx, dword [rbp + 0x10]
test edx, edx
jne 0x2079571a0
mov edx, dword [r13 + 0x38]
test edx, edx
jle 0x207956f8c
mov ecx, dword [rbp + 0xc]
mov rax, qword [rsi + 0x58]
movsxd r12, edx
mov r9d, 4
mov r8d, 0x1000
mov rdx, r12
add rcx, rbx
mov qword [rsp + 0x20], rax
call qword [rsi + 0x28]
test rax, rax
je 0x2079570c0
mov ecx, dword [rbp + 0xc]
mov r8, r12
xor edx, edx
add rcx, rbx
mov dword [rbp + 8], ecx
call sub.msvcrt.dll_memset
mov r8, qword [rsi]
movzx eax, word [r8 + 6]
add edi, 1
movzx edx, ax
add rbp, 0x28
cmp edx, edi
jg 0x207956f31
mov rdi, qword [r8 + 0x30]
mov rbx, qword [rsi + 8]
sub rdi, qword [r13 + 0x30]
jne 0x20795748b
mov dword [rsi + 0x24], 1
mov ecx, dword [r8 + 0x94]
test ecx, ecx
je 0x207957214
mov edi, dword [r8 + 0x90]
mov rbp, qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add rdi, rbx
nop dword [rax + rax]
mov edx, 0x14
mov rcx, rdi
call rbp
test eax, eax
jne 0x207957211
mov ecx, dword [rdi + 0xc]
test ecx, ecx
je 0x207957211
mov rdx, qword [rsi + 0x58]
add rcx, rbx
call qword [rsi + 0x38]
mov r14, rax
test rax, rax
je 0x207957548
mov eax, dword [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
lea edx, [rax + 1]
movsxd rdx, edx
shl rdx, 3
call sub.msvcrt.dll_realloc
test rax, rax
je 0x2079575ba
movsxd rdx, dword [rsi + 0x18]
mov r12d, dword [rdi]
mov qword [rsi + 0x10], rax
mov r13d, dword [rdi + 0x10]
lea ecx, [rdx + 1]
mov dword [rsi + 0x18], ecx
add r13, rbx
mov qword [rax + rdx*8], r14
mov rax, r12
add r12, rbx
test eax, eax
cmove r12, r13
mov rdx, qword [r12]
test rdx, rdx
jne 0x207957089
jmp 0x207957208
lea rdx, [rbx + rdx + 2]
mov rcx, r14
call rax
mov qword [r13], rax
test rax, rax
je 0x2079570a7
mov rdx, qword [r12 + 8]
add r12, 8
add r13, 8
test rdx, rdx
je 0x207957208
mov rax, qword [rsi + 0x40]
mov r8, qword [rsi + 0x58]
test rdx, rdx
jns 0x207957060
movzx edx, dx
mov rcx, r14
call rax
mov qword [r13], rax
test rax, rax
jne 0x207957073
mov rcx, r14
mov rdx, qword [rsi + 0x58]
call qword [rsi + 0x48]
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax]
mov rcx, rsi
xor esi, esi
call fcn.207956b90
jmp 0x207957103
mov rcx, qword [rdi + 8]
xor edx, edx
mov r9, r12
mov r8d, 0x8000
call qword [rsp + 0xf8]
mov rcx, rdi
mov rdi, qword [rdi]
call sub.msvcrt.dll_free
test rdi, rdi
jne 0x2079570d0
mov ecx, 0xe
xor esi, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
add edx, ecx
cmp rbx, rdx
cmovb rbx, rdx
add rax, 0x28
cmp rax, r8
jne 0x207956d60
jmp 0x207956d81
mov ecx, 0xc1
xor esi, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x207957103
mov ecx, 0xd
xor esi, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x207957103
mov qword [rsp + 0x20], r12
mov r9d, 4
mov rdx, rsi
xor ecx, ecx
mov r8d, 0x3000
call rbp
mov r15, rax
test rax, rax
jne 0x207956dd6
jmp 0x2079570f6
xor ebx, ebx
jmp 0x207956d81
mov eax, edx
add eax, dword [rbp + 0x14]
cmp qword [rsp + 0xe8], rax
jb 0x207957378
mov ecx, dword [rbp + 0xc]
mov rax, qword [rsi + 0x58]
mov r9d, 4
mov r8d, 0x1000
add rcx, rbx
mov qword [rsp + 0x20], rax
call qword [rsi + 0x28]
test rax, rax
je 0x2079570c0
mov ecx, dword [rbp + 0xc]
mov r8d, dword [rbp + 0x10]
mov edx, dword [rbp + 0x14]
add rdx, qword [rsp + 0xe0]
add rcx, rbx
call sub.msvcrt.dll_memcpy
mov r8, qword [rsi]
mov dword [rbp + 8], eax
movzx eax, word [r8 + 6]
jmp 0x207956f8c
add rdi, 0x14
jmp 0x207956fd8
mov r8, qword [rsi]
movzx eax, word [r8 + 0x14]
mov ebx, dword [rsi + 0x68]
movabs r14, 0xffffffff00000000
and r14, qword [r8 + 0x30]
lea rbp, [r8 + rax + 0x18]
mov rcx, rbx
mov eax, dword [rbp + 8]
neg rcx
mov edx, dword [rbp + 0x10]
mov r9d, dword [rbp + 0x24]
or rax, r14
and rcx, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
test edx, edx
je 0x207957422
mov dword [rsp + 0x58], r9d
movzx r9d, word [r8 + 6]
add rbp, 0x28
lea r10, [rsp + 0x40]
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x5c], 0
cmp r9w, 1
jbe 0x207957388
mov r13d, 1
lea r10, [rsp + 0x40]
jmp 0x2079572e9
mov rdx, r10
mov rcx, rsi
mov qword [rsp + 0x38], r10
call fcn.2079564e0
test eax, eax
je 0x2079570c0
mov edx, dword [rbp + 0x24]
mov r8, qword [rsi]
mov qword [rsp + 0x40], rdi
mov rax, rdi
mov qword [rsp + 0x48], rbx
mov r10, qword [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x50], r12
movzx r9d, word [r8 + 6]
mov dword [rsp + 0x58], edx
add r13d, 1
movzx edx, r9w
add rbp, 0x28
cmp edx, r13d
jle 0x207957388
mov ebx, dword [rsi + 0x68]
mov edi, dword [rbp + 8]
mov edx, dword [rbp + 0x10]
neg rbx
or rdi, r14
mov r12d, edx
and rbx, rdi
test edx, edx
jne 0x20795730b
mov edx, dword [rbp + 0x24]
test dl, 0x40
je 0x207957360
mov r12d, dword [r8 + 0x20]
cmp rbx, rcx
je 0x207957321
mov rdx, qword [rsp + 0x50]
add rdx, rax
cmp rbx, rdx
jae 0x207957290
mov r11d, dword [rbp + 0x24]
mov ebx, dword [rsp + 0x58]
mov edx, r11d
or edx, ebx
and r11d, 0x2000000
je 0x20795733f
and ebx, 0x2000000
jne 0x207957345
and edx, 0xfdffffff
sub rdi, rax
mov dword [rsp + 0x58], edx
lea rdx, [rdi + r12]
mov qword [rsp + 0x50], rdx
jmp 0x2079572d1
xor r12d, r12d
and edx, 0x80
je 0x20795730b
mov r12d, dword [r8 + 0x24]
jmp 0x20795730b
mov ecx, 0xd
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x2079570c0
mov rdx, r10
mov rcx, rsi
mov dword [rsp + 0x5c], 1
call fcn.2079564e0
test eax, eax
je 0x2079570c0
mov rdx, qword [rsi]
mov eax, dword [rdx + 0xd0]
test eax, eax
je 0x2079573ec
mov rdi, qword [rsi + 8]
mov rbx, qword [rdi + rax + 0x18]
test rbx, rbx
je 0x2079573ec
mov rax, qword [rbx]
test rax, rax
je 0x2079573ec
nop word cs:[rax + rax]
add rbx, 8
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call rax
mov rax, qword [rbx]
test rax, rax
jne 0x2079573d0
mov rdx, qword [rsi]
mov eax, dword [rdx + 0x28]
test eax, eax
je 0x207957435
mov edx, dword [rsi + 0x20]
add rax, r15
test edx, edx
je 0x207957558
xor r8d, r8d
mov edx, 1
mov rcx, r15
call rax
test eax, eax
je 0x2079575aa
mov dword [rsi + 0x1c], 1
jmp 0x207957103
test r9b, 0x40
je 0x207957533
mov edx, dword [r8 + 0x20]
jmp 0x207957257
mov qword [rsi + 0x60], 0
jmp 0x207957103
xor edx, edx
mov r9, r12
mov r8d, 0x8000
mov rcx, r15
call qword [rsp + 0xf8]
test rbx, rbx
je 0x2079570f6
mov rcx, qword [rbx + 8]
xor edx, edx
mov r9, r12
mov r8d, 0x8000
call qword [rsp + 0xf8]
mov rcx, rbx
mov rbx, qword [rbx]
call sub.msvcrt.dll_free
test rbx, rbx
jne 0x207957460
jmp 0x2079570f6
mov r9d, dword [r8 + 0xb4]
xor eax, eax
test r9d, r9d
je 0x20795752b
mov r11d, dword [r8 + 0xb0]
add r11, rbx
mov r9d, dword [r11]
test r9d, r9d
je 0x207957526
nop
mov r12d, dword [r11 + 4]
add r9, rbx
lea ebp, [r12 - 8]
mov eax, ebp
shr eax, 1
je 0x20795751b
xor edx, edx
jmp 0x2079574e9
cmp cx, 0xa
jne 0x2079574dd
movzx eax, ax
add qword [r9 + rax], rdi
mov eax, ebp
add rdx, 1
shr eax, 1
cmp eax, edx
jbe 0x20795751b
movzx eax, word [r11 + rdx*2 + 8]
mov ecx, eax
and ax, 0xfff
shr cx, 0xc
cmp cx, 3
jne 0x2079574d0
movzx eax, ax
add rdx, 1
add dword [r9 + rax], edi
mov r12d, dword [r11 + 4]
lea ebp, [r12 - 8]
mov eax, ebp
shr eax, 1
cmp eax, edx
ja 0x2079574e9
add r11, r12
mov r9d, dword [r11]
test r9d, r9d
jne 0x2079574b0
mov eax, 1
mov dword [rsi + 0x24], eax
jmp 0x207956fb3
xor edx, edx
test r9b, 0x80
je 0x207957257
mov edx, dword [r8 + 0x24]
jmp 0x207957257
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x2079570c0
mov qword [rsi + 0x60], rax
jmp 0x207957103
xor edx, edx
mov r9, r12
mov r8d, 0x8000
mov rcx, r15
call qword [rsp + 0xf8]
test rbx, rbx
je 0x2079570f6
mov rcx, qword [rbx + 8]
xor edx, edx
mov r9, r12
mov r8d, 0x8000
call qword [rsp + 0xf8]
mov rcx, rbx
mov rbx, qword [rbx]
call sub.msvcrt.dll_free
test rbx, rbx
jne 0x20795757f
jmp 0x2079570f6
mov ecx, 0x45a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x2079570c0
mov rcx, r14
mov rdx, qword [rsi + 0x58]
call qword [rsi + 0x48]
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x2079570c0