Function at 0x140184f90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r13, qword [0x14043ff88]
mov r14d, 1
mov rsi, rdx
mov eax, r14d
lea rbx, [r13 + 0x70]
lock xadd dword [rbx + 0x4c], eax
add eax, r14d
xor r15d, r15d
test eax, eax
jle 0x140184ff8
mov rcx, qword [rbx + 0x40]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, r14d
lock xadd dword [rbx + 0x4c], eax
add eax, r14d
test eax, eax
jg 0x140184fd4
mov r8, qword [rsp + 0xb0]
lea r12, [r13 + 0x60]
mov rcx, qword [r12]
cmp rcx, r12
je 0x140185063
mov rdx, qword [rcx + 0x478]
cmp rsi, rdx
jbe 0x14018501f
mov eax, dword [rcx + 0x480]
add rax, rdx
cmp rsi, rax
jb 0x140185024
mov rcx, qword [rcx]
jmp 0x140185000
mov rdx, rsi
call fcn.1401855b0
mov edi, eax
test rbx, rbx
je 0x140185050
or ecx, 0xffffffff
lock xadd dword [rbx + 0x4c], ecx
sub ecx, r14d
jle 0x140185050
mov rcx, qword [rbx + 0x38]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, edi
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test rbx, rbx
je 0x140185085
or eax, 0xffffffff
lock xadd dword [rbx + 0x4c], eax
sub eax, r14d
jle 0x140185085
mov rcx, qword [rbx + 0x38]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lock add dword [rbx + 0x34], r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rbx + 0x30]
mov ecx, r15d
mov r8d, eax
mov eax, edx
test edx, edx
je 0x1401850b7
cmp dword [rbx + 0x2c], r8d
je 0x1401850b7
mov ecx, edx
mov dword [rbx + 0x30], r15d
mov eax, r15d
inc eax
mov dword [rbx + 0x2c], r8d
mov dword [rbx + 0x30], eax
test ecx, ecx
je 0x1401850cb
neg ecx
lock xadd dword [rbx + 0x34], ecx
mov r14d, 0x40000000
mov edi, r15d
mov eax, r14d
xchg dword [rbx + 0x4c], eax
add eax, r14d
mov dword [rbx + 0x48], eax
test eax, eax
jle 0x1401850f8
mov rcx, qword [rbx + 0x38]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc edi
cmp edi, dword [rbx + 0x48]
jl 0x1401850e4
mov rcx, qword [r12]
mov r15d, 0xc0000000
cmp rcx, r12
je 0x14018512e
mov rdx, qword [rcx + 0x478]
cmp rsi, rdx
jbe 0x140185121
mov eax, dword [rcx + 0x480]
add rax, rdx
cmp rsi, rax
jb 0x140185126
mov rcx, qword [rcx]
jmp 0x140185102
mov rdx, rsi
jmp 0x1401854c5
cmp qword [r13], r13
jne 0x140185153
mov edx, 1
mov rcx, r13
call fcn.140184ba8
mov esi, eax
test eax, eax
js 0x1401853db
mov rsi, qword [rsp + 0xa8]
lea rdi, [r13 + 0x10]
lock inc dword [rdi + 0x34]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rdi + 0x30]
xor r9d, r9d
mov r8d, eax
mov ecx, r9d
mov eax, edx
test edx, edx
je 0x140185187
cmp dword [rdi + 0x2c], r8d
je 0x140185187
mov ecx, edx
mov eax, r9d
inc eax
mov dword [rdi + 0x2c], r8d
mov dword [rdi + 0x30], eax
test ecx, ecx
je 0x14018519b
neg ecx
lock xadd dword [rdi + 0x34], ecx
mov eax, r14d
xchg dword [rdi + 0x4c], eax
add eax, r14d
mov r14d, r9d
mov dword [rdi + 0x48], eax
test eax, eax
jle 0x1401851c4
mov rcx, qword [rdi + 0x38]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc r14d
cmp r14d, dword [rdi + 0x48]
jl 0x1401851ae
mov r14, qword [r13]
cmp qword [r14 + 8], r13
jne 0x14018550a
mov rax, qword [r14]
cmp qword [rax + 8], r14
jne 0x14018550a
mov qword [r13], rax
mov ecx, r15d
mov qword [rax + 8], r13
xchg dword [rdi + 0x4c], ecx
mov edx, dword [rdi + 0x48]
add edx, r15d
add edx, ecx
test edx, edx
jle 0x140185206
mov rcx, qword [rdi + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
dec dword [rdi + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [rdi + 0x34]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
test rax, rax
jne 0x14018524a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x140185490
cmp dword [rsp + 0x50], 0x1000000
jne 0x1401852d2
mov rax, qword [rsp + 0x30]
mov ecx, 0x5a4d
mov qword [rsp + 0x20], rax
cmp word [rax], cx
jne 0x1401852d2
movsxd rsi, dword [rax + 0x3c]
add rsi, rax
cmp rsi, qword [rsp + 0xa8]
ja 0x1401852d2
cmp dword [rsi], 0x4550
jne 0x1401852d2
mov ecx, edx
mov dword [rsp + 0xa0], edx
cmp dx, word [rsi + 6]
jae 0x1401852d2
mov eax, ecx
lea rcx, [rax + rax*4]
movzx eax, word [rsi + 0x14]
add rax, 0x18
mov qword [rsp + 0xb8], rcx
add rax, rsi
lea rcx, [rax + rcx*8]
call fcn.14018eb30
cmp al, 1
je 0x140185413
mov ecx, dword [rsp + 0xa0]
movzx eax, word [rsi + 6]
inc ecx
mov dword [rsp + 0xa0], ecx
cmp ecx, eax
jb 0x140185290
mov esi, 1
xor r12d, r12d
mov dword [r14 + 0x20], 0x400
lea rax, [r14 + 0x10]
mov qword [r14 + 0x478], r12
lea rcx, [0x1403ab4f8]
mov qword [r14 + 0x488], r12
mov qword [rax], rcx
lea rcx, [r14 + 0x28]
mov qword [rcx + 8], rax
lea rax, [r14 + 0x78]
mov qword [r14 + 0x18], rax
mov word [rcx], r12w
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
mov qword [rcx + 0x38], r12
mov qword [rcx + 0x48], r12
mov qword [rcx + 0x30], rcx
lock inc dword [rdi + 0x34]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rdi + 0x30]
mov ecx, r12d
mov r8d, eax
mov eax, edx
test edx, edx
je 0x140185353
cmp dword [rdi + 0x2c], r8d
je 0x140185353
mov ecx, edx
mov eax, r12d
inc eax
mov dword [rdi + 0x2c], r8d
mov dword [rdi + 0x30], eax
test ecx, ecx
je 0x140185367
neg ecx
lock xadd dword [rdi + 0x34], ecx
mov eax, 0x40000000
xchg dword [rdi + 0x4c], eax
add eax, 0x40000000
mov dword [rdi + 0x48], eax
test eax, eax
jle 0x140185391
mov rcx, qword [rdi + 0x38]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc r12d
cmp r12d, dword [rdi + 0x48]
jl 0x14018537b
mov rax, qword [r13 + 8]
cmp qword [rax], r13
jne 0x14018550a
mov qword [r14], r13
mov ecx, r15d
mov qword [r14 + 8], rax
mov qword [rax], r14
mov qword [r13 + 8], r14
xchg dword [rdi + 0x4c], ecx
mov edx, dword [rdi + 0x48]
add edx, r15d
add edx, ecx
test edx, edx
jle 0x1401853cb
mov rcx, qword [rdi + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
dec dword [rdi + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [rdi + 0x34]
xchg dword [rbx + 0x4c], r15d
mov edx, dword [rbx + 0x48]
add edx, 0xc0000000
add edx, r15d
test edx, edx
jle 0x1401853fc
mov rcx, qword [rbx + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
dec dword [rbx + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [rbx + 0x34]
mov eax, esi
jmp 0x140185052
lfence
movzx eax, word [rsi + 0x14]
mov rcx, qword [rsp + 0xb8]
add rax, rsi
add rcx, 3
lea r8, [rax + rcx*8]
test r8, r8
je 0x1401852d2
mov eax, dword [rsi + 0x50]
mov rcx, qword [rsp + 0x20]
mov qword [r14 + 0x478], rcx
mov dword [r14 + 0x480], eax
mov edx, dword [r8 + 0xc]
add rdx, rcx
lea rcx, [r14 + 0x28]
mov qword [r14 + 0x488], rdx
mov r8d, dword [r8 + 0x10]
call fcn.14018ebb8
mov esi, eax
test eax, eax
js 0x1401852d7
mov rax, qword [r14 + 0x488]
movups xmm0, xmmword [rax + 0xc]
movups xmmword [r14 + 0x490], xmm0
movups xmm1, xmmword [rax + 0x1c]
movups xmmword [r14 + 0x4a0], xmm1
test esi, esi
js 0x1401852d7
cmp esi, 1
je 0x1401852d7
mov rax, qword [r12 + 8]
cmp qword [rax], r12
jne 0x14018550a
mov rdx, qword [rsp + 0xa8]
mov rcx, r14
mov qword [r14], r12
mov qword [r14 + 8], rax
mov qword [rax], r14
mov qword [r12 + 8], r14
mov r8, qword [rsp + 0xb0]
call fcn.1401855b0
xchg dword [rbx + 0x4c], r15d
mov edx, dword [rbx + 0x48]
mov edi, eax
add edx, 0xc0000000
add edx, r15d
test edx, edx
jle 0x1401854f5
mov rcx, qword [rbx + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
dec dword [rbx + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [rbx + 0x34]
jmp 0x140185050
mov ecx, 3
int 0x29
int3