Function at 0x1e18b0
Capabilities:
Enumerate pe sections
Get system information on windows
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov rsi, qword [rsp + 0x128]
cmp rdx, 0x3f
mov r12, rcx
mov qword [rsp + 0xf8], rdx
mov rdi, r8
mov r13, r9
jbe 0x1e18fe
cmp word [rcx], 0x5a4d
jne 0x1e1912
movsxd r10, dword [rcx + 0x3c]
lea rax, [r10 + 0x108]
cmp rax, qword [rsp + 0xf8]
jbe 0x1e1905
mov ecx, 0xd
jmp 0x1e1917
lea r15, [rcx + r10]
cmp dword [r15], 0x4550
je 0x1e1924
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x1e1fa7
cmp word [r15 + 4], 0x8664
jne 0x1e1912
mov ecx, dword [r15 + 0x38]
test cl, 1
jne 0x1e1912
movzx edx, word [r15 + 6]
xor ebx, ebx
movzx eax, word [r15 + 0x14]
imul rdx, rdx, 0x28
lea rax, [r15 + rax + 0x18]
add rdx, rax
cmp rax, rdx
je 0x1e1975
mov r11d, dword [rax + 0x10]
mov r8d, dword [rax + 0xc]
test r11d, r11d
lea r9d, [r11 + r8]
jne 0x1e1968
lea r9, [r8 + rcx]
cmp rbx, r9
cmovb rbx, r9
add rax, 0x28
jmp 0x1e194e
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x74]
mov edx, dword [r15 + 0x50]
lea r8, [rax - 1]
neg rax
add rbx, r8
mov rcx, rax
and rbx, rax
lea rax, [rdx + r8]
and rax, rcx
cmp rbx, rax
jne 0x1e1912
mov rcx, qword [r15 + 0x30]
mov r9d, 4
mov qword [rsp + 0x20], rsi
mov rdx, rbx
mov r8d, 0x3000
call rdi
test rax, rax
mov rbp, rax
jne 0x1e19f3
xor ecx, ecx
mov qword [rsp + 0x20], rsi
mov r9d, 4
mov rdx, rbx
mov r8d, 0x3000
call rdi
mov ecx, 0xe
test rax, rax
mov rbp, rax
je 0x1e1917
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rsp + 0x40], rax
call rax
mov r8d, 0x68
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
mov rbx, rax
jne 0x1e1a3e
mov rcx, rbp
mov r9, rsi
mov r8d, 0x8000
xor edx, edx
call r13
mov ecx, 0xe
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1e1fa7
mov qword [rax + 8], rbp
mov ax, word [r15 + 0x16]
mov edx, dword [r15 + 0x54]
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x30], r13
mov qword [rbx + 0x50], rsi
shr ax, 0xd
and eax, 1
cmp rdx, qword [rsp + 0xf8]
mov dword [rbx + 0x20], eax
mov rax, qword [rsp + 0x110]
mov qword [rbx + 0x38], rax
mov rax, qword [rsp + 0x118]
mov qword [rbx + 0x40], rax
mov rax, qword [rsp + 0x120]
mov qword [rbx + 0x48], rax
mov eax, dword [rsp + 0x74]
mov dword [rbx + 0x60], eax
jbe 0x1e1aa0
mov ecx, 0xd
jmp 0x1e1c23
mov qword [rsp + 0x20], rsi
mov rcx, rbp
mov r9d, 4
mov rsi, r12
mov r8d, 0x1000
call rdi
mov ecx, dword [r15 + 0x54]
mov qword [rsp + 0x38], 0
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
movsxd rdx, dword [r12 + 0x3c]
mov r14, qword [rbx + 8]
add rax, rdx
movzx edx, word [rax + 0x14]
mov qword [rbx], rax
mov qword [rax + 0x30], rbp
lea rax, [rax + rdx + 0x18]
mov qword [rsp + 0x48], rax
imul r11, qword [rsp + 0x38], 0x28
mov rax, qword [rsp + 0x48]
mov rcx, qword [rbx]
lea r13, [r11 + rax]
movzx eax, word [rcx + 6]
cmp eax, dword [rsp + 0x38]
jle 0x1e1cd1
mov edx, dword [r13 + 0x10]
test edx, edx
jne 0x1e1b61
mov esi, dword [r15 + 0x38]
test esi, esi
jle 0x1e1bb8
mov ecx, dword [r13 + 0xc]
movsxd rdx, esi
mov r9d, 4
mov r8d, 0x1000
mov rax, qword [rbx + 0x50]
add rcx, r14
mov qword [rsp + 0x20], rax
call qword [rbx + 0x28]
test rax, rax
je 0x1e1cc4
mov edx, dword [r13 + 0xc]
mov ecx, esi
xor eax, eax
add rdx, r14
mov rdi, rdx
mov dword [r13 + 8], edx
rep stosb byte [rdi], al
jmp 0x1e1bb8
mov eax, edx
add eax, dword [r13 + 0x14]
cmp qword [rsp + 0xf8], rax
jb 0x1e1a96
mov ecx, dword [r13 + 0xc]
mov r9d, 4
mov r8d, 0x1000
mov rax, qword [rbx + 0x50]
add rcx, r14
mov qword [rsp + 0x20], rax
call qword [rbx + 0x28]
test rax, rax
je 0x1e1cc4
mov eax, dword [r13 + 0xc]
mov esi, dword [r13 + 0x14]
mov ecx, dword [r13 + 0x10]
add rax, r14
add rsi, r12
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov dword [r13 + 8], eax
inc qword [rsp + 0x38]
jmp 0x1e1aec
mov eax, 1
mov dword [rbx + 0x24], eax
cmp dword [rcx + 0x94], 0
je 0x1e1c2e
mov r12d, dword [rcx + 0x90]
xor r15d, r15d
mov rax, qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
add r12, r14
mov qword [rsp + 0x38], rax
mov edx, 0x14
mov rcx, r12
mov rax, qword [rsp + 0x38]
call rax
test eax, eax
jne 0x1e1c2e
mov ecx, dword [r12 + 0xc]
test ecx, ecx
je 0x1e1c2e
add rcx, r14
mov rdx, qword [rbx + 0x50]
call qword [rbx + 0x38]
test rax, rax
mov rsi, rax
jne 0x1e1d62
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1e1cc4
movabs r13, 0xffffffff00000000
mov rax, qword [rbx]
movzx edx, word [rax + 0x14]
and r13, qword [rax + 0x30]
lea rsi, [rax + rdx + 0x18]
mov eax, dword [rsi + 8]
or rax, r13
mov rdx, rax
mov qword [rsp + 0x50], rax
mov eax, dword [rbx + 0x60]
neg rax
and rax, rdx
mov edx, dword [rsi + 0x24]
mov qword [rsp + 0x58], rax
mov eax, dword [rsi + 0x10]
test eax, eax
je 0x1e1e3b
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
add rsi, 0x28
mov r12d, 1
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x6c], 0
mov qword [rsp + 0x38], rax
mov rdx, qword [rbx]
movzx eax, word [rdx + 6]
cmp r12d, eax
jl 0x1e1e5c
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov dword [rsp + 0x6c], 1
call fcn.001e14c3
test eax, eax
jne 0x1e1f0c
mov rcx, rbx
call fcn.001e1808
jmp 0x1e191d
mov rax, qword [rcx + 0x30]
sub rax, qword [r15 + 0x30]
mov r14, qword [rbx + 8]
mov r10, rax
je 0x1e1d56
xor eax, eax
cmp dword [rcx + 0xb4], 0
je 0x1e1bc7
mov r9d, dword [rcx + 0xb0]
add r9, r14
mov r8d, dword [r9]
test r8d, r8d
je 0x1e1bc2
lea rsi, [r9 + 8]
add r8, r14
xor r11d, r11d
mov eax, dword [r9 + 4]
lea edx, [rax - 8]
shr edx, 1
cmp r11d, edx
jae 0x1e1d51
mov dx, word [rsi]
mov eax, edx
shr dx, 0xc
and ax, 0xfff
cmp dx, 3
je 0x1e1d41
cmp dx, 0xa
jne 0x1e1d48
movzx eax, ax
add qword [r8 + rax], r10
jmp 0x1e1d48
movzx eax, ax
add dword [r8 + rax], r10d
inc r11d
add rsi, 2
jmp 0x1e1d11
add r9, rax
jmp 0x1e1cfb
mov dword [rbx + 0x24], 1
jmp 0x1e1bca
mov eax, dword [rbx + 0x18]
lea r13d, [rax + 1]
movsxd r13, r13d
shl r13, 3
test r15, r15
jne 0x1e1d8f
mov rax, qword [rsp + 0x40]
call rax
mov r8, r13
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x1e1db5
mov r8, qword [rbx + 0x10]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], r8
call rax
mov r9, r13
mov r8, qword [rsp + 0x48]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
mov r15, rax
jne 0x1e1dd1
mov rcx, rsi
mov rdx, qword [rbx + 0x50]
call qword [rbx + 0x48]
mov ecx, 0xe
jmp 0x1e1c23
mov qword [rbx + 0x10], rax
movsxd rax, dword [rbx + 0x18]
mov r9d, dword [r12 + 0x10]
lea edx, [rax + 1]
mov dword [rbx + 0x18], edx
lea rdi, [r14 + r9]
mov qword [r15 + rax*8], rsi
mov eax, dword [r12]
mov r13, rdi
test eax, eax
je 0x1e1e26
mov r13d, eax
add r13, r14
jmp 0x1e1e26
mov rax, qword [rbx + 0x40]
mov r8, qword [rbx + 0x50]
jns 0x1e1e34
movzx edx, dx
mov rcx, rsi
call rax
mov qword [rdi], rax
cmp qword [rdi], 0
je 0x1e1f8a
add r13, 8
add rdi, 8
mov rdx, qword [r13]
test rdx, rdx
jne 0x1e1dff
jmp 0x1e1f9e
lea rdx, [r14 + rdx + 2]
jmp 0x1e1e0c
test dl, 0x40
mov rcx, qword [rbx]
je 0x1e1e4b
mov eax, dword [rcx + 0x20]
jmp 0x1e1c72
test dl, 0x80
je 0x1e1c72
mov eax, dword [rcx + 0x24]
jmp 0x1e1c72
mov r15d, dword [rsi + 8]
mov edi, dword [rbx + 0x60]
mov eax, dword [rsi + 0x10]
or r15, r13
neg rdi
and rdi, r15
test eax, eax
jne 0x1e1e88
mov ecx, dword [rsi + 0x24]
test cl, 0x40
je 0x1e1e80
mov eax, dword [rdx + 0x20]
jmp 0x1e1e88
and cl, 0x80
je 0x1e1e88
mov eax, dword [rdx + 0x24]
cmp rdi, qword [rsp + 0x58]
mov r14d, eax
mov rdx, qword [rsp + 0x50]
je 0x1e1ea4
mov rax, qword [rsp + 0x60]
add rax, rdx
cmp rdi, rax
jae 0x1e1ed5
mov r9d, dword [rsi + 0x24]
mov ecx, dword [rsp + 0x68]
mov eax, r9d
or eax, ecx
bt r9d, 0x19
jae 0x1e1ebe
bt ecx, 0x19
jb 0x1e1ec3
and eax, 0xfdffffff
sub r15, rdx
mov dword [rsp + 0x68], eax
lea rax, [r15 + r14]
mov qword [rsp + 0x60], rax
jmp 0x1e1f00
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.001e14c3
test eax, eax
je 0x1e1cc4
mov eax, dword [rsi + 0x24]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], eax
inc r12d
add rsi, 0x28
jmp 0x1e1c97
mov rax, qword [rbx]
mov eax, dword [rax + 0xd0]
test eax, eax
jne 0x1e1f25
mov rax, qword [rbx]
mov eax, dword [rax + 0x28]
test eax, eax
jne 0x1e1f4e
jmp 0x1e1f80
mov rdi, qword [rbx + 8]
mov rsi, qword [rdi + rax + 0x18]
test rsi, rsi
je 0x1e1f19
mov rax, qword [rsi]
test rax, rax
je 0x1e1f19
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call rax
add rsi, 8
jmp 0x1e1f33
add rax, rbp
cmp dword [rbx + 0x20], 0
je 0x1e1f7a
xor r8d, r8d
mov rcx, rbp
mov edx, 1
call rax
mov ecx, 0x45a
test eax, eax
je 0x1e1c23
mov dword [rbx + 0x1c], 1
jmp 0x1e1fa7
mov qword [rbx + 0x58], rax
jmp 0x1e1fa7
mov qword [rbx + 0x58], 0
jmp 0x1e1fa7
mov rcx, rsi
mov rdx, qword [rbx + 0x50]
call qword [rbx + 0x48]
mov ecx, 0x7f
jmp 0x1e1c23
add r12, 0x14
jmp 0x1e1bec
mov rax, rbx
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret