Function at 0x7ff6c5d20210
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x18], r8b
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
movzx edi, r8b
mov r13, rdx
mov r15, rcx
test rdx, rdx
je 0x7ff6c5d206fd
mov eax, 0xffff
mov word [rsp + 0x1a8], ax
cmp rdx, rax
jae 0x7ff6c5d2025b
mov word [rsp + 0x1a8], dx
jmp 0x7ff6c5d20281
cmp byte [rdx], 0x23
jne 0x7ff6c5d20281
lea rcx, [rdx + 1]
call qword [sym.imp.ucrtbase.dll_atoi]
lea ecx, [rax - 1]
cmp ecx, 0xfffd
ja 0x7ff6c5d20281
mov word [rsp + 0x1a8], ax
movzx r13d, ax
test r15, r15
je 0x7ff6c5d206fd
mov eax, 0x5a4d
cmp word [r15], ax
jne 0x7ff6c5d206fd
movsxd rax, dword [r15 + 0x3c]
cmp dword [r15 + rax], 0x4550
lea r14, [r15 + rax]
jne 0x7ff6c5d206fd
xor r9d, r9d
lea rcx, [r15 + rax]
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x1b8], r9d
test eax, eax
jle 0x7ff6c5d202e0
cmp eax, 0x10000000
jae 0x7ff6c5d202e0
cmp dword [rcx], 0x4550
jne 0x7ff6c5d202e0
lea r8, [rcx + 4]
add rcx, 0x18
jmp 0x7ff6c5d202e7
lea rcx, [r15 + 0x14]
mov r8, r15
movzx edx, word [rcx]
sub edx, 0x107
je 0x7ff6c5d206fd
sub edx, 4
je 0x7ff6c5d20313
cmp edx, 0x100
jne 0x7ff6c5d206fd
cmp dword [rcx + 0x6c], r9d
jbe 0x7ff6c5d20361
lea rax, [rcx + 0x70]
jmp 0x7ff6c5d2031d
cmp dword [rcx + 0x5c], r9d
jbe 0x7ff6c5d20361
lea rax, [rcx + 0x60]
cmp dword [rax], r9d
je 0x7ff6c5d20361
cmp dword [rax + 4], r9d
je 0x7ff6c5d20361
mov r9d, dword [rcx + 0x3c]
movzx edx, dil
mov qword [rsp + 0x30], rcx
mov rcx, r15
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x1b8]
mov qword [rsp + 0x20], rax
call fcn.7ff6c5d20720
mov r9d, dword [rsp + 0x1b8]
mov rbp, rax
mov dword [rsp + 0x40], r9d
jmp 0x7ff6c5d20363
xor ebp, ebp
test rbp, rbp
je 0x7ff6c5d206fd
test r9d, r9d
je 0x7ff6c5d206fd
mov ebx, dword [rbp + 0x14]
test ebx, ebx
je 0x7ff6c5d206fd
mov edi, dword [rbp + 0x24]
cmp r9d, 0x28
ja 0x7ff6c5d203a6
mov eax, dword [rbp + 0x18]
cmp ebx, eax
cmova eax, ebx
imul r9d, eax, 0xff
sub r9d, ebp
add r9d, edi
add r9d, r15d
mov dword [rsp + 0x40], r9d
movzx eax, byte [rsp + 0x1b0]
mov r8d, dword [rbp + 0x20]
mov esi, dword [rbp + 0x1c]
test al, al
je 0x7ff6c5d203d9
add r8, r15
mov ecx, edi
add rcx, r15
mov qword [rsp + 0x48], r8
lea r9, [r15 + rsi]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x1b8], r9
jmp 0x7ff6c5d2042a
mov rdx, r15
mov rcx, r14
call fcn.7ff6c5d207f0
mov r8d, esi
mov qword [rsp + 0x48], rax
mov rdx, r15
mov rcx, r14
call fcn.7ff6c5d207f0
mov r8d, edi
mov qword [rsp + 0x1b8], rax
mov rdx, r15
mov rcx, r14
call fcn.7ff6c5d207f0
mov r8, qword [rsp + 0x48]
mov rcx, rax
mov r9, qword [rsp + 0x1b8]
mov qword [rsp + 0x50], rax
movzx eax, byte [rsp + 0x1b0]
xor r12d, r12d
test ebx, ebx
je 0x7ff6c5d206fd
nop word [rax + rax]
movzx esi, word [rcx + r12*2]
mov r11d, dword [r9 + rsi*4]
test r11d, r11d
je 0x7ff6c5d20676
mov r9d, dword [r8 + r12*4]
test al, al
je 0x7ff6c5d2059f
lea rdi, [r15 + r11]
add r9, r15
mov r8, rdi
cmp rdi, rbp
jbe 0x7ff6c5d20627
mov eax, dword [rsp + 0x40]
add rax, rbp
cmp rdi, rax
jae 0x7ff6c5d20627
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x7ff6c5d20490
inc ebx
cmp ebx, 0x100
jae 0x7ff6c5d2066e
mov r8d, ebx
lea rcx, [rsp + 0x60]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
test ebx, ebx
je 0x7ff6c5d2066e
lea rcx, [rsp + 0x60]
cmp byte [rcx], 0x2e
lea edx, [rax + 1]
je 0x7ff6c5d204dc
inc rcx
mov eax, edx
cmp edx, ebx
jb 0x7ff6c5d204c6
jmp 0x7ff6c5d2066e
mov ebx, edx
mov byte [rsp + rax + 0x60], 0
add rbx, rdi
je 0x7ff6c5d2066e
cmp byte [rbx], 0x23
jne 0x7ff6c5d20557
lea rcx, [rbx + 1]
test rcx, rcx
je 0x7ff6c5d2066e
movzx edi, word [rsp + 0x1a8]
mov eax, 0xffff
cmp di, ax
jae 0x7ff6c5d2066e
call qword [sym.imp.ucrtbase.dll_atoi]
mov ebx, eax
lea ecx, [rbx - 1]
cmp ecx, 0xfffe
ja 0x7ff6c5d2066e
cmp ebx, edi
jne 0x7ff6c5d2066e
lea rcx, [rsp + 0x60]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
movzx r8d, byte [rsp + 0x1b0]
mov rcx, rax
movzx edx, bx
call fcn.7ff6c5d20210
jmp 0x7ff6c5d206ff
mov r8, rbx
mov rax, r13
sub r8, r13
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x7ff6c5d20573
inc rax
test ecx, ecx
jne 0x7ff6c5d20560
test edx, edx
jne 0x7ff6c5d2066e
lea rcx, [rsp + 0x60]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
movzx r8d, byte [rsp + 0x1b0]
mov rdx, rbx
mov rcx, rax
call fcn.7ff6c5d20210
jmp 0x7ff6c5d206ff
movzx r10d, word [r14 + 6]
test r10d, r10d
je 0x7ff6c5d205e0
movzx eax, word [r14 + 0x14]
lea rbx, [r14 + 0x18]
add rbx, rax
xor r8d, r8d
test r10d, r10d
je 0x7ff6c5d205e0
lea rdx, [rbx + 0x10]
mov ecx, dword [rdx - 4]
cmp r9d, ecx
jb 0x7ff6c5d205d4
add ecx, dword [rdx]
cmp r9d, ecx
jb 0x7ff6c5d20696
inc r8d
add rdx, 0x28
cmp r8d, r10d
jb 0x7ff6c5d205c1
movzx r10d, word [r14 + 6]
xor r9d, r9d
test r10d, r10d
je 0x7ff6c5d20624
movzx eax, word [r14 + 0x14]
lea rbx, [r14 + 0x18]
add rbx, rax
xor r8d, r8d
test r10d, r10d
je 0x7ff6c5d20624
lea rdx, [rbx + 0x10]
mov ecx, dword [rdx - 4]
cmp r11d, ecx
jb 0x7ff6c5d20618
add ecx, dword [rdx]
cmp r11d, ecx
jb 0x7ff6c5d206d1
inc r8d
add rdx, 0x28
cmp r8d, r10d
jb 0x7ff6c5d20605
xor r8d, r8d
mov eax, 0xffff
cmp r13, rax
jbe 0x7ff6c5d2065b
mov rax, r13
sub r9, r13
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x7ff6c5d20653
inc rax
test ecx, ecx
jne 0x7ff6c5d20640
test edx, edx
je 0x7ff6c5d206f8
movzx eax, word [rsp + 0x1a8]
lea ecx, [rsi + 1]
cmp ecx, eax
je 0x7ff6c5d206f8
mov r9, qword [rsp + 0x1b8]
inc r12d
cmp r12d, dword [rbp + 0x14]
jae 0x7ff6c5d206fd
movzx eax, byte [rsp + 0x1b0]
mov r8, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
jmp 0x7ff6c5d20440
lea rcx, [r8 + r8*4]
lea rdx, [rbx + rcx*8]
test rdx, rdx
je 0x7ff6c5d205e0
sub r9d, dword [rdx + 0xc]
lea rbx, [r14 + 0x18]
movzx r10d, word [r14 + 6]
mov eax, r9d
mov r9d, dword [rdx + 0x14]
add rax, r15
add r9, rax
movzx eax, word [r14 + 0x14]
add rbx, rax
xor r8d, r8d
jmp 0x7ff6c5d20601
lea rcx, [r8 + r8*4]
lea rdx, [rbx + rcx*8]
test rdx, rdx
je 0x7ff6c5d20624
sub r11d, dword [rdx + 0xc]
mov r8d, dword [rdx + 0x14]
mov eax, r11d
add rax, r15
add r8, rax
jmp 0x7ff6c5d20627
mov rax, r8
jmp 0x7ff6c5d206ff
xor eax, eax
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret