Function at 0x180030490
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
mov eax, dword [rsp + 0x38]
mov r14, r9
mov r15, r8
mov rsi, rdx
mov rbx, rcx
cmp eax, 0x38
jb 0x1800307a1
mov rdi, qword [rsp + 0x30]
mov r11d, eax
movzx eax, byte [rdi + 0xe]
movzx r10d, byte [rdi + 0xf]
shl r10, 8
or r10, rax
movzx eax, byte [rdi + 0xd]
shl r10, 8
or r10, rax
movzx eax, byte [rdi + 0xc]
shl r10, 8
or r10, rax
add r10, 0x10
cmp r10, r11
jne 0x1800307a1
movzx eax, byte [rdi + 0x1a]
movzx r8d, byte [rdi + 0x1b]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdi + 0x19]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdi + 0x18]
shl r8d, 8
or r8d, eax
add r8d, 0x1c
mov ecx, r8d
add rcx, rdi
movzx eax, byte [rcx + 2]
movzx edx, byte [rcx + 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [rcx]
shl edx, 8
or edx, eax
add edx, 4
add r8d, edx
mov ecx, r8d
add rcx, rdi
movzx eax, byte [rcx + 2]
movzx r9d, byte [rcx + 3]
shl r9d, 8
or r9d, eax
movzx eax, byte [rcx + 1]
shl r9d, 8
or r9d, eax
movzx eax, byte [rcx]
shl r9d, 8
or r9d, eax
add r9d, 4
add r9d, r8d
mov ecx, r9d
add rcx, rdi
movzx eax, byte [rcx + 2]
movzx edx, byte [rcx + 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [rcx]
shl edx, 8
lea ecx, [r9 + 4]
or edx, eax
add ecx, edx
add rcx, 0x10
cmp rcx, r11
jne 0x1800307a1
movzx eax, byte [rdi + 0x16]
movzx ecx, byte [rdi + 0x17]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdi + 0x15]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdi + 0x14]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdi + 0x13]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdi + 0x12]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdi + 0x11]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdi + 0x10]
shl rcx, 8
or rcx, rax
mov qword [rbx], rcx
movzx eax, byte [rdi + 0x1a]
movzx r8d, byte [rdi + 0x1b]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdi + 0x19]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdi + 0x18]
shl r8d, 8
or r8d, eax
add r8d, 0x1c
mov ecx, r8d
add r8d, 4
add rcx, rdi
movzx eax, byte [rcx + 2]
lea rbx, [rcx + 4]
movzx edx, byte [rcx + 3]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 1]
shl edx, 8
or edx, eax
movzx eax, byte [rcx]
shl edx, 8
or edx, eax
add r8d, edx
mov ecx, r8d
add r8d, 4
add rcx, rdi
movzx eax, byte [rcx + 2]
lea r11, [rcx + 4]
movzx r9d, byte [rcx + 3]
shl r9d, 8
or r9d, eax
movzx eax, byte [rcx + 1]
shl r9d, 8
or r9d, eax
movzx eax, byte [rcx]
shl r9d, 8
or r9d, eax
add r9d, r8d
mov ecx, r9d
add rcx, rdi
movzx eax, byte [rcx + 2]
lea r10, [rcx + 4]
movzx r8d, byte [rcx + 3]
shl r8d, 8
or r8d, eax
movzx eax, byte [rcx + 1]
shl r8d, 8
or r8d, eax
movzx eax, byte [rcx]
shl r8d, 8
or r8d, eax
add r8d, 4
add r8d, r9d
mov ecx, r8d
add rcx, rdi
movzx eax, byte [rcx + 6]
movzx edx, byte [rcx + 7]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 5]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 4]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 3]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 2]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + 1]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx]
shl rdx, 8
or rdx, rax
lea eax, [r8 + 8]
mov qword [r15], rdx
movzx edx, byte [rax + rdi + 7]
shl rdx, 8
mov ecx, eax
movzx eax, byte [rax + rdi + 6]
or rdx, rax
shl rdx, 8
movzx eax, byte [rcx + rdi + 5]
or rdx, rax
movzx eax, byte [rcx + rdi + 4]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + rdi + 3]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + rdi + 2]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + rdi + 1]
shl rdx, 8
or rdx, rax
movzx eax, byte [rcx + rdi]
shl rdx, 8
or rdx, rax
lea rax, [rdi + 0x1c]
mov qword [r14], rdx
mov qword [rsi], rax
xor eax, eax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r11
mov qword [rsi + 0x18], r10
jmp 0x1800307a6
mov eax, reloc.WS2_32.dll_shutdown
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
pop r15
ret