Function at 0x140001830
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x238
mov rax, qword [0x140021008]
xor rax, rsp
mov qword [rsp + 0x220], rax
lea rcx, str.ADVAPI32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x14000186d
xor eax, eax
jmp 0x14000209b
mov ecx, 0x99225be9
call fcn.140001610
mov qword [rsp + 0x68], rax
mov ecx, 0xcaf2d14e
call fcn.140001610
mov qword [rsp + 0xa0], rax
mov ecx, 0x86f98370
call fcn.140001610
mov qword [rsp + 0x108], rax
mov edx, 0x12bcf846
mov rcx, qword [rsp + 0xa0]
call fcn.140001458
mov qword [rsp + 0xa8], rax
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0x68]
call section..text
mov dword [rsp + 0xbc], eax
cmp dword [rsp + 0xbc], 1
jne 0x1400018e7
mov eax, 1
jmp 0x14000209b
mov edx, 0x12dcc689
mov rcx, qword [rsp + 0xa0]
call fcn.140001458
mov qword [rsp + 0x78], rax
call qword [rsp + 0x78]
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0x1d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
mov r9d, 0x18
lea r8, [rsp + 0x1d0]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x88], rax
mov edx, 0x6b8272d5
mov rcx, qword [rsp + 0x68]
call fcn.140001458
mov qword [rsp + 0x118], rax
lea rax, str.__C:WindowsSystem32_ntdll.dll
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x98], 0xffffffffffffffff
inc qword [rsp + 0x98]
mov rax, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x98]
cmp word [rax + rcx*2], 0
jne 0x140001991
mov rax, qword [rsp + 0x98]
shl rax, 1
mov word [rsp + 0x190], ax
movzx eax, word [rsp + 0x190]
add rax, 2
mov word [rsp + 0x192], ax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x198], rax
mov dword [rsp + 0x1a0], 0x30
mov qword [rsp + 0x1a8], 0
mov dword [rsp + 0x1b8], 0x40
lea rax, [rsp + 0x190]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1c0], 0
mov qword [rsp + 0x1c8], 0
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x40], 0x40
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x1f8]
lea r8, [rsp + 0x1a0]
mov edx, 0x80000000
lea rcx, [rsp + 0x188]
call qword [rsp + 0x118]
mov dword [rsp + 0x100], eax
mov edx, 0x5135913e
mov rcx, qword [rsp + 0xa0]
call fcn.140001458
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x1000002
xor edx, edx
mov rcx, qword [rsp + 0x188]
call qword [rsp + 0x120]
mov qword [rsp + 0xd0], rax
mov edx, 0x468ab0f4
mov rcx, qword [rsp + 0xa0]
call fcn.140001458
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x128]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0xc8], rax
xor eax, eax
mov word [rsp + 0x60], ax
jmp 0x140001b70
movzx eax, word [rsp + 0x60]
inc ax
mov word [rsp + 0x60], ax
movzx eax, word [rsp + 0x60]
mov rcx, qword [rsp + 0xc8]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x140001cee
mov rax, qword [rsp + 0xc8]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0xc8]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rsp + 0x60]
imul rcx, rcx, 0x28
add rax, rcx
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rsp + 0x70]
lea rcx, str..text
sub rcx, rax
mov dl, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x140001bd9
inc rax
test dl, dl
jne 0x140001bc7
xor eax, eax
jmp 0x140001bde
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140001ce9
mov dword [rsp + 0x1e8], 0
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x88]
add rdx, rcx
mov rcx, rdx
lea r9, [rsp + 0x1e8]
mov r8d, 0x40
mov edx, eax
call qword [rsp + 0xa8]
test eax, eax
jne 0x140001c37
mov dword [rsp + 0x80], 0
jmp 0x140001c42
mov dword [rsp + 0x80], 1
mov al, byte [rsp + 0x80]
mov byte [rsp + 0x64], al
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0xe0]
add rdx, rcx
mov rcx, rdx
mov rdx, qword [rsp + 0x70]
mov edx, dword [rdx + 0xc]
mov rdi, qword [rsp + 0x88]
add rdi, rdx
mov rdx, rdi
mov rdi, rdx
mov rsi, rcx
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x70]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x88]
add rdx, rcx
mov rcx, rdx
lea r9, [rsp + 0x1e8]
mov r8d, dword [rsp + 0x1e8]
mov edx, eax
call qword [rsp + 0xa8]
test eax, eax
jne 0x140001cd3
mov dword [rsp + 0x84], 0
jmp 0x140001cde
mov dword [rsp + 0x84], 1
mov al, byte [rsp + 0x84]
mov byte [rsp + 0x64], al
jmp 0x140001b63
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x1ec], 0
mov edx, 0x60bb928a
mov rcx, qword [rsp + 0x68]
call fcn.140001458
mov qword [rsp + 0xc0], rax
lea r9, [rsp + 0x1ec]
mov r8d, 0x40
mov edx, 1
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0xa8]
mov rax, qword [rsp + 0xc0]
mov cl, byte [0x1400219fc]
mov byte [rax], cl
lea r9, [rsp + 0x1ec]
mov r8d, dword [rsp + 0x1ec]
mov edx, 1
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0xa8]
lea rax, str.5a8c723cf00f801b3b0d8262231fdd430c8c722ee64f02c57c91ea42cb10dd434d93ca1a018664eb73cf38039e5189165b92a8923960eceb738e26cfb734850bcb80df9ab88c64eb8025a906ef28dd430cc4b31dfca82ceb738e6e0a0c54f9130cc4fbda7fc840d7738e6e42232fde430c7da8cd5efc2d62b5660c40cb1067006681659331482c62b266cd40cb1067afb4470c96316d8c7d718e6ef843383413404d1a92314a8c6d718e6e0fa87ee1063d04b35971732c62b0c6e316ef5091ce40e0c397b97925e4c4cb7a0b467cd85b4d4fbe8afc0719e7b4ca4a6acf10dd43cb80dffab89c64eb37a796cb8f34e5bcda413bd5300e65eb73c2e7b28799a9676c81ca1afd0598a3568e9ebd34585407289cb351fca824a3faca4a2a4054f97b8580dfaaf983d3ae75c6e50eef50997accb2d893d35c4ca28c4e2643219b9f4f87b6ef96916c28ea85c66f8a405acd0b8503087e53422560e63e6e42cb950f371e4d2b9333d954aefa7722cfcf11353e0ec4fbeb4ecddaab738e6e0a466cf913404987fef0cd6b5c368826c987349d7afccb7d7db88c64a3184846858f34e1430cc4fb92b9642060239ee512c79b9d6740ed199631d840bb3207af0acac19ccacc887208f94d8df43b07226683511ca20f857a3ab88c64ab7c0be742cb109ccace857a38b88c64cb06e22fcb08515ca00cc4fbbaf90d9feb738e0e37c458540f28b0ba63988c64ebfada4a3e0af8c2068916f44f7a08a69f74cbeb828e1f988d4449bffe84c5ed133f07940a4254f96344473225f073a214a06729bd34ef9cc849ecb757fca83c51728e6e4287393d0b0d0c040a53a92562b2cfafbbd4515ea27c85781ba867e7aafa4f2f83320f9cc0edc6ba59798e8d888c71910a4ad455430cc4a084e7d125b732d32f1c8a4f1ed3454d3262bd9964eb36046f0a4ec2a84549403bafae4f2162b9cf478882290f3026817f1acd892d14b26564034be8bd350885783298cded293681d88282ef1c02cd26fe9fb95c20eab365d3815b804dd35b92b35376df2c689fae0b0a4014f8230cc4fb9233cc7ca3f8f64e0a42ebd2f45f8cb351f3dc8c6e8c7191cb0b58e4b379c2b351fbac8ffa3b05750a4ecba94644fd24af61c4e7238cc6ed86eb4b831ccf85ac9beec5ed3d32db2f169e2130145a97b35373c4e7075bc60d03f79b614b84c4fbdaf08dabaff8f14e064077c10787abdf93b9435d846bf85fcb25210f0287c84c92b9558cfe8c71910ef2e0a85b44c50d92b95226e4c48a400a46145e0187c0db92b9548fef8c4b85888393196b579aa487f9d025b632d02f1d08804dd3e4c4fbdab8d52cdaa8352318cb1095bccda2c0c3cd7c2cdab3e8e503f758dc8b44f520bc394f34ae15b576371258548bcf2cfbdab88c3ca3f0666b81c40f9d435a8d7211fd05ada3b44896bd34ef8e0a2517b6f370c04d223ea7a503401058837896ba51e8882d662b8626430359549a40c53996814610c036043f438a933fb34d44017acd9d02aef89f2fc329efd2430c8afac6a86762aef75c1a4307595e820e2f2b92317c28c2b3c7e78282110d0a0d1c107de3d2a77be31efed25b804dd30cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd0e5654fbd9b88c64ef738e6ebd3410ddfb0cc4fbdab88c64ab738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6ec2cb10dd4d137ef5da0c85a9cacb8f228fea44b52a7fe48ba8d7eb168a1eae0d23a57eb2372ca69efacaf90acb1ae04e068443fd2e63a09ef4b5816ecf738e6e42cb10dd1349c4fbbe3e8a64d6dfeb0842cb10dd430cc4fb2ab8a246e0718c4b42b311dd4318c4fbdab88c644be68e6e42db10dd430c9893d8b88c64eb638e6e42c910dd470cc4fbdab88c64ee738c6e42cb10dd43ecc5fbdabc8c6480d88f6e40cb70d8430ce4fbdab88c64eb638e6e42cb10dd430cd4fbdab88c64eb638e6e42cb10dd430cc4fbcab88c64ebc38f6e0acb10dd43ccc5fbceb88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd43dcc5fb36b88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64eb738e6e42cb10dd430cc4fbdab88c64c507eb1636cb10dd437bc5fbdaa88c64eb0b8f6e42cf10dd430cc4fbdab88c64eb738e6e62cb10bd6d68a58fbbb88c64cb7a8e6e425b11dd4306c4fbdac48d64eb738e6e42cb10dd430cc4fb9ab88ca4c501ea0f36aa10dda30ec4fbda188d64eb778e6e424d11dd430cc4fbdab88c64eb738e6e02cb109d6d
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x138], rax
mov qword [rsp + 0xb0], 0xffffffffffffffff
inc qword [rsp + 0xb0]
mov rax, qword [rsp + 0x138]
mov rcx, qword [rsp + 0xb0]
cmp byte [rax + rcx], 0
jne 0x140001d9e
mov rax, qword [rsp + 0xb0]
xor edx, edx
mov ecx, 2
div rcx
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x208]
lea rcx, [0x140021a00]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x11
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x180]
call fcn.14000b990
mov qword [rsp + 0xf0], rax
mov r8, qword [rsp + 0xf0]
lea rdx, [rsp + 0x208]
mov rcx, qword [rsp + 0xe8]
call fcn.140001378
mov edx, 0x111600ce
mov rcx, qword [rsp + 0x68]
call fcn.140001458
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x170], 0
call qword [rsp + 0x78]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x180]
xor r8d, r8d
lea rdx, [rsp + 0x170]
mov rcx, rax
call qword [rsp + 0x140]
cmp qword [rsp + 0x170], 0
jne 0x140001e8d
mov eax, 1
jmp 0x14000209b
mov edx, 0x851a3420
mov rcx, qword [rsp + 0x68]
call fcn.140001458
mov qword [rsp + 0x148], rax
call qword [rsp + 0x78]
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x180]
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0x170]
mov rcx, rax
call qword [rsp + 0x148]
mov edx, 0x5c75b49c
mov rcx, qword [rsp + 0x68]
call fcn.140001458
mov qword [rsp + 0x150], rax
call qword [rsp + 0x78]
lea rcx, [rsp + 0x1f0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
lea r8, [rsp + 0x180]
lea rdx, [rsp + 0x170]
mov rcx, rax
call qword [rsp + 0x150]
mov edx, 0x226fbef
mov rcx, qword [rsp + 0x68]
call fcn.140001458
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x178], 0
call qword [rsp + 0x78]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x170]
mov qword [rsp + 0x20], rcx
mov r9, rax
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rsp + 0x178]
call qword [rsp + 0x158]
cmp qword [rsp + 0x178], 0
jne 0x140001fb3
mov eax, 1
jmp 0x14000209b
mov edx, 0x516ff836
mov rcx, qword [rsp + 0x68]
call fcn.140001458
mov qword [rsp + 0x160], rax
mov edx, 0xb5cbb7d2
mov rcx, qword [rsp + 0x68]
call fcn.140001458
mov qword [rsp + 0x90], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x178]
call qword [rsp + 0x160]
mov dword [rsp + 0xb8], eax
cmp dword [rsp + 0xb8], 0
je 0x14000201c
mov rcx, qword [rsp + 0x178]
call qword [rsp + 0x90]
mov eax, 1
jmp 0x14000209b
mov rcx, qword [rsp + 0x178]
call qword [rsp + 0x90]
mov edx, 0x6bd1161f
mov rcx, qword [rsp + 0x68]
call fcn.140001458
mov qword [rsp + 0x168], rax
call qword [rsp + 0x78]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x170]
mov rcx, rax
call qword [rsp + 0x168]
mov rcx, qword [rsp + 0xf8]
call qword [rsp + 0x90]
mov rcx, qword [rsp + 0x188]
call qword [rsp + 0x90]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x90]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.1400020d0
add rsp, 0x238
pop rdi
pop rsi
ret