Function at 0x180006a70
Capabilities:
Enumerate pe sections

Disassembly:
mov r11, rsp
push rbp
push rdi
push r12
push r13
push r15
sub rsp, 0x1a0
mov rax, qword [0x18002f108]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbp, qword [rsp + 0x1f0]
mov rdi, r9
mov qword [rsp + 0x50], rbp
mov r12, r8
mov qword [rsp + 0x48], r9
mov r15, rdx
mov r13, rcx
cmp rcx, 0x1000
jb 0x180006db5
movabs rax, 0xffff800000000000
test rax, rcx
jne 0x180006db5
cmp rdx, 0x1000
jb 0x180006dae
test rax, rdx
jne 0x180006dae
mov qword [r11 - 0x30], rbx
mov qword [r11 - 0x38], rsi
mov qword [r11 - 0x40], r14
lea r14, [0x180000000]
nop dword [rax + rax]
mov rax, qword [r13]
xor r9d, r9d
mov qword [rsp + 0x60], rax
mov edx, 0xfffffffd
mov eax, dword [r13 + 8]
xor ecx, ecx
mov dword [rsp + 0x68], eax
mov r8d, 0x1c8
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], 0x19730211
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x5c], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rsp + 0x6c], 0xffffffff
call qword [sym.imp.VBoxRT.dll_SUPR3CallVMMR0Ex]
test eax, eax
jns 0x180006b59
lea ecx, [rax + 0x28]
cmp ecx, 1
ja 0x180006d94
mov rcx, qword [r13 + 0x10]
add rcx, 0x10
mov edx, dword [rcx + 8]
mov eax, dword [rcx + 0x10]
cmp edx, eax
je 0x180006b00
mov eax, edx
add rax, rcx
je 0x180006b00
movzx ecx, byte [rax + 3]
cmp cl, 0x42
jne 0x180006ba2
mov r8d, dword [rax]
mov rcx, r12
movsxd rdx, dword [rax + 4]
and r8d, 0xffffff
add rdx, rax
mov dword [rsp + 0x40], r8d
mov rax, r15
call qword [case.0x180016895.0]
jmp 0x180006d41
cmp cl, 0x64
jne 0x180006d41
mov ecx, dword [rax]
movsxd rbx, dword [rax + 4]
and ecx, 0xffffff
add rbx, rax
lea rsi, [rcx - 8]
cmp rcx, 8
jb 0x180006d41
movzx r10d, byte [rbx]
lea eax, [r10 - 1]
cmp eax, 5
ja 0x180006d41
movzx r8d, byte [rbx + 4]
cmp r8b, 0xe
jb 0x180006d41
movzx edx, byte [rbx + 5]
cmp dl, r8b
jbe 0x180006d41
movzx r9d, byte [rbx + 1]
cmp r9b, dl
jbe 0x180006d41
lea r11d, [r10 - 1]
cmp r11d, 5
ja case.default.0x180006c1b
movsxd rax, r11d
mov ecx, dword [r14 + rax*4 + 0x6ddc]
add rcx, r14
jmp rcx
mov ecx, edx
sub ecx, r8d
cmp ecx, 0x14
jae 0x180006c49
jmp 0x180006d41
mov ecx, edx
sub ecx, r8d
cmp ecx, 0x28
jae 0x180006c49
jmp 0x180006d41
mov ecx, edx
sub ecx, r8d
cmp ecx, 0x3c
jb 0x180006d41
movsxd rax, r11d
mov ecx, dword [r14 + rax*4 + 0x6df4]
add rcx, r14
jmp rcx
mov ecx, r9d
sub ecx, edx
cmp ecx, 0x14
jae case.default.0x180006c1b
jmp 0x180006d41
mov ecx, r9d
sub ecx, edx
cmp ecx, 8
jb 0x180006d41
mov rcx, r9
cmp rsi, r9
jbe 0x180006d41
movzx r9d, word [rbx + 2]
mov rax, rsi
sub rax, rcx
cmp rax, r9
jb 0x180006d41
cmp r10d, 3
jne 0x180006ca6
cmp r9d, 8
jb 0x180006d41
test r9w, r9w
je 0x180006d41
test rdi, rdi
je 0x180006cc9
mov r8d, esi
mov rdx, rbx
mov rcx, rbp
mov rax, rdi
call qword [case.0x180016895.0]
jmp 0x180006d41
movzx eax, byte [rbx + 6]
xor edx, edx
mov rcx, r9
xor edi, edi
sub rcx, rax
lea rax, [rsi - 1]
add rax, rcx
div r9
mov rbp, rax
test eax, eax
je 0x180006d37
nop dword [rax + rax]
lea rax, [rsp + 0x40]
mov r8, rsi
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x70]
mov dword [rsp + 0x28], ebp
lea rdx, [rbx + 8]
mov rcx, rbx
mov dword [rsp + 0x20], edi
call fcn.180006fa0
mov r8d, dword [rsp + 0x40]
mov rdx, rax
mov rax, r15
mov rcx, r12
call qword [case.0x180016895.0]
inc edi
cmp edi, ebp
jb 0x180006cf0
lea r14, [0x180000000]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov r8, qword [r13 + 0x10]
mov edx, dword [r8 + 0x18]
mov eax, dword [rdx + r8 + 0x10]
lea ecx, [rdx + 7]
and eax, 0xffffff
add eax, dword [rdx + r8 + 0x14]
add ecx, eax
and ecx, 0xfffffff8
cmp ecx, dword [r8 + 0x14]
jb 0x180006d6a
mov ecx, dword [r8 + 0x10]
xchg dword [r8 + 0x18], ecx
mov rdx, qword [r13 + 0x10]
add rdx, 0x10
mov ecx, dword [rdx + 8]
mov eax, dword [rdx + 0x10]
cmp ecx, eax
je 0x180006b00
mov eax, ecx
add rax, rdx
jne 0x180006b72
jmp 0x180006b00
mov r14, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x190]
mov rbx, qword [rsp + 0x198]
jmp 0x180006dba
mov eax, 0xfffffffa
jmp 0x180006dba
mov eax, 0xfffffffc
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18001f500
add rsp, 0x1a0
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret