Function at 0x140004680
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xfd0]
mov eax, 0x10d0
call fcn.140075c10
sub rsp, rax
mov rax, qword [0x14009d080]
xor rax, rsp
mov qword [rbp + 0xfc0], rax
mov r14, rcx
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 6
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov eax, dword [str.ci.dll]
mov dword [rsp + 0x30], eax
movzx eax, word [0x1400875d4]
mov word [rsp + 0x34], ax
mov byte [rsp + 0x36], r12b
lea rcx, [rsp + 0x30]
call fcn.140009f40
mov rbx, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140004746
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004741
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004741
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140075180
test rbx, rbx
je 0x140004913
mov edi, r12d
mov r9d, 0x1000
mov r8, rbx
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.1400030e0
mov r11, 0xffffffffffffffff
test al, al
je 0x1400047cb
movsxd rax, dword [rbp - 4]
lea rcx, [rbp - 0x40]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
add r10, rax
mov r8d, r12d
movzx r9d, word [rcx + 6]
test r9d, r9d
je 0x1400047cb
mov eax, r8d
lea rcx, [rax + rax*4]
lea rdx, [r10 + rcx*8]
cmp dword [rdx], 0x45474150
jne 0x1400047c3
mov rax, r11
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], dil
jne 0x1400047b0
cmp rax, 4
je 0x1400048ca
inc r8d
cmp r8d, r9d
jb 0x140004795
mov rdx, r12
mov r8d, edi
lea rax, str.xxx____x_xxxxxxx
mov qword [rsp + 0x20], rax
lea r9, [0x1400875f0]
mov rcx, r14
call fcn.140004570
mov rsi, rax
test rax, rax
je 0x140004913
lea rbx, [rax - 0x32]
test rbx, rbx
je 0x140004913
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call fcn.1400752e4
mov rdi, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
mov word [rdi + 0x30], ax
lea r9d, [rax + 0x32]
mov r8, rbx
mov rdx, rdi
mov rcx, r14
call fcn.1400030e0
test al, al
je 0x14000490b
mov r9, r12
lea r11, [0x140087608]
mov r10, rdi
sub r10, r11
lea rdx, [0x140087604]
mov rcx, r11
mov al, 0x78
lea r8, [r9 + r10]
cmp al, 0x78
jne 0x140004871
movzx eax, byte [rcx]
cmp byte [rcx + r8], al
jne 0x1400048fe
inc rdx
inc rcx
movzx eax, byte [rdx]
test al, al
jne 0x140004860
lea rax, [r9 + rdi]
test rax, rax
je 0x14000490b
sub rax, rdi
add rbx, rax
mov rcx, rdi
call fcn.140075180
test rbx, rbx
je 0x140004913
mov dword [rsp + 0x50], r12d
lea r8, [rsi + 3]
mov r9d, 4
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.1400030e0
test al, al
jne 0x140004945
mov r13, r12
jmp 0x140004951
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x1400047cb
mov ecx, dword [rdx + 8]
lea rdx, [rbp - 0x40]
add rdx, rax
je 0x1400047cb
test ecx, ecx
je 0x1400047cb
mov edi, ecx
lea rax, [rbp - 0x40]
sub rdx, rax
add rdx, rbx
jmp 0x1400047ce
inc r9
cmp r9, 0x2f
jb 0x140004850
mov rcx, rdi
call fcn.140075180
xor al, al
mov rcx, qword [rbp + 0xfc0]
xor rcx, rsp
call fcn.140075160
lea r11, [rsp + 0x10d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd r13, dword [rsp + 0x50]
add r13, 7
add r13, rsi
mov dword [rsp + 0x60], r12d
lea r8, [rbx + 3]
mov r9d, 4
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.1400030e0
test al, al
jne 0x140004976
mov r15, r12
jmp 0x140004982
movsxd r15, dword [rsp + 0x60]
add r15, 7
add r15, rbx
test r13, r13
je 0x140004913
test r15, r15
je 0x140004913
mov rdx, r15
mov rcx, r14
call fcn.140003a40
test al, al
je 0x140004913
mov qword [rsp + 0x58], r12
mov r9d, 8
mov r8, r13
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.1400030e0
test al, al
jne 0x1400049ce
mov rdx, r15
mov rcx, r14
call fcn.140003bb0
jmp 0x140004913
cmp qword [rsp + 0x58], 0
jne 0x1400049e8
mov rdx, r15
mov rcx, r14
call fcn.140003bb0
mov al, 1
jmp 0x140004915
lea rcx, [rsp + 0x78]
call fcn.140001cd0
nop
lea rcx, [rbp - 0x60]
call fcn.140001fb0
nop
mov rax, qword [rbp - 0x50]
lea rbx, [rax*2 - 4]
mov qword [rsp + 0x68], rbx
mov rsi, qword [rsp + 0x78]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x140004c51
mov rdi, qword [rbp - 0x78]
nop word [rax + rax]
mov word [rsp + 0x50], r12w
lea r8, [rax + 8]
mov r9d, 2
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.1400030e0
test al, al
je 0x140004c51
movzx eax, word [rsp + 0x50]
test ax, ax
je 0x140004c51
cmp rbx, rax
jne 0x140004c24
mov qword [rsp + 0x70], r12
mov r8, qword [rsp + 0x58]
add r8, 0x10
mov r9d, 8
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.1400030e0
test al, al
je 0x140004c51
cmp qword [rsp + 0x70], 0
je 0x140004c51
movzx ecx, word [rsp + 0x50]
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rbx, rax
mov rax, 0xffffffffffffffff
cmovo rbx, rax
mov rcx, rbx
call fcn.1400752e4
mov r12, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x68], r12
movzx r9d, word [rsp + 0x50]
mov r8, qword [rsp + 0x70]
mov rdx, r12
mov rcx, r14
call fcn.1400030e0
test al, al
je 0x140004d12
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.140005b60
mov r11, rax
lea r10, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
cmova r10, rsi
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140004b28
mov r11, qword [rax]
cmp rdi, rcx
ja 0x140004bc1
test rdi, rdi
jne 0x140004b3d
xor ebx, ebx
jmp 0x140004bc8
sub rcx, rdi
lea rsi, [rcx + 1]
lea rsi, [r11 + rsi*2]
mov rbx, r11
movzx r9d, word [r10]
nop
mov rax, rsi
sub rax, rbx
sar rax, 1
mov ecx, 0
je 0x140004b7c
cmp word [rbx], r9w
je 0x140004b79
cmp rax, 1
je 0x140004b7c
dec rax
add rbx, 2
cmp word [rbx], r9w
jne 0x140004b66
mov rcx, rbx
mov rbx, rcx
test rcx, rcx
je 0x140004bbc
mov rdx, rdi
mov rcx, r10
test rdi, rdi
je 0x140004ba9
mov r8, rbx
sub r8, r10
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140004bb6
add rcx, 2
sub rdx, 1
jne 0x140004b95
sub rbx, r11
sar rbx, 1
mov rsi, qword [rsp + 0x78]
jmp 0x140004bc8
add rbx, 2
jmp 0x140004b50
mov rsi, qword [rsp + 0x78]
mov rbx, 0xffffffffffffffff
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140004c0a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004ca8
call fcn.140075180
cmp rbx, 0xffffffffffffffff
jne 0x140004caf
mov rcx, r12
call fcn.140075180
mov rbx, qword [rsp + 0x68]
xor r12d, r12d
mov r13, qword [rsp + 0x58]
mov r9d, 8
mov r8, r13
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.1400030e0
test al, al
je 0x140004c51
mov rax, qword [rsp + 0x58]
test rax, rax
jne 0x140004a30
mov rdx, r15
mov rcx, r14
call fcn.140003bb0
xor bl, bl
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140004d32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004d2c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rsp + 0x68], 0
mov r9d, 8
mov r8, qword [rsp + 0x58]
lea rdx, [rsp + 0x68]
mov rcx, r14
call fcn.1400030e0
mov rcx, r14
test al, al
je 0x140004d15
mov r9d, 8
lea r8, [rsp + 0x68]
mov rdx, r13
call fcn.1400030e0
mov rcx, r14
test al, al
je 0x140004d15
mov rdx, qword [rsp + 0x58]
call fcn.140003300
mov rdx, r15
mov rcx, r14
test al, al
je 0x140004d18
call fcn.140003bb0
test al, al
je 0x140004d12
mov bl, 1
jmp 0x140004d1f
mov rcx, r14
mov rdx, r15
call fcn.140003bb0
xor bl, bl
mov rcx, r12
call fcn.140075180
jmp 0x140004c5e
call fcn.140075180
nop
mov rax, qword [rbp - 0x70]
cmp rax, 7
jbe 0x140004d74
lea rdx, [rax*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140004d6c
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004d6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140075180
movzx eax, bl
jmp 0x140004915