Function at 0x140185494
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r13, qword [0x140438448]
mov r14d, 1
mov rsi, rdx
mov eax, r14d
lea rbx, [r13 + 0x70]
lock xadd dword [rbx + 0x4c], eax
add eax, r14d
xor r15d, r15d
test eax, eax
jle 0x1401854fc
mov rcx, qword [rbx + 0x40]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, r14d
lock xadd dword [rbx + 0x4c], eax
add eax, r14d
test eax, eax
jg 0x1401854d8
mov r8, qword [rsp + 0xb0]
lea r12, [r13 + 0x60]
mov rcx, qword [r12]
cmp rcx, r12
je 0x140185566
mov rdx, qword [rcx + 0x478]
cmp rsi, rdx
jbe 0x140185523
mov eax, dword [rcx + 0x480]
add rax, rdx
cmp rsi, rax
jb 0x140185528
mov rcx, qword [rcx]
jmp 0x140185504
mov rdx, rsi
call fcn.140185abc
mov edi, eax
test rbx, rbx
je 0x140185554
or ecx, 0xffffffff
lock xadd dword [rbx + 0x4c], ecx
sub ecx, r14d
jle 0x140185554
mov rcx, qword [rbx + 0x38]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, edi
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test rbx, rbx
je 0x140185588
or eax, 0xffffffff
lock xadd dword [rbx + 0x4c], eax
sub eax, r14d
jle 0x140185588
mov rcx, qword [rbx + 0x38]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
lock add dword [rbx + 0x34], r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rbx + 0x30]
mov ecx, r15d
mov r8d, eax
mov eax, edx
test edx, edx
je 0x1401855ba
cmp dword [rbx + 0x2c], r8d
je 0x1401855ba
mov ecx, edx
mov dword [rbx + 0x30], r15d
mov eax, r15d
inc eax
mov dword [rbx + 0x2c], r8d
mov dword [rbx + 0x30], eax
test ecx, ecx
je 0x1401855ce
neg ecx
lock xadd dword [rbx + 0x34], ecx
mov r14d, 0x40000000
mov edi, r15d
mov eax, r14d
xchg dword [rbx + 0x4c], eax
add eax, r14d
mov dword [rbx + 0x48], eax
test eax, eax
jle 0x1401855fb
mov rcx, qword [rbx + 0x38]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc edi
cmp edi, dword [rbx + 0x48]
jl 0x1401855e7
mov rcx, qword [r12]
mov r15d, 0xc0000000
cmp rcx, r12
je 0x140185631
mov rdx, qword [rcx + 0x478]
cmp rsi, rdx
jbe 0x140185624
mov eax, dword [rcx + 0x480]
add rax, rdx
cmp rsi, rax
jb 0x140185629
mov rcx, qword [rcx]
jmp 0x140185605
mov rdx, rsi
jmp 0x1401859d0
cmp qword [r13], r13
jne 0x140185656
mov edx, 1
mov rcx, r13
call fcn.14018509c
mov esi, eax
test eax, eax
js 0x1401858e6
mov rsi, qword [rsp + 0xa8]
lea rdi, [r13 + 0x10]
lock inc dword [rdi + 0x34]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rdi + 0x30]
xor r9d, r9d
mov r8d, eax
mov ecx, r9d
mov eax, edx
test edx, edx
je 0x14018568e
cmp dword [rdi + 0x2c], r8d
je 0x14018568e
mov ecx, edx
mov dword [rdi + 0x30], r9d
mov eax, r9d
inc eax
mov dword [rdi + 0x2c], r8d
mov dword [rdi + 0x30], eax
test ecx, ecx
je 0x1401856a2
neg ecx
lock xadd dword [rdi + 0x34], ecx
mov eax, r14d
xchg dword [rdi + 0x4c], eax
add eax, r14d
mov r14d, r9d
mov dword [rdi + 0x48], eax
test eax, eax
jle 0x1401856cb
mov rcx, qword [rdi + 0x38]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc r14d
cmp r14d, dword [rdi + 0x48]
jl 0x1401856b5
mov r14, qword [r13]
cmp qword [r14 + 8], r13
jne 0x140185a15
mov rax, qword [r14]
cmp qword [rax + 8], r14
jne 0x140185a15
mov qword [r13], rax
mov ecx, r15d
mov qword [rax + 8], r13
xchg dword [rdi + 0x4c], ecx
mov edx, dword [rdi + 0x48]
add edx, r15d
add edx, ecx
test edx, edx
jle 0x14018570d
mov rcx, qword [rdi + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
dec dword [rdi + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [rdi + 0x34]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
test rax, rax
jne 0x140185751
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
jmp 0x14018599b
cmp dword [rsp + 0x50], 0x1000000
jne 0x1401857d9
mov rax, qword [rsp + 0x30]
mov ecx, 0x5a4d
mov qword [rsp + 0x20], rax
cmp word [rax], cx
jne 0x1401857d9
movsxd rsi, dword [rax + 0x3c]
add rsi, rax
cmp rsi, qword [rsp + 0xa8]
ja 0x1401857d9
cmp dword [rsi], 0x4550
jne 0x1401857d9
mov ecx, edx
mov dword [rsp + 0xa0], edx
cmp dx, word [rsi + 6]
jae 0x1401857d9
mov eax, ecx
lea rcx, [rax + rax*4]
movzx eax, word [rsi + 0x14]
add rax, 0x18
mov qword [rsp + 0xb8], rcx
add rax, rsi
lea rcx, [rax + rcx*8]
call fcn.14018f044
cmp al, 1
je 0x14018591e
mov ecx, dword [rsp + 0xa0]
movzx eax, word [rsi + 6]
inc ecx
mov dword [rsp + 0xa0], ecx
cmp ecx, eax
jb 0x140185797
mov esi, 1
xor r12d, r12d
lea rax, [r14 + 0x10]
lea rcx, [0x1403a2528]
mov qword [rax], rcx
lea rcx, [r14 + 0x28]
mov qword [rcx + 8], rax
lea rax, [r14 + 0x78]
mov word [rcx], r12w
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
mov qword [rcx + 0x38], r12
mov qword [rcx + 0x48], r12
mov qword [rcx + 0x30], rcx
mov qword [r14 + 0x478], r12
mov qword [r14 + 0x488], r12
mov qword [r14 + 0x18], rax
mov dword [r14 + 0x20], 0x400
lock inc dword [rdi + 0x34]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [rdi + 0x30]
mov ecx, r12d
mov r8d, eax
mov eax, edx
test edx, edx
je 0x14018585e
cmp dword [rdi + 0x2c], r8d
je 0x14018585e
mov ecx, edx
mov dword [rdi + 0x30], r12d
mov eax, r12d
inc eax
mov dword [rdi + 0x2c], r8d
mov dword [rdi + 0x30], eax
test ecx, ecx
je 0x140185872
neg ecx
lock xadd dword [rdi + 0x34], ecx
mov eax, 0x40000000
xchg dword [rdi + 0x4c], eax
add eax, 0x40000000
mov dword [rdi + 0x48], eax
test eax, eax
jle 0x14018589c
mov rcx, qword [rdi + 0x38]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc r12d
cmp r12d, dword [rdi + 0x48]
jl 0x140185886
mov rax, qword [r13 + 8]
cmp qword [rax], r13
jne 0x140185a15
mov qword [r14], r13
mov ecx, r15d
mov qword [r14 + 8], rax
mov qword [rax], r14
mov qword [r13 + 8], r14
xchg dword [rdi + 0x4c], ecx
mov edx, dword [rdi + 0x48]
add edx, r15d
add edx, ecx
test edx, edx
jle 0x1401858d6
mov rcx, qword [rdi + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
dec dword [rdi + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [rdi + 0x34]
xchg dword [rbx + 0x4c], r15d
mov edx, dword [rbx + 0x48]
add edx, 0xc0000000
add edx, r15d
test edx, edx
jle 0x140185907
mov rcx, qword [rbx + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
dec dword [rbx + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [rbx + 0x34]
mov eax, esi
jmp 0x140185556
lfence
movzx eax, word [rsi + 0x14]
mov rcx, qword [rsp + 0xb8]
add rax, rsi
add rcx, 3
lea r8, [rax + rcx*8]
test r8, r8
je 0x1401857d9
mov eax, dword [rsi + 0x50]
mov rcx, qword [rsp + 0x20]
mov qword [r14 + 0x478], rcx
mov dword [r14 + 0x480], eax
mov edx, dword [r8 + 0xc]
add rdx, rcx
lea rcx, [r14 + 0x28]
mov qword [r14 + 0x488], rdx
mov r8d, dword [r8 + 0x10]
call fcn.14018f0cc
mov esi, eax
test eax, eax
js 0x1401857de
mov rax, qword [r14 + 0x488]
movups xmm0, xmmword [rax + 0xc]
movups xmmword [r14 + 0x490], xmm0
movups xmm1, xmmword [rax + 0x1c]
movups xmmword [r14 + 0x4a0], xmm1
test esi, esi
js 0x1401857de
cmp esi, 1
je 0x1401857de
mov rax, qword [r12 + 8]
cmp qword [rax], r12
jne 0x140185a15
mov rdx, qword [rsp + 0xa8]
mov rcx, r14
mov qword [r14], r12
mov qword [r14 + 8], rax
mov qword [rax], r14
mov qword [r12 + 8], r14
mov r8, qword [rsp + 0xb0]
call fcn.140185abc
xchg dword [rbx + 0x4c], r15d
mov edx, dword [rbx + 0x48]
mov edi, eax
add edx, 0xc0000000
add edx, r15d
test edx, edx
jle 0x140185a00
mov rcx, qword [rbx + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
dec dword [rbx + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lock dec dword [rbx + 0x34]
jmp 0x140185554
mov ecx, 3
int 0x29
int3