Function at 0x18005d230
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2060
call fcn.18006d450
sub rsp, rax
mov rax, qword [0x18008b088]
xor rax, rsp
mov qword [rsp + 0x2050], rax
lea ebp, [rdx + 0x96e]
mov r15, r9
mov dword [rsp + 0x38], ebp
mov r13, r8
mov esi, edx
mov r14, rcx
cmp edx, ebp
jae 0x18005d66d
mov rdi, qword [rsp + 0x48]
mov ebx, dword [rsp + 0x38]
nop word [rax + rax]
cmp esi, 0x1be
ja 0x18005d575
je 0x18005d55a
cmp esi, 0xc9
ja 0x18005d3f8
je 0x18005d6c8
mov eax, esi
sub eax, 0x14
je 0x18005d3c1
sub eax, 0x19
je 0x18005d348
sub eax, 0x75
je 0x18005d329
cmp eax, 0x19
jne 0x18005d6c8
movzx eax, byte [r13 + 0x11]
movzx ecx, byte [r13 + 0x10]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0x13]
shl ecx, 8
or ecx, eax
mov dword [r15 + 0xc], ecx
movzx eax, byte [r13 + 0xd]
movzx ecx, byte [r13 + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0xf]
shl ecx, 8
or ecx, eax
mov dword [r15 + 0x10], ecx
jmp 0x18005d6c8
mov eax, dword [r15 + 8]
mov dword [r15 + 4], edi
imul ecx, dword [r13], 0x50b75fc4
shr rdi, 0x20
add rcx, rax
add rdi, rcx
jmp 0x18005d6c8
movzx eax, byte [r13 + 0x1d]
movzx ecx, byte [r13 + 0x1c]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0x1f]
shl ecx, 8
or ecx, eax
mov dword [r15], ecx
movzx eax, byte [r13 + 0x19]
movzx ecx, byte [r13 + 0x18]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0x1b]
shl ecx, 8
or ecx, eax
mov dword [r15 + 4], ecx
movzx eax, byte [r13 + 0x15]
movzx ecx, byte [r13 + 0x14]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0x17]
shl ecx, 8
or ecx, eax
mov dword [r15 + 8], ecx
jmp 0x18005d6c8
mov eax, dword [r13]
cmp eax, 1
ja 0x18005d6d8
imul ecx, eax, 0x2fc9bebf
mov eax, dword [r15]
add rcx, rax
mov eax, dword [r15 + 4]
mov dword [r15], ecx
imul edi, dword [r13], 0x402da173
shr rcx, 0x20
add rdi, rax
add rdi, rcx
jmp 0x18005d6c8
mov eax, esi
sub eax, 0x130
je 0x18005d551
sub eax, 0x19
je 0x18005d525
cmp eax, 0xe
jne 0x18005d6c8
mov r9d, 0xac
lea r8, str.ssleay32.dll
lea edx, [rax + 0x40]
xor ecx, ecx
call fcn.180003df0
mov rcx, qword [r15]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rcx
mov r8d, 0x5f
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rsi, rax
mov dword [rsp + 0x30], 0x14
call fcn.180047420
cmp al, 2
jne 0x18005d51b
nop dword [rax]
nop word [rax + rax]
mov r8d, 0x2000
lea rdx, [rsp + 0x50]
mov rcx, r13
call rsi
test eax, eax
jle 0x18005d517
mov rcx, qword [r14 + 0x18]
mov rbp, qword [r14 + 0x10]
movsxd rsi, eax
mov rax, rcx
sub rax, rbp
cmp rsi, rax
ja 0x18005d4cd
lea rax, [rsi + rbp]
mov r12, r14
mov qword [r14 + 0x10], rax
cmp rcx, 0x10
jb 0x18005d4b2
mov r12, qword [r14]
lea rcx, [r12 + rbp]
mov r8, rsi
lea rdx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + r12]
mov byte [rax + rbp], 0
jmp 0x18005d4e5
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.180001fa0
mov rax, qword [r15]
lea rdx, [rsp + 0x40]
mov r8d, 0x5f
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x14
call fcn.180047420
mov rsi, qword [rsp + 0x48]
cmp al, 2
je 0x18005d470
mov ebp, dword [rsp + 0x38]
mov esi, 0x1e5
jmp 0x18005d6c8
movzx eax, byte [r13 + 9]
movzx ecx, byte [r13 + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0xb]
shl ecx, 8
or ecx, eax
mov dword [r15 + 0x14], ecx
jmp 0x18005d6c8
mov dword [r15 + 8], edi
jmp 0x18005d6c4
imul ecx, dword [r13], 0x45512319
mov eax, dword [r15 + 0xc]
add rdi, rax
add rdi, rcx
mov dword [r15 + 0xc], edi
jmp 0x18005d6c8
cmp esi, 0x273
ja 0x18005d649
je 0x18005d70f
mov eax, esi
sub eax, 0x1d7
je 0x18005d5cf
sub eax, 0xe
je 0x18005d51b
sub eax, 0x67
je 0x18005d5b4
cmp eax, 0x19
jne 0x18005d6c8
test r14, r14
je 0x18005d6c8
mov dword [r14], ebx
jmp 0x18005d6c8
mov eax, dword [r13]
shr rdi, 0x20
add rdi, rax
mov eax, dword [r15 + 0x10]
add rdi, rax
mov dword [r15 + 0x10], edi
jmp 0x18005d6c8
movzx eax, byte [r13 + 5]
mov r8, r15
movzx ecx, byte [r13 + 4]
xor edx, edx
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 7]
shl ecx, 8
or ecx, eax
mov dword [r15 + 0x18], ecx
movzx eax, byte [r13]
movzx ecx, byte [r13 + 1]
shl eax, 8
or ecx, eax
movzx eax, byte [r13 + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 3]
shl ecx, 8
or ecx, eax
mov dword [r15 + 0x1c], ecx
mov ecx, 0xca
call fcn.18003ee10
mov r9, r15
mov dword [rsp + 0x30], eax
lea r8, [rsp + 0x30]
mov edx, 0x14
xor ecx, ecx
call fcn.18005d230
mov rbx, rax
jmp 0x18005d6c8
cmp esi, 0x2da
je 0x18005d6b5
cmp esi, 0x368
je 0x18005d69d
cmp esi, 0x3f6
jne 0x18005d6c8
mov dword [r15 + 0x1c], edi
mov eax, dword [r13]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x2050]
xor rcx, rsp
call fcn.18006d4c0
mov rbx, qword [rsp + 0x20a8]
add rsp, 0x2060
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [r15 + 0x18]
add rdi, rax
mov eax, dword [r15 + 0x1c]
mov dword [r15 + 0x18], edi
shr rdi, 0x20
add rdi, rax
jmp 0x18005d6c8
mov eax, dword [r15 + 0x14]
shr rdi, 0x20
add rdi, rax
mov dword [r15 + 0x14], edi
shr rdi, 0x20
add esi, 0x8e
cmp esi, ebp
jb 0x18005d290
jmp 0x18005d66d
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor r9d, r9d
lea r8, [0x180070fd1]
mov rcx, rax
lea rdx, str.y_LgNQYgma
lea rax, str.get_CodeViewRegisterEnumToRegisterId
mov qword [rsp + 0x20], rax
call fcn.18006ca50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov rax, qword [r14 + 0x10]
jmp 0x18005d672