Function at 0x140042be0
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov r13, qword [rdx]
mov r14, qword [rdx + 0x10]
mov esi, dword [rdx + 0x18]
movzx eax, byte [r13 + 4]
movzx edi, byte [r13 + 0x11]
mov rbx, rcx
movzx ecx, byte [r13 + 5]
mov dword [rsp + 0x88], eax
shl edi, 8
mov eax, ecx
mov r12d, ecx
and ecx, 4
mov dword [rsp + 0x24], ecx
movzx ecx, byte [r13 + 0xd]
and eax, 1
shl rcx, 8
mov dword [rsp + 0x20], eax
movzx eax, byte [r13 + 0xc]
or rcx, rax
movzx eax, byte [r13 + 0xb]
xor ebp, ebp
shl rcx, 8
and r12d, 2
or rcx, rax
movzx eax, byte [r13 + 0xa]
shl rcx, 8
or rcx, rax
movzx eax, byte [r13 + 9]
shl rcx, 8
or rcx, rax
movzx eax, byte [r13 + 8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r13 + 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [r13 + 6]
shl rcx, 8
or rcx, rax
movzx eax, byte [r13 + 0x10]
or edi, eax
movzx eax, byte [r13 + 0xf]
mov qword [rsp + 0x28], rcx
movzx ecx, byte [r13 + 0x15]
shl edi, 8
or edi, eax
movzx eax, byte [r13 + 0xe]
shl ecx, 8
shl edi, 8
or edi, eax
movzx eax, byte [r13 + 0x14]
or ecx, eax
movzx eax, byte [r13 + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [r13 + 0x1a]
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x98], ecx
test rbx, rbx
je 0x140042f5f
mov rcx, qword [rbx]
test rcx, rcx
je 0x140042f5f
movsxd rax, dword [rbx + 0x10]
mov qword [rsp + 0x38], r15
movsxd r15, dword [rbx + 0x34]
test eax, eax
je 0x140042d18
sub dword [rbx + 0xc], eax
je 0x140042d15
movsxd r8, dword [rbx + 0xc]
lea rdx, [rcx + rax]
call sub.msvcrt.dll_memmove
mov dword [rbx + 0x10], ebp
test r15d, r15d
je 0x140042d5e
mov eax, dword [rbx + 0x2c]
sub eax, r15d
je 0x140042d53
mov rcx, qword [rbx + 0x18]
movsxd r8, eax
lea rdx, [rcx + r15*4]
shl r8, 2
call sub.msvcrt.dll_memmove
mov eax, dword [rbx + 0x2c]
mov rcx, qword [rbx + 0x20]
sub eax, r15d
lea rdx, [rcx + r15*8]
movsxd r8, eax
shl r8, 3
call sub.msvcrt.dll_memmove
sub dword [rbx + 0x2c], r15d
sub dword [rbx + 0x30], r15d
mov dword [rbx + 0x34], ebp
cmp edi, dword [rbx + 0x160]
jne 0x140042e6f
cmp dword [rsp + 0x88], ebp
jg 0x140042e6f
movsxd rdi, dword [rsp + 0x90]
mov rcx, rbx
lea edx, [rdi + 1]
call fcn.140041ff0
test eax, eax
jne 0x140042e6f
mov r11d, dword [rbx + 0x164]
mov r15d, dword [rsp + 0x98]
cmp r15d, r11d
je 0x140042dfe
movsxd r9, dword [rbx + 0x30]
mov r10d, dword [rbx + 0x2c]
cmp r9d, r10d
jge 0x140042de2
mov rcx, qword [rbx + 0x18]
mov edx, dword [rbx + 0xc]
sub r10d, r9d
lea r8, [rcx + r9*4]
mov ecx, r10d
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8]
lea r8, [r8 + 4]
sub edx, eax
mov dword [rbx + 0xc], edx
dec rcx
jne 0x140042dd0
mov dword [rbx + 0x2c], r9d
cmp r11d, 0xffffffff
je 0x140042dfe
mov rax, qword [rbx + 0x18]
mov dword [rax + r9*4], 0x400
inc dword [rbx + 0x2c]
inc dword [rbx + 0x30]
cmp dword [rsp + 0x20], ebp
je 0x140042e5d
movsxd rax, dword [rbx + 0x2c]
cmp eax, 1
jl 0x140042e2a
mov rcx, rax
mov rax, qword [rbx + 0x18]
mov edx, dword [rax + rcx*4 - 4]
movzx eax, dl
cmp eax, 0xff
jl 0x140042e2a
cmp edx, 0x400
jne 0x140042e5d
xor r12d, r12d
xor edx, edx
test rdi, rdi
jle 0x140042e5d
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r13 + rdx + 0x1b]
inc ebp
add r14, rcx
sub esi, ecx
cmp ecx, 0xff
jl 0x140042e5d
inc rdx
cmp rdx, rdi
jl 0x140042e40
test esi, esi
je 0x140042e9b
mov edx, esi
mov rcx, rbx
call fcn.140041f80
test eax, eax
je 0x140042e86
or eax, 0xffffffff
mov r15, qword [rsp + 0x38]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
movsxd rcx, dword [rbx + 0xc]
movsxd r8, esi
mov rdx, r14
add rcx, qword [rbx]
call sub.msvcrt.dll_memcpy
add dword [rbx + 0xc], esi
movsxd rdx, ebp
or r9d, 0xffffffff
cmp rdx, rdi
jge 0x140042f26
nop word [rax + rax]
movsxd rcx, dword [rbx + 0x2c]
mov rax, qword [rbx + 0x18]
movzx r8d, byte [r13 + rdx + 0x1b]
mov dword [rax + rcx*4], r8d
movsxd rcx, dword [rbx + 0x2c]
mov rax, qword [rbx + 0x20]
mov qword [rax + rcx*8], 0xffffffffffffffff
test r12d, r12d
je 0x140042ee9
movsxd rcx, dword [rbx + 0x2c]
mov rax, qword [rbx + 0x18]
or dword [rax + rcx*4], 0x100
xor r12d, r12d
cmp r8d, 0xff
jge 0x140042ef6
mov r9d, dword [rbx + 0x2c]
inc dword [rbx + 0x2c]
mov eax, dword [rbx + 0x2c]
inc rdx
cmp r8d, 0xff
jge 0x140042f0b
mov dword [rbx + 0x30], eax
cmp rdx, rdi
jl 0x140042eb0
cmp r9d, 0xffffffff
je 0x140042f26
mov rax, qword [rbx + 0x20]
mov rdx, qword [rsp + 0x28]
movsxd rcx, r9d
mov qword [rax + rcx*8], rdx
cmp dword [rsp + 0x24], 0
je 0x140042f4e
movsxd rax, dword [rbx + 0x2c]
mov dword [rbx + 0x158], 1
test eax, eax
jle 0x140042f4e
mov rcx, rax
mov rax, qword [rbx + 0x18]
or dword [rax + rcx*4 - 4], 0x200
lea eax, [r15 + 1]
mov dword [rbx + 0x164], eax
xor eax, eax
jmp 0x140042e72
or eax, 0xffffffff
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret