Function at 0x40b970
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm6
mov rbx, rcx
mov rcx, qword [0x00536fc0]
mov qword [rsp + 0xf8], rdx
mov edx, 0x16
mov dword [rsp + 0x84], 0
call fcn.0040b8f0
mov r8d, 0xffffc3e3
movdqa xmm0, xmmword [0x0041ffd0]
mov edx, 0x786712aa
mov word [rax + 0x24], r8w
lea rcx, [0x0041fac0]
mov rsi, rax
movups xmmword [rax + 0x10], xmm0
lea r12, [rax + 0x10]
mov dword [rax + 0x20], 0xff410000
call fcn.00402bc0
mov edx, 0x29eb4d6e
mov rcx, rax
call fcn.00402e60
mov rcx, rax
call fcn.004023b0
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
mov rax, qword [0x00536d00]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [rax]
xor edx, edx
mov rcx, rax
mov rdi, rax
mov rax, qword [0x00536d10]
call qword [rax]
mov r13d, eax
mov rax, qword [0x00536d40]
call qword [rax]
xor edx, edx
movsxd r8, r13d
mov rcx, rax
mov rax, qword [0x00536cf0]
call qword [rax]
lea r9, [rsp + 0x84]
mov r8d, r13d
mov rcx, rdi
mov r15, rax
mov qword [rsp + 0x40], rax
mov rdx, rax
mov rax, qword [0x00536d20]
mov qword [rsp + 0x20], 0
call qword [rax]
movsxd r11, dword [r15 + 0x3c]
lea r14, [r15 + r11]
mov eax, dword [r14 + 0x88]
movzx r8d, word [r14 + 0x14]
mov dword [rsp + 0x48], eax
lea rax, [r14 + 0x18]
mov rcx, rax
add rax, r8
cmp word [r14 + 6], 0
mov qword [rsp + 0x50], rax
mov rbp, rax
je 0x40bb90
mov rdi, rax
xor r15d, r15d
mov r13, rcx
movdqa xmm6, xmmword [0x0041fec0]
mov qword [rsp + 0xf0], rbx
mov rbp, r8
jmp 0x40bae8
mov rdi, rbp
movzx ebp, word [r14 + 0x14]
lea eax, [r15 + r15*4]
add rbp, r13
mov ecx, 0x29
shl eax, 3
movzx eax, ax
add rbp, rax
call fcn.00412ed0
lea rcx, [0x0041faa0]
mov qword [rax + 0x20], 0
lea rbx, [rax + 0x10]
mov qword [rax + 8], 1
mov byte [rax + 0x28], 0
movups xmmword [rax + 0x10], xmm6
movzx edx, byte [rbp]
mov byte [rax + 0x20], dl
movzx edx, byte [rbp + 1]
mov byte [rax + 0x21], dl
movzx edx, byte [rbp + 2]
mov byte [rax + 0x22], dl
movzx edx, byte [rbp + 3]
mov byte [rax + 0x23], dl
movzx edx, byte [rbp + 4]
mov byte [rax + 0x24], dl
movzx edx, byte [rbp + 5]
mov byte [rax + 0x25], dl
movzx edx, byte [rbp + 6]
mov byte [rax + 0x26], dl
movzx edx, byte [rbp + 7]
mov byte [rax + 0x27], dl
mov edx, 0x6b6ae42a
call fcn.00402e60
mov rcx, rbx
mov rdx, rax
call fcn.00416070
test rax, rax
cmovs rbp, rdi
add r15d, 1
cmp word [r14 + 6], r15w
ja 0x40bae0
mov rbx, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0x40]
movsxd r15, dword [rsp + 0x48]
movsxd rdx, dword [rbp + 0xc]
movsxd rax, dword [rbp + 0x14]
add r15, rdi
sub r15, rdx
add r15, rax
movsxd rcx, dword [r15 + 0x20]
add rcx, rdi
sub rcx, rdx
lea r13, [rcx + rax]
movsxd rcx, dword [r15 + 0x1c]
add rcx, rdi
sub rcx, rdx
lea rdi, [rcx + rax]
mov ecx, dword [r15 + 0x18]
mov qword [rsp + 0x70], rdi
test ecx, ecx
jle 0x40be46
mov rcx, qword [rsp + 0xf8]
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x60], rdi
mov r13, qword [rsp + 0xf8]
mov dword [rsp + 0x58], 0
add rcx, 0x10
cmp qword [rsp + 0xf8], rdi
mov qword [rsp + 0x68], rcx
setae r9b
cmp rcx, r12
setbe cl
xor r14d, r14d
or r9d, ecx
mov byte [rsp + 0x7f], r9b
jmp 0x40bc5f
lea edi, [r14 + 1]
test rcx, rcx
je 0x40bc4a
test rbx, rbx
je 0x40bc4a
mov rdx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x40bc7b
cmp dword [r15 + 0x18], edi
mov r14d, edi
jle 0x40bde4
movsxd rdx, dword [rbp + 0xc]
movsxd rax, dword [rbp + 0x14]
mov rdi, qword [rsp + 0x48]
movsxd rcx, r14d
movsxd rcx, dword [rdi + rcx*4]
add rcx, qword [rsp + 0x40]
sub rcx, rdx
add rcx, rax
cmp rbx, rcx
jne 0x40bc30
mov rcx, qword [rsp + 0x70]
lea edi, [r14 + 1]
movsxd rax, edi
mov edx, dword [rcx + rax*4]
mov rax, qword [rsp + 0x50]
movsxd r8, dword [rax + 0xc]
movsxd rcx, dword [rax + 0x14]
mov rax, qword [0x00537310]
mov eax, dword [rax]
test eax, eax
jne 0x40be0b
movsxd rax, edx
add rax, qword [rsp + 0x40]
sub rax, r8
add rax, rcx
movzx edx, byte [rax + 4]
lea rcx, [0x0041fa80]
mov byte [rsi + 0x14], dl
movzx edx, byte [rax + 5]
mov byte [rsi + 0x15], dl
movzx edx, byte [rax + 6]
mov byte [rsi + 0x16], dl
movzx eax, byte [rax + 7]
mov edx, 0x43452e0e
mov byte [rsi + 0x17], al
call fcn.00402e60
mov rcx, rax
call fcn.004076f0
mov rcx, rax
mov rax, qword [0x00536d50]
call qword [rax]
mov rdx, rbx
mov rcx, rax
mov rax, qword [0x00536d60]
call qword [rax]
lea rcx, [rax + 0x27]
jmp 0x40bd1d
add rax, 1
cmp rcx, rax
je 0x40be04
cmp byte [rax], 0xf
mov rdx, rax
jne 0x40bd10
cmp byte [rax + 1], 5
jne 0x40bd10
mov rcx, rdx
mov r11d, edx
mov r10d, edx
mov byte [rsi + 0x1a], dl
shr rcx, 0x30
mov r9, rdx
mov r8, rdx
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x58], rcx
shr r11d, 0x10
movzx ecx, dh
shr r10d, 0x18
shr r9, 0x20
shr r8, 0x28
mov byte [rsi + 0x1b], cl
movzx ecx, byte [rsp + 0x58]
shr rdx, 0x38
cmp byte [rsp + 0x7f], 0
mov byte [rsi + 0x1c], r11b
mov byte [rsi + 0x1d], r10b
mov byte [rsi + 0x1e], r9b
mov byte [rsi + 0x1f], r8b
mov byte [rsi + 0x20], cl
mov byte [rsi + 0x21], dl
je 0x40be2b
mov rax, qword [rsp + 0x60]
movdqu xmm1, xmmword [rsi + 0x10]
mov rcx, qword [rsp + 0x68]
movups xmmword [r13], xmm1
movzx eax, byte [rax]
mov byte [rcx], al
movzx eax, byte [r12 + 0x11]
mov byte [r13 + 0x11], al
movzx eax, byte [r12 + 0x12]
mov byte [r13 + 0x12], al
movzx eax, byte [r12 + 0x13]
mov byte [r13 + 0x13], al
movzx eax, byte [r12 + 0x14]
mov byte [r13 + 0x14], al
cmp dword [r15 + 0x18], edi
mov dword [rsp + 0x58], 1
mov r14d, edi
jg 0x40bc57
mov eax, dword [rsp + 0x58]
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
jmp 0x40bd2b
mov rax, qword [rsp + 0x70]
add r14d, 8
movsxd r14, r14d
movsxd rax, dword [rax + r14*4]
add rax, qword [rsp + 0x40]
sub rax, r8
add rax, rcx
jmp 0x40bcb6
xor eax, eax
nop dword [rax]
movzx edx, byte [rsi + rax + 0x10]
mov byte [r13 + rax], dl
add rax, 1
cmp rax, 0x15
jne 0x40be30
jmp 0x40bdcf
mov dword [rsp + 0x58], 0
jmp 0x40bde4