Function at 0x1400bf550
Capabilities:
Enumerate pe sections

Disassembly:
test r8d, r8d
je 0x1400c00c7
mov rax, rsp
mov dword [rax + 0x18], r8d
push r13
push r14
sub rsp, 0x88
mov qword [rax + 8], rbx
mov qword [rax - 0x18], rbp
mov qword [rax - 0x20], rsi
mov qword [rax - 0x28], rdi
mov qword [rax - 0x30], r12
xor r12d, r12d
mov r13, rdx
mov r14, rcx
mov qword [rax - 0x38], r15
lea r10d, [r12 + 1]
movabs r11, 0xffffffffffff
nop
nop
mov edx, dword [r13]
cmp edx, 0x454c4946
jne 0x1400c0033
test byte [r13 + 0x16], 1
je 0x1400c007e
mov rax, qword [r13 + 0x20]
test rax, rax
je 0x1400bf712
test r11, rax
jne 0x1400bf712
mov ecx, dword [r14 + 0x18]
add rcx, 8
call fcn.1400be650
mov r8d, dword [r14 + 0x18]
mov rdx, r13
lea rcx, [rax + 8]
mov rbx, rax
call fcn.140193220
mov r9, qword [r13 + 0x20]
mov r8, qword [r14 + 0x30]
lea rdx, str.found_extended_MFT_file_record__016I64x_base__016I64x_n
mov ecx, 0xff00ffff
call fcn.1400b1ca0
lea rcx, str.extended_MFT_type__t_n
mov r8d, 4
mov rdx, r13
call fcn.1400b1c70
movzx edx, word [r13 + 4]
lea rcx, str.extended_MFT_USA_Offset__u_n
call fcn.1400b1c70
movzx edx, word [r13 + 6]
lea rcx, str.extended_MFT_USA_Count__u_n
call fcn.1400b1c70
mov rdx, qword [r13 + 8]
lea rcx, str.extended_MFT_lsn__I64u_n
call fcn.1400b1c70
movzx edx, word [r13 + 0x10]
lea rcx, str.extended_MFT_sequence_number__u_n
call fcn.1400b1c70
movzx edx, word [r13 + 0x12]
lea rcx, str.extended_MFT_name_count__u_n
call fcn.1400b1c70
movzx edx, word [r13 + 0x14]
lea rcx, str.extended_MFT_attribute_offset__u_n
call fcn.1400b1c70
movzx edx, word [r13 + 0x16]
lea rcx, str.extended_MFT_flags__u_n
call fcn.1400b1c70
mov edx, dword [r13 + 0x18]
lea rcx, str.extended_MFT_bytes_in_use__u_n
call fcn.1400b1c70
mov edx, dword [r13 + 0x1c]
lea rcx, str.extended_MFT_bytes_allocated__u_n
call fcn.1400b1c70
mov rdx, qword [r13 + 0x20]
lea rcx, str.extended_MFT_base_frn__u_n
call fcn.1400b1c70
movzx edx, word [r13 + 0x28]
lea rcx, str.extended_MFT_next_attribute_number__u_n
call fcn.1400b1c70
cmp qword [r14 + 0xc0], 0
je 0x1400bf6ec
mov rax, qword [r14 + 0xc8]
mov qword [rax], rbx
jmp 0x1400bf6f3
mov qword [r14 + 0xc0], rbx
mov qword [rbx], r12
mov r10d, 1
movabs r11, 0xffffffffffff
mov qword [r14 + 0xc8], rbx
jmp 0x1400c007e
mov rax, qword [r14 + 0x30]
cmp rax, 0x10
jae 0x1400bf726
cmp rax, 5
jne 0x1400c007e
movzx ecx, word [r13 + 4]
movzx r8d, word [r13 + 6]
add rcx, r13
cmp r8d, 1
jbe 0x1400bf84d
lea r9d, [r8 + r8]
test r9d, r9d
je 0x1400bf791
cmp rcx, r13
jb 0x1400bf765
mov edx, dword [r14 + 0x18]
lea rax, [r13 + rdx]
cmp rcx, rax
jae 0x1400bf765
mov eax, r13d
sub eax, ecx
add eax, edx
cmp r9d, eax
jbe 0x1400bf791
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b1ca0
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400c007e
movzx r10d, word [rcx]
add r8d, 0xffffffff
add rcx, 2
mov r9d, r8d
lea rdx, [r13 + 0x1fe]
shl r9d, 9
je 0x1400bf7f3
mov r11d, dword [r14 + 0x18]
lea rax, [r13 + r11]
cmp r13, rax
jae 0x1400bf7c0
cmp r9d, r11d
jbe 0x1400bf7e9
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
xor r8d, r8d
mov ecx, 0xffff0000
call fcn.1400b1ca0
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400c007e
movabs r11, 0xffffffffffff
test r8d, r8d
je 0x1400bf847
cmp word [rdx], r10w
jne 0x1400bf81f
movzx eax, word [rcx]
add rdx, 0x200
add rcx, 2
add r8d, 0xffffffff
mov word [rdx - 0x200], ax
jne 0x1400bf7f8
lea r10d, [r8 + 1]
jmp 0x1400bf84d
movzx edx, word [rdx]
lea rcx, str.bad_US__x____x_n
movzx r8d, r10w
call fcn.1400b1c70
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400c007e
mov r10d, 1
mov r15b, byte [r13 + 0x16]
movzx ebx, word [r13 + 0x14]
xor ebp, ebp
and r15d, 2
mov esi, ebp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x48], 0xffffffffffffffff
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0xffffffffffffffff
add rbx, r13
mov qword [rsp + 0x30], rbp
mov rdi, rbp
nop
nop
cmp rbx, r13
jb 0x1400bfc52
mov edx, dword [r14 + 0x18]
lea r8, [rdx + r13]
cmp rbx, r8
jae 0x1400bfc52
mov ecx, r13d
sub ecx, ebx
add ecx, edx
cmp ecx, 4
jb 0x1400bfc52
mov eax, dword [rbx]
cmp eax, 0xffffffff
je 0x1400bfc6f
cmp ecx, 8
jb 0x1400bfc33
mov r9d, dword [rbx + 4]
test r9d, r9d
je 0x1400bf8e0
cmp r9d, ecx
ja 0x1400bfbfe
cmp r9d, 0x10
jb 0x1400bfc17
cmp byte [rbx + 9], bpl
jne 0x1400bfbe9
sub eax, 0x10
je 0x1400bfb2a
sub eax, 0x10
je 0x1400bfb0a
sub eax, 0x10
je 0x1400bf9a5
cmp eax, 0x50
jne 0x1400bfbe9
cmp dword [r14 + 0x2c], ebp
je 0x1400bfbe9
test byte [rbx + 8], 1
je 0x1400bf96b
cmp ecx, 0x48
jae 0x1400bf953
mov r8d, ebx
lea r9d, [rax - 8]
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b1ca0
mov r10d, 1
jmp 0x1400bfbe9
cmp qword [rbx + 0x10], rbp
jne 0x1400bfbe9
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x30], rax
jmp 0x1400bfbe9
cmp ecx, 0x16
jae 0x1400bf998
mov r8d, ebx
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, socket
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b1ca0
mov r10d, 1
jmp 0x1400bfbe9
mov eax, dword [rbx + 0x10]
mov qword [rsp + 0x30], rax
jmp 0x1400bfbe9
test byte [rbx + 8], 1
jne 0x1400bfaf3
cmp ecx, 0x16
jae 0x1400bf9dc
mov r8d, ebx
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, socket
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b1ca0
mov r10d, 1
jmp 0x1400bfbe9
movzx ecx, word [rbx + 0x14]
add rcx, rbx
cmp rcx, r13
jb 0x1400bfacb
cmp rcx, r8
jae 0x1400bfacb
mov eax, r13d
sub eax, ecx
add edx, eax
cmp edx, 0x42
jb 0x1400bfacb
movzx eax, byte [rcx + 0x40]
lea r9d, [rax + rax + 0x42]
test r9d, r9d
je 0x1400bfa3a
cmp r9d, edx
jbe 0x1400bfa3a
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b1ca0
mov r10d, 1
jmp 0x1400bfbe9
movzx eax, byte [rcx + 0x41]
cmp al, 1
je 0x1400bfa6c
cmp al, 3
je 0x1400bfa6c
test al, al
je 0x1400bfa6c
cmp al, 2
je 0x1400bfbe9
lea rcx, str.bad_name_flag__02x_n
movzx edx, al
call fcn.1400b1c70
mov r10d, 1
jmp 0x1400bfbe9
mov rdx, qword [rcx]
and rdx, r11
cmp rdx, 0x10
jae 0x1400bfa95
cmp rdx, 5
je 0x1400bfa95
lea rcx, str.ignore_name_attr_for_internal_ntfs_folder__016I64x_n
call fcn.1400b1c70
mov r10d, 1
jmp 0x1400bfbe9
test rdi, rdi
je 0x1400bfab7
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xa8], rcx
mov qword [rax + 0x28], rcx
mov qword [rcx + 0x28], rbp
jmp 0x1400bfbe9
mov rdi, rcx
mov qword [rcx + 0x28], rbp
mov qword [rsp + 0xa8], rcx
jmp 0x1400bfbe9
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 0x42
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b1ca0
mov r10d, 1
jmp 0x1400bfbe9
lea rcx, str.nonresident_name_attribute_n
call fcn.1400b1c70
mov r10d, 1
jmp 0x1400bfbe9
cmp qword [r13 + 0x20], rbp
je 0x1400bfb22
lea rcx, str.attribute_list_attribute_with_base_frn_n
call fcn.1400b1c70
mov r10d, 1
mov esi, r10d
jmp 0x1400bfbe9
cmp dword [r14 + 0x28], ebp
je 0x1400bfbe9
test r12d, r12d
jne 0x1400bfbe9
test byte [rbx + 8], 1
je 0x1400bfb59
lea rcx, str.nonresident_standard_information_n
call fcn.1400b1c70
lea r10d, [r12 + 1]
jmp 0x1400bfbe9
cmp ecx, 0x16
jae 0x1400bfb83
mov r8d, ebx
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, socket
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b1ca0
mov r10d, 1
jmp 0x1400bfbe9
movzx ecx, word [rbx + 0x14]
add rcx, rbx
cmp rcx, r13
jb 0x1400bfbc6
cmp rcx, r8
jae 0x1400bfbc6
mov eax, r13d
sub eax, ecx
add eax, edx
cmp eax, 0x24
jb 0x1400bfbc6
mov eax, dword [rcx + 0x20]
mov r12d, r10d
mov dword [rsp + 0x50], eax
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x1400bfbe9
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 0x24
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b1ca0
mov r10d, 1
mov eax, dword [rbx + 4]
movabs r11, 0xffffffffffff
add rbx, rax
jmp 0x1400bf890
sub ebx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov ecx, 0xffff0000
mov r8d, ebx
call fcn.1400b1ca0
jmp 0x1400bfc6f
mov r8d, dword [rbx + 4]
mov rdx, qword [r14 + 0x30]
lea rcx, str._t_I64u:_BAD_record_length__d____d_n
mov r9d, reloc.WS2_32.dll_recv
call fcn.1400b1c70
jmp 0x1400bfc6f
sub ebx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 8
mov r8d, ebx
mov ecx, 0xffff0000
call fcn.1400b1ca0
jmp 0x1400bfc6f
sub ebx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 4
mov r8d, ebx
mov ecx, 0xffff0000
call fcn.1400b1ca0
mov rdx, qword [r13 + 0x20]
test rdx, rdx
je 0x1400bfe04
mov rax, rdx
movabs rcx, 0xffffffffffff
and rax, rcx
cmp rax, 0x10
jae 0x1400bfcbb
cmp rax, 5
je 0x1400bfcbb
lea rcx, str.ignore_internal_extended_fragmented_file_record__016I64x_n
call fcn.1400b1c70
xor r12d, r12d
movabs r11, 0xffffffffffff
lea r10d, [r12 + 1]
jmp 0x1400c007e
mov rax, qword [r14 + 0x78]
add rax, 0x50
cmp rax, qword [r14 + 0x80]
jb 0x1400bfcda
lea rcx, [r14 + 0x68]
mov edx, 0x50
call fcn.1400d34f0
mov rsi, qword [r14 + 0x78]
lea rax, [rsi + 0x50]
mov qword [r14 + 0x78], rax
mov rax, qword [r13 + 0x20]
mov qword [rsi + 8], rax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x30], eax
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x18], rax
mov rax, qword [rsp + 0x48]
mov qword [rsi + 0x20], rax
mov rax, qword [rsp + 0x30]
mov dword [rsi + 0x38], r12d
xor r12d, r12d
test rdi, rdi
mov dword [rsi + 0x34], r15d
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], r12
mov qword [rsi + 0x48], r12
je 0x1400bfdd5
nop
nop
nop
movzx eax, byte [rdi + 0x40]
lea edx, [rax + rax + 0x18]
cmp edx, 0x100
jle 0x1400bfd5e
lea rcx, [r14 + 0x68]
call fcn.1400d35c0
mov rbx, rax
jmp 0x1400bfd8a
mov rax, qword [r14 + 0x78]
movsxd r12, edx
lea rcx, [r12 + rax]
cmp rcx, qword [r14 + 0x80]
jb 0x1400bfd7b
lea rcx, [r14 + 0x68]
call fcn.1400d34f0
mov rbx, qword [r14 + 0x78]
lea rax, [rbx + r12]
xor r12d, r12d
mov qword [r14 + 0x78], rax
movzx eax, byte [rdi + 0x40]
lea rdx, [rdi + 0x42]
lea rcx, [rbx + 0x18]
mov byte [rbx + 0x10], al
mov rax, qword [rdi]
mov qword [rbx], rax
movzx r8d, byte [rdi + 0x40]
add r8, r8
call fcn.140193220
cmp qword [rsi + 0x40], rbp
je 0x1400bfdbc
mov rax, qword [rsi + 0x48]
mov qword [rax + 8], rbx
jmp 0x1400bfdc0
mov qword [rsi + 0x40], rbx
mov qword [rbx + 8], r12
mov qword [rsi + 0x48], rbx
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400bfd40
cmp qword [r14 + 0x38], rbp
je 0x1400bfde4
mov rax, qword [r14 + 0x40]
mov qword [rax], rsi
jmp 0x1400bfde8
mov qword [r14 + 0x38], rsi
mov qword [rsi], r12
mov r10d, 1
movabs r11, 0xffffffffffff
mov qword [r14 + 0x40], rsi
jmp 0x1400c007e
test esi, esi
je 0x1400bffb8
mov rax, qword [r14 + 0x50]
cmp qword [r14 + 0x48], rax
jne 0x1400bfea6
mov eax, dword [r14 + 0x60]
mov ebx, dword [r14 + 0x64]
add eax, 1
cmp eax, ebx
jbe 0x1400bfe6b
mov eax, 1
add ebx, ebx
cmove ebx, eax
mov ecx, ebx
shl rcx, 3
call fcn.1400be650
mov r8d, dword [r14 + 0x60]
mov rdx, qword [r14 + 0x58]
shl r8, 3
mov rcx, rax
mov rsi, rax
call fcn.140193220
mov rcx, qword [r14 + 0x58]
test rcx, rcx
je 0x1400bfe63
call fcn.1400be6d0
mov qword [r14 + 0x58], rsi
mov dword [r14 + 0x64], ebx
mov ecx, 0x10000
call fcn.1400be650
mov edx, dword [r14 + 0x60]
mov rcx, qword [r14 + 0x58]
mov qword [rcx + rdx*8], rax
mov edx, dword [r14 + 0x60]
mov rcx, qword [r14 + 0x58]
mov rax, qword [rcx + rdx*8]
mov qword [r14 + 0x48], rax
mov rax, qword [rcx + rdx*8]
add rax, 0xfff0
mov qword [r14 + 0x50], rax
lea eax, [rdx + 1]
mov dword [r14 + 0x60], eax
mov rsi, qword [r14 + 0x48]
lea rax, [rsi + 0x48]
mov qword [r14 + 0x48], rax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsi + 8], rax
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x48]
mov dword [rsi + 0x30], r12d
mov qword [rsi + 0x18], rax
mov rax, qword [rsp + 0x30]
xor r12d, r12d
mov qword [rsi + 0x20], rax
movzx eax, word [r13 + 0x10]
shl rax, 0x30
or rax, qword [r14 + 0x30]
test rdi, rdi
mov qword [rsi + 0x38], r12
mov qword [rsi + 0x40], r12
mov dword [rsi + 0x2c], r15d
mov qword [rsi], rax
je 0x1400c006e
nop
nop
movzx eax, byte [rdi + 0x40]
lea edx, [rax + rax + 0x18]
cmp edx, 0x100
jle 0x1400bff2e
lea rcx, [r14 + 0x68]
call fcn.1400d35c0
mov rbx, rax
jmp 0x1400bff5a
mov rax, qword [r14 + 0x78]
movsxd r12, edx
lea rcx, [r12 + rax]
cmp rcx, qword [r14 + 0x80]
jb 0x1400bff4b
lea rcx, [r14 + 0x68]
call fcn.1400d34f0
mov rbx, qword [r14 + 0x78]
lea rax, [rbx + r12]
xor r12d, r12d
mov qword [r14 + 0x78], rax
movzx eax, byte [rdi + 0x40]
lea rdx, [rdi + 0x42]
lea rcx, [rbx + 0x18]
mov byte [rbx + 0x10], al
mov rax, qword [rdi]
mov qword [rbx], rax
movzx r8d, byte [rdi + 0x40]
add r8, r8
call fcn.140193220
cmp qword [rsi + 0x38], rbp
je 0x1400bff8c
mov rax, qword [rsi + 0x40]
mov qword [rax + 8], rbx
jmp 0x1400bff90
mov qword [rsi + 0x38], rbx
mov qword [rbx + 8], r12
mov qword [rsi + 0x40], rbx
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400bff10
lea r10d, [rdi + 1]
movabs r11, 0xffffffffffff
jmp 0x1400c007e
movzx eax, word [r13 + 0x10]
shl rax, 0x30
or rax, qword [r14 + 0x30]
test rdi, rdi
mov qword [rsp + 0x20], rax
je 0x1400c005a
nop
nop
nop
nop
test r15d, r15d
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
lea rax, [rdi + 0x42]
mov qword [rsp + 0x58], rax
movzx eax, byte [rdi + 0x40]
mov byte [rsp + 0x54], al
je 0x1400c0005
or dword [rsp + 0x50], 0x10
jmp 0x1400c000a
and dword [rsp + 0x50], 0xffffffef
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x20]
call qword [r14 + reloc.WS2_32.dll_recv]
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400bffe0
xor r12d, r12d
lea r10d, [rdi + 1]
movabs r11, 0xffffffffffff
jmp 0x1400c007e
cmp dword [0x1401f3720], 0
je 0x1400c007e
lea rcx, str.bad_file_record_type__08x_n
call fcn.1400b1c70
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400c007e
xor r12d, r12d
movabs r11, 0xffffffffffff
lea r10d, [r12 + 1]
jmp 0x1400c007e
mov r10d, 1
movabs r11, 0xffffffffffff
mov eax, dword [r14 + 0x18]
add qword [r14 + 0x30], 1
add r13, rax
add dword [rsp + 0xb0], 0xffffffff
jne 0x1400bf5a0
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x88
pop r14
pop r13
ret 0