Function at 0x17001c850
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm7
movaps xmmword [rsp + 0x70], xmm6
mov qword [rsp + 0x50], rcx
mov eax, dword [rdx + 8]
test eax, eax
je 0x17001cd52
mov r15, r8
mov rbx, qword [rsp + 0x100]
mov r14d, 0x44
lea rbp, [rsp + 0x60]
xorps xmm6, xmm6
movaps xmm7, xmmword [0x17006d020]
xor esi, esi
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
jmp 0x17001c8df
add qword [r9], 0x1c
mov eax, dword [rdx + 8]
lea rbp, [rsp + 0x60]
add rsi, 1
mov ecx, eax
add r14, 0x58
cmp rsi, rcx
jae 0x17001cd52
mov r13, qword [rdx]
cmp dword [r13 + r14 - 0x44], 4
jne 0x17001c8cc
mov rcx, qword [r13 + r14 - 0x2c]
test rcx, rcx
mov qword [rsp + 0x48], rsi
mov rdi, r9
je 0x17001c905
call sym.ntdll.dll_wcslen
add eax, eax
jmp 0x17001c907
xor eax, eax
mov qword [rsp + 0x58], rax
test r15, r15
je 0x17001c91e
mov rcx, qword [r15]
call sym.ntdll.dll_wcslen
add rax, rax
jmp 0x17001c923
mov eax, 0x16
mov qword [rsp + 0x20], rax
mov rdx, qword [r13 + r14 - 0x3c]
mov rcx, rbp
call sym.ntdll.dll_RtlInitUnicodeString
mov rdx, qword [rdi]
mov rcx, rbp
call sym.ntdll.dll_RtlGUIDFromString
mov eax, dword [rbx]
mov rcx, qword [rdi]
mov dword [rcx + 0x10], eax
mov rax, qword [rdi]
mov dword [rax + 0x14], pe_nt_image_headers64
mov rax, qword [rdi]
mov ecx, dword [rsp + 0x118]
mov dword [rax + 0x18], ecx
mov r15, qword [rdi]
mov rbx, qword [rsp + 0x50]
mov eax, dword [rbx + 0x14]
shr rax, 1
lea rcx, [rax + rax*8]
lea r12, [rcx + rcx*2]
add r12, rax
mov rsi, qword [rsp + 0x110]
mov rcx, rsi
call sym.ntdll.dll_RtlUniform
mov dword [r15 + r12], eax
mov rcx, rsi
call sym.ntdll.dll_RtlUniform
mov dword [r15 + r12 + 4], eax
mov rcx, rsi
call sym.ntdll.dll_RtlUniform
mov dword [r15 + r12 + 8], eax
mov rcx, rsi
call sym.ntdll.dll_RtlUniform
mov dword [r15 + r12 + 0xc], eax
movzx eax, word [r15 + r12 + 6]
and eax, 0xfff
or eax, 0x4000
mov word [r15 + r12 + 6], ax
movzx eax, byte [r15 + r12 + 8]
and al, 0x3f
or al, 0x80
mov byte [r15 + r12 + 8], al
mov rax, qword [rdi]
mov eax, dword [rax + 0x10]
mov dword [r15 + r12 + 0x10], eax
mov dword [r15 + r12 + 0x14], 0
mov rax, qword [rdi]
mov eax, dword [rax + 0x18]
mov dword [r15 + r12 + 0x18], eax
mov rax, qword [rdi]
mov eax, dword [rax + 0x10]
lea rsi, [rbx + rax]
mov dword [rbx + rax], pe_nt_image_headers64
mov ecx, dword [r13 + r14 - 0x14]
mov dword [rbx + rax + 8], ecx
mov rcx, qword [rdi]
movups xmm0, xmmword [rcx]
movups xmmword [rbx + rax + 0xc], xmm0
mov qword [rsp + 0x40], r15
movups xmm1, xmmword [r15 + r12]
movups xmmword [rbx + rax + 0x1c], xmm1
movups xmmword [rbx + rax + 0x2c], xmm0
mov rdx, qword [r13 + r14 - 0x34]
test rdx, rdx
je 0x17001ca50
mov rcx, rbp
call sym.ntdll.dll_RtlInitUnicodeString
lea rdx, [rsi + 0x3c]
mov rcx, rbp
call sym.ntdll.dll_RtlGUIDFromString
jmp 0x17001ca54
movups xmmword [rsi + 0x3c], xmm6
mov r10, qword [rsp + 0x108]
mov r11, qword [rsp + 0x20]
mov dword [rsi + 0x4c], r11d
mov r15d, dword [r10]
mov dword [rsi + 0x50], r15d
mov rax, qword [rsp + 0x58]
mov dword [rsi + 0x54], eax
test eax, eax
je 0x17001ca7c
mov eax, dword [rsi]
jmp 0x17001ca7e
xor eax, eax
mov dword [rsi + 0x58], eax
mov dword [rsi + 0x5c], 0
mov r8, qword [r13 + r14 - 0x24]
test r8, r8
mov eax, pe_nt_image_headers64
mov ecx, 0
cmove eax, ecx
mov dword [rsi + 0x60], eax
mov edx, dword [r13 + r14 - 0x10]
xor ebp, ebp
test edx, edx
setne bpl
mov dword [rsi + 0x64], edx
mov edx, dword [r13 + r14 - 0xc]
mov dword [rsi + 0x68], edx
mov ebx, dword [r13 + r14 - 8]
mov dword [rsi + 0x6c], ebx
mov edi, dword [r13 + r14 - 4]
mov dword [rsi + 0x70], edi
mov r9d, dword [r13 + r14]
shl ebp, 8
lea ecx, [rbp + 0x400]
test edx, edx
cmove ecx, ebp
lea edx, [rcx + 0x800]
test ebx, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 0x200
test edi, edi
cmove ecx, edx
mov edx, ecx
or edx, 0x1000
test r9d, r9d
cmove edx, ecx
mov dword [rsi + 0x74], r9d
mov dword [rsi + 4], edx
test r8, r8
mov qword [rsp + 0x20], r11
je 0x17001cb64
mov edi, eax
lea rbp, [rsi + rdi]
movups xmmword [rsi + rdi], xmm7
mov eax, dword [r10]
mov ecx, dword [rsi + 0x4c]
add eax, ecx
add eax, 2
mov dword [rsi + rdi + 0x10], eax
mov rcx, qword [r13 + r14 - 0x24]
call sym.ntdll.dll_wcslen
mov rbx, rax
add ebx, ebx
mov dword [rsi + rdi + 0x14], ebx
mov dword [rsi + rdi + 0x18], 0x2c
mov rcx, qword [r13 + r14 - 0x1c]
test rcx, rcx
je 0x17001cb9f
call sym.ntdll.dll_wcslen
add eax, eax
mov dword [rbp + 0x1c], eax
add ebx, 0x2e
test eax, eax
cmovne eax, ebx
jmp 0x17001cbab
add r15, qword [rsp + 0x50]
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax]
mov r8d, r11d
and r8d, 0xfffffffe
mov rcx, r15
mov rdi, r10
call sym.ntdll.dll_memcpy
mov r10, rdi
mov eax, dword [rsi + 0x4c]
and eax, 0xfffffffe
mov word [rax + r15], 0
xor ebp, ebp
mov r9, qword [rsp + 0x38]
jmp 0x17001cc83
mov dword [rbp + 0x1c], 0
add ebx, 0x2e
xor eax, eax
mov rdi, qword [rsp + 0x38]
mov dword [rbp + 0x20], eax
mov qword [rbp + 0x24], 0
mov dword [rsi + 0x5c], ebx
mov r8d, dword [rbp + 0xc]
mov ebx, dword [rbp + 0x10]
mov r15, qword [rsp + 0x50]
add rbx, r15
mov rcx, rbx
lea rdx, [0x17006ef16]
call sym.ntdll.dll_memcpy
mov eax, dword [rbp + 0xc]
and eax, 0xfffffffe
mov word [rax + rbx], 0
mov r8d, dword [rsi + 0x4c]
mov ebx, dword [rsi + 0x50]
add rbx, r15
mov rcx, rbx
lea rdx, str.MSCOREE.DLL
call sym.ntdll.dll_memcpy
mov eax, dword [rsi + 0x4c]
and eax, 0xfffffffe
mov word [rax + rbx], 0
mov r8d, dword [rbp + 0x14]
mov ebx, dword [rbp + 0x18]
add rbx, rbp
mov rdx, qword [r13 + r14 - 0x24]
mov rcx, rbx
call sym.ntdll.dll_memcpy
mov eax, dword [rbp + 0x14]
and eax, 0xfffffffe
mov word [rax + rbx], 0
mov eax, dword [rbp + 0x1c]
test eax, eax
je 0x17001cc65
mov ecx, dword [rsi + 0x5c]
add eax, ecx
add eax, 2
mov dword [rsi + 0x5c], eax
mov r8d, dword [rbp + 0x1c]
mov ebx, dword [rbp + 0x20]
add rbx, rbp
mov rdx, qword [r13 + r14 - 0x1c]
mov rcx, rbx
call sym.ntdll.dll_memcpy
mov eax, dword [rbp + 0x1c]
and eax, 0xfffffffe
mov word [rax + rbx], 0
cmp dword [rsi + 0x54], 0
mov r9, rdi
je 0x17001cc74
mov eax, dword [rsi + 0x5c]
add dword [rsi + 0x58], eax
mov rax, qword [r9]
add dword [rax + 0x14], 0x2c
mov r10, qword [rsp + 0x108]
mov r8d, dword [rsi + 0x54]
test r8, r8
je 0x17001ccb7
mov ebx, dword [rsi + 0x58]
add rbx, rsi
mov rdx, qword [r13 + r14 - 0x2c]
mov rcx, rbx
mov r15, r10
mov rdi, r9
call sym.ntdll.dll_memcpy
mov r9, rdi
mov r10, r15
mov eax, dword [rsi + 0x54]
and eax, 0xfffffffe
mov word [rax + rbx], 0
test rbp, rbp
je 0x17001ccd0
mov eax, dword [rbp + 0x14]
mov ecx, dword [rbp + 0x1c]
add eax, 2
test ecx, ecx
je 0x17001ccd2
add eax, ecx
add eax, 2
jmp 0x17001ccd2
xor eax, eax
mov r15, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
test ecx, ecx
lea ecx, [rcx + 5]
mov ebx, 3
cmove ecx, ebx
add ecx, eax
and ecx, 0xfffffffc
mov rax, qword [r9]
add dword [rax + 0x14], ecx
lea rax, [rdi + r12]
add rax, 0x14
mov rbx, qword [r9]
mov ebx, dword [rbx + 0x14]
mov dword [rax], ebx
mov rbx, qword [rsp + 0x100]
mov eax, dword [rbx]
lea eax, [rcx + rax + 0x78]
mov dword [rbx], eax
mov eax, dword [r10]
mov rcx, qword [rsp + 0x20]
add eax, ecx
add eax, 2
mov dword [r10], eax
test rbp, rbp
je 0x17001c8c0
add dword [rbx], 0x2c
mov eax, dword [rbp + 0xc]
mov ecx, dword [r10]
add eax, ecx
add eax, 2
mov dword [r10], eax
jmp 0x17001c8c0
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret