Function at 0x1400d0600
Capabilities:
Enumerate pe sections

Disassembly:
test r8d, r8d
je 0x1400d1177
mov rax, rsp
mov dword [rax + 0x18], r8d
push r13
push r14
sub rsp, 0x88
mov qword [rax + 8], rbx
mov qword [rax - 0x18], rbp
mov qword [rax - 0x20], rsi
mov qword [rax - 0x28], rdi
mov qword [rax - 0x30], r12
xor r12d, r12d
mov r13, rdx
mov r14, rcx
mov qword [rax - 0x38], r15
lea r10d, [r12 + 1]
movabs r11, 0xffffffffffff
nop
nop
mov edx, dword [r13]
cmp edx, 0x454c4946
jne 0x1400d10e3
test byte [r13 + 0x16], 1
je 0x1400d112e
mov rax, qword [r13 + 0x20]
test rax, rax
je 0x1400d07c2
test r11, rax
jne 0x1400d07c2
mov ecx, dword [r14 + 0x18]
add rcx, 8
call fcn.1400cf700
mov r8d, dword [r14 + 0x18]
mov rdx, r13
lea rcx, [rax + 8]
mov rbx, rax
call fcn.1401a8ef0
mov r9, qword [r13 + 0x20]
mov r8, qword [r14 + 0x30]
lea rdx, str.found_extended_MFT_file_record__016I64x_base__016I64x_n
mov ecx, 0xff00ffff
call fcn.1400b4010
lea rcx, str.extended_MFT_type__t_n
mov r8d, 4
mov rdx, r13
call fcn.1400b3fe0
movzx edx, word [r13 + 4]
lea rcx, str.extended_MFT_USA_Offset__u_n
call fcn.1400b3fe0
movzx edx, word [r13 + 6]
lea rcx, str.extended_MFT_USA_Count__u_n
call fcn.1400b3fe0
mov rdx, qword [r13 + 8]
lea rcx, str.extended_MFT_lsn__I64u_n
call fcn.1400b3fe0
movzx edx, word [r13 + 0x10]
lea rcx, str.extended_MFT_sequence_number__u_n
call fcn.1400b3fe0
movzx edx, word [r13 + 0x12]
lea rcx, str.extended_MFT_name_count__u_n
call fcn.1400b3fe0
movzx edx, word [r13 + 0x14]
lea rcx, str.extended_MFT_attribute_offset__u_n
call fcn.1400b3fe0
movzx edx, word [r13 + 0x16]
lea rcx, str.extended_MFT_flags__u_n
call fcn.1400b3fe0
mov edx, dword [r13 + 0x18]
lea rcx, str.extended_MFT_bytes_in_use__u_n
call fcn.1400b3fe0
mov edx, dword [r13 + 0x1c]
lea rcx, str.extended_MFT_bytes_allocated__u_n
call fcn.1400b3fe0
mov rdx, qword [r13 + 0x20]
lea rcx, str.extended_MFT_base_frn__u_n
call fcn.1400b3fe0
movzx edx, word [r13 + 0x28]
lea rcx, str.extended_MFT_next_attribute_number__u_n
call fcn.1400b3fe0
cmp qword [r14 + 0xc0], 0
je 0x1400d079c
mov rax, qword [r14 + 0xc8]
mov qword [rax], rbx
jmp 0x1400d07a3
mov qword [r14 + 0xc0], rbx
mov qword [rbx], r12
mov r10d, 1
movabs r11, 0xffffffffffff
mov qword [r14 + 0xc8], rbx
jmp 0x1400d112e
mov rax, qword [r14 + 0x30]
cmp rax, 0x10
jae 0x1400d07d6
cmp rax, 5
jne 0x1400d112e
movzx ecx, word [r13 + 4]
movzx r8d, word [r13 + 6]
add rcx, r13
cmp r8d, 1
jbe 0x1400d08fd
lea r9d, [r8 + r8]
test r9d, r9d
je 0x1400d0841
cmp rcx, r13
jb 0x1400d0815
mov edx, dword [r14 + 0x18]
lea rax, [r13 + rdx]
cmp rcx, rax
jae 0x1400d0815
mov eax, r13d
sub eax, ecx
add eax, edx
cmp r9d, eax
jbe 0x1400d0841
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b4010
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400d112e
movzx r10d, word [rcx]
add r8d, 0xffffffff
add rcx, 2
mov r9d, r8d
lea rdx, [r13 + 0x1fe]
shl r9d, 9
je 0x1400d08a3
mov r11d, dword [r14 + 0x18]
lea rax, [r13 + r11]
cmp r13, rax
jae 0x1400d0870
cmp r9d, r11d
jbe 0x1400d0899
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
xor r8d, r8d
mov ecx, 0xffff0000
call fcn.1400b4010
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400d112e
movabs r11, 0xffffffffffff
test r8d, r8d
je 0x1400d08f7
cmp word [rdx], r10w
jne 0x1400d08cf
movzx eax, word [rcx]
add rdx, 0x200
add rcx, 2
add r8d, 0xffffffff
mov word [rdx - 0x200], ax
jne 0x1400d08a8
lea r10d, [r8 + 1]
jmp 0x1400d08fd
movzx edx, word [rdx]
lea rcx, str.bad_US__x____x_n
movzx r8d, r10w
call fcn.1400b3fe0
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400d112e
mov r10d, 1
mov r15b, byte [r13 + 0x16]
movzx ebx, word [r13 + 0x14]
xor ebp, ebp
and r15d, 2
mov esi, ebp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x48], 0xffffffffffffffff
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0xffffffffffffffff
add rbx, r13
mov qword [rsp + 0x30], rbp
mov rdi, rbp
nop
nop
cmp rbx, r13
jb 0x1400d0d02
mov edx, dword [r14 + 0x18]
lea r8, [rdx + r13]
cmp rbx, r8
jae 0x1400d0d02
mov ecx, r13d
sub ecx, ebx
add ecx, edx
cmp ecx, 4
jb 0x1400d0d02
mov eax, dword [rbx]
cmp eax, 0xffffffff
je 0x1400d0d1f
cmp ecx, 8
jb 0x1400d0ce3
mov r9d, dword [rbx + 4]
test r9d, r9d
je 0x1400d0990
cmp r9d, ecx
ja 0x1400d0cae
cmp r9d, 0x10
jb 0x1400d0cc7
cmp byte [rbx + 9], bpl
jne 0x1400d0c99
sub eax, 0x10
je 0x1400d0bda
sub eax, 0x10
je 0x1400d0bba
sub eax, 0x10
je 0x1400d0a55
cmp eax, 0x50
jne 0x1400d0c99
cmp dword [r14 + 0x2c], ebp
je 0x1400d0c99
test byte [rbx + 8], 1
je 0x1400d0a1b
cmp ecx, 0x48
jae 0x1400d0a03
mov r8d, ebx
lea r9d, [rax - 8]
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b4010
mov r10d, 1
jmp 0x1400d0c99
cmp qword [rbx + 0x10], rbp
jne 0x1400d0c99
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x30], rax
jmp 0x1400d0c99
cmp ecx, 0x16
jae 0x1400d0a48
mov r8d, ebx
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, reloc.WS2_32.dll_shutdown
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b4010
mov r10d, 1
jmp 0x1400d0c99
mov eax, dword [rbx + 0x10]
mov qword [rsp + 0x30], rax
jmp 0x1400d0c99
test byte [rbx + 8], 1
jne 0x1400d0ba3
cmp ecx, 0x16
jae 0x1400d0a8c
mov r8d, ebx
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, reloc.WS2_32.dll_shutdown
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b4010
mov r10d, 1
jmp 0x1400d0c99
movzx ecx, word [rbx + 0x14]
add rcx, rbx
cmp rcx, r13
jb 0x1400d0b7b
cmp rcx, r8
jae 0x1400d0b7b
mov eax, r13d
sub eax, ecx
add edx, eax
cmp edx, 0x42
jb 0x1400d0b7b
movzx eax, byte [rcx + 0x40]
lea r9d, [rax + rax + 0x42]
test r9d, r9d
je 0x1400d0aea
cmp r9d, edx
jbe 0x1400d0aea
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b4010
mov r10d, 1
jmp 0x1400d0c99
movzx eax, byte [rcx + 0x41]
cmp al, 1
je 0x1400d0b1c
cmp al, 3
je 0x1400d0b1c
test al, al
je 0x1400d0b1c
cmp al, 2
je 0x1400d0c99
lea rcx, str.bad_name_flag__02x_n
movzx edx, al
call fcn.1400b3fe0
mov r10d, 1
jmp 0x1400d0c99
mov rdx, qword [rcx]
and rdx, r11
cmp rdx, 0x10
jae 0x1400d0b45
cmp rdx, 5
je 0x1400d0b45
lea rcx, str.ignore_name_attr_for_internal_ntfs_folder__016I64x_n
call fcn.1400b3fe0
mov r10d, 1
jmp 0x1400d0c99
test rdi, rdi
je 0x1400d0b67
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xa8], rcx
mov qword [rax + 0x28], rcx
mov qword [rcx + 0x28], rbp
jmp 0x1400d0c99
mov rdi, rcx
mov qword [rcx + 0x28], rbp
mov qword [rsp + 0xa8], rcx
jmp 0x1400d0c99
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 0x42
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b4010
mov r10d, 1
jmp 0x1400d0c99
lea rcx, str.nonresident_name_attribute_n
call fcn.1400b3fe0
mov r10d, 1
jmp 0x1400d0c99
cmp qword [r13 + 0x20], rbp
je 0x1400d0bd2
lea rcx, str.attribute_list_attribute_with_base_frn_n
call fcn.1400b3fe0
mov r10d, 1
mov esi, r10d
jmp 0x1400d0c99
cmp dword [r14 + 0x28], ebp
je 0x1400d0c99
test r12d, r12d
jne 0x1400d0c99
test byte [rbx + 8], 1
je 0x1400d0c09
lea rcx, str.nonresident_standard_information_n
call fcn.1400b3fe0
lea r10d, [r12 + 1]
jmp 0x1400d0c99
cmp ecx, 0x16
jae 0x1400d0c33
mov r8d, ebx
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, reloc.WS2_32.dll_shutdown
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b4010
mov r10d, 1
jmp 0x1400d0c99
movzx ecx, word [rbx + 0x14]
add rcx, rbx
cmp rcx, r13
jb 0x1400d0c76
cmp rcx, r8
jae 0x1400d0c76
mov eax, r13d
sub eax, ecx
add eax, edx
cmp eax, 0x24
jb 0x1400d0c76
mov eax, dword [rcx + 0x20]
mov r12d, r10d
mov dword [rsp + 0x50], eax
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x1400d0c99
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 0x24
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b4010
mov r10d, 1
mov eax, dword [rbx + 4]
movabs r11, 0xffffffffffff
add rbx, rax
jmp 0x1400d0940
sub ebx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov ecx, 0xffff0000
mov r8d, ebx
call fcn.1400b4010
jmp 0x1400d0d1f
mov r8d, dword [rbx + 4]
mov rdx, qword [r14 + 0x30]
lea rcx, str._t_I64u:_BAD_record_length__d____d_n
mov r9d, reloc.WS2_32.dll_recv
call fcn.1400b3fe0
jmp 0x1400d0d1f
sub ebx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 8
mov r8d, ebx
mov ecx, 0xffff0000
call fcn.1400b4010
jmp 0x1400d0d1f
sub ebx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 4
mov r8d, ebx
mov ecx, 0xffff0000
call fcn.1400b4010
mov rdx, qword [r13 + 0x20]
test rdx, rdx
je 0x1400d0eb4
mov rax, rdx
movabs rcx, 0xffffffffffff
and rax, rcx
cmp rax, 0x10
jae 0x1400d0d6b
cmp rax, 5
je 0x1400d0d6b
lea rcx, str.ignore_internal_extended_fragmented_file_record__016I64x_n
call fcn.1400b3fe0
xor r12d, r12d
movabs r11, 0xffffffffffff
lea r10d, [r12 + 1]
jmp 0x1400d112e
mov rax, qword [r14 + 0x78]
add rax, 0x50
cmp rax, qword [r14 + 0x80]
jb 0x1400d0d8a
lea rcx, [r14 + 0x68]
mov edx, 0x50
call fcn.1400e4720
mov rsi, qword [r14 + 0x78]
lea rax, [rsi + 0x50]
mov qword [r14 + 0x78], rax
mov rax, qword [r13 + 0x20]
mov qword [rsi + 8], rax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x30], eax
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x18], rax
mov rax, qword [rsp + 0x48]
mov qword [rsi + 0x20], rax
mov rax, qword [rsp + 0x30]
mov dword [rsi + 0x38], r12d
xor r12d, r12d
test rdi, rdi
mov dword [rsi + 0x34], r15d
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], r12
mov qword [rsi + 0x48], r12
je 0x1400d0e85
nop
nop
nop
movzx eax, byte [rdi + 0x40]
lea edx, [rax + rax + 0x18]
cmp edx, 0x100
jle 0x1400d0e0e
lea rcx, [r14 + 0x68]
call fcn.1400e47f0
mov rbx, rax
jmp 0x1400d0e3a
mov rax, qword [r14 + 0x78]
movsxd r12, edx
lea rcx, [r12 + rax]
cmp rcx, qword [r14 + 0x80]
jb 0x1400d0e2b
lea rcx, [r14 + 0x68]
call fcn.1400e4720
mov rbx, qword [r14 + 0x78]
lea rax, [rbx + r12]
xor r12d, r12d
mov qword [r14 + 0x78], rax
movzx eax, byte [rdi + 0x40]
lea rdx, [rdi + 0x42]
lea rcx, [rbx + 0x18]
mov byte [rbx + 0x10], al
mov rax, qword [rdi]
mov qword [rbx], rax
movzx r8d, byte [rdi + 0x40]
add r8, r8
call fcn.1401a8ef0
cmp qword [rsi + 0x40], rbp
je 0x1400d0e6c
mov rax, qword [rsi + 0x48]
mov qword [rax + 8], rbx
jmp 0x1400d0e70
mov qword [rsi + 0x40], rbx
mov qword [rbx + 8], r12
mov qword [rsi + 0x48], rbx
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400d0df0
cmp qword [r14 + 0x38], rbp
je 0x1400d0e94
mov rax, qword [r14 + 0x40]
mov qword [rax], rsi
jmp 0x1400d0e98
mov qword [r14 + 0x38], rsi
mov qword [rsi], r12
mov r10d, 1
movabs r11, 0xffffffffffff
mov qword [r14 + 0x40], rsi
jmp 0x1400d112e
test esi, esi
je 0x1400d1068
mov rax, qword [r14 + 0x50]
cmp qword [r14 + 0x48], rax
jne 0x1400d0f56
mov eax, dword [r14 + 0x60]
mov ebx, dword [r14 + 0x64]
add eax, 1
cmp eax, ebx
jbe 0x1400d0f1b
mov eax, 1
add ebx, ebx
cmove ebx, eax
mov ecx, ebx
shl rcx, 3
call fcn.1400cf700
mov r8d, dword [r14 + 0x60]
mov rdx, qword [r14 + 0x58]
shl r8, 3
mov rcx, rax
mov rsi, rax
call fcn.1401a8ef0
mov rcx, qword [r14 + 0x58]
test rcx, rcx
je 0x1400d0f13
call fcn.1400cf780
mov qword [r14 + 0x58], rsi
mov dword [r14 + 0x64], ebx
mov ecx, 0x10000
call fcn.1400cf700
mov edx, dword [r14 + 0x60]
mov rcx, qword [r14 + 0x58]
mov qword [rcx + rdx*8], rax
mov edx, dword [r14 + 0x60]
mov rcx, qword [r14 + 0x58]
mov rax, qword [rcx + rdx*8]
mov qword [r14 + 0x48], rax
mov rax, qword [rcx + rdx*8]
add rax, 0xfff0
mov qword [r14 + 0x50], rax
lea eax, [rdx + 1]
mov dword [r14 + 0x60], eax
mov rsi, qword [r14 + 0x48]
lea rax, [rsi + 0x48]
mov qword [r14 + 0x48], rax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsi + 8], rax
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x48]
mov dword [rsi + 0x30], r12d
mov qword [rsi + 0x18], rax
mov rax, qword [rsp + 0x30]
xor r12d, r12d
mov qword [rsi + 0x20], rax
movzx eax, word [r13 + 0x10]
shl rax, 0x30
or rax, qword [r14 + 0x30]
test rdi, rdi
mov qword [rsi + 0x38], r12
mov qword [rsi + 0x40], r12
mov dword [rsi + 0x2c], r15d
mov qword [rsi], rax
je 0x1400d111e
nop
nop
movzx eax, byte [rdi + 0x40]
lea edx, [rax + rax + 0x18]
cmp edx, 0x100
jle 0x1400d0fde
lea rcx, [r14 + 0x68]
call fcn.1400e47f0
mov rbx, rax
jmp 0x1400d100a
mov rax, qword [r14 + 0x78]
movsxd r12, edx
lea rcx, [r12 + rax]
cmp rcx, qword [r14 + 0x80]
jb 0x1400d0ffb
lea rcx, [r14 + 0x68]
call fcn.1400e4720
mov rbx, qword [r14 + 0x78]
lea rax, [rbx + r12]
xor r12d, r12d
mov qword [r14 + 0x78], rax
movzx eax, byte [rdi + 0x40]
lea rdx, [rdi + 0x42]
lea rcx, [rbx + 0x18]
mov byte [rbx + 0x10], al
mov rax, qword [rdi]
mov qword [rbx], rax
movzx r8d, byte [rdi + 0x40]
add r8, r8
call fcn.1401a8ef0
cmp qword [rsi + 0x38], rbp
je 0x1400d103c
mov rax, qword [rsi + 0x40]
mov qword [rax + 8], rbx
jmp 0x1400d1040
mov qword [rsi + 0x38], rbx
mov qword [rbx + 8], r12
mov qword [rsi + 0x40], rbx
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400d0fc0
lea r10d, [rdi + 1]
movabs r11, 0xffffffffffff
jmp 0x1400d112e
movzx eax, word [r13 + 0x10]
shl rax, 0x30
or rax, qword [r14 + 0x30]
test rdi, rdi
mov qword [rsp + 0x20], rax
je 0x1400d110a
nop
nop
nop
nop
test r15d, r15d
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
lea rax, [rdi + 0x42]
mov qword [rsp + 0x58], rax
movzx eax, byte [rdi + 0x40]
mov byte [rsp + 0x54], al
je 0x1400d10b5
or dword [rsp + 0x50], 0x10
jmp 0x1400d10ba
and dword [rsp + 0x50], 0xffffffef
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x20]
call qword [r14 + reloc.WS2_32.dll_recv]
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400d1090
xor r12d, r12d
lea r10d, [rdi + 1]
movabs r11, 0xffffffffffff
jmp 0x1400d112e
cmp dword [0x14020e118], 0
je 0x1400d112e
lea rcx, str.bad_file_record_type__08x_n
call fcn.1400b3fe0
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400d112e
xor r12d, r12d
movabs r11, 0xffffffffffff
lea r10d, [r12 + 1]
jmp 0x1400d112e
mov r10d, 1
movabs r11, 0xffffffffffff
mov eax, dword [r14 + 0x18]
add qword [r14 + 0x30], 1
add r13, rax
add dword [rsp + 0xb0], 0xffffffff
jne 0x1400d0650
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x88
pop r14
pop r13
ret 0