Function at 0x14009dc7c
Capabilities:
Enumerate pe sections
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov ebx, ecx
mov r12d, 0xa
lea rcx, str.hid________7dc44cnpTxSc
mov dword [rbp - 0x7d], r12d
mov r14d, r9d
mov rdi, r8
mov r15d, edx
mov dword [rsp + 0x30], 0x20000a
mov dword [rsp + 0x34], 0x20002a
xor esi, esi
mov dword [rsp + 0x38], 0x730025
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movdqa xmm0, xmmword [0x140122ff0]
lea rcx, str.hid________gkojREmArDhm
movdqa xmm1, xmmword [0x1401236a0]
movups xmmword [rbp - 0x41], xmm0
movdqa xmm0, xmmword [0x140122e00]
movdqu xmmword [rbp - 0x21], xmm0
movdqu xmmword [rbp - 0x31], xmm1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movdqa xmm0, xmmword [0x140122ff0]
lea rcx, str.hid________zfagWj2s0WQ1
movdqa xmm1, xmmword [0x140123030]
movups xmmword [rbp - 0x75], xmm0
mov dword [rbp - 0x79], r12d
movdqa xmm0, xmmword [0x140122e00]
movdqu xmmword [rbp - 0x55], xmm0
movdqu xmmword [rbp - 0x65], xmm1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movdqa xmm0, xmmword [0x140122ff0]
lea rcx, str.hid________GETWI9KfQhxv
movdqa xmm1, xmmword [0x140123a90]
movups xmmword [rbp - 9], xmm0
movdqa xmm0, xmmword [0x140123800]
movdqa xmmword [rbp + 0x17], xmm0
movdqa xmm0, xmmword [0x140122e00]
movdqa xmmword [rbp + 7], xmm1
movdqa xmm1, xmmword [0x140123cd0]
movdqa xmmword [rbp + 0x37], xmm0
movdqa xmmword [rbp + 0x27], xmm1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp ebx, 6
jae 0x14009dda4
lea rdx, [0x1400f8ed0]
mov rdx, qword [rdx + rbx*8]
jmp 0x14009ddab
lea rdx, str.unknown
lea rcx, [rsp + 0x30]
call fcn.14000b314
test ebx, ebx
je 0x14009df4d
sub ebx, 1
je 0x14009df33
sub ebx, 1
je 0x14009dee0
sub ebx, 1
je 0x14009de92
sub ebx, 1
je 0x14009de12
cmp ebx, 1
je 0x14009de04
mov r8d, 1
mov edx, r14d
mov rcx, rdi
call fcn.1400115ec
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
jmp 0x14009e034
lea rcx, [rbp - 9]
call fcn.14000b314
xor r8d, r8d
jmp 0x14009dde8
mov r8d, dword [rdi + 0x10]
lea rcx, str.____Default_Salt_:__.s_n____Default_Iterations_:__u_n
movzx edx, word [rdi + 0xc]
add r8, rdi
mov r9d, dword [rdi + 0x14]
shr rdx, 1
call fcn.14000b314
movzx r8d, word [rdi + 4]
lea rdx, [rdi + 0x18]
lea r9, str.Credentials
mov rcx, rdi
call fcn.14009e12c
movzx r8d, word [rdi + 6]
lea r9, str.ServiceCredentials
mov rdx, rax
mov rcx, rdi
call fcn.14009e12c
movzx r8d, word [rdi + 8]
lea r9, str.OldCredentials
mov rdx, rax
mov rcx, rdi
call fcn.14009e12c
movzx r8d, word [rdi + 0xa]
lea r9, str.OlderCredentials
mov rdx, rax
mov rcx, rdi
call fcn.14009e12c
jmp 0x14009e034
mov r8d, dword [rdi + 0xc]
lea rcx, str.____Default_Salt_:__.s_n
movzx edx, word [rdi + 8]
add r8, rdi
shr rdx, 1
call fcn.14000b314
movzx r8d, word [rdi + 4]
lea rdx, [rdi + 0x10]
lea r9, str.Credentials
mov rcx, rdi
call fcn.14009e058
movzx r8d, word [rdi + 6]
lea r9, str.OldCredentials
mov rdx, rax
mov rcx, rdi
call fcn.14009e058
jmp 0x14009e034
cmp byte [rdi + 3], sil
jbe 0x14009e034
mov r14d, 0x10
lea ebx, [rsi + 1]
mov edx, ebx
lea rcx, str._____02u
call fcn.14000b314
mov ecx, esi
xor r8d, r8d
inc rcx
mov edx, r14d
shl rcx, 4
add rcx, rdi
call fcn.1400115ec
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
movzx eax, byte [rdi + 3]
mov esi, ebx
cmp ebx, eax
jb 0x14009def0
jmp 0x14009e034
mov rdx, r14
lea rcx, str._____.s_n
shr rdx, 1
mov r8, rdi
call fcn.14000b314
jmp 0x14009e034
lea rcx, [rbp - 0x41]
call fcn.14000b314
mov r14d, 0x10
cmp byte [rdi + 0x20], sil
je 0x14009df70
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call fcn.1400115ec
lea rcx, [rbp - 0x79]
call fcn.14000b314
cmp byte [rdi + 0x21], sil
je 0x14009df8e
lea rcx, [rdi + 0x10]
xor r8d, r8d
mov edx, r14d
call fcn.1400115ec
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
cmp dword [rdi + 0x24], esi
je 0x14009e034
cmp word [rdi + 0x44], si
je 0x14009dfc3
lea rcx, [rdi + 0x4c]
mov dword [rsp + 0x20], esi
lea r9, str.NTLM
mov r8d, r15d
mov edx, r14d
call fcn.1400b3378
cmp word [rdi + 0x64], si
je 0x14009dfe8
movzx edx, word [rdi + 0x64]
lea rcx, [rdi + 0x6c]
lea r9, str.ntlm
mov dword [rsp + 0x20], 1
mov r8d, r15d
call fcn.1400b3378
cmp word [rdi + 0x2c], si
je 0x14009e008
lea rcx, [rdi + 0x34]
mov dword [rsp + 0x20], esi
lea r9, str.LM
mov r8d, r15d
mov edx, r14d
call fcn.1400b3378
cmp word [rdi + 0x5c], si
je 0x14009e034
movzx ecx, word [rdi + 0x64]
lea r9, str.lm
movzx edx, word [rdi + 0x5c]
add rcx, 0x6c
add rcx, rdi
mov dword [rsp + 0x20], 1
mov r8d, r15d
call fcn.1400b3378
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret