Function at 0x18006ca68
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x18010ab28]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, edx
mov r14, r9
mov r15, r8
mov rsi, rcx
test r8, r8
je 0x18006cd6d
test r9, r9
je 0x18006cd6d
and qword [rsp + 0x38], 0
or dword [rsp + 0x40], 0xffffffff
mov dword [r9], ebp
mov rax, qword [rcx + 0x68]
mov rcx, qword [rax + 0x20]
mov eax, dword [rcx + rbp*4]
mov qword [r9 + 8], rax
movzx eax, word [r8 + 4]
mov word [r9 + 0x10], ax
movzx eax, word [r8 + 6]
mov word [r9 + 0x12], ax
movzx eax, word [r8 + 8]
mov word [r9 + 0x14], ax
movzx eax, word [r8 + 0xa]
mov word [r9 + 0x16], ax
movzx ecx, word [r8 + 0xe]
movzx edx, word [r8 + 0xc]
mov eax, ecx
shr eax, 9
add eax, 0x50
mov dword [rsp + 0x34], eax
mov eax, ecx
shr eax, 5
and ecx, 0x1f
and eax, 0xf
mov dword [rsp + 0x2c], ecx
dec eax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov eax, edx
shr eax, 0xb
mov dword [rsp + 0x28], eax
mov eax, edx
shr eax, 5
and edx, 0x1f
and eax, 0x3f
add edx, edx
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], edx
call qword [sym.imp.msvcrt.dll__mktime64]
mov qword [r14 + 0x18], rax
mov edi, 0x1ff
mov eax, dword [r15 + 0x10]
lea rdx, [r15 + 0x2e]
mov dword [r14 + 0x20], eax
mov eax, dword [r15 + 0x14]
mov qword [r14 + 0x28], rax
mov eax, dword [r15 + 0x18]
mov qword [r14 + 0x30], rax
movzx eax, word [r15 + 0x24]
mov word [r14 + 0x38], ax
mov eax, dword [r15 + 0x26]
mov dword [r14 + 0x3c], eax
mov eax, dword [r15 + 0x2a]
mov qword [r14 + 0x40], rax
mov eax, edi
movzx ecx, word [r15 + 0x1c]
cmp ecx, edi
cmovb eax, ecx
lea rcx, [r14 + 0x58]
mov r8d, eax
mov ebx, eax
call sub.msvcrt.dll_memcpy
mov byte [rbx + r14 + 0x58], 0
movzx eax, word [r15 + 0x20]
cmp eax, edi
cmovb edi, eax
mov dword [r14 + 0x48], edi
movzx edx, word [r15 + 0x1c]
movzx ecx, word [r15 + 0x1e]
add rdx, r15
add rcx, 0x2e
mov r8d, edi
add rdx, rcx
lea rcx, [r14 + 0x258]
call sub.msvcrt.dll_memcpy
mov edx, ebp
mov byte [rdi + r14 + 0x258], 0
mov rcx, rsi
call fcn.18006ca0c
mov dword [r14 + 0x4c], eax
mov r8, qword [rsi + 0x68]
lea rcx, [rsi + 0x10]
test r8, r8
je 0x18006cc0e
cmp ebp, dword [rcx]
jae 0x18006cc0e
mov rax, qword [r8 + 0x20]
mov edx, dword [rax + rbp*4]
add rdx, qword [r8]
je 0x18006cc0e
test byte [rdx + 8], 0x41
mov eax, 0
setne al
jmp 0x18006cc17
mov dword [rsi + 0x1c], 0x18
xor eax, eax
mov dword [r14 + 0x50], eax
mov rdx, qword [rsi + 0x68]
test rdx, rdx
je 0x18006cc6f
cmp ebp, dword [rcx]
jae 0x18006cc6f
mov rax, qword [rdx + 0x20]
mov ecx, dword [rax + rbp*4]
add rcx, qword [rdx]
je 0x18006cc6f
movzx eax, word [rcx + 8]
mov edx, 0xfff7
test word [rcx + 0xa], dx
je 0x18006cc4c
mov dword [rsi + 0x1c], 4
jmp 0x18006cc76
test al, 0x41
je 0x18006cc59
mov dword [rsi + 0x1c], 5
jmp 0x18006cc76
mov edi, 1
test al, 0x20
je 0x18006cc6b
mov dword [rsi + 0x1c], 6
jmp 0x18006cc7b
mov eax, edi
jmp 0x18006cc7d
mov dword [rsi + 0x1c], 0x18
mov edi, 1
xor eax, eax
mov r10, qword [r14 + 0x28]
mov ebx, 0xffffffff
cmp r10, qword [r14 + 0x30]
mov rcx, r10
mov dword [r14 + 0x54], eax
cmovbe rcx, qword [r14 + 0x30]
mov rax, qword [r14 + 0x40]
cmp rcx, rax
cmova rax, rcx
cmp rax, rbx
jne 0x18006ccf4
movzx r9d, word [r15 + 0x1e]
test r9d, r9d
je 0x18006ccf4
movzx edx, word [r15 + 0x1c]
add rdx, 0x2e
add rdx, r15
cmp r9d, 4
jb 0x18006cd64
movzx r8d, word [rdx + 2]
mov eax, r9d
lea rcx, [r8 + 4]
cmp rcx, rax
ja 0x18006cd64
cmp word [rdx], di
je 0x18006ccfb
add rdx, 4
mov eax, 0xfffffffc
add rdx, r8
sub eax, r8d
add r9d, eax
jne 0x18006ccbc
mov eax, edi
jmp 0x18006cd7b
add rdx, 4
cmp qword [r14 + 0x30], rbx
jne 0x18006cd23
cmp r8d, 8
jb 0x18006cd64
mov ecx, dword [rdx + 4]
mov eax, dword [rdx]
add rdx, 8
shl rcx, 0x20
or rcx, rax
mov qword [r14 + 0x30], rcx
add r8d, 0xfffffff8
cmp r10, rbx
jne 0x18006cd46
cmp r8d, 8
jb 0x18006cd64
mov ecx, dword [rdx + 4]
mov eax, dword [rdx]
add rdx, 8
shl rcx, 0x20
or rcx, rax
mov qword [r14 + 0x28], rcx
add r8d, 0xfffffff8
cmp qword [r14 + 0x40], rbx
jne 0x18006ccf4
cmp r8d, 8
jb 0x18006cd64
mov ecx, dword [rdx + 4]
mov eax, dword [rdx]
shl rcx, 0x20
or rcx, rax
mov qword [r14 + 0x40], rcx
jmp 0x18006ccf4
mov dword [rsi + 0x1c], 9
jmp 0x18006cd79
test rsi, rsi
je 0x18006cd79
mov dword [rcx + 0x1c], 0x18
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180091b90
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret