Function at 0x7ff7b081fc50
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1070
call fcn.7ff7b0833020
sub rsp, rax
xor ebx, ebx
mov r13, r8
mov r14, rdx
mov rax, rcx
test r8, r8
je 0x7ff7b081fd6b
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x58], rcx
mov r9d, 0x28
lea rcx, [rsp + 0x10c0]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], ebx
mov rcx, rax
mov edx, 0x80862007
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], 0x33
mov qword [rsp + 0x60], 0x1000
mov dword [rsp + 0x10c0], ebx
call qword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
je 0x7ff7b081fd6b
mov rdi, 0xffffffffffffffff
mov rsi, rdi
nop word [rax + rax]
inc rsi
cmp byte [r14 + rsi], bl
jne 0x7ff7b081fd00
movsxd rax, dword [rsp + 0xac]
lea r15, [rsp + 0x70]
add r15, rax
mov ebp, ebx
movzx eax, word [r15 + 0x14]
lea r12, [r15 + 0x18]
add r12, rax
cmp bx, word [r15 + 6]
jae 0x7ff7b081fd6b
nop
mov eax, ebp
mov r8, rsi
mov rdx, r14
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x7ff7b081fd5e
mov rax, rdi
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x7ff7b081fd50
cmp rsi, rax
je 0x7ff7b081fd89
movzx eax, word [r15 + 6]
inc ebp
cmp ebp, eax
jb 0x7ff7b081fd30
xor ebx, ebx
mov rax, rbx
mov rbx, qword [rsp + 0x10b8]
add rsp, 0x1070
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x7ff7b081fd69
mov edx, dword [rbx + 8]
lea rcx, [rsp + 0x70]
add rcx, rax
je 0x7ff7b081fd69
test edx, edx
je 0x7ff7b081fd69
lea rax, [rsp + 0x70]
mov ebx, edx
sub rcx, rax
lea rbp, [rcx + r13]
test rbp, rbp
je 0x7ff7b081fd69
cmp rdx, 0x40000000
jbe 0x7ff7b081fdc1
xor eax, eax
jmp 0x7ff7b081fd6e
mov rcx, rbx
call fcn.7ff7b0832b04
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rsp + 0x10b0]
lea rax, [rsp + 0x10c0]
xor r14d, r14d
mov qword [rsp + 0x40], 0x33
mov qword [rsp + 0x38], r14
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov r9d, 0x28
mov dword [rsp + 0x28], r14d
mov edx, 0x80862007
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x10c0], r14d
call qword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
jne 0x7ff7b081fe4f
mov rcx, rsi
call fcn.7ff7b08327b0
mov rax, r14
jmp 0x7ff7b081fd6e
mov r10, qword [rsp + 0x10d0]
inc rdi
cmp byte [r10 + rdi], r14b
jne 0x7ff7b081fe57
mov r9, r14
sub rbx, rdi
je 0x7ff7b081fe3f
mov rax, qword [rsp + 0x10c8]
mov rdi, rsi
movzx r11d, byte [r10]
sub rdi, rax
nop word [rax + rax]
mov rdx, r10
test r11b, r11b
je 0x7ff7b081feac
movzx ecx, r11b
lea r8, [rdi + r9]
cmp cl, 0x78
jne 0x7ff7b081fe9e
movzx ecx, byte [rax]
cmp byte [r8 + rax], cl
jne 0x7ff7b081feb1
movzx ecx, byte [rdx + 1]
inc rdx
inc rax
test cl, cl
jne 0x7ff7b081fe90
cmp byte [rdx], r14b
je 0x7ff7b081fed1
mov rax, qword [rsp + 0x10c8]
inc r9
cmp r9, rbx
jb 0x7ff7b081fe80
mov rcx, rsi
call fcn.7ff7b08327b0
mov rax, r14
jmp 0x7ff7b081fd6e
lea rax, [r9 + rsi]
test rax, rax
je 0x7ff7b081fe3f
sub rax, rsi
mov rcx, rsi
lea rbx, [rax + rbp]
call fcn.7ff7b08327b0
jmp 0x7ff7b081fd6b