Function at 0x180012a20
Capabilities:
Enumerate pe sections
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x4b0
mov rax, qword [0x1800d61f8]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r14, qword [rsp + 0x510]
mov rdi, r9
mov qword [rsp + 0x48], r9
mov r15, r8
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x50], rcx
call fcn.180005ccc
xor esi, esi
mov rbp, rax
test r14, r14
je 0x180012edd
mov r12, qword [rsp + 0x518]
test r12, r12
je 0x180012edd
xor r8d, r8d
mov rcx, rax
cmp dword [rsp + 0x520], 0x3e8
jle 0x180012aa9
lea r9, [0x1800bf450]
jmp 0x180012ed3
mov rax, qword [rdi]
lea r9, str.____Processing_AttributeList_for_Inode__I64u___u_bytes
mov qword [rsp + 0x28], r12
mov edx, 6
mov qword [rsp + 0x20], rax
call fcn.180004968
mov ebx, esi
mov dword [rsp + 0x40], ebx
test r12, r12
je 0x180012edd
lea ecx, [rbx + 3]
cmp rcx, r12
ja 0x180012edd
mov edx, dword [rsi + r14]
cmp edx, 0xffffffff
je 0x180012edd
cmp word [rsi + r14 + 4], 3
jb 0x180012edd
movzx eax, word [rsi + r14 + 4]
add eax, ebx
cmp rax, r12
ja 0x180012edd
movzx ebx, word [rsi + r14 + 0x14]
mov eax, dword [rsi + r14 + 0x10]
shl rbx, 0x20
add rbx, rax
cmp rbx, qword [rdi]
je 0x180012e55
mov rcx, qword [rsp + 0x50]
call fcn.180013780
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea r9, str.____List_attribute:__s
mov rcx, rbp
lea edx, [r8 + 6]
call fcn.180004968
movzx eax, word [rsi + r14 + 0x18]
lea r9, str.______LowestVcn___I64u__RefInode___I64u__InodeSequence___u__Instance___u
movzx ecx, word [rsi + r14 + 0x16]
xor r8d, r8d
mov dword [rsp + 0x38], eax
mov rax, qword [rsi + r14 + 8]
mov dword [rsp + 0x30], ecx
mov rcx, rbp
lea edx, [r8 + 6]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.180004968
movzx eax, byte [rsi + r14 + 6]
test al, al
je 0x180012bfc
lea rcx, [rax*2 + 2]
call fcn.180026bf8
mov rdi, rax
test rax, rax
je 0x180012ec6
movzx r8d, byte [rsi + r14 + 7]
mov rcx, rax
movzx r9d, byte [rsi + r14 + 6]
add r8d, dword [rsp + 0x40]
add r8, r14
lea rdx, [r9 + 1]
call fcn.180055aac
movzx ecx, byte [rsi + r14 + 6]
lea r9, str.______AttributeList_name___s
xor eax, eax
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov word [rdi + rcx*2], ax
mov rcx, rbp
lea edx, [rax + 6]
call fcn.180004968
mov rcx, rdi
call fcn.180053d58
mov rdi, qword [rsp + 0x48]
mov r11, qword [r15 + 0x28]
xor eax, eax
mov rcx, qword [r15]
mov r9d, eax
imul rcx, qword [r15 + 8]
mov r15, qword [rdi + 0x50]
mov r8d, eax
xor edx, edx
mov rax, r11
imul rax, rbx
div rcx
mov r10, rax
test r15, r15
je 0x180012e2d
cmp qword [r15], 0xffffffffffffffff
je 0x180012c50
cmp r10, r8
jb 0x180012c46
mov rcx, qword [r15 + 8]
sub rcx, r9
add rcx, r8
cmp r10, rcx
jb 0x180012c5d
mov rax, qword [r15 + 8]
sub rax, r9
add r8, rax
mov r9, qword [r15 + 8]
mov r15, qword [r15 + 0x10]
test r15, r15
jne 0x180012c2c
mov qword [rsp + 0x68], r8
test r15, r15
je 0x180012e2d
mov rcx, r11
call fcn.180026bf8
mov rdi, rax
xor eax, eax
test rdi, rdi
je 0x180012ec6
mov rdx, qword [r15]
lea r9, [rsp + 0x58]
mov r15, qword [rsp + 0x70]
mov rcx, rbx
sub rdx, qword [rsp + 0x68]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
imul rcx, qword [r15 + 0x28]
imul rdx, qword [r15]
mov r8d, dword [r15 + 0x28]
imul rdx, qword [r15 + 8]
add rcx, rdx
mov rdx, rdi
mov dword [rsp + 0x88], ecx
shr rcx, 0x20
mov dword [rsp + 0x8c], ecx
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180012e71
mov rcx, qword [r15 + 0x28]
mov eax, dword [rsp + 0x58]
cmp rax, rcx
jne 0x180012e71
mov rdx, qword [rsp + 0x60]
mov r9, rdi
mov qword [rsp + 0x20], rcx
mov r8, r15
mov rcx, qword [rsp + 0x50]
call fcn.180012428
xor r8d, r8d
test eax, eax
jne 0x180012d44
lea r9, str.The_error_occurred_while_processing_Inode__I64u
lea edx, [rax + 2]
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call fcn.180004968
mov rcx, rdi
call fcn.180053d58
mov rdi, qword [rsp + 0x48]
jmp 0x180012e55
test byte [rdi + 0x16], 1
jne 0x180012d58
lea r9, str.______Referenced_Inode__I64u_is_not_in_use.
mov edx, 6
jmp 0x180012d25
mov eax, dword [rdi + 0x20]
movzx ecx, word [rdi + 0x24]
shl rcx, 0x20
add rcx, rax
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax]
cmp rdx, rcx
je 0x180012d98
mov qword [rsp + 0x30], rcx
lea r9, str.______Warning:_Inode__I64u_is_an_extension_of_Inode__I64u__but_thinks_its_an_extension_of_Inode__I64u.
mov qword [rsp + 0x28], rdx
mov rcx, rbp
mov edx, 6
mov qword [rsp + 0x20], rbx
call fcn.180004968
jmp 0x180012d32
movzx eax, word [rsi + r14 + 0x18]
lea r9, str.______Processing_Inode__I64u_Instance__u
mov dword [rsp + 0x28], eax
mov edx, 6
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call fcn.180004968
movzx eax, word [rdi + 0x14]
mov ecx, dword [rsp + 0x520]
mov r8, qword [r15 + 0x28]
inc ecx
mov r9, qword [rsp + 0x48]
sub r8, rax
mov dword [rsp + 0x38], ecx
lea rdx, [rax + rdi]
movzx eax, word [rsi + r14 + 0x18]
mov rcx, qword [rsp + 0x50]
mov word [rsp + 0x30], ax
mov qword [rsp + 0x28], r8
mov r8, r15
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x60]
call fcn.180012f00
movzx eax, word [rsi + r14 + 0x18]
lea r9, str.______Finished_processing_Inode__I64u_Instance__u
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rcx, rbp
mov qword [rsp + 0x20], rbx
lea edx, [r8 + 6]
call fcn.180004968
jmp 0x180012d32
mov rax, qword [rdi]
lea r9, str.______Error:_Inode__I64u_is_an_extension_of_Inode__I64u__but_does_not_exist__outside_the_MFT_.
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rcx, rbp
mov qword [rsp + 0x20], rbx
lea edx, [r8 + 6]
call fcn.180004968
mov r15, qword [rsp + 0x70]
movzx eax, word [rsi + r14 + 4]
mov ebx, dword [rsp + 0x40]
add ebx, eax
mov esi, ebx
mov dword [rsp + 0x40], ebx
cmp rsi, r12
jae 0x180012edd
jmp 0x180012ad6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x200
lea r8, [rsp + 0xa0]
mov edx, eax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
call sym.JkDefrag.dll_public:_void___cdecl_JKDefragLib::SystemErrorStr_unsigned_long_int__wchar_t____ptr64__unsigned_long_long_unsigned___int64_____ptr64
xor r8d, r8d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea r9, str.______Error_while_reading_Inode__I64u:__s
mov rcx, rbp
mov qword [rsp + 0x20], rbx
lea edx, [r8 + 2]
call fcn.180004968
mov rcx, rdi
call fcn.180053d58
jmp 0x180012edd
lea r9, str.Error:_malloc___returned_NULL.
xor r8d, r8d
mov rcx, rbp
mov edx, 2
call fcn.180004968
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1800149a0
add rsp, 0x4b0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret