Function at 0x1400d0870
Capabilities:
Enumerate pe sections

Disassembly:
test r8d, r8d
je 0x1400d13e7
mov rax, rsp
mov dword [rax + 0x18], r8d
push r13
push r14
sub rsp, 0x88
mov qword [rax + 8], rbx
mov qword [rax - 0x18], rbp
mov qword [rax - 0x20], rsi
mov qword [rax - 0x28], rdi
mov qword [rax - 0x30], r12
xor r12d, r12d
mov r13, rdx
mov r14, rcx
mov qword [rax - 0x38], r15
lea r10d, [r12 + 1]
movabs r11, 0xffffffffffff
nop
nop
mov edx, dword [r13]
cmp edx, 0x454c4946
jne 0x1400d1353
test byte [r13 + 0x16], 1
je 0x1400d139e
mov rax, qword [r13 + 0x20]
test rax, rax
je 0x1400d0a32
test r11, rax
jne 0x1400d0a32
mov ecx, dword [r14 + 0x18]
add rcx, 8
call fcn.1400cf3f0
mov r8d, dword [r14 + 0x18]
mov rdx, r13
lea rcx, [rax + 8]
mov rbx, rax
call fcn.1401a9000
mov r9, qword [r13 + 0x20]
mov r8, qword [r14 + 0x30]
lea rdx, str.found_extended_MFT_file_record__016I64x_base__016I64x_n
mov ecx, 0xff00ffff
call fcn.1400b3ec0
lea rcx, str.extended_MFT_type__t_n
mov r8d, 4
mov rdx, r13
call fcn.1400b3e90
movzx edx, word [r13 + 4]
lea rcx, str.extended_MFT_USA_Offset__u_n
call fcn.1400b3e90
movzx edx, word [r13 + 6]
lea rcx, str.extended_MFT_USA_Count__u_n
call fcn.1400b3e90
mov rdx, qword [r13 + 8]
lea rcx, str.extended_MFT_lsn__I64u_n
call fcn.1400b3e90
movzx edx, word [r13 + 0x10]
lea rcx, str.extended_MFT_sequence_number__u_n
call fcn.1400b3e90
movzx edx, word [r13 + 0x12]
lea rcx, str.extended_MFT_name_count__u_n
call fcn.1400b3e90
movzx edx, word [r13 + 0x14]
lea rcx, str.extended_MFT_attribute_offset__u_n
call fcn.1400b3e90
movzx edx, word [r13 + 0x16]
lea rcx, str.extended_MFT_flags__u_n
call fcn.1400b3e90
mov edx, dword [r13 + 0x18]
lea rcx, str.extended_MFT_bytes_in_use__u_n
call fcn.1400b3e90
mov edx, dword [r13 + 0x1c]
lea rcx, str.extended_MFT_bytes_allocated__u_n
call fcn.1400b3e90
mov rdx, qword [r13 + 0x20]
lea rcx, str.extended_MFT_base_frn__u_n
call fcn.1400b3e90
movzx edx, word [r13 + 0x28]
lea rcx, str.extended_MFT_next_attribute_number__u_n
call fcn.1400b3e90
cmp qword [r14 + 0xc0], 0
je 0x1400d0a0c
mov rax, qword [r14 + 0xc8]
mov qword [rax], rbx
jmp 0x1400d0a13
mov qword [r14 + 0xc0], rbx
mov qword [rbx], r12
mov r10d, 1
movabs r11, 0xffffffffffff
mov qword [r14 + 0xc8], rbx
jmp 0x1400d139e
mov rax, qword [r14 + 0x30]
cmp rax, 0x10
jae 0x1400d0a46
cmp rax, 5
jne 0x1400d139e
movzx ecx, word [r13 + 4]
movzx r8d, word [r13 + 6]
add rcx, r13
cmp r8d, 1
jbe 0x1400d0b6d
lea r9d, [r8 + r8]
test r9d, r9d
je 0x1400d0ab1
cmp rcx, r13
jb 0x1400d0a85
mov edx, dword [r14 + 0x18]
lea rax, [r13 + rdx]
cmp rcx, rax
jae 0x1400d0a85
mov eax, r13d
sub eax, ecx
add eax, edx
cmp r9d, eax
jbe 0x1400d0ab1
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b3ec0
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400d139e
movzx r10d, word [rcx]
add r8d, 0xffffffff
add rcx, 2
mov r9d, r8d
lea rdx, [r13 + 0x1fe]
shl r9d, 9
je 0x1400d0b13
mov r11d, dword [r14 + 0x18]
lea rax, [r13 + r11]
cmp r13, rax
jae 0x1400d0ae0
cmp r9d, r11d
jbe 0x1400d0b09
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
xor r8d, r8d
mov ecx, 0xffff0000
call fcn.1400b3ec0
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400d139e
movabs r11, 0xffffffffffff
test r8d, r8d
je 0x1400d0b67
cmp word [rdx], r10w
jne 0x1400d0b3f
movzx eax, word [rcx]
add rdx, 0x200
add rcx, 2
add r8d, 0xffffffff
mov word [rdx - 0x200], ax
jne 0x1400d0b18
lea r10d, [r8 + 1]
jmp 0x1400d0b6d
movzx edx, word [rdx]
lea rcx, str.bad_US__x____x_n
movzx r8d, r10w
call fcn.1400b3e90
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400d139e
mov r10d, 1
mov r15b, byte [r13 + 0x16]
movzx ebx, word [r13 + 0x14]
xor ebp, ebp
and r15d, 2
mov esi, ebp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x48], 0xffffffffffffffff
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0xffffffffffffffff
add rbx, r13
mov qword [rsp + 0x30], rbp
mov rdi, rbp
nop
nop
cmp rbx, r13
jb 0x1400d0f72
mov edx, dword [r14 + 0x18]
lea r8, [rdx + r13]
cmp rbx, r8
jae 0x1400d0f72
mov ecx, r13d
sub ecx, ebx
add ecx, edx
cmp ecx, 4
jb 0x1400d0f72
mov eax, dword [rbx]
cmp eax, 0xffffffff
je 0x1400d0f8f
cmp ecx, 8
jb 0x1400d0f53
mov r9d, dword [rbx + 4]
test r9d, r9d
je 0x1400d0c00
cmp r9d, ecx
ja 0x1400d0f1e
cmp r9d, 0x10
jb 0x1400d0f37
cmp byte [rbx + 9], bpl
jne 0x1400d0f09
sub eax, 0x10
je 0x1400d0e4a
sub eax, 0x10
je 0x1400d0e2a
sub eax, 0x10
je 0x1400d0cc5
cmp eax, 0x50
jne 0x1400d0f09
cmp dword [r14 + 0x2c], ebp
je 0x1400d0f09
test byte [rbx + 8], 1
je 0x1400d0c8b
cmp ecx, 0x48
jae 0x1400d0c73
mov r8d, ebx
lea r9d, [rax - 8]
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b3ec0
mov r10d, 1
jmp 0x1400d0f09
cmp qword [rbx + 0x10], rbp
jne 0x1400d0f09
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x30], rax
jmp 0x1400d0f09
cmp ecx, 0x16
jae 0x1400d0cb8
mov r8d, ebx
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, reloc.WS2_32.dll_shutdown
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b3ec0
mov r10d, 1
jmp 0x1400d0f09
mov eax, dword [rbx + 0x10]
mov qword [rsp + 0x30], rax
jmp 0x1400d0f09
test byte [rbx + 8], 1
jne 0x1400d0e13
cmp ecx, 0x16
jae 0x1400d0cfc
mov r8d, ebx
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, reloc.WS2_32.dll_shutdown
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b3ec0
mov r10d, 1
jmp 0x1400d0f09
movzx ecx, word [rbx + 0x14]
add rcx, rbx
cmp rcx, r13
jb 0x1400d0deb
cmp rcx, r8
jae 0x1400d0deb
mov eax, r13d
sub eax, ecx
add edx, eax
cmp edx, 0x42
jb 0x1400d0deb
movzx eax, byte [rcx + 0x40]
lea r9d, [rax + rax + 0x42]
test r9d, r9d
je 0x1400d0d5a
cmp r9d, edx
jbe 0x1400d0d5a
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b3ec0
mov r10d, 1
jmp 0x1400d0f09
movzx eax, byte [rcx + 0x41]
cmp al, 1
je 0x1400d0d8c
cmp al, 3
je 0x1400d0d8c
test al, al
je 0x1400d0d8c
cmp al, 2
je 0x1400d0f09
lea rcx, str.bad_name_flag__02x_n
movzx edx, al
call fcn.1400b3e90
mov r10d, 1
jmp 0x1400d0f09
mov rdx, qword [rcx]
and rdx, r11
cmp rdx, 0x10
jae 0x1400d0db5
cmp rdx, 5
je 0x1400d0db5
lea rcx, str.ignore_name_attr_for_internal_ntfs_folder__016I64x_n
call fcn.1400b3e90
mov r10d, 1
jmp 0x1400d0f09
test rdi, rdi
je 0x1400d0dd7
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xa8], rcx
mov qword [rax + 0x28], rcx
mov qword [rcx + 0x28], rbp
jmp 0x1400d0f09
mov rdi, rcx
mov qword [rcx + 0x28], rbp
mov qword [rsp + 0xa8], rcx
jmp 0x1400d0f09
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 0x42
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b3ec0
mov r10d, 1
jmp 0x1400d0f09
lea rcx, str.nonresident_name_attribute_n
call fcn.1400b3e90
mov r10d, 1
jmp 0x1400d0f09
cmp qword [r13 + 0x20], rbp
je 0x1400d0e42
lea rcx, str.attribute_list_attribute_with_base_frn_n
call fcn.1400b3e90
mov r10d, 1
mov esi, r10d
jmp 0x1400d0f09
cmp dword [r14 + 0x28], ebp
je 0x1400d0f09
test r12d, r12d
jne 0x1400d0f09
test byte [rbx + 8], 1
je 0x1400d0e79
lea rcx, str.nonresident_standard_information_n
call fcn.1400b3e90
lea r10d, [r12 + 1]
jmp 0x1400d0f09
cmp ecx, 0x16
jae 0x1400d0ea3
mov r8d, ebx
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, reloc.WS2_32.dll_shutdown
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b3ec0
mov r10d, 1
jmp 0x1400d0f09
movzx ecx, word [rbx + 0x14]
add rcx, rbx
cmp rcx, r13
jb 0x1400d0ee6
cmp rcx, r8
jae 0x1400d0ee6
mov eax, r13d
sub eax, ecx
add eax, edx
cmp eax, 0x24
jb 0x1400d0ee6
mov eax, dword [rcx + 0x20]
mov r12d, r10d
mov dword [rsp + 0x50], eax
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x1400d0f09
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 0x24
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b3ec0
mov r10d, 1
mov eax, dword [rbx + 4]
movabs r11, 0xffffffffffff
add rbx, rax
jmp 0x1400d0bb0
sub ebx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov ecx, 0xffff0000
mov r8d, ebx
call fcn.1400b3ec0
jmp 0x1400d0f8f
mov r8d, dword [rbx + 4]
mov rdx, qword [r14 + 0x30]
lea rcx, str._t_I64u:_BAD_record_length__d____d_n
mov r9d, reloc.WS2_32.dll_recv
call fcn.1400b3e90
jmp 0x1400d0f8f
sub ebx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 8
mov r8d, ebx
mov ecx, 0xffff0000
call fcn.1400b3ec0
jmp 0x1400d0f8f
sub ebx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 4
mov r8d, ebx
mov ecx, 0xffff0000
call fcn.1400b3ec0
mov rdx, qword [r13 + 0x20]
test rdx, rdx
je 0x1400d1124
mov rax, rdx
movabs rcx, 0xffffffffffff
and rax, rcx
cmp rax, 0x10
jae 0x1400d0fdb
cmp rax, 5
je 0x1400d0fdb
lea rcx, str.ignore_internal_extended_fragmented_file_record__016I64x_n
call fcn.1400b3e90
xor r12d, r12d
movabs r11, 0xffffffffffff
lea r10d, [r12 + 1]
jmp 0x1400d139e
mov rax, qword [r14 + 0x78]
add rax, 0x50
cmp rax, qword [r14 + 0x80]
jb 0x1400d0ffa
lea rcx, [r14 + 0x68]
mov edx, 0x50
call fcn.1400e4690
mov rsi, qword [r14 + 0x78]
lea rax, [rsi + 0x50]
mov qword [r14 + 0x78], rax
mov rax, qword [r13 + 0x20]
mov qword [rsi + 8], rax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x30], eax
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x18], rax
mov rax, qword [rsp + 0x48]
mov qword [rsi + 0x20], rax
mov rax, qword [rsp + 0x30]
mov dword [rsi + 0x38], r12d
xor r12d, r12d
test rdi, rdi
mov dword [rsi + 0x34], r15d
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], r12
mov qword [rsi + 0x48], r12
je 0x1400d10f5
nop
nop
nop
movzx eax, byte [rdi + 0x40]
lea edx, [rax + rax + 0x18]
cmp edx, 0x100
jle 0x1400d107e
lea rcx, [r14 + 0x68]
call fcn.1400e4760
mov rbx, rax
jmp 0x1400d10aa
mov rax, qword [r14 + 0x78]
movsxd r12, edx
lea rcx, [r12 + rax]
cmp rcx, qword [r14 + 0x80]
jb 0x1400d109b
lea rcx, [r14 + 0x68]
call fcn.1400e4690
mov rbx, qword [r14 + 0x78]
lea rax, [rbx + r12]
xor r12d, r12d
mov qword [r14 + 0x78], rax
movzx eax, byte [rdi + 0x40]
lea rdx, [rdi + 0x42]
lea rcx, [rbx + 0x18]
mov byte [rbx + 0x10], al
mov rax, qword [rdi]
mov qword [rbx], rax
movzx r8d, byte [rdi + 0x40]
add r8, r8
call fcn.1401a9000
cmp qword [rsi + 0x40], rbp
je 0x1400d10dc
mov rax, qword [rsi + 0x48]
mov qword [rax + 8], rbx
jmp 0x1400d10e0
mov qword [rsi + 0x40], rbx
mov qword [rbx + 8], r12
mov qword [rsi + 0x48], rbx
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400d1060
cmp qword [r14 + 0x38], rbp
je 0x1400d1104
mov rax, qword [r14 + 0x40]
mov qword [rax], rsi
jmp 0x1400d1108
mov qword [r14 + 0x38], rsi
mov qword [rsi], r12
mov r10d, 1
movabs r11, 0xffffffffffff
mov qword [r14 + 0x40], rsi
jmp 0x1400d139e
test esi, esi
je 0x1400d12d8
mov rax, qword [r14 + 0x50]
cmp qword [r14 + 0x48], rax
jne 0x1400d11c6
mov eax, dword [r14 + 0x60]
mov ebx, dword [r14 + 0x64]
add eax, 1
cmp eax, ebx
jbe 0x1400d118b
mov eax, 1
add ebx, ebx
cmove ebx, eax
mov ecx, ebx
shl rcx, 3
call fcn.1400cf3f0
mov r8d, dword [r14 + 0x60]
mov rdx, qword [r14 + 0x58]
shl r8, 3
mov rcx, rax
mov rsi, rax
call fcn.1401a9000
mov rcx, qword [r14 + 0x58]
test rcx, rcx
je 0x1400d1183
call fcn.1400cf470
mov qword [r14 + 0x58], rsi
mov dword [r14 + 0x64], ebx
mov ecx, 0x10000
call fcn.1400cf3f0
mov edx, dword [r14 + 0x60]
mov rcx, qword [r14 + 0x58]
mov qword [rcx + rdx*8], rax
mov edx, dword [r14 + 0x60]
mov rcx, qword [r14 + 0x58]
mov rax, qword [rcx + rdx*8]
mov qword [r14 + 0x48], rax
mov rax, qword [rcx + rdx*8]
add rax, 0xfff0
mov qword [r14 + 0x50], rax
lea eax, [rdx + 1]
mov dword [r14 + 0x60], eax
mov rsi, qword [r14 + 0x48]
lea rax, [rsi + 0x48]
mov qword [r14 + 0x48], rax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsi + 8], rax
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x48]
mov dword [rsi + 0x30], r12d
mov qword [rsi + 0x18], rax
mov rax, qword [rsp + 0x30]
xor r12d, r12d
mov qword [rsi + 0x20], rax
movzx eax, word [r13 + 0x10]
shl rax, 0x30
or rax, qword [r14 + 0x30]
test rdi, rdi
mov qword [rsi + 0x38], r12
mov qword [rsi + 0x40], r12
mov dword [rsi + 0x2c], r15d
mov qword [rsi], rax
je 0x1400d138e
nop
nop
movzx eax, byte [rdi + 0x40]
lea edx, [rax + rax + 0x18]
cmp edx, 0x100
jle 0x1400d124e
lea rcx, [r14 + 0x68]
call fcn.1400e4760
mov rbx, rax
jmp 0x1400d127a
mov rax, qword [r14 + 0x78]
movsxd r12, edx
lea rcx, [r12 + rax]
cmp rcx, qword [r14 + 0x80]
jb 0x1400d126b
lea rcx, [r14 + 0x68]
call fcn.1400e4690
mov rbx, qword [r14 + 0x78]
lea rax, [rbx + r12]
xor r12d, r12d
mov qword [r14 + 0x78], rax
movzx eax, byte [rdi + 0x40]
lea rdx, [rdi + 0x42]
lea rcx, [rbx + 0x18]
mov byte [rbx + 0x10], al
mov rax, qword [rdi]
mov qword [rbx], rax
movzx r8d, byte [rdi + 0x40]
add r8, r8
call fcn.1401a9000
cmp qword [rsi + 0x38], rbp
je 0x1400d12ac
mov rax, qword [rsi + 0x40]
mov qword [rax + 8], rbx
jmp 0x1400d12b0
mov qword [rsi + 0x38], rbx
mov qword [rbx + 8], r12
mov qword [rsi + 0x40], rbx
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400d1230
lea r10d, [rdi + 1]
movabs r11, 0xffffffffffff
jmp 0x1400d139e
movzx eax, word [r13 + 0x10]
shl rax, 0x30
or rax, qword [r14 + 0x30]
test rdi, rdi
mov qword [rsp + 0x20], rax
je 0x1400d137a
nop
nop
nop
nop
test r15d, r15d
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
lea rax, [rdi + 0x42]
mov qword [rsp + 0x58], rax
movzx eax, byte [rdi + 0x40]
mov byte [rsp + 0x54], al
je 0x1400d1325
or dword [rsp + 0x50], 0x10
jmp 0x1400d132a
and dword [rsp + 0x50], 0xffffffef
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x20]
call qword [r14 + reloc.WS2_32.dll_recv]
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400d1300
xor r12d, r12d
lea r10d, [rdi + 1]
movabs r11, 0xffffffffffff
jmp 0x1400d139e
cmp dword [0x14020e0e0], 0
je 0x1400d139e
lea rcx, str.bad_file_record_type__08x_n
call fcn.1400b3e90
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400d139e
xor r12d, r12d
movabs r11, 0xffffffffffff
lea r10d, [r12 + 1]
jmp 0x1400d139e
mov r10d, 1
movabs r11, 0xffffffffffff
mov eax, dword [r14 + 0x18]
add qword [r14 + 0x30], 1
add r13, rax
add dword [rsp + 0xb0], 0xffffffff
jne 0x1400d08c0
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x88
pop r14
pop r13
ret 0