Function at 0x1400d86a4
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd8
mov rax, qword [0x140173708]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rsp + 0x148]
xor r14d, r14d
mov r13, qword [rsp + 0x158]
mov rsi, rcx
mov rcx, qword [rsp + 0x140]
xorps xmm0, xmm0
mov r15, qword [rsp + 0x150]
mov r12, r8
mov qword [r8], r14
mov dword [r9], r14d
mov byte [rbx], r14b
mov qword [rsp + 0xa0], r9
mov qword [rsp + 0xa8], r8
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], r13
movups xmmword [rsp + 0xb0], xmm0
test r13, r13
je 0x1400d8740
mov byte [r13], r14b
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d8791
test byte [rcx + 0x1c], 4
je 0x1400d8791
cmp byte [rcx + 0x19], 5
jb 0x1400d8791
mov r9, qword [rsi + 0x38]
lea r8, [0x14015a1f0]
mov eax, dword [rsi + 0x38]
mov edx, reloc.OLEAUT32.dll_QueryPathOfRegTypeLib
mov rcx, qword [rcx + 0x10]
sar r9, 0x20
mov dword [rsp + 0x20], eax
call fcn.14003f558
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp byte [rsi + 0x48], r14b
jne 0x1400d89d3
mov rax, qword [rsi + 0x18]
lea rdi, str.base_stor_blb_blbimg_backfile.cxx
cmp qword [rsi + 0x38], rax
jl 0x1400d87c0
lea r8, [0x140150944]
mov edx, 0xd30
mov rcx, rdi
call fcn.1400906e0
mov r8, r15
mov rdx, rbx
mov rcx, rsi
call fcn.1400d7440
test eax, eax
jne 0x1400d87d9
mov al, 1
jmp 0x1400d91a8
cmp byte [rbx], r14b
jne 0x1400d91a6
mov rbx, qword [rsi + 0x38]
mov ebp, 0x10000
mov dword [r15 + 0x10], ebx
mov rax, rbx
shr rax, 0x20
mov r14d, ebp
mov dword [r15 + 0x14], eax
mov rax, qword [rsi + 0x18]
mov qword [rsp + 0x80], rbx
cmp qword [rsi + 0x38], rax
jl 0x1400d8823
lea r8, [0x14015a020]
mov edx, 0xd43
mov rcx, rdi
call fcn.1400906e0
mov rax, qword [rsi + 0x38]
add rax, rbp
cmp rax, qword [rsi + 0x18]
jle 0x1400d8844
lea r8, [0x140150944]
mov edx, 0xd4b
mov rcx, rdi
call fcn.1400906e0
mov rdi, qword [rsi + 0x18]
mov rcx, rsi
mov qword [rsp + 0x88], rdi
call fcn.1400dc110
test al, al
je 0x1400d88a7
mov rcx, qword [0x140173048]
lea rdx, [0x140173048]
cmp rcx, rdx
je 0x1400d889e
test byte [rcx + 0x1c], 4
je 0x1400d889e
cmp byte [rcx + 0x19], 5
jb 0x1400d889e
mov r9d, dword [rsi + 0xac]
lea r8, [0x14015a1f0]
mov rcx, qword [rcx + 0x10]
mov edx, 0xa4
call fcn.14000c354
mov rcx, qword [0x140173048]
mov r14d, dword [rsi + 0xac]
jmp 0x1400d88ae
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d892d
test byte [rcx + 0x1c], 4
je 0x1400d88fb
cmp byte [rcx + 0x19], 5
jb 0x1400d88fb
mov eax, dword [rsp + 0x84]
lea r8, [0x14015a1f0]
mov rcx, qword [rcx + 0x10]
mov edx, 0xa5
mov dword [rsp + 0x28], ebx
mov r9d, r14d
mov dword [rsp + 0x20], eax
call fcn.1400d1104
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d892d
test byte [rcx + 0x1c], 4
je 0x1400d892d
cmp byte [rcx + 0x19], 5
jb 0x1400d892d
mov r9d, dword [rsp + 0x8c]
lea r8, [0x14015a1f0]
mov rcx, qword [rcx + 0x10]
mov edx, 0xa6
mov dword [rsp + 0x20], edi
call fcn.14003f558
mov rdx, qword [rsp + 0x98]
mov r9, r15
mov rcx, qword [rsi]
mov r8d, r14d
call fcn.1400052c0
movabs rax, 0x7ff8007ff8007ff9
mov r8, r13
imul qword [rsi + 0x40]
mov rcx, rsi
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x90]
mov dword [rax], edx
mov rdx, r12
call fcn.1400d3ad8
mov rcx, qword [rsp + 0xa0]
mov dword [rcx], r14d
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d89c6
test byte [rcx + 0x1c], 4
je 0x1400d89c6
cmp byte [rcx + 0x19], 5
jb 0x1400d89c6
mov r9, qword [r12]
lea r8, [0x14015a1f0]
mov eax, dword [r12]
mov edx, 0xa7
mov rcx, qword [rcx + 0x10]
sar r9, 0x20
mov dword [rsp + 0x20], eax
call fcn.14003f558
add qword [rsi + 0x40], rbp
add qword [rsi + 0x38], rbp
jmp 0x1400d87d2
cmp rcx, rax
je 0x1400d89fd
test byte [rcx + 0x1c], 4
je 0x1400d89fd
cmp byte [rcx + 0x19], 5
jb 0x1400d89fd
mov r9d, dword [rsi + 0x68]
lea r8, [0x14015a1f0]
mov rcx, qword [rcx + 0x10]
mov edx, 0xa8
call fcn.14000c354
mov rcx, rsi
call fcn.1400db3d8
mov ebp, 0x10000
movabs r13, 0x7ff8007ff8007ff9
mov eax, dword [rsi + 0x68]
mov edi, ebp
mov r12d, eax
sub edi, eax
add r12, qword [rsi + 0x60]
cmp edi, 0x20
jb 0x1400d8a41
mov ecx, dword [r12 + 0x10]
cmp edi, ecx
jb 0x1400d8a41
add eax, ecx
lea r14, [rsi + 0xf8]
mov dword [rsi + 0x68], eax
jmp 0x1400d8b15
test edi, edi
je 0x1400d8a59
mov rcx, qword [rsi + 0x50]
mov rdx, r12
mov r8d, edi
mov r13d, edi
call sub.msvcrt.dll_memcpy
jmp 0x1400d8a5c
mov r13, r14
mov r12, qword [rsi + 0x50]
lea r14, [rsi + 0xf8]
cmp byte [r14], 0
mov rcx, rsi
je 0x1400d9160
call fcn.1400d3080
test al, al
je 0x1400d9102
cmp edi, 0x20
jae 0x1400d8a9f
mov rcx, qword [rsi + 0x50]
mov r8d, 0x20
mov rdx, qword [rsi + 0x60]
sub r8d, edi
add rcx, r13
call sub.msvcrt.dll_memcpy
mov ebx, dword [r12 + 0x10]
cmp ebx, 0x10020
ja 0x1400d90b0
cmp ebx, edi
jb 0x1400d9068
mov rax, qword [rsi + 0x50]
sub ebx, edi
mov rdx, qword [rsi + 0x60]
lea rcx, [rax + r13]
cmp ebx, ebp
jb 0x1400d8b00
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [r14], 0
je 0x1400d9021
mov rcx, rsi
call fcn.1400d3080
test al, al
je 0x1400d8fec
mov rdx, qword [rsi + 0x60]
lea ecx, [rdi + 0x10000]
add ebx, 0xffff0000
add rcx, qword [rsi + 0x50]
mov r8d, ebx
call sub.msvcrt.dll_memcpy
add dword [rsi + 0x68], ebx
movabs r13, 0x7ff8007ff8007ff9
mov r8d, 0x10
lea rdx, [0x140159de8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
nop dword [rax + rax]
cmp rax, 0x10
jne 0x1400d8eca
mov r9d, dword [r12 + 0x10]
cmp r9d, 0x20
jb 0x1400d8e85
test r9b, 0xf
jne 0x1400d8e85
mov r8d, dword [r12 + 0x18]
mov r10d, dword [r12 + 0x14]
cmp r10d, r8d
ja 0x1400d8e3a
mov r11d, dword [r12 + 0x1c]
test r11d, r11d
jne 0x1400d8e3a
lea eax, [r10 + 0x20]
cmp eax, r9d
ja 0x1400d8e3a
test r8d, 0x1ff
jne 0x1400d8e3a
test r8d, r8d
je 0x1400d8e3a
test r10d, r10d
jne 0x1400d8bc0
xor r14d, r14d
test r8w, r8w
jne 0x1400d8c69
cmp r8d, 0x200000
jae 0x1400d8c69
add qword [rsi + 0x40], r8
jmp 0x1400d8a14
mov rbx, qword [rsi + 0x40]
mov rax, r13
imul rbx
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rcx, rdx, 0x200200
cmp rbx, rcx
jne 0x1400d8cdd
cmp r8d, 0x200
jne 0x1400d8ca3
mov r8, qword [rsi + 0xd0]
lea rax, [rbx + 0x200]
mov rcx, qword [rsi + 0x138]
mov rdx, r12
mov qword [rsi + 0x40], rax
call fcn.1400c4d48
xor r14d, r14d
test al, al
jne 0x1400d8a14
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d90f9
test byte [rcx + 0x1c], 4
je 0x1400d90f9
cmp byte [rcx + 0x19], 2
jb 0x1400d90f9
mov edx, VariantTimeToSystemTime
mov eax, dword [r12 + 0x1c]
mov r9d, dword [r12 + 0x14]
mov dword [rsp + 0x30], eax
mov eax, dword [r12 + 0x10]
jmp 0x1400d9098
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d90f9
test byte [rcx + 0x1c], 4
je 0x1400d90f9
cmp byte [rcx + 0x19], 2
jb 0x1400d90f9
mov edx, 0xb3
mov dword [rsp + 0x30], r14d
jmp 0x1400d8e73
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d90f9
test byte [rcx + 0x1c], 4
je 0x1400d90f9
cmp byte [rcx + 0x19], 2
jb 0x1400d90f9
mov edx, VariantTimeToSystemTime
mov dword [rsp + 0x30], r11d
jmp 0x1400d8e73
cmp r8d, ebp
je 0x1400d8d40
cmp byte [r14], 0
jne 0x1400d8ced
cmp r8d, ebp
jbe 0x1400d8d40
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d90f9
test byte [rcx + 0x1c], 4
je 0x1400d90f9
cmp byte [rcx + 0x19], 2
jb 0x1400d90f9
movzx eax, byte [r14]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], r9d
mov r9d, r10d
mov dword [rsp + 0x20], r8d
call fcn.1400dd5e4
jmp 0x1400d90f9
mov r8, qword [rsp + 0x98]
mov rax, r13
imul rbx
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x90]
mov dword [rax], edx
mov rdx, r12
mov rcx, qword [rsi + 0x138]
call fcn.1400c4d48
test al, al
jne 0x1400d8dae
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d90f9
test byte [rcx + 0x1c], 4
je 0x1400d90f9
cmp byte [rcx + 0x19], 2
jb 0x1400d90f9
mov edx, VariantTimeToSystemTime
jmp 0x1400d8c51
and qword [r15], 0
mov eax, dword [r12 + 0x18]
mov rcx, qword [r15 + 0x18]
mov qword [r15 + 8], rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop dword [rax + rax]
mov rbx, qword [rsp + 0xa8]
mov rcx, rsi
mov r8, qword [rsp + 0x88]
mov rdx, rbx
call fcn.1400d3ad8
mov rcx, qword [rsp + 0xa0]
mov eax, dword [r12 + 0x18]
mov dword [rcx], eax
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d8e2c
test byte [rcx + 0x1c], 4
je 0x1400d8e2c
cmp byte [rcx + 0x19], 5
jb 0x1400d8e2c
mov r9, qword [rbx]
lea r8, [0x14015a1f0]
mov rcx, qword [rcx + 0x10]
mov edx, reloc.OLEAUT32.dll_VariantTimeToSystemTime
call fcn.140040ae4
mov eax, dword [r12 + 0x18]
add qword [rsi + 0x40], rax
jmp 0x1400d87d2
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d90f9
test byte [rcx + 0x1c], 4
je 0x1400d90f9
cmp byte [rcx + 0x19], 2
jb 0x1400d90f9
mov eax, dword [r12 + 0x1c]
mov edx, 0xb2
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r9d
mov r9d, r10d
mov dword [rsp + 0x20], r8d
jmp 0x1400d90a5
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d90f9
test byte [rcx + 0x1c], 4
je 0x1400d90f9
cmp byte [rcx + 0x19], 2
jb 0x1400d90f9
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015a1f0]
mov edx, 0xb1
call fcn.14000c47c
jmp 0x1400d90f9
mov r8d, 0x10
lea rdx, [rsp + 0xb0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
nop dword [rax + rax]
cmp rax, 0x10
jne 0x1400d8f3e
cmp byte [r14], 0
jne 0x1400d8f3e
mov rcx, rsi
call fcn.1400dc3b4
mov rcx, qword [rsp + 0x80]
mov byte [rcx], al
mov rcx, qword [0x140173048]
lea rdx, [0x140173048]
cmp rcx, rdx
je 0x1400d91a6
test byte [rcx + 0x1c], 4
je 0x1400d91a6
cmp byte [rcx + 0x19], 4
jb 0x1400d91a6
mov r9d, dword [rsi + 0x68]
mov edx, 0xb0
jmp 0x1400d9196
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d90f9
test byte [rcx + 0x1c], 4
je 0x1400d90f9
cmp byte [rcx + 0x19], 2
jb 0x1400d90f9
movzx eax, byte [r14]
movzx r9d, byte [r12 + 0xd]
movzx edx, byte [r12 + 0xf]
movzx r8d, byte [r12 + 0xe]
movzx r10d, byte [r12 + 0xc]
movzx r11d, byte [r12 + 0xb]
movzx ebx, byte [r12 + 0xa]
movzx edi, byte [r12 + 9]
movzx esi, byte [r12 + 8]
movzx ebp, word [r12 + 6]
movzx r14d, word [r12 + 4]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x58], r9d
mov r9d, dword [r12]
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
call fcn.1400dd3b0
jmp 0x1400d90f9
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d9136
test byte [rcx + 0x1c], 4
je 0x1400d9136
cmp byte [rcx + 0x19], 2
jb 0x1400d9136
mov edx, 0xae
jmp 0x1400d9126
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d90f9
test byte [rcx + 0x1c], 4
je 0x1400d90f9
cmp byte [rcx + 0x19], 2
jb 0x1400d90f9
mov rax, qword [rsi + 0x38]
sub ebp, ebx
mov rcx, qword [rcx + 0x10]
mov r9d, ebp
mov qword [rsp + 0x20], rax
call fcn.1400dd748
jmp 0x1400d90f9
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d90f9
test byte [rcx + 0x1c], 4
je 0x1400d90f9
cmp byte [rcx + 0x19], 2
jb 0x1400d90f9
mov eax, dword [r12 + 0x14]
mov edx, 0xac
mov dword [rsp + 0x30], edi
mov r9d, ebx
mov dword [rsp + 0x28], eax
mov eax, dword [r12 + 0x18]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.1400dd574
jmp 0x1400d90f9
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d90f9
test byte [rcx + 0x1c], 4
je 0x1400d90f9
cmp byte [rcx + 0x19], 2
jb 0x1400d90f9
mov eax, dword [r12 + 0x14]
lea r8, [0x14015a1f0]
mov rcx, qword [rcx + 0x10]
mov edx, 0xab
mov dword [rsp + 0x28], eax
mov r9d, ebx
mov eax, dword [r12 + 0x18]
mov dword [rsp + 0x20], eax
call fcn.1400d1538
mov qword [r15], 0xffffffffc0000102
jmp 0x1400d914b
mov rcx, qword [0x140173048]
lea rax, [0x140173048]
cmp rcx, rax
je 0x1400d9136
test byte [rcx + 0x1c], 4
je 0x1400d9136
cmp byte [rcx + 0x19], 2
jb 0x1400d9136
mov edx, 0xaa
mov rcx, qword [rcx + 0x10]
lea r8, [0x14015a1f0]
call fcn.14000c328
mov rax, qword [rsi + 0x110]
mov qword [r15], rax
mov rax, qword [rsi + 0x118]
mov qword [r15 + 8], rax
mov rcx, qword [r15 + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop dword [rax + rax]
jmp 0x1400d87d2
call fcn.1400dc3b4
mov rcx, qword [rsp + 0x80]
mov byte [rcx], al
mov rcx, qword [0x140173048]
lea rdx, [0x140173048]
cmp rcx, rdx
je 0x1400d91a6
test byte [rcx + 0x1c], 4
je 0x1400d91a6
cmp byte [rcx + 0x19], 4
jb 0x1400d91a6
mov edx, 0xa9
mov r9d, edi
mov rcx, qword [rcx + 0x10]
movzx eax, al
mov dword [rsp + 0x20], eax
call fcn.1400dd6f0
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140007410
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret