Function at 0x1400c936c
Capabilities:
Enumerate pe sections

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc8
mov rax, qword [0x140172608]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov r15, qword [rsp + 0x148]
xor ebx, ebx
mov r14, qword [rsp + 0x138]
mov rsi, rcx
mov rcx, qword [rsp + 0x130]
mov r13, r8
mov r12, qword [rsp + 0x140]
mov qword [r8], rbx
mov qword [rsp + 0x88], rcx
xor ecx, ecx
mov dword [r9], ebx
mov qword [rsp + 0x98], r9
mov qword [rsp + 0x90], rdx
mov qword [rsp + 0x80], r15
mov qword [r11 - 0x60], rcx
mov qword [r11 - 0x58], rcx
mov byte [r14], bl
test r15, r15
je 0x1400c93f7
mov byte [r15], bl
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9448
test byte [rcx + 0x1c], 4
je 0x1400c9448
cmp byte [rcx + 0x19], 5
jb 0x1400c9448
mov r9, qword [rsi + 0x38]
lea r8, [0x1401532b8]
mov eax, dword [rsi + 0x38]
mov edx, reloc.OLEAUT32.dll_QueryPathOfRegTypeLib
mov rcx, qword [rcx + 0x10]
sar r9, 0x20
mov dword [rsp + 0x20], eax
call fcn.14000ffdc
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp byte [rsi + 0x48], bl
jne 0x1400c968b
mov rax, qword [rsi + 0x18]
lea rdi, str.base_stor_blb_blbimg_backfile.cxx
cmp qword [rsi + 0x38], rax
jl 0x1400c9476
lea r8, [0x140149d6c]
mov edx, 0xd30
mov rcx, rdi
call fcn.14008410c
mov r8, r12
mov rdx, r14
mov rcx, rsi
call fcn.1400c7c34
test eax, eax
jne 0x1400c948f
mov al, 1
jmp 0x1400c9e5e
cmp byte [r14], bl
jne 0x1400c9e5c
mov rbx, qword [rsi + 0x38]
mov ebp, 0x10000
mov dword [r12 + 0x10], ebx
mov rax, rbx
shr rax, 0x20
mov r14d, ebp
mov dword [r12 + 0x14], eax
mov rax, qword [rsi + 0x18]
mov qword [rsp + 0xa0], rbx
cmp qword [rsi + 0x38], rax
jl 0x1400c94db
lea r8, [0x1401530b0]
mov edx, 0xd43
mov rcx, rdi
call fcn.14008410c
mov rax, qword [rsi + 0x38]
add rax, rbp
cmp rax, qword [rsi + 0x18]
jle 0x1400c94fc
lea r8, [0x140149d6c]
mov edx, 0xd4b
mov rcx, rdi
call fcn.14008410c
mov rdi, qword [rsi + 0x18]
mov rcx, rsi
mov qword [rsp + 0x80], rdi
call fcn.1400cfb30
test al, al
je 0x1400c955f
mov rcx, qword [0x1401720a0]
lea r8, [0x1401720a0]
cmp rcx, r8
je 0x1400c9556
test byte [rcx + 0x1c], 4
je 0x1400c9556
cmp byte [rcx + 0x19], 5
jb 0x1400c9556
mov r9d, dword [rsi + 0xac]
lea r8, [0x1401532b8]
mov rcx, qword [rcx + 0x10]
mov edx, 0xa4
call fcn.140004b98
mov rcx, qword [0x1401720a0]
mov r14d, dword [rsi + 0xac]
jmp 0x1400c9566
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c95e5
test byte [rcx + 0x1c], 4
je 0x1400c95b3
cmp byte [rcx + 0x19], 5
jb 0x1400c95b3
mov eax, dword [rsp + 0xa4]
lea r8, [0x1401532b8]
mov rcx, qword [rcx + 0x10]
mov edx, 0xa5
mov dword [rsp + 0x28], ebx
mov r9d, r14d
mov dword [rsp + 0x20], eax
call fcn.1400ae470
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c95e5
test byte [rcx + 0x1c], 4
je 0x1400c95e5
cmp byte [rcx + 0x19], 5
jb 0x1400c95e5
mov r9d, dword [rsp + 0x84]
lea r8, [0x1401532b8]
mov rcx, qword [rcx + 0x10]
mov edx, 0xa6
mov dword [rsp + 0x20], edi
call fcn.14000ffdc
mov rdx, qword [rsp + 0x90]
mov r9, r12
mov rcx, qword [rsi]
mov r8d, r14d
call fcn.1400bcbc0
movabs rax, 0x7ff8007ff8007ff9
mov r8, r15
imul qword [rsi + 0x40]
mov rcx, rsi
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x88]
mov dword [rax], edx
mov rdx, r13
call fcn.1400c858c
mov rcx, qword [rsp + 0x98]
mov dword [rcx], r14d
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c967e
test byte [rcx + 0x1c], 4
je 0x1400c967e
cmp byte [rcx + 0x19], 5
jb 0x1400c967e
mov r9, qword [r13]
lea r8, [0x1401532b8]
mov eax, dword [r13]
mov edx, 0xa7
mov rcx, qword [rcx + 0x10]
sar r9, 0x20
mov dword [rsp + 0x20], eax
call fcn.14000ffdc
add qword [rsi + 0x40], rbp
add qword [rsi + 0x38], rbp
jmp 0x1400c9488
cmp rcx, rax
je 0x1400c96b5
test byte [rcx + 0x1c], 4
je 0x1400c96b5
cmp byte [rcx + 0x19], 5
jb 0x1400c96b5
mov r9d, dword [rsi + 0x68]
lea r8, [0x1401532b8]
mov rcx, qword [rcx + 0x10]
mov edx, 0xa8
call fcn.140004b98
mov rcx, rsi
call fcn.1400cdef0
mov ebp, 0x10000
movabs rdi, 0x7ff8007ff8007ff9
mov eax, dword [rsi + 0x68]
mov ebx, ebp
mov r15d, eax
sub ebx, eax
add r15, qword [rsi + 0x60]
cmp ebx, 0x20
jb 0x1400c96f1
mov ecx, dword [r15 + 0x10]
cmp ebx, ecx
jb 0x1400c96f1
add eax, ecx
mov dword [rsi + 0x68], eax
jmp 0x1400c980b
test ebx, ebx
je 0x1400c9704
mov rcx, qword [rsi + 0x50]
mov rdx, r15
mov r8d, ebx
call sub.msvcrt.dll_memcpy
cmp byte [rsi + 0xf8], 0
mov rcx, rsi
mov r15, qword [rsi + 0x50]
je 0x1400c9e1d
call fcn.1400cdfdc
test al, al
je 0x1400c9dc2
cmp ebx, 0x20
jae 0x1400c9742
mov rdx, qword [rsi + 0x60]
mov r8d, 0x20
mov ecx, ebx
sub r8d, ebx
add rcx, qword [rsi + 0x50]
call sub.msvcrt.dll_memcpy
mov edi, dword [r15 + 0x10]
cmp edi, 0x10020
ja 0x1400c9d71
cmp edi, ebx
jb 0x1400c9d2b
sub edi, ebx
cmp edi, ebp
jae 0x1400c9767
mov ecx, ebx
jmp 0x1400c97ee
mov rcx, qword [rsi + 0x60]
mov edx, 0x200
mov eax, ebx
mov r8d, 0x80
add rax, qword [rsi + 0x50]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
add rax, r8
movups xmm1, xmmword [rcx + 0x70]
add rcx, r8
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1400c977c
cmp byte [rsi + 0xf8], dl
je 0x1400c9ce4
mov rcx, rsi
call fcn.1400cdfdc
test al, al
je 0x1400c9caf
add edi, 0xffff0000
lea ecx, [rbx + 0x10000]
mov rdx, qword [rsi + 0x60]
add rcx, qword [rsi + 0x50]
mov r8d, edi
call sub.msvcrt.dll_memcpy
add dword [rsi + 0x68], edi
movabs rdi, 0x7ff8007ff8007ff9
mov ebx, 0x10
lea rdx, [0x140152e68]
mov r8d, ebx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1400c9ba3
cmp dword [r15 + 0x10], 0x20
jb 0x1400c9b5a
test byte [r15 + 0x10], 0xf
jne 0x1400c9b5a
mov r8d, dword [r15 + 0x18]
mov ecx, dword [r15 + 0x14]
cmp ecx, r8d
ja 0x1400c9b25
cmp dword [r15 + 0x1c], 0
jne 0x1400c9b25
lea eax, [rcx + 0x20]
cmp eax, dword [r15 + 0x10]
ja 0x1400c9b25
test r8d, 0x1ff
jne 0x1400c9b25
test r8d, r8d
je 0x1400c9b25
test ecx, ecx
jne 0x1400c98a5
test r8w, r8w
jne 0x1400c994b
cmp r8d, 0x200000
jae 0x1400c994b
add qword [rsi + 0x40], r8
jmp 0x1400c96cc
mov r9, qword [rsi + 0x40]
mov rax, rdi
imul r9
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r9
imul rcx, rdx, 0x200200
sub rax, rcx
jne 0x1400c99c9
cmp r8d, 0x200
jne 0x1400c9997
mov r8, qword [rsi + 0xd0]
lea rax, [r9 + 0x200]
mov rcx, qword [rsi + 0x138]
mov rdx, r15
mov qword [rsi + 0x40], rax
call fcn.1400b8b44
test al, al
jne 0x1400c96cc
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9db8
test byte [rcx + 0x1c], 4
je 0x1400c9db8
cmp byte [rcx + 0x19], 2
jb 0x1400c9db8
mov edx, VariantTimeToSystemTime
mov eax, dword [r15 + 0x1c]
mov r9d, dword [r15 + 0x14]
mov dword [rsp + 0x30], eax
mov eax, dword [r15 + 0x10]
jmp 0x1400c9d5a
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9db8
test byte [rcx + 0x1c], 4
je 0x1400c9db8
cmp byte [rcx + 0x19], 2
jb 0x1400c9db8
mov edx, 0xb3
mov eax, dword [r15 + 0x1c]
mov r9d, dword [r15 + 0x14]
mov dword [rsp + 0x30], eax
mov eax, dword [r15 + 0x10]
mov dword [rsp + 0x28], eax
mov eax, r8d
jmp 0x1400c9d62
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9db8
test byte [rcx + 0x1c], 4
je 0x1400c9db8
cmp byte [rcx + 0x19], 2
jb 0x1400c9db8
mov edx, VariantTimeToSystemTime
jmp 0x1400c997b
mov edx, r8d
cmp r8d, ebp
je 0x1400c9a37
mov al, byte [rsi + 0xf8]
test al, al
jne 0x1400c99df
cmp edx, ebp
jbe 0x1400c9a37
mov rcx, qword [0x1401720a0]
lea r8, [0x1401720a0]
cmp rcx, r8
je 0x1400c9db8
test byte [rcx + 0x1c], 4
je 0x1400c9db8
cmp byte [rcx + 0x19], 2
jb 0x1400c9db8
mov r9d, dword [r15 + 0x14]
mov rcx, qword [rcx + 0x10]
movzx eax, al
mov dword [rsp + 0x38], eax
mov eax, dword [r15 + 0x1c]
mov dword [rsp + 0x30], eax
mov eax, dword [r15 + 0x10]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
call fcn.1400c4eb4
jmp 0x1400c9db8
mov r8, qword [rsp + 0x90]
mov rax, rdi
imul qword [rsi + 0x40]
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x88]
mov dword [rax], edx
mov rdx, r15
mov rcx, qword [rsi + 0x138]
call fcn.1400b8b44
test al, al
jne 0x1400c9aa6
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9db8
test byte [rcx + 0x1c], 4
je 0x1400c9db8
cmp byte [rcx + 0x19], 2
jb 0x1400c9db8
mov edx, VariantTimeToSystemTime
jmp 0x1400c9936
and qword [r12], 0
mov eax, dword [r15 + 0x18]
mov rcx, qword [r12 + 0x18]
mov qword [r12 + 8], rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov r8, qword [rsp + 0x80]
mov rdx, r13
mov rcx, rsi
call fcn.1400c858c
mov rcx, qword [rsp + 0x98]
mov eax, dword [r15 + 0x18]
mov dword [rcx], eax
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9b18
test byte [rcx + 0x1c], 4
je 0x1400c9b18
cmp byte [rcx + 0x19], 5
jb 0x1400c9b18
mov r9, qword [r13]
lea r8, [0x1401532b8]
mov rcx, qword [rcx + 0x10]
mov edx, reloc.OLEAUT32.dll_VariantTimeToSystemTime
call fcn.1400aedd0
mov eax, dword [r15 + 0x18]
add qword [rsi + 0x40], rax
jmp 0x1400c9488
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9db8
test byte [rcx + 0x1c], 4
je 0x1400c9db8
cmp byte [rcx + 0x19], 2
jb 0x1400c9db8
mov edx, 0xb2
jmp 0x1400c997b
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9db8
test byte [rcx + 0x1c], 4
je 0x1400c9db8
cmp byte [rcx + 0x19], 2
jb 0x1400c9db8
mov r9d, dword [r15 + 0x10]
lea r8, [0x1401532b8]
mov rcx, qword [rcx + 0x10]
mov edx, 0xb1
call fcn.140004b98
jmp 0x1400c9db8
mov r8, rbx
lea rdx, [rsp + 0xa8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1400c9c09
cmp byte [rsi + 0xf8], 0
jne 0x1400c9c09
mov rcx, rsi
call fcn.1400cfdbc
mov byte [r14], al
mov rcx, qword [0x1401720a0]
lea r8, [0x1401720a0]
cmp rcx, r8
je 0x1400c9e5c
test byte [rcx + 0x1c], 4
je 0x1400c9e5c
cmp byte [rcx + 0x19], 4
jb 0x1400c9e5c
mov r9d, dword [rsi + 0x68]
mov edx, 0xb0
jmp 0x1400c9e4c
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9db8
test byte [rcx + 0x1c], 4
je 0x1400c9db8
cmp byte [rcx + 0x19], 2
jb 0x1400c9db8
movzx eax, byte [rsi + 0xf8]
movzx r9d, byte [r15 + 0xd]
movzx edx, byte [r15 + 0xf]
movzx r8d, byte [r15 + 0xe]
movzx r10d, byte [r15 + 0xc]
movzx r11d, byte [r15 + 0xb]
movzx ebx, byte [r15 + 0xa]
movzx edi, byte [r15 + 9]
movzx esi, byte [r15 + 8]
movzx ebp, word [r15 + 6]
movzx r14d, word [r15 + 4]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x58], r9d
mov r9d, dword [r15]
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
call fcn.1400c4c94
jmp 0x1400c9db8
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9df6
test byte [rcx + 0x1c], 4
je 0x1400c9df6
cmp byte [rcx + 0x19], 2
jb 0x1400c9df6
mov edx, 0xae
jmp 0x1400c9de6
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9db8
test byte [rcx + 0x1c], 4
je 0x1400c9db8
cmp byte [rcx + 0x19], 2
jb 0x1400c9db8
mov rax, qword [rsi + 0x38]
sub ebp, edi
mov rcx, qword [rcx + 0x10]
mov r9d, ebp
mov qword [rsp + 0x20], rax
call fcn.1400c5008
jmp 0x1400c9db8
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9db8
test byte [rcx + 0x1c], 4
je 0x1400c9db8
cmp byte [rcx + 0x19], 2
jb 0x1400c9db8
mov eax, dword [r15 + 0x14]
mov edx, 0xac
mov dword [rsp + 0x30], ebx
mov r9d, edi
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + 0x18]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], eax
call fcn.1400c4e4c
jmp 0x1400c9db8
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9db8
test byte [rcx + 0x1c], 4
je 0x1400c9db8
cmp byte [rcx + 0x19], 2
jb 0x1400c9db8
mov eax, dword [r15 + 0x14]
lea r8, [0x1401532b8]
mov rcx, qword [rcx + 0x10]
mov edx, 0xab
mov dword [rsp + 0x28], eax
mov r9d, edi
mov eax, dword [r15 + 0x18]
mov dword [rsp + 0x20], eax
call fcn.1400ae470
mov qword [r12], 0xffffffffc0000102
jmp 0x1400c9e0d
mov rcx, qword [0x1401720a0]
lea rax, [0x1401720a0]
cmp rcx, rax
je 0x1400c9df6
test byte [rcx + 0x1c], 4
je 0x1400c9df6
cmp byte [rcx + 0x19], 2
jb 0x1400c9df6
mov edx, 0xaa
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401532b8]
call fcn.140004b74
mov rax, qword [rsi + 0x110]
mov qword [r12], rax
mov rax, qword [rsi + 0x118]
mov qword [r12 + 8], rax
mov rcx, qword [r12 + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400c9488
call fcn.1400cfdbc
mov byte [r14], al
mov rcx, qword [0x1401720a0]
lea r8, [0x1401720a0]
cmp rcx, r8
je 0x1400c9e5c
test byte [rcx + 0x1c], 4
je 0x1400c9e5c
cmp byte [rcx + 0x19], 4
jb 0x1400c9e5c
mov edx, 0xa9
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
movzx eax, al
mov dword [rsp + 0x20], eax
call fcn.1400c4fb8
xor al, al
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.140141cf0
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret