Function at 0x12821400
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor esi, esi
xor edi, edi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov r12, rdx
mov rbx, rcx
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x28], esi
mov r13, rcx
test rcx, rcx
je 0x12821a03
movzx eax, word [rcx]
test ax, ax
je 0x12821a03
cmp ax, 0x5c
jne 0x128219d8
movzx eax, word [rcx + 2]
cmp ax, 0x3f
jne 0x128215a5
cmp word [rcx + 4], ax
jne 0x128215a5
cmp word [rcx + 6], 0x5c
jne 0x128215a5
movzx eax, word [rcx + 8]
cmp ax, 0x41
jb 0x12821483
cmp ax, 0x5a
jbe 0x1282148f
cmp ax, 0x61
jb 0x1282149f
cmp ax, 0x7a
ja 0x1282149f
cmp word [rcx + 0xa], 0x3a
jne 0x1282149f
lea rdi, [rcx + 0xc]
jmp 0x1282158f
cmp ax, 0x56
je 0x128214ab
cmp ax, 0x76
jne 0x128214ed
lea rdx, str.Volume
mov r8d, 6
add rcx, 8
call fcn.1295a8a4
test eax, eax
jne 0x128214ed
cmp word [rbx + 0x14], 0x7b
jne 0x128214ed
lea edx, [rax + 0x7d]
lea rcx, [rbx + 0x16]
call fcn.1295be3c
test rax, rax
je 0x128214e1
lea rdi, [rax + 2]
or esi, 0x10
mov dword [rsp + 0x24], esi
jmp 0x1282158f
movzx eax, word [rbx + 8]
cmp ax, 0x55
je 0x128214fd
cmp ax, 0x75
jne 0x12821555
movzx eax, word [rbx + 0xa]
cmp ax, 0x4e
je 0x1282150d
cmp ax, 0x6e
jne 0x12821555
movzx eax, word [rbx + 0xc]
cmp ax, 0x43
je 0x1282151d
cmp ax, 0x63
jne 0x12821555
cmp word [rbx + 0xe], 0x5c
jne 0x12821555
lea rcx, [rbx + 0x10]
mov edx, 0x5c
call fcn.1295be3c
mov rbx, rax
test rax, rax
je 0x12821a03
lea rdx, [0x129c6388]
lea rcx, [rax + 2]
call fcn.1295bbd0
lea rdi, [rbx + rax*2 + 2]
jmp 0x1282158f
lea rdx, str.physicaldrive
lea rcx, [rbx + 8]
mov r8d, 0xd
call fcn.1295a8a4
test eax, eax
jne 0x12821a03
lea rdx, [0x129c6388]
lea rcx, [rbx + 0x22]
call fcn.1295bbd0
or esi, 4
lea rdi, [rbx + rax*2 + 0x22]
mov dword [rsp + 0x24], esi
test rdi, rdi
je 0x12821a03
mov dword [rsp + 0x20], 2
jmp 0x12821a03
cmp ax, 0x44
je 0x128215b5
cmp ax, 0x64
jne 0x12821831
lea rdx, str.Device_
mov r8d, 7
add rcx, 2
call fcn.1295a8a4
test eax, eax
jne 0x12821831
movzx eax, word [rbx + 0x10]
cmp ax, 0x48
je 0x128215e7
cmp ax, 0x68
jne 0x128216e3
lea rdx, str.Harddisk
lea rcx, [rbx + 0x10]
mov r8d, 8
call fcn.1295a8a4
test eax, eax
jne 0x128216e3
movzx eax, word [rbx + 0x20]
add rbx, 0x20
cmp ax, 0x44
je 0x12821619
cmp ax, 0x64
jne 0x1282166b
lea rdx, str.DmVolumes_
mov r8d, 0xa
mov rcx, rbx
call fcn.1295a8a4
test eax, eax
jne 0x1282166b
lea rdx, [0x129c6388]
lea rcx, [rbx + 0x14]
call fcn.1295bbd0
cmp word [rbx + rax*2 + 0x14], 0x5c
lea rbx, [rbx + rax*2 + 0x14]
jne 0x12821653
add rbx, 2
lea rdx, [0x129c6388]
mov rcx, rbx
call fcn.1295bbd0
lea rdi, [rbx + rax*2]
jmp 0x1282181b
lea rdx, [0x129c6388]
mov rcx, rbx
call fcn.1295bbd0
lea rdx, str.Volume
mov r8d, 6
mov rcx, rbx
lea rdi, [rbx + rax*2]
call fcn.1295a8a4
test eax, eax
je 0x1282181b
cmp word [rdi], 0x5c
jne 0x128216a5
add rdi, 2
movzx eax, word [rdi]
cmp ax, 0x44
je 0x128216b4
cmp ax, 0x64
jne 0x128216cb
movzx eax, word [rdi + 2]
cmp ax, 0x52
je 0x128216c4
cmp ax, 0x72
jne 0x128216cb
or esi, 4
mov dword [rsp + 0x24], esi
lea rdx, [0x129c6388]
mov rcx, rdi
call fcn.1295bbd0
lea rdi, [rdi + rax*2]
jmp 0x1282181b
movzx eax, word [rbx + 0x10]
cmp ax, 0x4c
je 0x128216f3
cmp ax, 0x6c
jne 0x1282173f
lea rdx, str.LanmanRedirector_
lea rcx, [rbx + 0x10]
mov r8d, 0x11
call fcn.1295a8a4
test eax, eax
jne 0x1282173f
lea edx, [rax + 0x5c]
lea rcx, [rbx + 0x32]
call fcn.1295be3c
mov rbx, rax
test rax, rax
je 0x12821a03
lea rdx, [0x129c6388]
lea rcx, [rax + 2]
call fcn.1295bbd0
lea rdi, [rbx + rax*2 + 2]
jmp 0x1282181b
movzx eax, word [rbx + 0x10]
cmp ax, 0x43
je 0x1282174f
cmp ax, 0x63
jne 0x1282178f
movzx ecx, word [rbx + 0x12]
cmp cx, 0x64
je 0x1282175f
cmp cx, 0x44
jne 0x1282178f
movzx ecx, word [rbx + 0x14]
cmp cx, 0x52
je 0x1282176f
cmp cx, 0x72
jne 0x1282178f
movzx ecx, word [rbx + 0x16]
cmp cx, 0x6f
je 0x1282177f
cmp cx, 0x4f
jne 0x1282178f
movzx ecx, word [rbx + 0x18]
cmp cx, 0x6d
je 0x12821806
cmp cx, 0x4d
je 0x12821806
cmp ax, 0x4d
je 0x1282179f
cmp ax, 0x6d
jne 0x12821a03
movzx eax, word [rbx + 0x12]
cmp ax, 0x75
je 0x128217b3
cmp ax, 0x55
jne 0x12821a03
movzx eax, word [rbx + 0x14]
cmp ax, 0x70
je 0x128217c7
cmp ax, 0x50
jne 0x12821a03
cmp word [rbx + 0x16], 0x5c
jne 0x12821a03
lea rdx, [0x129c6388]
lea rcx, [rbx + 0x18]
call fcn.1295bbd0
cmp word [rbx + rax*2 + 0x18], 0x5c
lea rdi, [rbx + rax*2 + 0x18]
jne 0x1282181b
lea rdx, [0x129c6388]
lea rcx, [rdi + 2]
call fcn.1295bbd0
lea rdi, [rdi + rax*2 + 2]
jmp 0x1282181b
lea rdx, [0x129c6388]
lea rcx, [rbx + 0x1a]
call fcn.1295bbd0
lea rdi, [rbx + rax*2 + 0x1a]
test rdi, rdi
je 0x12821a03
mov dword [rsp + 0x20], 3
jmp 0x12821a03
cmp word [rbx], 0x5c
jne 0x1282197b
cmp word [rbx + 2], 0x5c
jne 0x1282197b
cmp word [rbx + 6], 0x5c
jne 0x1282197b
movzx eax, word [rbx + 4]
cmp ax, 0x2e
jne 0x128218ca
lea rdx, str.physicaldrive
lea rcx, [rbx + 8]
mov r8d, 0xd
call fcn.1295a8a4
test eax, eax
jne 0x128218a1
lea rdx, [0x129c6388]
lea rcx, [rbx + 0x22]
call fcn.1295bbd0
or esi, 4
mov dword [rsp + 0x20], 1
or esi, 2
lea rdi, [rbx + rax*2 + 0x22]
mov dword [rsp + 0x24], esi
jmp 0x12821a03
lea rdx, [0x129c6388]
lea rcx, [rbx + 8]
call fcn.1295bbd0
or esi, 2
mov dword [rsp + 0x20], 1
lea rdi, [rbx + rax*2 + 8]
mov dword [rsp + 0x24], esi
jmp 0x12821a03
cmp ax, 0x3f
jne 0x12821a03
movzx eax, word [rbx + 8]
add rbx, 8
cmp ax, 0x56
je 0x128218e8
cmp ax, 0x76
jne 0x12821954
movzx eax, word [rbx + 2]
cmp ax, 0x6f
je 0x128218f8
cmp ax, 0x4f
jne 0x12821954
movzx eax, word [rbx + 4]
cmp ax, 0x6c
je 0x12821908
cmp ax, 0x4c
jne 0x12821954
movzx eax, word [rbx + 6]
cmp ax, 0x75
je 0x12821918
cmp ax, 0x55
jne 0x12821954
movzx eax, word [rbx + 8]
cmp ax, 0x6d
je 0x12821928
cmp ax, 0x4d
jne 0x12821954
movzx eax, word [rbx + 0xa]
cmp ax, 0x65
je 0x12821938
cmp ax, 0x45
jne 0x12821954
cmp word [rbx + 0xc], 0x7b
lea rax, [rbx + 0xc]
jne 0x12821954
cmp word [rax + 0x4a], 0x7d
mov rbx, rax
jne 0x12821954
add rbx, 0x4c
or esi, 0x10
lea rdx, [0x129c6388]
mov rcx, rbx
call fcn.1295bbd0
or esi, 8
mov dword [rsp + 0x20], 1
lea rdi, [rbx + rax*2]
mov dword [rsp + 0x24], esi
jmp 0x12821a03
movzx eax, word [rbx + 2]
cmp ax, 0x44
je 0x1282198b
cmp ax, 0x64
jne 0x12821a03
movzx eax, word [rbx + 4]
cmp ax, 0x6f
je 0x1282199b
cmp ax, 0x4f
jne 0x12821a03
lea rcx, [rbx + 6]
lea rdx, [0x129c5636]
mov r8d, 9
call fcn.1295a8a4
test eax, eax
jne 0x12821a03
cmp word [rbx + 0x18], si
lea rdi, [rbx + 0x18]
je 0x128219d4
cmp word [rdi + 2], 0x3a
jne 0x128219d4
add rdi, 4
mov dword [rsp + 0x20], 4
jmp 0x12821a03
xor edi, edi
jmp 0x12821a03
cmp ax, 0x41
jb 0x128219e4
cmp ax, 0x5a
jbe 0x128219f0
cmp ax, 0x61
jb 0x12821a03
cmp ax, 0x7a
ja 0x12821a03
cmp word [rcx + 2], 0x3a
jne 0x12821a03
lea rdi, [rcx + 4]
mov dword [rsp + 0x20], 1
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
test r12, r12
je 0x12821a5b
test rdi, rdi
je 0x12821a40
cmp rdi, r13
je 0x12821a40
movzx eax, word [rdi]
test ax, ax
jne 0x12821a2c
or esi, 0xc0
jmp 0x12821a3c
cmp ax, 0x5c
jne 0x12821a40
cmp word [rdi + 2], 0
jne 0x12821a40
or esi, 0x40
mov dword [rsp + 0x24], esi
lea rax, [rsp + 0x20]
mov ecx, dword [rax]
mov dword [r12], ecx
mov ecx, dword [rax + 4]
mov dword [r12 + 4], ecx
mov ecx, dword [rax + 8]
mov dword [r12 + 8], ecx
mov rax, rdi
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret