Function at 0x18005d748
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov ebp, r9d
mov rdi, r8
mov r12d, edx
mov ebx, ecx
cmp ecx, 6
jae 0x18005d77e
lea rdx, [0x1800d3d40]
mov rdx, qword [rdx + rbx*8]
jmp 0x18005d785
lea rdx, str.unknown
lea rcx, str._n___s_n
call fcn.180008f6c
xor esi, esi
test ebx, ebx
je 0x18005d924
dec ebx
je 0x18005d90a
dec ebx
je 0x18005d8b9
dec ebx
je 0x18005d86b
dec ebx
je 0x18005d7eb
dec ebx
je 0x18005d7da
lea r8d, [rsi + 1]
mov edx, ebp
mov rcx, rdi
call fcn.18000e574
lea rcx, [0x1800964e8]
call fcn.180008f6c
jmp 0x18005da0a
lea rcx, str.____Random_Value_:
call fcn.180008f6c
xor r8d, r8d
jmp 0x18005d7bf
mov r8d, dword [rdi + 0x10]
movzx edx, word [rdi + 0xc]
mov r9d, dword [rdi + 0x14]
lea rcx, str.____Default_Salt_:__.s_n____Default_Iterations_:__u_n
add r8, rdi
shr rdx, 1
call fcn.180008f6c
movzx r8d, word [rdi + 4]
lea rdx, [rdi + 0x18]
lea r9, str.Credentials
mov rcx, rdi
call fcn.18005dad8
movzx r8d, word [rdi + 6]
lea r9, str.ServiceCredentials
mov rdx, rax
mov rcx, rdi
call fcn.18005dad8
movzx r8d, word [rdi + 8]
lea r9, str.OldCredentials
mov rdx, rax
mov rcx, rdi
call fcn.18005dad8
movzx r8d, word [rdi + 0xa]
lea r9, str.OlderCredentials
mov rdx, rax
mov rcx, rdi
call fcn.18005dad8
jmp 0x18005da0a
mov r8d, dword [rdi + 0xc]
movzx edx, word [rdi + 8]
lea rcx, str.____Default_Salt_:__.s_n
add r8, rdi
shr rdx, 1
call fcn.180008f6c
movzx r8d, word [rdi + 4]
lea rdx, [rdi + 0x10]
lea r9, str.Credentials
mov rcx, rdi
call fcn.18005da28
movzx r8d, word [rdi + 6]
lea r9, str.OldCredentials
mov rdx, rax
mov rcx, rdi
call fcn.18005da28
jmp 0x18005da0a
cmp byte [rdi + 3], sil
jbe 0x18005da0a
mov ebp, reloc.WLDAP32.dll_Ordinal_16
lea ebx, [rsi + 1]
lea rcx, str._____02u
mov edx, ebx
call fcn.180008f6c
mov ecx, esi
xor r8d, r8d
inc rcx
mov edx, ebp
shl rcx, 4
add rcx, rdi
call fcn.18000e574
lea rcx, [0x1800964e8]
call fcn.180008f6c
movzx eax, byte [rdi + 3]
mov esi, ebx
cmp ebx, eax
jb 0x18005d8c8
jmp 0x18005da0a
mov rdx, rbp
lea rcx, str._____.s_n
mov r8, rdi
shr rdx, 1
call fcn.180008f6c
jmp 0x18005da0a
lea rcx, str.____NTLM_:
call fcn.180008f6c
mov ebp, reloc.WLDAP32.dll_Ordinal_16
cmp byte [rdi + 0x20], sil
je 0x18005d948
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call fcn.18000e574
lea rcx, str._n____LM___:
call fcn.180008f6c
cmp byte [rdi + 0x21], sil
je 0x18005d968
lea rcx, [rdi + 0x10]
xor r8d, r8d
mov edx, ebp
call fcn.18000e574
lea rcx, [0x1800964e8]
call fcn.180008f6c
cmp dword [rdi + 0x24], esi
je 0x18005da0a
cmp word [rdi + 0x44], si
je 0x18005d99c
lea rcx, [rdi + 0x4c]
lea r9, str.NTLM
mov r8d, r12d
mov edx, ebp
mov dword [rsp + 0x20], esi
call fcn.180069880
cmp word [rdi + 0x64], si
je 0x18005d9c1
movzx edx, word [rdi + 0x64]
lea rcx, [rdi + 0x6c]
lea r9, str.ntlm
mov r8d, r12d
mov dword [rsp + 0x20], 1
call fcn.180069880
cmp word [rdi + 0x2c], si
je 0x18005d9e0
lea rcx, [rdi + 0x34]
lea r9, str.LM
mov r8d, r12d
mov edx, ebp
mov dword [rsp + 0x20], esi
call fcn.180069880
cmp word [rdi + 0x5c], si
je 0x18005da0a
movzx eax, word [rdi + 0x64]
movzx edx, word [rdi + 0x5c]
lea r9, str.lm
lea rcx, [rax + rdi + 0x6c]
mov r8d, r12d
mov dword [rsp + 0x20], 1
call fcn.180069880
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret