Function at 0x14009a270
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xc0]
test r8d, r8d
mov rdi, rcx
mov qword [rsp + 0x30], rax
mov ecx, 0x10
mov r12d, 0x20
cmovne r12d, ecx
mov r13d, r9d
inc dword [rax]
mov ebp, r8d
cmp dword [rax], 0x3e8
mov r14, rdx
jle 0x14009a2c9
lea eax, [rcx - 0xc]
jmp 0x14009ace0
movzx eax, byte [rdx]
mov qword [rsp + 0x68], rbx
lea rbx, [rdx + 3]
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], r15
mov r15d, 1
cmp al, 0x89
je 0x14009a2f5
cmp al, 0x8e
je 0x14009a2f5
cmp al, 0x8a
je 0x14009a2f5
cmp al, 0x8f
jne 0x14009a2f9
add rbx, 2
movzx r9d, byte [reloc.OLEAUT32.dll_SysStringLen]
movzx r11d, byte [0x1400ae2db]
mov r10, 0xffffffffffffffff
lea r8, [0x140000000]
mov edx, 4
nop dword [rax]
movzx eax, byte [rbx]
xor esi, esi
cmp eax, 0xaa
ja case.0x14009a344.33
movzx eax, byte [r8 + rax + 0x9ad8c]
mov ecx, dword [r8 + rax*4 + 0x9acfc]
add rcx, r8
jmp rcx
movzx eax, r11b
add rbx, rax
jmp 0x14009a320
inc rbx
jmp 0x14009a320
movzx edx, byte [rbx + 1]
movzx eax, byte [rbx + 2]
shl rdx, 8
or rdx, rax
add rdx, rbx
cmp byte [rdx], 0x78
jne 0x14009a387
nop dword [rax + rax]
movzx ecx, byte [rdx + 1]
movzx eax, byte [rdx + 2]
shl rcx, 8
or rcx, rax
add rdx, rcx
cmp byte [rdx], 0x78
je 0x14009a370
lea rsi, [0x140000000]
add rdx, 3
movzx eax, byte [rdx]
add eax, 0xfffffffc
cmp eax, 0xa6
ja case.0x14009a3b3.8
cdqe
movzx eax, byte [rsi + rax + 0x9ae4c]
mov ecx, dword [rsi + rax*4 + 0x9ae38]
add rcx, rsi
jmp rcx
movzx ecx, byte [rdx + 1]
movzx eax, byte [rdx + 2]
shl rcx, 8
or rcx, rax
add rdx, rcx
cmp byte [rdx], 0x78
jne 0x14009a38e
nop dword [rax]
movzx ecx, byte [rdx + 1]
movzx eax, byte [rdx + 2]
shl rcx, 8
or rcx, rax
add rdx, rcx
cmp byte [rdx], 0x78
je 0x14009a3d0
jmp 0x14009a38e
inc rdx
jmp 0x14009a392
movzx eax, r9b
add rdx, rax
jmp 0x14009a392
movzx ecx, byte [rdx + 5]
movzx eax, byte [rdx + 6]
shl rcx, 8
or rcx, rax
add rdx, rcx
jmp 0x14009a392
movzx eax, byte [rdx]
add eax, 0xfffffffa
cmp eax, 0x32
ja case.0x14009a42a.8
cdqe
movzx eax, byte [rsi + rax + 0x9af00]
mov ecx, dword [rsi + rax*4 + 0x9aef4]
add rcx, rsi
jmp rcx
cmp byte [rdx + 1], 0xa
jne case.0x14009a42a.8
mov rbx, rdx
jmp 0x14009a309
mov rax, qword [rsp + 0x30]
mov r9d, r13d
mov r8d, ebp
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call fcn.14009a270
cmp eax, 1
je 0x14009ac72
cmp eax, 2
jne 0x14009acd1
nop word [rax + rax]
movzx ecx, byte [rbx + 1]
movzx eax, byte [rbx + 2]
shl rcx, 8
or rcx, rax
add rbx, rcx
cmp byte [rbx], 0x78
je 0x14009a470
add rbx, 3
jmp 0x14009a2f9
movzx eax, r9b
add rbx, rax
jmp 0x14009a320
movzx ecx, byte [rbx + 5]
movzx eax, byte [rbx + 6]
shl rcx, 8
or rcx, rax
add rbx, rcx
jmp 0x14009a320
movzx ecx, byte [rbx + 1]
movzx eax, byte [rbx + 2]
shl rcx, 8
or rcx, rax
add rbx, rcx
cmp byte [rbx], 0x78
je case.0x14009a344.29
add rbx, 3
jmp 0x14009a320
mov rax, qword [rsp + 0x30]
inc rbx
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8d, ebp
mov rcx, rdi
call fcn.14009a270
mov ecx, eax
test eax, eax
je 0x14009acb8
add eax, 0xfffffffd
cmp eax, 1
jbe 0x14009acb8
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rbx + 1]
movzx eax, byte [rbx + 2]
shl rcx, 8
or rcx, rax
add rbx, rcx
cmp byte [rbx], 0x78
je 0x14009a520
add rbx, 3
jmp 0x14009a2f9
inc rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbx + 1]
movzx eax, byte [rbx + 2]
shl rcx, 8
or rcx, rax
add rbx, rcx
cmp byte [rbx], 0x78
je 0x14009a550
add rbx, 3
jmp 0x14009a320
lea rdx, [rbx + 1]
xor r8d, r8d
mov r9d, ebp
mov dword [rsp + 0x20], r13d
mov rcx, rdi
call fcn.14009afb0
mov rbx, rax
jmp 0x14009a2f9
lea rdx, [rbx + 1]
mov dword [rsp + 0x20], r13d
mov r9d, ebp
mov r8d, 1
mov rcx, rdi
call fcn.14009afb0
mov rbx, rax
jmp 0x14009a2f9
lea rdx, [rbx + 3]
jmp 0x14009a574
lea rdx, [rbx + 3]
mov r8d, 1
jmp 0x14009a577
add rbx, 2
movzx eax, byte [rbx + 1]
add eax, 0xfffffffa
cmp eax, 0xf
ja case.0x14009a5e4.12
cdqe
mov ecx, dword [r8 + rax*4 + 0x9af34]
add rcx, r8
jmp rcx
or byte [rdi + 0x29], 2
or byte [rdi + 0x2c], 1
test ebp, ebp
je 0x14009a5ff
or byte [rdi + 0x40], 4
or byte [rdi + 0x44], 0xe
jmp 0x14009a704
or byte [rdi + 0x3c], 1
jmp 0x14009a704
or byte [rdi + 0x29], 0x3c
test ebp, ebp
je 0x14009a61d
or byte [rdi + 0x40], 4
or byte [rdi + 0x44], 4
jmp 0x14009a704
or byte [rdi + 0x38], 0x20
jmp 0x14009a704
lea rdx, [rdi + 0x28]
mov r9d, r12d
mov r8d, 0x240
mov rax, qword [rdi + 0x18]
lea r8, [r8 + 1]
lea rdx, [rdx + 1]
movzx ecx, byte [rax + r8 - 1]
not cl
or byte [rdx - 1], cl
sub r9, 1
jne 0x14009a633
lea r8, [0x140000000]
mov edx, 4
test ebp, ebp
je 0x14009a704
mov qword [rdi + 0x40], 0xffffffffffffffff
jmp 0x14009a704
mov edx, 0x40
jmp 0x14009a6e7
lea rdx, [rdi + 0x28]
mov r9d, r12d
mov r8d, 0x200
nop word [rax + rax]
mov rax, qword [rdi + 0x18]
lea r8, [r8 + 1]
lea rdx, [rdx + 1]
movzx ecx, byte [rax + r8 - 1]
not cl
or byte [rdx - 1], cl
sub r9, 1
jne 0x14009a690
jmp 0x14009a650
xor edx, edx
jmp 0x14009a6e7
lea rdx, [rdi + 0x28]
mov r9d, r12d
mov r8d, 0x2a0
mov rax, qword [rdi + 0x18]
lea r8, [r8 + 1]
lea rdx, [rdx + 1]
movzx ecx, byte [rax + r8 - 1]
not cl
or byte [rdx - 1], cl
sub r9, 1
jne 0x14009a6c0
jmp 0x14009a650
mov edx, 0xa0
mov r8d, r12d
mov rcx, rdi
call fcn.14009b210
mov r10, 0xffffffffffffffff
lea r8, [0x140000000]
lea edx, [r10 + 5]
movzx r9d, byte [reloc.OLEAUT32.dll_SysStringLen]
add rbx, 2
movzx r11d, byte [0x1400ae2db]
jmp 0x14009a320
movzx ecx, byte [rbx + 3]
test cl, 4
jne case.0x14009a5e4.12
movzx eax, cl
and al, 3
cmp al, 1
je case.0x14009a5e4.12
test cl, 2
je 0x14009a740
lea rsi, [rbx + 4]
test ebp, ebp
je case.0x14009a344.21
test cl, 1
jne case.0x14009a344.22
movzx ecx, byte [rbx + 2]
test rsi, rsi
mov eax, 0x24
cmove rax, rdx
movzx edx, byte [rbx + 1]
shl rdx, 8
add rax, rbx
or rdx, rcx
add rbx, rdx
movzx edx, byte [rax]
test edx, edx
je 0x14009a86d
sub edx, 1
je 0x14009a82c
cmp edx, 1
jne case.0x14009a344.33
movzx r9d, byte [rax + 1]
add rax, 2
movzx r10d, byte [rax]
movzx ecx, r10b
and cl, 0xc0
cmp cl, 0x80
jne 0x14009a7c4
nop dword [rax + rax]
movzx r10d, byte [rax + 1]
inc rax
movzx ecx, r10b
and cl, 0xc0
cmp cl, 0x80
je 0x14009a7b0
movzx ecx, byte [rax + 1]
inc rax
and cl, 0xc0
cmp cl, 0x80
jne 0x14009a7ef
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax + 1]
inc rax
and cl, 0xc0
cmp cl, 0x80
je 0x14009a7e0
cmp r9b, r10b
ja 0x14009a772
nop dword [rax + rax]
movzx r8d, r9b
mov ecx, r9d
shr r8, 3
and ecx, 7
add r8, 0x28
inc r9b
add r8, rdi
movzx edx, byte [r8]
bts edx, ecx
mov byte [r8], dl
cmp r9b, r10b
jbe 0x14009a800
jmp 0x14009a772
movzx r8d, byte [rax + 1]
add rax, 2
movzx ecx, byte [rax]
and cl, 0xc0
cmp cl, 0x80
jne 0x14009a84f
movzx ecx, byte [rax + 1]
inc rax
and cl, 0xc0
cmp cl, 0x80
je 0x14009a840
movzx edx, r8b
and r8d, 7
shr rdx, 3
movzx ecx, byte [rdx + rdi + 0x28]
bts ecx, r8d
mov byte [rdx + rdi + 0x28], cl
jmp 0x14009a772
movzx r9d, byte [reloc.OLEAUT32.dll_SysStringLen]
lea r8, [0x140000000]
movzx r11d, byte [0x1400ae2db]
mov r10, 0xffffffffffffffff
jmp 0x14009a8d3
test ebp, ebp
je case.0x14009a344.21
or byte [rdi + 0x40], 0xf0
mov dword [rdi + 0x41], r10d
mov word [rdi + 0x45], r10w
mov byte [rdi + 0x47], r10b
movzx r9d, byte [reloc.OLEAUT32.dll_SysStringLen]
movzx r11d, byte [0x1400ae2db]
cmp byte [rbx], 0x70
jne 0x14009a8cb
movzx ecx, byte [rbx + 1]
movzx eax, byte [rbx + 2]
shl rcx, 8
or rcx, rax
add rbx, rcx
jmp 0x14009a8d3
lea rsi, [rbx + 1]
add rbx, 0x21
test rsi, rsi
je 0x14009aa50
movzx eax, byte [rsi]
or byte [rdi + 0x28], al
movzx eax, byte [rsi + 1]
or byte [rdi + 0x29], al
movzx eax, byte [rsi + 2]
or byte [rdi + 0x2a], al
movzx eax, byte [rsi + 3]
or byte [rdi + 0x2b], al
movzx eax, byte [rsi + 4]
or byte [rdi + 0x2c], al
movzx eax, byte [rsi + 5]
or byte [rdi + 0x2d], al
movzx eax, byte [rsi + 6]
or byte [rdi + 0x2e], al
movzx eax, byte [rsi + 7]
or byte [rdi + 0x2f], al
movzx eax, byte [rsi + 8]
or byte [rdi + 0x30], al
movzx eax, byte [rsi + 9]
or byte [rdi + 0x31], al
movzx eax, byte [rsi + 0xa]
or byte [rdi + 0x32], al
movzx eax, byte [rsi + 0xb]
or byte [rdi + 0x33], al
movzx eax, byte [rsi + 0xc]
or byte [rdi + 0x34], al
movzx eax, byte [rsi + 0xd]
or byte [rdi + 0x35], al
movzx eax, byte [rsi + 0xe]
or byte [rdi + 0x36], al
movzx eax, byte [rsi + 0xf]
or byte [rdi + 0x37], al
test ebp, ebp
je 0x14009a9d0
mov r8d, 0x80
nop dword [rax]
mov eax, r8d
mov ecx, r8d
and ecx, 7
shr rax, 3
mov edx, 1
shl edx, cl
test byte [rax + rsi], dl
je 0x14009a9ae
mov edx, r8d
or edx, 0x3000
shr edx, 6
mov eax, edx
test edx, edx
jns 0x14009a98e
lea eax, [rdx + 7]
sar eax, 3
and edx, 7
movsxd rcx, eax
and r8d, 0xc0
movzx eax, byte [rcx + rdi + 0x28]
bts eax, edx
mov byte [rcx + rdi + 0x28], al
add r8d, 0x3f
inc r8d
cmp r8d, 0x100
jb 0x14009a960
lea r8, [0x140000000]
jmp 0x14009aa40
movzx eax, byte [rsi + 0x10]
or byte [rdi + 0x38], al
movzx eax, byte [rsi + 0x11]
or byte [rdi + 0x39], al
movzx eax, byte [rsi + 0x12]
or byte [rdi + 0x3a], al
movzx eax, byte [rsi + 0x13]
or byte [rdi + 0x3b], al
movzx eax, byte [rsi + 0x14]
or byte [rdi + 0x3c], al
movzx eax, byte [rsi + 0x15]
or byte [rdi + 0x3d], al
movzx eax, byte [rsi + 0x16]
or byte [rdi + 0x3e], al
movzx eax, byte [rsi + 0x17]
or byte [rdi + 0x3f], al
movzx eax, byte [rsi + 0x18]
or byte [rdi + 0x40], al
movzx eax, byte [rsi + 0x19]
or byte [rdi + 0x41], al
movzx eax, byte [rsi + 0x1a]
or byte [rdi + 0x42], al
movzx eax, byte [rsi + 0x1b]
or byte [rdi + 0x43], al
movzx eax, byte [rsi + 0x1c]
or byte [rdi + 0x44], al
movzx eax, byte [rsi + 0x1d]
or byte [rdi + 0x45], al
movzx eax, byte [rsi + 0x1e]
or byte [rdi + 0x46], al
movzx eax, byte [rsi + 0x1f]
or byte [rdi + 0x47], al
movzx r11d, byte [0x1400ae2db]
movzx r9d, byte [reloc.OLEAUT32.dll_SysStringLen]
movzx eax, byte [rbx]
add eax, 0xffffff9e
cmp eax, 0xb
ja case.0x14009aa6c.100
cdqe
mov ecx, dword [r8 + rax*4 + 0x9af74]
add rcx, r8
jmp rcx
inc rbx
jmp 0x14009a317
movzx ecx, byte [rbx + 1]
mov edx, 4
movzx eax, byte [rbx + 2]
shl ecx, 8
or ecx, eax
jne 0x14009ac87
add rbx, 5
jmp 0x14009a320
cmp byte [rbx + 1], 0xa
jne case.0x14009a5e4.12
movzx eax, byte [rbx + 2]
lea rbx, [rax*4 + 0xb0910]
add rbx, r8
mov r8d, dword [rbx]
cmp r8d, 0xffffffff
jae 0x14009ac87
nop dword [rax]
lea rbx, [rbx + 4]
test ebp, ebp
je 0x14009aadb
lea rdx, [rsp + 0x38]
mov ecx, r8d
call fcn.1400991b0
movzx r8d, byte [rsp + 0x38]
cmp r8d, 0xff
jbe 0x14009aaea
or byte [rdi + 0x47], 0x80
jmp 0x14009ab02
mov ecx, r8d
and r8d, 7
shr rcx, 3
movzx eax, byte [rcx + rdi + 0x28]
bts eax, r8d
mov byte [rcx + rdi + 0x28], al
mov r8d, dword [rbx]
cmp r8d, 0xffffffff
jb 0x14009aac0
jmp 0x14009ac72
mov r15d, 2
jmp 0x14009ac87
add rbx, 2
xor r8d, r8d
mov r9d, ebp
mov dword [rsp + 0x20], r13d
lea rdx, [rbx + 1]
mov rcx, rdi
call fcn.14009afb0
jmp 0x14009ac72
add rbx, 2
mov r8d, 1
jmp 0x14009ab22
or byte [rdi + 0x29], 2
or byte [rdi + 0x2c], 1
test ebp, ebp
je 0x14009ab70
or byte [rdi + 0x40], 4
or byte [rdi + 0x44], 0xe
movzx r9d, byte [reloc.OLEAUT32.dll_SysStringLen]
movzx r11d, byte [0x1400ae2db]
jmp 0x14009ac87
or byte [rdi + 0x3c], 1
movzx r9d, byte [reloc.OLEAUT32.dll_SysStringLen]
movzx r11d, byte [0x1400ae2db]
jmp 0x14009ac87
or byte [rdi + 0x29], 0x3c
test ebp, ebp
je 0x14009abae
or byte [rdi + 0x40], 4
or byte [rdi + 0x44], 4
movzx r9d, byte [reloc.OLEAUT32.dll_SysStringLen]
movzx r11d, byte [0x1400ae2db]
jmp 0x14009ac87
or byte [rdi + 0x38], 0x20
movzx r9d, byte [reloc.OLEAUT32.dll_SysStringLen]
movzx r11d, byte [0x1400ae2db]
jmp 0x14009ac87
lea rdx, [rdi + 0x28]
mov r9d, r12d
mov r8d, 0x240
mov rax, qword [rdi + 0x18]
lea r8, [r8 + 1]
lea rdx, [rdx + 1]
movzx ecx, byte [r8 + rax - 1]
not cl
or byte [rdx - 1], cl
sub r9, 1
jne 0x14009abd4
test ebp, ebp
je 0x14009ac72
mov qword [rdi + 0x40], 0xffffffffffffffff
jmp 0x14009ac72
mov edx, 0x40
jmp 0x14009ac67
lea rdx, [rdi + 0x28]
mov r9d, r12d
mov r8d, 0x200
mov rax, qword [rdi + 0x18]
lea r8, [r8 + 1]
lea rdx, [rdx + 1]
movzx ecx, byte [rax + r8 - 1]
not cl
or byte [rdx - 1], cl
sub r9, 1
jne 0x14009ac13
jmp 0x14009abf1
xor edx, edx
jmp 0x14009ac67
lea rdx, [rdi + 0x28]
mov r9d, r12d
mov r8d, 0x2a0
mov rax, qword [rdi + 0x18]
lea r8, [r8 + 1]
lea rdx, [rdx + 1]
movzx ecx, byte [rax + r8 - 1]
not cl
or byte [rdx - 1], cl
sub r9, 1
jne 0x14009ac43
jmp 0x14009abf1
mov edx, 0xa0
mov r8d, r12d
mov rcx, rdi
call fcn.14009b210
movzx r9d, byte [reloc.OLEAUT32.dll_SysStringLen]
movzx r11d, byte [0x1400ae2db]
mov edx, 4
movzx ecx, byte [r14 + 1]
movzx eax, byte [r14 + 2]
shl rcx, 8
or rcx, rax
add r14, rcx
cmp byte [r14], 0x78
jne 0x14009acbc
lea rbx, [r14 + 3]
mov r10, 0xffffffffffffffff
lea r8, [0x140000000]
jmp 0x14009a320
mov eax, ecx
jmp 0x14009acd1
mov eax, r15d
jmp 0x14009acd1
mov eax, 2
jmp 0x14009acd1
xor eax, eax
jmp 0x14009acd1
mov eax, 3
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400783c0
add rsp, 0x70
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret