Function at 0x2a3ed0a70
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
cmp qword [rsp + 0xd0], 0
mov rdi, rcx
mov r15d, edx
mov rsi, r8
mov rbx, r9
je 0x2a3ed0aa5
mov rax, qword [rsp + 0xd0]
mov dword [rax], 0
test rsi, rsi
je 0x2a3ed0ce0
test rbx, rbx
je 0x2a3ed0ce0
mov rax, qword [rdi + 0x68]
mov dword [rbx], r15d
lea rcx, [rsp + 0x30]
mov ebp, r15d
mov rax, qword [rax + 0x20]
mov eax, dword [rax + rbp*4]
mov dword [rsp + 0x50], 0xffffffff
mov qword [rsp + 0x48], 0
mov qword [rbx + 8], rax
movzx eax, word [rsi + 4]
mov word [rbx + 0x10], ax
movzx eax, word [rsi + 6]
mov word [rbx + 0x12], ax
movzx eax, word [rsi + 8]
mov word [rbx + 0x14], ax
movzx eax, word [rsi + 0xa]
mov word [rbx + 0x16], ax
movzx eax, word [rsi + 0xe]
movzx r8d, word [rsi + 0xc]
mov edx, eax
mov r10d, eax
sar eax, 5
and eax, 0xf
sar r10d, 9
sub eax, 1
add r10d, 0x50
mov dword [rsp + 0x40], eax
lea eax, [r8 + r8]
and eax, 0x3e
mov dword [rsp + 0x44], r10d
movd xmm0, eax
mov eax, r8d
sar r8d, 0xb
sar eax, 5
movd xmm1, r8d
and eax, 0x3f
mov r10d, eax
mov eax, edx
and eax, 0x1f
movd xmm3, r10d
movd xmm2, eax
punpckldq xmm0, xmm3
punpckldq xmm1, xmm2
punpcklqdq xmm0, xmm1
movaps xmmword [rsp + 0x30], xmm0
call qword [sym.imp.msvcrt.dll__mktime64]
lea rcx, [rbx + 0x58]
mov qword [rbx + 0x18], rax
mov eax, dword [rsi + 0x10]
lea rdx, [rsi + 0x2e]
mov dword [rbx + 0x20], eax
movzx eax, word [rsi + 0x24]
mov r13d, dword [rsi + 0x14]
mov r12d, dword [rsi + 0x18]
mov word [rbx + 0x38], ax
mov eax, dword [rsi + 0x26]
movzx r8d, word [rsi + 0x1c]
movq xmm0, r13
movq xmm4, r12
punpcklqdq xmm0, xmm4
movups xmmword [rbx + 0x28], xmm0
mov dword [rbx + 0x3c], eax
mov r14d, dword [rsi + 0x2a]
mov eax, 0x1ff
cmp r8d, eax
cmova r8, rax
mov qword [rbx + 0x40], r14
mov qword [rsp + 0x28], r8
call sub.msvcrt.dll_memcpy
mov r8, qword [rsp + 0x28]
mov eax, 0x1ff
lea rcx, [rbx + 0x258]
mov byte [rbx + r8 + 0x58], 0
movzx r8d, word [rsi + 0x20]
movzx edx, word [rsi + 0x1c]
cmp r8d, eax
cmova r8, rax
movzx eax, word [rsi + 0x1e]
mov dword [rbx + 0x48], r8d
mov qword [rsp + 0x28], r8
lea rdx, [rdx + rax + 0x2e]
add rdx, rsi
call sub.msvcrt.dll_memcpy
mov r8, qword [rsp + 0x28]
mov byte [rbx + r8 + 0x258], 0
mov rax, qword [rdi + 0x68]
test rax, rax
je 0x2a3ed0d20
cmp r15d, dword [rdi + 0x10]
jae 0x2a3ed0d20
mov r8, qword [rax + 0x20]
mov rax, qword [rax]
mov edx, dword [r8 + rbp*4]
add rdx, rax
je 0x2a3ed0da0
movzx ecx, word [rdx + 0x1c]
test cx, cx
jne 0x2a3ed0cf0
mov ecx, dword [rdx + 0x26]
shr ecx, 4
and ecx, 1
mov dword [rbx + 0x4c], ecx
mov edx, dword [r8 + rbp*4]
add rdx, rax
je 0x2a3ed0db0
test byte [rdx + 8], 0x41
setne dl
movzx edx, dl
mov dword [rbx + 0x50], edx
mov edx, dword [r8 + rbp*4]
add rax, rdx
je 0x2a3ed0d28
test word [rax + 0xa], 0xfff7
movzx edx, word [rax + 8]
jne 0x2a3ed0d10
test dl, 0x41
jne 0x2a3ed0d90
and edx, 0x20
jne 0x2a3ed0dc0
mov eax, 1
cmp r13, r12
mov dword [rbx + 0x54], eax
mov rax, r12
mov edx, 0xffffffff
cmovae rax, r13
cmp rax, r14
cmovb rax, r14
cmp rax, rdx
je 0x2a3ed0d30
mov eax, 1
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rdi, rdi
je 0x2a3ed0cec
mov dword [rdi + 0x1c], 0x18
xor eax, eax
jmp 0x2a3ed0ccc
movzx r10d, cx
mov ecx, 1
cmp byte [rdx + r10 + 0x2d], 0x2f
jne 0x2a3ed0c53
jmp 0x2a3ed0c5c
mov eax, 4
mov dword [rdi + 0x1c], eax
xor eax, eax
jmp 0x2a3ed0ca9
mov qword [rbx + 0x4c], 0
mov eax, 0x18
jmp 0x2a3ed0d15
movzx edx, word [rsi + 0x1e]
test edx, edx
je 0x2a3ed0cc7
movzx eax, word [rsi + 0x1c]
lea rcx, [rsi + rax + 0x2e]
jmp 0x2a3ed0d76
movzx r8d, word [rcx + 2]
mov r9d, edx
movzx r10d, word [rcx]
mov rax, r8
add rax, 4
cmp r9, rax
jb 0x2a3ed0d7b
cmp r10w, 1
je 0x2a3ed0dd0
sub edx, 4
add rcx, rax
sub edx, r8d
je 0x2a3ed0cc7
cmp edx, 3
ja 0x2a3ed0d48
mov dword [rdi + 0x1c], 9
xor eax, eax
jmp 0x2a3ed0ccc
mov eax, 5
jmp 0x2a3ed0d15
mov dword [rdi + 0x1c], 0x18
xor ecx, ecx
jmp 0x2a3ed0c5c
mov dword [rdi + 0x1c], 0x18
xor edx, edx
jmp 0x2a3ed0c76
mov eax, 6
jmp 0x2a3ed0d15
cmp qword [rsp + 0xd0], 0
je 0x2a3ed0de9
mov rax, qword [rsp + 0xd0]
mov dword [rax], 1
mov eax, 0xffffffff
cmp r12, rax
je 0x2a3ed0e25
add rcx, 4
mov eax, 0xffffffff
cmp r13, rax
je 0x2a3ed0e41
mov eax, 0xffffffff
cmp r14, rax
jne 0x2a3ed0cc7
cmp r8d, 7
jbe 0x2a3ed0d7b
mov rax, qword [rcx]
mov qword [rbx + 0x40], rax
jmp 0x2a3ed0cc7
cmp r8d, 7
jbe 0x2a3ed0d7b
mov rax, qword [rcx + 4]
sub r8d, 8
add rcx, 0xc
mov qword [rbx + 0x30], rax
jmp 0x2a3ed0df7
cmp r8d, 7
jbe 0x2a3ed0d7b
mov rax, qword [rcx]
sub r8d, 8
add rcx, 8
mov qword [rbx + 0x28], rax
jmp 0x2a3ed0e01