Function at 0x1000d99dc
Capabilities:
Enumerate pe sections

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc8
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x148]
mov r12, qword [rsp + 0x138]
mov r14, qword [rsp + 0x140]
mov r15, rdx
mov qword [rsp + 0x80], rdx
xor edx, edx
mov r13, r8
mov qword [rsp + 0x88], r8
mov rsi, rcx
lea r8d, [rdx + 0x10]
lea rcx, [r11 - 0x60]
mov rdi, r9
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
call sub.msvcrt.dll_memset
xor ebp, ebp
mov qword [r13], rbp
mov dword [rdi], ebp
mov byte [r12], bpl
cmp rbx, rbp
je 0x1000d9a7b
mov byte [rbx], bpl
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x1000d9ac5
test byte [rcx + 0x1c], 4
je 0x1000d9ac5
cmp byte [rcx + 0x19], 5
jb 0x1000d9ac5
mov r9, qword [rsi + 0x38]
mov eax, dword [rsi + 0x38]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
sar r9, 0x20
mov edx, 0xa5
mov dword [rsp + 0x20], eax
call fcn.10001e8b4
mov rcx, qword [0x1001653b8]
cmp byte [rsi + 0x48], bpl
jne 0x1000d9d0a
mov rax, qword [rsi + 0x18]
lea rdi, [0x10000d5f8]
cmp qword [rsi + 0x38], rax
jl 0x1000d9af4
lea r8, [0x100004638]
mov edx, 0xd44
mov rcx, rdi
call fcn.100099ad8
mov r8, r14
mov rdx, r12
mov rcx, rsi
call fcn.1000d821c
cmp eax, ebp
jne 0x1000d9b0d
mov al, 1
jmp 0x1000da49c
cmp byte [r12], bpl
jne 0x1000da49a
mov rbx, qword [rsi + 0x38]
mov ebp, 0x10000
mov dword [r14 + 0x10], ebx
mov rax, rbx
mov qword [rsp + 0x88], rbx
shr rax, 0x20
mov r12d, ebp
mov dword [r14 + 0x14], eax
mov rax, qword [rsi + 0x18]
cmp qword [rsi + 0x38], rax
jl 0x1000d9b58
lea r8, [0x10000d7f8]
mov edx, 0xd57
mov rcx, rdi
call fcn.100099ad8
mov rax, qword [rsi + 0x38]
add rax, rbp
cmp rax, qword [rsi + 0x18]
jle 0x1000d9b79
lea r8, [0x100004638]
mov edx, 0xd5f
mov rcx, rdi
call fcn.100099ad8
mov rdi, qword [rsi + 0x18]
mov edx, ebp
mov rcx, rsi
mov qword [rsp + 0x80], rdi
call fcn.1000e0858
test al, al
je 0x1000d9bde
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000d9bd5
test byte [rcx + 0x1c], 4
je 0x1000d9bd5
cmp byte [rcx + 0x19], 5
jb 0x1000d9bd5
mov r9d, dword [rsi + 0xac]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xa6
call fcn.10001c7dc
mov rcx, qword [0x1001653b8]
mov r12d, dword [rsi + 0xac]
jmp 0x1000d9be5
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d9c64
test byte [rcx + 0x1c], 4
je 0x1000d9c32
cmp byte [rcx + 0x19], 5
jb 0x1000d9c32
mov eax, dword [rsp + 0x8c]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xa7
mov r9d, r12d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call fcn.1000c27bc
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d9c64
test byte [rcx + 0x1c], 4
je 0x1000d9c64
cmp byte [rcx + 0x19], 5
jb 0x1000d9c64
mov r9d, dword [rsp + 0x84]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xa8
mov dword [rsp + 0x20], edi
call fcn.10001e8b4
mov rcx, qword [rsi]
mov r9, r14
mov r8d, r12d
mov rdx, r15
call fcn.1000d33d4
mov r8, qword [rsp + 0xa0]
movabs rax, 0x7ff8007ff8007ff9
imul qword [rsi + 0x40]
sar rdx, 0x14
mov rcx, rsi
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x98]
mov dword [rax], edx
mov rdx, r13
call fcn.1000d8b88
mov r10, qword [rsp + 0x90]
mov dword [r10], r12d
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d9cfd
test byte [rcx + 0x1c], 4
je 0x1000d9cfd
cmp byte [rcx + 0x19], 5
jb 0x1000d9cfd
mov r9, qword [r13]
mov eax, dword [r13]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
sar r9, 0x20
mov edx, 0xa9
mov dword [rsp + 0x20], eax
call fcn.10001e8b4
add qword [rsi + 0x40], rbp
add qword [rsi + 0x38], rbp
jmp 0x1000d9b06
cmp rcx, rdi
je 0x1000d9d34
test byte [rcx + 0x1c], 4
je 0x1000d9d34
cmp byte [rcx + 0x19], 5
jb 0x1000d9d34
mov r9d, dword [rsi + 0x68]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xaa
call fcn.10001c7dc
mov rcx, rsi
call fcn.1000de814
mov ebp, 0x10000
movabs r15, 0x7ff8007ff8007ff9
mov eax, dword [rsi + 0x68]
mov ebx, ebp
mov r13, rax
sub ebx, eax
add r13, qword [rsi + 0x60]
cmp ebx, 0x20
jb 0x1000d9d70
mov ecx, dword [r13 + 0x10]
cmp ebx, ecx
jb 0x1000d9d70
add eax, ecx
mov dword [rsi + 0x68], eax
jmp 0x1000d9e2d
test ebx, ebx
je 0x1000d9d83
mov rcx, qword [rsi + 0x50]
mov r8d, ebx
mov rdx, r13
call sub.msvcrt.dll_memcpy
cmp byte [rsi + 0xf8], 0
mov r13, qword [rsi + 0x50]
mov rcx, rsi
je 0x1000da453
call fcn.1000de900
test al, al
je 0x1000da3fb
cmp ebx, 0x20
jae 0x1000d9dc1
mov rdx, qword [rsi + 0x60]
mov r8d, 0x20
mov ecx, ebx
add rcx, qword [rsi + 0x50]
sub r8d, ebx
call sub.msvcrt.dll_memcpy
mov edi, dword [r13 + 0x10]
cmp edi, 0x10020
ja 0x1000da3ab
cmp edi, ebx
jb 0x1000da35a
mov rdx, qword [rsi + 0x60]
mov ecx, ebx
sub edi, ebx
add rcx, qword [rsi + 0x50]
cmp edi, ebp
jb 0x1000d9e22
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rsi + 0xf8], 0
je 0x1000da307
mov rcx, rsi
call fcn.1000de900
test al, al
je 0x1000da2d2
mov rdx, qword [rsi + 0x60]
lea ecx, [rbx + 0x10000]
add edi, 0xffff0000
add rcx, qword [rsi + 0x50]
mov r8d, edi
call sub.msvcrt.dll_memcpy
add dword [rsi + 0x68], edi
mov ebx, 0x10
lea rdx, [0x10000d0e0]
mov rcx, r13
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1000da1b6
cmp dword [r13 + 0x10], 0x20
jb 0x1000da16d
test byte [r13 + 0x10], 0xf
jne 0x1000da16d
mov edx, dword [r13 + 0x14]
mov ecx, dword [r13 + 0x18]
cmp edx, ecx
ja 0x1000da138
cmp dword [r13 + 0x1c], 0
jne 0x1000da138
lea eax, [rdx + 0x20]
cmp eax, dword [r13 + 0x10]
ja 0x1000da138
test ecx, 0x1ff
jne 0x1000da138
test ecx, ecx
je 0x1000da138
test edx, edx
jne 0x1000d9ec2
test cx, cx
jne 0x1000d9f54
cmp ecx, 0x200000
jae 0x1000d9f54
add qword [rsi + 0x40], rcx
jmp 0x1000d9d4b
mov r8, qword [rsi + 0x40]
mov rax, r15
imul r8
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x200200
sub rax, rdx
jne 0x1000d9fcb
cmp ecx, 0x200
jne 0x1000d9f99
mov rcx, qword [rsi + 0x138]
lea rax, [r8 + 0x200]
mov r8, qword [rsi + 0xd0]
mov rdx, r13
mov qword [rsi + 0x40], rax
call fcn.1000ceb78
test al, al
jne 0x1000d9d4b
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da3f2
test byte [rcx + 0x1c], 4
je 0x1000da3f2
cmp byte [rcx + 0x19], 2
jb 0x1000da3f2
mov edx, 0xb7
jmp 0x1000d9f84
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da3f2
test byte [rcx + 0x1c], 4
je 0x1000da3f2
cmp byte [rcx + 0x19], 2
jb 0x1000da3f2
mov edx, 0xb5
mov eax, dword [r13 + 0x1c]
mov r9d, dword [r13 + 0x14]
mov dword [rsp + 0x30], eax
mov eax, dword [r13 + 0x10]
jmp 0x1000da38d
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da3f2
test byte [rcx + 0x1c], 4
je 0x1000da3f2
cmp byte [rcx + 0x19], 2
jb 0x1000da3f2
mov edx, 0xb6
jmp 0x1000d9f84
mov r8d, ecx
cmp ecx, ebp
je 0x1000da045
mov al, byte [rsi + 0xf8]
test al, al
jne 0x1000d9fe0
cmp ecx, ebp
jbe 0x1000da045
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000da3f2
test byte [rcx + 0x1c], 4
je 0x1000da3f2
cmp byte [rcx + 0x19], 2
jb 0x1000da3f2
mov r9d, dword [r13 + 0x14]
mov rcx, qword [rcx + 0x10]
movzx eax, al
mov dword [rsp + 0x38], eax
mov eax, dword [r13 + 0x1c]
mov edx, 0xb8
mov dword [rsp + 0x30], eax
mov eax, dword [r13 + 0x10]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
lea r8, [0x100003188]
call fcn.1000d3c1c
jmp 0x1000da3f2
mov r8, qword [rsp + 0x80]
mov rax, r15
imul qword [rsi + 0x40]
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x98]
mov dword [rax], edx
mov rcx, qword [rsi + 0x138]
mov rdx, r13
call fcn.1000ceb78
test al, al
jne 0x1000da0b4
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da3f2
test byte [rcx + 0x1c], 4
je 0x1000da3f2
cmp byte [rcx + 0x19], 2
jb 0x1000da3f2
mov edx, 0xb9
jmp 0x1000d9f84
and qword [r14], 0
mov eax, dword [r13 + 0x18]
mov rcx, qword [r14 + 0x18]
mov qword [r14 + 8], rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rsp + 0x88]
mov r8, qword [rsp + 0xa0]
mov rdx, rbx
mov rcx, rsi
call fcn.1000d8b88
mov r10, qword [rsp + 0x90]
mov r11d, dword [r13 + 0x18]
mov dword [r10], r11d
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da12b
test byte [rcx + 0x1c], 4
je 0x1000da12b
cmp byte [rcx + 0x19], 5
jb 0x1000da12b
mov r9, qword [rbx]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xba
call fcn.10001d680
mov eax, dword [r13 + 0x18]
add qword [rsi + 0x40], rax
jmp 0x1000d9b06
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da3f2
test byte [rcx + 0x1c], 4
je 0x1000da3f2
cmp byte [rcx + 0x19], 2
jb 0x1000da3f2
mov edx, 0xb4
jmp 0x1000d9f84
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da3f2
test byte [rcx + 0x1c], 4
je 0x1000da3f2
cmp byte [rcx + 0x19], 2
jb 0x1000da3f2
mov r9d, dword [r13 + 0x10]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov edx, 0xb3
call fcn.10001c7dc
jmp 0x1000da3f2
lea rdx, [rsp + 0xa8]
mov r8, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1000da21d
cmp byte [rsi + 0xf8], 0
jne 0x1000da21d
mov rcx, rsi
call fcn.1000e0ae4
mov byte [r12], al
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000da49a
test byte [rcx + 0x1c], 4
je 0x1000da49a
cmp byte [rcx + 0x19], 4
jb 0x1000da49a
mov r9d, dword [rsi + 0x68]
mov edx, 0xb2
jmp 0x1000da483
mov r15, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp r15, rax
je 0x1000da3f2
test byte [r15 + 0x1c], 4
je 0x1000da3f2
cmp byte [r15 + 0x19], 2
jb 0x1000da3f2
movzx eax, byte [rsi + 0xf8]
movzx r8d, byte [r13 + 0xf]
movzx r9d, byte [r13 + 0xe]
movzx ecx, byte [r13 + 0xb]
movzx r10d, byte [r13 + 0xd]
movzx r11d, byte [r13 + 0xc]
movzx ebx, byte [r13 + 0xa]
movzx edi, byte [r13 + 9]
movzx esi, byte [r13 + 8]
movzx ebp, word [r13 + 6]
movzx r12d, word [r13 + 4]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], r8d
mov dword [rsp + 0x60], r9d
mov dword [rsp + 0x60], ecx
mov r9d, dword [r13]
mov dword [rsp + 0x58], r10d
mov dword [rsp + 0x50], r11d
mov dword [rsp + 0x48], ecx
mov rcx, qword [r15 + 0x10]
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
lea r8, [0x100003188]
mov edx, 0xb1
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r12d
call fcn.1000d3a74
jmp 0x1000da3f2
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da42f
test byte [rcx + 0x1c], 4
je 0x1000da42f
cmp byte [rcx + 0x19], 2
jb 0x1000da42f
mov edx, 0xb0
jmp 0x1000da41f
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da3f2
test byte [rcx + 0x1c], 4
je 0x1000da3f2
cmp byte [rcx + 0x19], 2
jb 0x1000da3f2
mov rax, qword [rsi + 0x38]
mov rcx, qword [rcx + 0x10]
sub ebp, edi
lea r8, [0x100003188]
mov edx, 0xaf
mov r9d, ebp
mov qword [rsp + 0x20], rax
call fcn.1000d3d70
jmp 0x1000da3f2
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da3f2
test byte [rcx + 0x1c], 4
je 0x1000da3f2
cmp byte [rcx + 0x19], 2
jb 0x1000da3f2
mov eax, dword [r13 + 0x14]
mov edx, 0xae
mov dword [rsp + 0x30], ebx
mov r9d, edi
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [r13 + 0x18]
lea r8, [0x100003188]
mov dword [rsp + 0x20], eax
call fcn.1000d3bb4
jmp 0x1000da3f2
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da3f2
test byte [rcx + 0x1c], 4
je 0x1000da3f2
cmp byte [rcx + 0x19], 2
jb 0x1000da3f2
mov eax, dword [r13 + 0x14]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
mov dword [rsp + 0x28], eax
mov eax, dword [r13 + 0x18]
mov edx, 0xad
mov r9d, edi
mov dword [rsp + 0x20], eax
call fcn.1000c27bc
mov qword [r14], 0xffffffffc0000102
jmp 0x1000da444
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da42f
test byte [rcx + 0x1c], 4
je 0x1000da42f
cmp byte [rcx + 0x19], 2
jb 0x1000da42f
mov edx, 0xac
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003188]
call fcn.10001c7b8
mov rax, qword [rsi + 0x110]
mov qword [r14], rax
mov rax, qword [rsi + 0x118]
mov qword [r14 + 8], rax
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1000d9b06
call fcn.1000e0ae4
mov byte [r12], al
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000da49a
test byte [rcx + 0x1c], 4
je 0x1000da49a
cmp byte [rcx + 0x19], 4
jb 0x1000da49a
mov edx, 0xab
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
movzx eax, al
lea r8, [0x100003188]
mov dword [rsp + 0x20], eax
call fcn.1000d3d20
xor al, al
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.10014e480
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret