Function at 0x140099da0
Capabilities:
Enumerate pe sections

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r8d, dword [rcx + 0x30]
mov rbx, rcx
mov ecx, dword [rcx + 0x38]
mov rsi, rdx
mov edx, r8d
mov edi, dword [rbx + 0x34]
mov byte [rsp + 0x26], pe_nt_image_headers64
add edx, ecx
mov byte [rsp + 0x27], 0
mov r13d, edx
adc edi, 0
movzx eax, dl
mov r12d, edx
shr r13d, 8
shl rax, 8
mov ebp, edx
mov r9d, edi
movzx r13d, r13b
shr r12d, 0x10
mov r10d, edi
mov r11d, edi
or rax, r13
movzx r12d, r12b
shr ebp, 0x18
movzx edi, dil
shl rax, 8
movzx ebp, bpl
shr r11d, 8
shr r10d, 0x10
or rax, r12
movzx r11d, r11b
shr r9d, 0x18
shl rax, 8
movzx r10d, r10b
movzx r9d, r9b
or rax, rbp
shl rax, 8
or rax, rdi
shl rax, 8
or rax, r11
shl rax, 8
or rax, r10
shl rax, 8
or rax, r9
mov qword [rsp + 0x28], rax
cmp ecx, 0x1b8
je 0x14009a000
cmp ecx, 0x1b7
jg 0x140099fb0
test ecx, ecx
je 0x140099fa0
sub edx, 0x1b8
mov r8d, 0x1b8
mov dword [rbx + 0x30], edx
sub r8d, ecx
lea rdx, [0x1402bfae0]
mov rcx, rbx
movsxd r8, r8d
call sym.blake256_update
lea rdx, [rsp + 0x27]
mov r8d, 8
mov rcx, rbx
call sym.blake256_update
mov eax, dword [rbx + 0x30]
sub eax, 8
sub eax, 0x40
lea rdx, [rsp + 0x28]
mov r8d, 0x40
mov rcx, rbx
mov dword [rbx + 0x30], eax
call sym.blake256_update
mov eax, dword [rbx]
shr eax, 0x18
mov byte [rsi], al
mov eax, dword [rbx]
shr eax, 0x10
mov byte [rsi + 1], al
mov eax, dword [rbx]
mov byte [rsi + 2], ah
mov eax, dword [rbx]
mov byte [rsi + 3], al
movzx eax, byte [rbx + 7]
mov byte [rsi + 4], al
movzx eax, word [rbx + 6]
mov byte [rsi + 5], al
mov eax, dword [rbx + 4]
mov byte [rsi + 6], ah
mov eax, dword [rbx + 4]
mov byte [rsi + 7], al
movzx eax, byte [rbx + 0xb]
mov byte [rsi + 8], al
movzx eax, word [rbx + 0xa]
mov byte [rsi + 9], al
mov eax, dword [rbx + 8]
mov byte [rsi + 0xa], ah
mov eax, dword [rbx + 8]
mov byte [rsi + 0xb], al
movzx eax, byte [rbx + 0xf]
mov byte [rsi + 0xc], al
movzx eax, word [rbx + 0xe]
mov byte [rsi + 0xd], al
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xe], ah
mov eax, dword [rbx + 0xc]
mov byte [rsi + 0xf], al
movzx eax, byte [rbx + 0x13]
mov byte [rsi + 0x10], al
movzx eax, word [rbx + 0x12]
mov byte [rsi + 0x11], al
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x12], ah
mov eax, dword [rbx + 0x10]
mov byte [rsi + 0x13], al
movzx eax, byte [rbx + 0x17]
mov byte [rsi + 0x14], al
movzx eax, word [rbx + 0x16]
mov byte [rsi + 0x15], al
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x16], ah
mov eax, dword [rbx + 0x14]
mov byte [rsi + 0x17], al
movzx eax, byte [rbx + 0x1b]
mov byte [rsi + 0x18], al
movzx eax, word [rbx + 0x1a]
mov byte [rsi + 0x19], al
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1a], ah
mov eax, dword [rbx + 0x18]
mov byte [rsi + 0x1b], al
movzx eax, byte [rbx + 0x1f]
mov byte [rsi + 0x1c], al
movzx eax, word [rbx + 0x1e]
mov byte [rsi + 0x1d], al
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1e], ah
mov eax, dword [rbx + 0x1c]
mov byte [rsi + 0x1f], al
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov dword [rbx + 0x3c], 1
jmp 0x140099e6b
sub edx, 0x200
mov r8d, 0x200
mov dword [rbx + 0x30], edx
sub r8d, ecx
lea rdx, [0x1402bfae0]
mov rcx, rbx
movsxd r8, r8d
call sym.blake256_update
sub dword [rbx + 0x30], 0x1b8
mov r8d, 0x1b8
mov rcx, rbx
lea rdx, [0x1402bfae1]
call sym.blake256_update
mov dword [rbx + 0x3c], 1
jmp 0x140099e8f
sub r8d, 8
lea rdx, [rsp + 0x26]
mov rcx, rbx
mov dword [rbx + 0x30], r8d
mov r8d, 8
call sym.blake256_update
mov eax, dword [rbx + 0x30]
jmp 0x140099ea8