Function at 0x1400ede84
Capabilities:
Enumerate pe sections

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc8
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x148]
mov r12, qword [rsp + 0x138]
mov r15, qword [rsp + 0x140]
mov qword [rsp + 0x88], rdx
xor edx, edx
mov r13, r8
mov rsi, rcx
lea r8d, [rdx + 0x10]
lea rcx, [r11 - 0x68]
mov rdi, r9
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
call sub.msvcrt.dll_memset
xor ebp, ebp
mov qword [r13], rbp
mov dword [rdi], ebp
mov byte [r12], bpl
test rbx, rbx
je 0x1400edf12
mov byte [rbx], bpl
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x1400edf63
test byte [rcx + 0x1c], 4
je 0x1400edf63
cmp byte [rcx + 0x19], 5
jb 0x1400edf63
mov r9, qword [rsi + 0x38]
mov eax, dword [rsi + 0x38]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
sar r9, 0x20
mov edx, 0xa3
mov dword [rsp + 0x20], eax
call fcn.1400285b4
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp byte [rsi + 0x48], bpl
jne 0x1400ee197
mov rax, qword [rsi + 0x18]
lea rdi, [0x14000d138]
cmp qword [rsi + 0x38], rax
jl 0x1400edf92
lea r8, [0x140003304]
mov edx, 0xd30
mov rcx, rdi
call fcn.1400a8be8
mov r8, r15
mov rdx, r12
mov rcx, rsi
call fcn.1400ec704
test eax, eax
jne 0x1400edfab
mov al, 1
jmp 0x1400ee8d1
cmp byte [r12], bpl
jne 0x1400ee8cf
mov rbx, qword [rsi + 0x38]
mov ebp, 0x10000
mov dword [r15 + 0x10], ebx
mov rax, rbx
mov qword [rsp + 0x90], rbx
shr rax, 0x20
mov r14d, ebp
mov dword [r15 + 0x14], eax
mov rax, qword [rsi + 0x18]
cmp qword [rsi + 0x38], rax
jl 0x1400edff6
lea r8, [0x14000d330]
mov edx, 0xd43
mov rcx, rdi
call fcn.1400a8be8
mov rax, qword [rsi + 0x38]
add rax, rbp
cmp rax, qword [rsi + 0x18]
jle 0x1400ee017
lea r8, [0x140003304]
mov edx, 0xd4b
mov rcx, rdi
call fcn.1400a8be8
mov rdi, qword [rsi + 0x18]
mov rcx, rsi
mov qword [rsp + 0x98], rdi
call fcn.1400f4378
test al, al
je 0x1400ee07a
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee071
test byte [rcx + 0x1c], 4
je 0x1400ee071
cmp byte [rcx + 0x19], 5
jb 0x1400ee071
mov r9d, dword [rsi + 0xac]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xa4
call fcn.14001de24
mov rcx, qword [0x14017d3a8]
mov r14d, dword [rsi + 0xac]
jmp 0x1400ee088
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee0f9
test byte [rcx + 0x1c], 4
je 0x1400ee0c7
cmp byte [rcx + 0x19], 5
jb 0x1400ee0c7
mov eax, dword [rsp + 0x94]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xa5
mov r9d, r14d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call fcn.1400d3284
mov rcx, qword [0x14017d3a8]
cmp rcx, r12
je 0x1400ee0f9
test byte [rcx + 0x1c], 4
je 0x1400ee0f9
cmp byte [rcx + 0x19], 5
jb 0x1400ee0f9
mov r9d, dword [rsp + 0x9c]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xa6
mov dword [rsp + 0x20], edi
call fcn.1400285b4
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsi]
mov r9, r15
mov r8d, r14d
call fcn.1400e156c
mov r8, qword [rsp + 0x80]
movabs rax, 0x7ff8007ff8007ff9
imul qword [rsi + 0x40]
sar rdx, 0x14
mov rcx, rsi
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x78]
mov dword [rax], edx
mov rdx, r13
call fcn.1400ed098
mov r10, qword [rsp + 0x70]
mov dword [r10], r14d
mov rcx, qword [0x14017d3a8]
cmp rcx, r12
je 0x1400ee18a
test byte [rcx + 0x1c], 4
je 0x1400ee18a
cmp byte [rcx + 0x19], 5
jb 0x1400ee18a
mov r9, qword [r13]
mov eax, dword [r13]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
sar r9, 0x20
mov edx, 0xa7
mov dword [rsp + 0x20], eax
call fcn.1400285b4
add qword [rsi + 0x40], rbp
add qword [rsi + 0x38], rbp
jmp 0x1400edfa4
cmp rcx, rax
je 0x1400ee1c1
test byte [rcx + 0x1c], 4
je 0x1400ee1c1
cmp byte [rcx + 0x19], 5
jb 0x1400ee1c1
mov r9d, dword [rsi + 0x68]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xa8
call fcn.14001de24
mov rcx, rsi
call fcn.1400f2790
mov ebp, 0x10000
movabs rdi, 0x7ff8007ff8007ff9
mov eax, dword [rsi + 0x68]
mov ebx, ebp
mov r14d, eax
sub ebx, eax
add r14, qword [rsi + 0x60]
cmp ebx, 0x20
jb 0x1400ee1fd
mov ecx, dword [r14 + 0x10]
cmp ebx, ecx
jb 0x1400ee1fd
add eax, ecx
mov dword [rsi + 0x68], eax
jmp 0x1400ee2c5
test ebx, ebx
je 0x1400ee210
mov rcx, qword [rsi + 0x50]
mov r8d, ebx
mov rdx, r14
call sub.msvcrt.dll_memcpy
cmp byte [rsi + 0xf8], 0
mov r14, qword [rsi + 0x50]
mov rcx, rsi
je 0x1400ee892
call fcn.1400f287c
test al, al
je 0x1400ee83a
cmp ebx, 0x20
jae 0x1400ee24f
mov rdx, qword [rsi + 0x60]
mov eax, 0x20
mov ecx, ebx
add rcx, qword [rsi + 0x50]
sub eax, ebx
mov r8d, eax
call sub.msvcrt.dll_memcpy
mov edi, dword [r14 + 0x10]
cmp edi, 0x10020
ja 0x1400ee7ea
cmp edi, ebx
jb 0x1400ee7a8
mov rdx, qword [rsi + 0x60]
mov ecx, ebx
sub edi, ebx
add rcx, qword [rsi + 0x50]
cmp edi, ebp
jb 0x1400ee2b0
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rsi + 0xf8], 0
je 0x1400ee767
mov rcx, rsi
call fcn.1400f287c
test al, al
je 0x1400ee732
mov rdx, qword [rsi + 0x60]
lea ecx, reloc.ADVAPI32.dll_TraceEvent
add edi, 0xffff0000
add rcx, qword [rsi + 0x50]
mov r8d, edi
call sub.msvcrt.dll_memcpy
add dword [rsi + 0x68], edi
movabs rdi, 0x7ff8007ff8007ff9
mov ebx, CoRevokeClassObject
lea rdx, [0x14000d0f8]
mov rcx, r14
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1400ee62e
cmp dword [r14 + 0x10], 0x20
jb 0x1400ee5e5
test byte [r14 + 0x10], 0xf
jne 0x1400ee5e5
mov edx, dword [r14 + 0x14]
mov ecx, dword [r14 + 0x18]
cmp edx, ecx
ja 0x1400ee5b0
cmp dword [r14 + 0x1c], 0
jne 0x1400ee5b0
lea eax, [rdx + 0x20]
cmp eax, dword [r14 + 0x10]
ja 0x1400ee5b0
test ecx, 0x1ff
jne 0x1400ee5b0
test ecx, ecx
je 0x1400ee5b0
test edx, edx
jne 0x1400ee35c
movzx eax, cx
test eax, eax
jne 0x1400ee3ee
cmp ecx, 0x200000
jae 0x1400ee3ee
add qword [rsi + 0x40], rcx
jmp 0x1400ee1d8
mov r8, qword [rsi + 0x40]
mov rax, rdi
imul r8
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x200200
sub rax, rdx
jne 0x1400ee465
cmp ecx, 0x200
jne 0x1400ee433
mov rcx, qword [rsi + 0x138]
lea rax, [r8 + 0x200]
mov r8, qword [rsi + 0xd0]
mov rdx, r14
mov qword [rsi + 0x40], rax
call fcn.1400dd708
test al, al
jne 0x1400ee1d8
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee831
test byte [rcx + 0x1c], 4
je 0x1400ee831
cmp byte [rcx + 0x19], 2
jb 0x1400ee831
mov edx, 0xb5
jmp 0x1400ee41e
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee831
test byte [rcx + 0x1c], 4
je 0x1400ee831
cmp byte [rcx + 0x19], 2
jb 0x1400ee831
mov edx, 0xb3
mov eax, dword [r14 + 0x1c]
mov r8d, dword [r14 + 0x14]
mov dword [rsp + 0x28], eax
mov eax, dword [r14 + 0x10]
jmp 0x1400ee7d7
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee831
test byte [rcx + 0x1c], 4
je 0x1400ee831
cmp byte [rcx + 0x19], 2
jb 0x1400ee831
mov edx, 0xb4
jmp 0x1400ee41e
mov r8d, ecx
cmp ecx, ebp
je 0x1400ee4ca
mov al, byte [rsi + 0xf8]
test al, al
jne 0x1400ee47a
cmp ecx, ebp
jbe 0x1400ee4ca
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee831
test byte [rcx + 0x1c], 4
je 0x1400ee831
cmp byte [rcx + 0x19], 2
jb 0x1400ee831
mov r9d, dword [r14 + 0x10]
mov edx, dword [r14 + 0x14]
mov rcx, qword [rcx + 0x10]
movzx eax, al
mov dword [rsp + 0x28], eax
mov eax, dword [r14 + 0x1c]
mov dword [rsp + 0x20], eax
call fcn.1400e996c
jmp 0x1400ee831
mov r8, qword [rsp + 0x88]
mov rax, rdi
imul qword [rsi + 0x40]
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x78]
mov dword [rax], edx
mov rcx, qword [rsi + 0x138]
mov rdx, r14
call fcn.1400dd708
test al, al
jne 0x1400ee536
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee831
test byte [rcx + 0x1c], 4
je 0x1400ee831
cmp byte [rcx + 0x19], 2
jb 0x1400ee831
mov edx, 0xb7
jmp 0x1400ee41e
and qword [r15], 0
mov eax, dword [r14 + 0x18]
mov rcx, qword [r15 + 0x18]
mov qword [r15 + 8], rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov r8, qword [rsp + 0x80]
mov rdx, r13
mov rcx, rsi
call fcn.1400ed098
mov r10, qword [rsp + 0x70]
mov r11d, dword [r14 + 0x18]
mov dword [r10], r11d
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee5a3
test byte [rcx + 0x1c], 4
je 0x1400ee5a3
cmp byte [rcx + 0x19], 5
jb 0x1400ee5a3
mov r9, qword [r13]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xb8
call fcn.1400d3ca0
mov eax, dword [r14 + 0x18]
add qword [rsi + 0x40], rax
jmp 0x1400edfa4
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee831
test byte [rcx + 0x1c], 4
je 0x1400ee831
cmp byte [rcx + 0x19], 2
jb 0x1400ee831
mov edx, 0xb2
jmp 0x1400ee41e
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee831
test byte [rcx + 0x1c], 4
je 0x1400ee831
cmp byte [rcx + 0x19], 2
jb 0x1400ee831
mov r9d, dword [r14 + 0x10]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov edx, 0xb1
call fcn.14001de24
jmp 0x1400ee831
lea rdx, [rsp + 0xa0]
mov r8, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1400ee695
cmp byte [rsi + 0xf8], 0
jne 0x1400ee695
mov rcx, rsi
call fcn.1400f4604
mov byte [r12], al
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee8cf
test byte [rcx + 0x1c], 4
je 0x1400ee8cf
cmp byte [rcx + 0x19], 4
jb 0x1400ee8cf
mov r8d, dword [rsi + 0x68]
mov edx, 0xb0
jmp 0x1400ee8c2
mov r13, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp r13, r12
je 0x1400ee831
test byte [r13 + 0x1c], 4
je 0x1400ee831
cmp byte [r13 + 0x19], 2
jb 0x1400ee831
movzx eax, byte [rsi + 0xf8]
movzx edx, byte [r14 + 0xf]
movzx ecx, byte [r14 + 0xc]
movzx r10d, byte [r14 + 0xe]
movzx r11d, byte [r14 + 0xd]
movzx ebx, byte [r14 + 0xb]
movzx edi, byte [r14 + 0xa]
movzx esi, byte [r14 + 9]
movzx ebp, byte [r14 + 8]
movzx r9d, word [r14 + 6]
movzx r8d, word [r14 + 4]
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x58], edx
mov edx, dword [r14]
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], ecx
mov rcx, qword [r13 + 0x10]
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebp
call fcn.1400e9734
jmp 0x1400ee831
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee86e
test byte [rcx + 0x1c], 4
je 0x1400ee86e
cmp byte [rcx + 0x19], 2
jb 0x1400ee86e
mov edx, 0xae
jmp 0x1400ee85e
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee831
test byte [rcx + 0x1c], 4
je 0x1400ee831
cmp byte [rcx + 0x19], 2
jb 0x1400ee831
mov r8, qword [rsi + 0x38]
mov rcx, qword [rcx + 0x10]
sub ebp, edi
mov edx, ebp
call fcn.1400e9ad4
jmp 0x1400ee831
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee831
test byte [rcx + 0x1c], 4
je 0x1400ee831
cmp byte [rcx + 0x19], 2
jb 0x1400ee831
mov eax, dword [r14 + 0x14]
mov edx, 0xac
mov dword [rsp + 0x28], ebx
mov r8d, edi
mov r9d, dword [r14 + 0x18]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], eax
call fcn.1400e9900
jmp 0x1400ee831
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee831
test byte [rcx + 0x1c], 4
je 0x1400ee831
cmp byte [rcx + 0x19], 2
jb 0x1400ee831
mov eax, dword [r14 + 0x14]
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
mov dword [rsp + 0x28], eax
mov eax, dword [r14 + 0x18]
mov edx, 0xab
mov r9d, edi
mov dword [rsp + 0x20], eax
call fcn.1400d3284
mov qword [r15], 0xffffffffc0000102
jmp 0x1400ee883
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee86e
test byte [rcx + 0x1c], 4
je 0x1400ee86e
cmp byte [rcx + 0x19], 2
jb 0x1400ee86e
mov edx, 0xaa
mov rcx, qword [rcx + 0x10]
lea r8, [0x14000d538]
call fcn.14001dd24
mov rax, qword [rsi + 0x110]
mov qword [r15], rax
mov rax, qword [rsi + 0x118]
mov qword [r15 + 8], rax
mov rcx, qword [r15 + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400edfa4
call fcn.1400f4604
mov byte [r12], al
mov rcx, qword [0x14017d3a8]
lea r12, [0x14017d3a8]
cmp rcx, r12
je 0x1400ee8cf
test byte [rcx + 0x1c], 4
je 0x1400ee8cf
cmp byte [rcx + 0x19], 4
jb 0x1400ee8cf
mov edx, 0xa9
mov r8d, ebx
mov rcx, qword [rcx + 0x10]
movzx r9d, al
call fcn.1400e9a80
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140168920
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret