Function at 0x1000d9b30
Capabilities:
Enumerate pe sections

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc8
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x148]
mov r12, qword [rsp + 0x138]
mov r14, qword [rsp + 0x140]
mov r15, rdx
mov qword [rsp + 0x80], rdx
xor edx, edx
mov r13, r8
mov qword [rsp + 0x88], r8
mov rsi, rcx
lea r8d, [rdx + 0x10]
lea rcx, [r11 - 0x60]
mov rdi, r9
mov qword [rsp + 0x90], r9
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rbx
call sub.msvcrt.dll_memset
xor ebp, ebp
mov qword [r13], rbp
mov dword [rdi], ebp
mov byte [r12], bpl
cmp rbx, rbp
je 0x1000d9bcf
mov byte [rbx], bpl
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x1000d9c19
test byte [rcx + 0x1c], 4
je 0x1000d9c19
cmp byte [rcx + 0x19], 5
jb 0x1000d9c19
mov r9, qword [rsi + 0x38]
mov eax, dword [rsi + 0x38]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
sar r9, 0x20
mov edx, 0xa5
mov dword [rsp + 0x20], eax
call fcn.10001d914
mov rcx, qword [0x1001653b8]
cmp byte [rsi + 0x48], bpl
jne 0x1000d9e5e
mov rax, qword [rsi + 0x18]
lea rdi, [0x10000d4e8]
cmp qword [rsi + 0x38], rax
jl 0x1000d9c48
lea r8, [0x1000045d8]
mov edx, 0xd44
mov rcx, rdi
call fcn.10009a050
mov r8, r14
mov rdx, r12
mov rcx, rsi
call fcn.1000d8370
cmp eax, ebp
jne 0x1000d9c61
mov al, 1
jmp 0x1000da5f0
cmp byte [r12], bpl
jne 0x1000da5ee
mov rbx, qword [rsi + 0x38]
mov ebp, 0x10000
mov dword [r14 + 0x10], ebx
mov rax, rbx
mov qword [rsp + 0x88], rbx
shr rax, 0x20
mov r12d, ebp
mov dword [r14 + 0x14], eax
mov rax, qword [rsi + 0x18]
cmp qword [rsi + 0x38], rax
jl 0x1000d9cac
lea r8, [0x10000d6e8]
mov edx, 0xd57
mov rcx, rdi
call fcn.10009a050
mov rax, qword [rsi + 0x38]
add rax, rbp
cmp rax, qword [rsi + 0x18]
jle 0x1000d9ccd
lea r8, [0x1000045d8]
mov edx, 0xd5f
mov rcx, rdi
call fcn.10009a050
mov rdi, qword [rsi + 0x18]
mov edx, ebp
mov rcx, rsi
mov qword [rsp + 0x80], rdi
call fcn.1000e09ac
test al, al
je 0x1000d9d32
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000d9d29
test byte [rcx + 0x1c], 4
je 0x1000d9d29
cmp byte [rcx + 0x19], 5
jb 0x1000d9d29
mov r9d, dword [rsi + 0xac]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0xa6
call fcn.10001c878
mov rcx, qword [0x1001653b8]
mov r12d, dword [rsi + 0xac]
jmp 0x1000d9d39
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d9db8
test byte [rcx + 0x1c], 4
je 0x1000d9d86
cmp byte [rcx + 0x19], 5
jb 0x1000d9d86
mov eax, dword [rsp + 0x8c]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0xa7
mov r9d, r12d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call fcn.10007fb28
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d9db8
test byte [rcx + 0x1c], 4
je 0x1000d9db8
cmp byte [rcx + 0x19], 5
jb 0x1000d9db8
mov r9d, dword [rsp + 0x84]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0xa8
mov dword [rsp + 0x20], edi
call fcn.10001d914
mov rcx, qword [rsi]
mov r9, r14
mov r8d, r12d
mov rdx, r15
call fcn.1000d3528
mov r8, qword [rsp + 0xa0]
movabs rax, 0x7ff8007ff8007ff9
imul qword [rsi + 0x40]
sar rdx, 0x14
mov rcx, rsi
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x98]
mov dword [rax], edx
mov rdx, r13
call fcn.1000d8cdc
mov r10, qword [rsp + 0x90]
mov dword [r10], r12d
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000d9e51
test byte [rcx + 0x1c], 4
je 0x1000d9e51
cmp byte [rcx + 0x19], 5
jb 0x1000d9e51
mov r9, qword [r13]
mov eax, dword [r13]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
sar r9, 0x20
mov edx, 0xa9
mov dword [rsp + 0x20], eax
call fcn.10001d914
add qword [rsi + 0x40], rbp
add qword [rsi + 0x38], rbp
jmp 0x1000d9c5a
cmp rcx, rdi
je 0x1000d9e88
test byte [rcx + 0x1c], 4
je 0x1000d9e88
cmp byte [rcx + 0x19], 5
jb 0x1000d9e88
mov r9d, dword [rsi + 0x68]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0xaa
call fcn.10001c878
mov rcx, rsi
call fcn.1000de968
mov ebp, 0x10000
movabs r15, 0x7ff8007ff8007ff9
mov eax, dword [rsi + 0x68]
mov ebx, ebp
mov r13, rax
sub ebx, eax
add r13, qword [rsi + 0x60]
cmp ebx, 0x20
jb 0x1000d9ec4
mov ecx, dword [r13 + 0x10]
cmp ebx, ecx
jb 0x1000d9ec4
add eax, ecx
mov dword [rsi + 0x68], eax
jmp 0x1000d9f81
test ebx, ebx
je 0x1000d9ed7
mov rcx, qword [rsi + 0x50]
mov r8d, ebx
mov rdx, r13
call sub.msvcrt.dll_memcpy
cmp byte [rsi + 0xf8], 0
mov r13, qword [rsi + 0x50]
mov rcx, rsi
je 0x1000da5a7
call fcn.1000dea54
test al, al
je 0x1000da54f
cmp ebx, 0x20
jae 0x1000d9f15
mov rdx, qword [rsi + 0x60]
mov r8d, 0x20
mov ecx, ebx
add rcx, qword [rsi + 0x50]
sub r8d, ebx
call sub.msvcrt.dll_memcpy
mov edi, dword [r13 + 0x10]
cmp edi, 0x10020
ja 0x1000da4ff
cmp edi, ebx
jb 0x1000da4ae
mov rdx, qword [rsi + 0x60]
mov ecx, ebx
sub edi, ebx
add rcx, qword [rsi + 0x50]
cmp edi, ebp
jb 0x1000d9f76
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rsi + 0xf8], 0
je 0x1000da45b
mov rcx, rsi
call fcn.1000dea54
test al, al
je 0x1000da426
mov rdx, qword [rsi + 0x60]
lea ecx, [rbx + 0x10000]
add edi, 0xffff0000
add rcx, qword [rsi + 0x50]
mov r8d, edi
call sub.msvcrt.dll_memcpy
add dword [rsi + 0x68], edi
mov ebx, 0x10
lea rdx, [0x10000cfd0]
mov rcx, r13
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1000da30a
cmp dword [r13 + 0x10], 0x20
jb 0x1000da2c1
test byte [r13 + 0x10], 0xf
jne 0x1000da2c1
mov edx, dword [r13 + 0x14]
mov ecx, dword [r13 + 0x18]
cmp edx, ecx
ja 0x1000da28c
cmp dword [r13 + 0x1c], 0
jne 0x1000da28c
lea eax, [rdx + 0x20]
cmp eax, dword [r13 + 0x10]
ja 0x1000da28c
test ecx, 0x1ff
jne 0x1000da28c
test ecx, ecx
je 0x1000da28c
test edx, edx
jne 0x1000da016
test cx, cx
jne 0x1000da0a8
cmp ecx, 0x200000
jae 0x1000da0a8
add qword [rsi + 0x40], rcx
jmp 0x1000d9e9f
mov r8, qword [rsi + 0x40]
mov rax, r15
imul r8
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x200200
sub rax, rdx
jne 0x1000da11f
cmp ecx, 0x200
jne 0x1000da0ed
mov rcx, qword [rsi + 0x138]
lea rax, [r8 + 0x200]
mov r8, qword [rsi + 0xd0]
mov rdx, r13
mov qword [rsi + 0x40], rax
call fcn.1000ceccc
test al, al
jne 0x1000d9e9f
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da546
test byte [rcx + 0x1c], 4
je 0x1000da546
cmp byte [rcx + 0x19], 2
jb 0x1000da546
mov edx, VarDecFix
jmp 0x1000da0d8
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da546
test byte [rcx + 0x1c], 4
je 0x1000da546
cmp byte [rcx + 0x19], 2
jb 0x1000da546
mov edx, VariantTimeToSystemTime
mov eax, dword [r13 + 0x1c]
mov r9d, dword [r13 + 0x14]
mov dword [rsp + 0x30], eax
mov eax, dword [r13 + 0x10]
jmp 0x1000da4e1
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da546
test byte [rcx + 0x1c], 4
je 0x1000da546
cmp byte [rcx + 0x19], 2
jb 0x1000da546
mov edx, VarDecFix
jmp 0x1000da0d8
mov r8d, ecx
cmp ecx, ebp
je 0x1000da199
mov al, byte [rsi + 0xf8]
test al, al
jne 0x1000da134
cmp ecx, ebp
jbe 0x1000da199
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000da546
test byte [rcx + 0x1c], 4
je 0x1000da546
cmp byte [rcx + 0x19], 2
jb 0x1000da546
mov r9d, dword [r13 + 0x14]
mov rcx, qword [rcx + 0x10]
movzx eax, al
mov dword [rsp + 0x38], eax
mov eax, dword [r13 + 0x1c]
mov edx, reloc.OLEAUT32.dll_VariantTimeToSystemTime
mov dword [rsp + 0x30], eax
mov eax, dword [r13 + 0x10]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
lea r8, [0x100003148]
call fcn.1000d3d70
jmp 0x1000da546
mov r8, qword [rsp + 0x80]
mov rax, r15
imul qword [rsi + 0x40]
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x98]
mov dword [rax], edx
mov rcx, qword [rsi + 0x138]
mov rdx, r13
call fcn.1000ceccc
test al, al
jne 0x1000da208
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da546
test byte [rcx + 0x1c], 4
je 0x1000da546
cmp byte [rcx + 0x19], 2
jb 0x1000da546
mov edx, VarDecFix
jmp 0x1000da0d8
and qword [r14], 0
mov eax, dword [r13 + 0x18]
mov rcx, qword [r14 + 0x18]
mov qword [r14 + 8], rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rsp + 0x88]
mov r8, qword [rsp + 0xa0]
mov rdx, rbx
mov rcx, rsi
call fcn.1000d8cdc
mov r10, qword [rsp + 0x90]
mov r11d, dword [r13 + 0x18]
mov dword [r10], r11d
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da27f
test byte [rcx + 0x1c], 4
je 0x1000da27f
cmp byte [rcx + 0x19], 5
jb 0x1000da27f
mov r9, qword [rbx]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, reloc.OLEAUT32.dll_VarDecFix
call fcn.10001d71c
mov eax, dword [r13 + 0x18]
add qword [rsi + 0x40], rax
jmp 0x1000d9c5a
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da546
test byte [rcx + 0x1c], 4
je 0x1000da546
cmp byte [rcx + 0x19], 2
jb 0x1000da546
mov edx, VariantTimeToSystemTime
jmp 0x1000da0d8
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da546
test byte [rcx + 0x1c], 4
je 0x1000da546
cmp byte [rcx + 0x19], 2
jb 0x1000da546
mov r9d, dword [r13 + 0x10]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov edx, 0xb3
call fcn.10001c878
jmp 0x1000da546
lea rdx, [rsp + 0xa8]
mov r8, rbx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1000da371
cmp byte [rsi + 0xf8], 0
jne 0x1000da371
mov rcx, rsi
call fcn.1000e0c38
mov byte [r12], al
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000da5ee
test byte [rcx + 0x1c], 4
je 0x1000da5ee
cmp byte [rcx + 0x19], 4
jb 0x1000da5ee
mov r9d, dword [rsi + 0x68]
mov edx, 0xb2
jmp 0x1000da5d7
mov r15, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp r15, rax
je 0x1000da546
test byte [r15 + 0x1c], 4
je 0x1000da546
cmp byte [r15 + 0x19], 2
jb 0x1000da546
movzx eax, byte [rsi + 0xf8]
movzx r8d, byte [r13 + 0xf]
movzx r9d, byte [r13 + 0xe]
movzx ecx, byte [r13 + 0xb]
movzx r10d, byte [r13 + 0xd]
movzx r11d, byte [r13 + 0xc]
movzx ebx, byte [r13 + 0xa]
movzx edi, byte [r13 + 9]
movzx esi, byte [r13 + 8]
movzx ebp, word [r13 + 6]
movzx r12d, word [r13 + 4]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], r8d
mov dword [rsp + 0x60], r9d
mov r9d, dword [r13]
mov dword [rsp + 0x58], r10d
mov dword [rsp + 0x50], r11d
mov dword [rsp + 0x48], ecx
mov rcx, qword [r15 + 0x10]
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
lea r8, [0x100003148]
mov edx, 0xb1
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r12d
call fcn.1000d3bc8
jmp 0x1000da546
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da583
test byte [rcx + 0x1c], 4
je 0x1000da583
cmp byte [rcx + 0x19], 2
jb 0x1000da583
mov edx, 0xb0
jmp 0x1000da573
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da546
test byte [rcx + 0x1c], 4
je 0x1000da546
cmp byte [rcx + 0x19], 2
jb 0x1000da546
mov rax, qword [rsi + 0x38]
mov rcx, qword [rcx + 0x10]
sub ebp, edi
lea r8, [0x100003148]
mov edx, 0xaf
mov r9d, ebp
mov qword [rsp + 0x20], rax
call fcn.1000d3ec4
jmp 0x1000da546
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da546
test byte [rcx + 0x1c], 4
je 0x1000da546
cmp byte [rcx + 0x19], 2
jb 0x1000da546
mov eax, dword [r13 + 0x14]
mov edx, 0xae
mov dword [rsp + 0x30], ebx
mov r9d, edi
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x28], eax
mov eax, dword [r13 + 0x18]
lea r8, [0x100003148]
mov dword [rsp + 0x20], eax
call fcn.1000d3d08
jmp 0x1000da546
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da546
test byte [rcx + 0x1c], 4
je 0x1000da546
cmp byte [rcx + 0x19], 2
jb 0x1000da546
mov eax, dword [r13 + 0x14]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
mov dword [rsp + 0x28], eax
mov eax, dword [r13 + 0x18]
mov edx, 0xad
mov r9d, edi
mov dword [rsp + 0x20], eax
call fcn.10007fb28
mov qword [r14], 0xffffffffc0000102
jmp 0x1000da598
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000da583
test byte [rcx + 0x1c], 4
je 0x1000da583
cmp byte [rcx + 0x19], 2
jb 0x1000da583
mov edx, 0xac
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003148]
call fcn.10001c854
mov rax, qword [rsi + 0x110]
mov qword [r14], rax
mov rax, qword [rsi + 0x118]
mov qword [r14 + 8], rax
mov rcx, qword [r14 + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1000d9c5a
call fcn.1000e0c38
mov byte [r12], al
mov rcx, qword [0x1001653b8]
lea rdx, [0x1001653b8]
cmp rcx, rdx
je 0x1000da5ee
test byte [rcx + 0x1c], 4
je 0x1000da5ee
cmp byte [rcx + 0x19], 4
jb 0x1000da5ee
mov edx, 0xab
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
movzx eax, al
lea r8, [0x100003148]
mov dword [rsp + 0x20], eax
call fcn.1000d3e74
xor al, al
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.10014e600
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret