Function at 0x140054c00
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov dword [rsp + 0x58], 0
mov rcx, qword [0x1401590d8]
mov rcx, qword [rcx + 8]
call fcn.14006fb80
mov rdi, rax
test rax, rax
je 0x140054f1c
mov rcx, rax
mov qword [rsp + 0x30], rbx
call fcn.140053ce0
mov rbx, rax
test rax, rax
je 0x140054e6e
cmp dword [rax], 0xfeef04bd
jne 0x140054e6e
mov edx, dword ds:[rax]
lea rcx, str.0x_lx
call fcn.140001000
lea r9, str.Signature
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call fcn.14001c520
movzx r8d, word [rbx + 4]
lea rcx, str._lu._lu
movzx edx, word [rbx + 6]
call fcn.140001000
lea r9, str.Struct_version
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call fcn.14001c520
movzx eax, word [rbx + 0xc]
lea rcx, str._lu._lu._lu._lu
movzx r9d, word [rbx + 0xe]
movzx r8d, word [rbx + 8]
movzx edx, word [rbx + 0xa]
mov dword [rsp + 0x20], eax
call fcn.140001000
lea r9, str.File_version
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call fcn.14001c520
movzx eax, word [rbx + 0x14]
lea rcx, str._lu._lu._lu._lu
movzx r9d, word [rbx + 0x16]
movzx r8d, word [rbx + 0x10]
movzx edx, word [rbx + 0x12]
mov dword [rsp + 0x20], eax
call fcn.140001000
lea r9, str.Product_version
xor r8d, r8d
mov rcx, rsi
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x58]
call fcn.14001c520
mov edx, dword [rbx + 0x18]
lea rcx, str.0x_lx
call fcn.140001000
lea r9, str.FileFlagsMask
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call fcn.14001c520
mov ecx, dword [rbx + 0x1c]
call fcn.140053fe0
mov rcx, rax
call fcn.140060660
lea r9, str.FileFlags
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call fcn.14001c520
mov ecx, dword [rbx + 0x20]
call fcn.140054460
mov rcx, rax
call fcn.140060660
lea r9, str.FileOS
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call fcn.14001c520
mov ecx, dword [rbx + 0x24]
call fcn.140054820
mov rcx, rax
call fcn.140060660
lea r9, str.FileType
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call fcn.14001c520
mov edx, dword [rbx + 0x28]
lea rcx, [0x140110328]
call fcn.140001000
lea r9, str.FileSubtype
xor r8d, r8d
mov rcx, rsi
mov rdx, qword [rax + 8]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x58]
call fcn.14001c520
movzx eax, word [rbx + 0x30]
lea rcx, str._lu._lu._lu._lu
movzx r9d, word [rbx + 0x32]
movzx r8d, word [rbx + 0x2c]
movzx edx, word [rbx + 0x2e]
mov dword [rsp + 0x20], eax
call fcn.140001000
lea r9, str.FileDate
xor r8d, r8d
lea rdx, [rsp + 0x58]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call fcn.14001c520
lea r9, ds:[rsp + 0x60]
mov rcx, rdi
lea r8, [rsp + 0x68]
call fcn.14006fd00
test al, al
je 0x140054e9c
mov rax, qword [rsp + 0x68]
movzx ebx, word [rax]
movzx eax, word [rax + 2]
shl ebx, 0x10
add ebx, eax
jmp 0x140054ea1
mov ebx, 0x40904e4
lea r9, [rsp + 0x58]
mov r8, rsi
mov edx, ebx
mov rcx, rdi
call fcn.140053d80
test al, al
jne 0x140054f05
and ebx, 0xffff0000
lea r9, [rsp + 0x58]
mov r8, rsi
mov rcx, rdi
lea edx, [rbx + 0x4e4]
call fcn.140053d80
test al, al
jne 0x140054f05
lea r9, [rsp + 0x58]
mov r8, rsi
mov edx, 0x40904e4
mov rcx, rdi
call fcn.140053d80
test al, al
jne 0x140054f05
lea r9, [rsp + 0x58]
mov r8, rsi
mov edx, 0x4090000
mov rcx, rdi
call fcn.140053d80
mov rcx, qword [0x140159238]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
pop rdi
pop rsi
ret