Function at 0x140046dd8
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2b8]
sub rsp, 0x3b8
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
mov r13, rcx
mov qword [rsp + 0x68], rcx
call fcn.140090fbc
mov rax, qword [r13 + 0x108]
lea r14, [0x14012da68]
mov rdx, r14
xor r12d, r12d
test rax, rax
cmovne rdx, rax
lea rbx, [r13 + 0x110]
mov qword [rsp + 0x60], rbx
or r8d, 0xffffffff
lea rcx, [rsp + 0x40]
call fcn.1400e6fc8
nop
lea rcx, [rbx + 8]
lea rdx, [rsp + 0x40]
call fcn.140048434
nop
lea r15, vtable.micro::utils::QString.0
mov qword [rsp + 0x40], r15
lea rcx, [rsp + 0x40]
call fcn.1400e712c
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140047888
mov qword [rbx + 0x40], rcx
mov qword [rbx + 0x48], rcx
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
mov qword [rbx + 0x58], rcx
mov qword [rbx + 0x60], rcx
add rcx, 4
mov qword [rbx + 0x50], rcx
mov rax, qword [rbx + 0x48]
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140047888
mov rax, qword [rbx + 0x58]
cmp dword [rax], 0x4550
jne 0x140047888
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r15
mov edi, r12d
mov qword [rsp + 0x48], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov rsi, rax
mov edx, 0x9e
lea r8d, [r12 + 0x17]
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_FindResourceW]
test rax, rax
je 0x140046f13
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.1400ef90c
mov rdi, qword [rsp + 0x48]
mov rax, qword [r13 + 0x108]
mov r8, r14
test rax, rax
cmovne r8, rax
mov rdx, r14
test rdi, rdi
cmovne rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400e7a18
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], r12
mov rax, qword [r13 + 0x160]
movzx r8d, word [rax]
mov r9, r12
mov edx, r12d
mov edi, 1
lea r10, [0x140000000]
movzx eax, word [0x140171350]
test ax, ax
je 0x140046f9e
mov rcx, r12
cmp ax, r8w
je 0x140046f90
add edx, edi
add rcx, rdi
mov rax, rcx
shl rax, 4
movzx eax, word [rax + r10 + 0x171350]
test ax, ax
jne 0x140046f6e
jmp 0x140046f9e
movsxd rax, edx
add rax, rax
mov r9, qword [r10 + rax*8 + 0x171358]
movzx r8d, r8w
lea rdx, str.0x_X___b__s__b__
lea rcx, [rsp + 0x20]
call fcn.1400e7a18
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Machine:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140047a7c
nop
mov r9, r14
cmp qword [rax + 8], r12
cmovne r9, qword [rax + 8]
lea r8, str.Timestamp:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
nop
mov qword [rsp + 0x50], r15
lea rcx, [rsp + 0x50]
call fcn.1400e712c
mov rax, qword [r13 + 0x160]
movzx r15d, word [rax + 0x12]
mov r8d, r15d
lea rdx, str.0x_X
lea rcx, [rsp + 0x20]
call fcn.1400e7a18
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Characteristics:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
lea rcx, [rsp + 0x20]
call fcn.1400e719c
mov r12d, reloc.SHELL32.dll_ILFindLastID
mov esi, r12d
mov r9d, 0xffff
movzx r8d, word [reloc.d2d1.dll_Ordinal_1]
xor ebx, ebx
test r15w, di
je 0x1400470e3
mov rcx, rbx
cmp r8w, r9w
je 0x1400470e3
movzx eax, r8w
lea rdx, [0x140000000]
cmp ax, di
je 0x1400470aa
inc rcx
mov rax, rcx
shl rax, 4
movzx eax, word [rax + rdx + 0x171250]
cmp ax, r9w
jne 0x14004708b
jmp 0x1400470e3
add rcx, rcx
mov rdx, qword [rdx + rcx*8 + 0x171258]
test rdx, rdx
je 0x1400470e3
lea rcx, [rsp + 0x20]
call fcn.1400e7ce0
lea rdx, [0x1401173ec]
lea rcx, [rsp + 0x20]
call fcn.1400e7ce0
movzx r8d, word [reloc.d2d1.dll_Ordinal_1]
mov r9d, 0xffff
add di, di
dec rsi
jne 0x140047071
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Details:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
mov rax, qword [r13 + 0x168]
mov edi, 0x20b
cmp word [rax + 0x18], di
sete al
lea rcx, str.64_bit_PE
lea r9, str.32_bit_PE
xor r13d, r13d
test al, al
cmovne r9, rcx
lea r8, [0x140117440]
lea rdx, [rsp + 0x30]
call fcn.1400478b0
mov rbx, qword [rsp + 0x60]
mov rax, qword [rbx + 0x58]
cmp word [rax + 0x18], di
jne 0x140047159
mov rax, qword [rbx + 0x60]
movzx edx, word [rax + 0x42]
movzx ecx, word [rax + 0x40]
movzx r8d, cx
shl r8d, 0x10
movzx eax, dx
or r8d, eax
movzx r9d, r8w
shr r8d, 0x10
lea rsi, str._u._02u
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1400e7a18
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Required_OS_ver:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
mov rax, qword [rbx + 0x58]
cmp word [rax + 0x18], di
jne 0x1400471b9
mov rax, qword [rbx + 0x60]
movzx edx, word [rax + 0x46]
movzx ecx, word [rax + 0x44]
movzx r8d, cx
shl r8d, 0x10
movzx eax, dx
or r8d, eax
movzx r9d, r8w
shr r8d, 0x10
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1400e7a18
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Image_ver:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
mov rax, qword [rbx + 0x58]
cmp word [rax + 0x18], di
jne 0x140047212
mov rax, qword [rbx + 0x60]
movzx edx, word [rax + 0x4a]
movzx ecx, word [rax + 0x48]
movzx r8d, cx
shl r8d, 0x10
movzx eax, dx
or r8d, eax
movzx r9d, r8w
shr r8d, 0x10
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1400e7a18
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Subsystem_version:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
mov rax, qword [rbx + 0x58]
cmp word [rax + 0x18], di
jne 0x14004726b
mov rax, qword [rbx + 0x60]
mov r8d, dword [rax + 0x58]
lea rdx, [0x1401174c8]
lea rcx, [rsp + 0x20]
call fcn.1400e7a18
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Checksum:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
mov rax, qword [rbx + 0x58]
cmp word [rax + 0x18], di
jne 0x1400472ae
mov rax, qword [rbx + 0x60]
movzx edx, word [rax + 0x5c]
mov r9, r13
mov rax, qword [rbx + 0x58]
cmp word [rax + 0x18], di
jne 0x1400472c3
mov rax, qword [rbx + 0x60]
movzx ecx, word [rax + 0x5c]
cmp cx, 0x11
jae 0x1400472df
movzx eax, cx
lea r9, [0x140000000]
mov r9, qword [r9 + rax*8 + 0x1071f0]
movzx r8d, dx
lea rdx, str._u___s_
lea rcx, [rsp + 0x20]
call fcn.1400e7a18
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Subsystem:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
mov rax, qword [rbx + 0x58]
cmp word [rax + 0x18], di
jne 0x140047322
mov rax, qword [rbx + 0x60]
movzx esi, word [rax + 0x5e]
movzx r8d, si
lea rdx, str._0x_X
lea rcx, [rsp + 0x20]
call fcn.1400e7a18
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Dll_characteristics:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
lea rcx, [rsp + 0x20]
call fcn.1400e719c
mov r15d, 1
movzx edi, r15w
movzx r8d, word [0x1401711c0]
test di, si
je 0x1400473ed
mov rcx, r13
mov r9d, 0xffff
cmp r8w, r9w
je 0x1400473c2
movzx eax, r8w
lea rdx, [0x140000000]
cmp ax, di
je 0x1400473b5
add rcx, r15
mov rax, rcx
shl rax, 4
movzx eax, word [rax + rdx + 0x1711c0]
cmp ax, r9w
jne 0x140047396
jmp 0x1400473c2
add rcx, rcx
mov rdx, qword [rdx + rcx*8 + 0x1711c8]
jmp 0x1400473c5
mov rdx, r13
test rdx, rdx
je 0x1400473ed
lea rcx, [rsp + 0x20]
call fcn.1400e7ce0
lea rdx, [0x1401173ec]
lea rcx, [rsp + 0x20]
call fcn.1400e7ce0
movzx r8d, word [0x1401711c0]
add di, di
sub r12, r15
jne 0x140047377
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Details:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
mov rdi, qword [rbx + 0x58]
mov esi, 0x20b
mov rax, qword [rbx + 0x40]
mov r15b, r13b
mov qword [rsp + 0x50], rax
cmp word [rdi + 0x18], si
jne 0x140047516
mov rdi, qword [rbx + 0x60]
mov r12d, dword [rdi + 0xb8]
test r12d, r12d
je 0x140047601
movzx eax, word [rdi + 0x14]
lea rsi, [rdi + 0x18]
add rsi, rax
xor eax, eax
cmp ax, word [rdi + 6]
jae 0x14004748c
mov r8d, 8
lea rdx, str..debug
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
je 0x140047487
inc r13d
add rsi, 0x28
movzx eax, word [rdi + 6]
cmp r13d, eax
jb 0x14004745b
jmp 0x14004748c
xor r13d, r13d
jmp 0x140047492
xor r13d, r13d
mov esi, r13d
test rsi, rsi
je 0x1400474b1
cmp dword [rsi + 0xc], r12d
jne 0x1400474b1
mov eax, dword [rsi + 0x14]
add rax, qword [rsp + 0x50]
imul esi, dword [rdi + 0xbc], 0x1c
jmp 0x1400475e8
movzx eax, word [rdi + 0x14]
lea rcx, [rdi + 0x18]
add rcx, rax
mov edx, r13d
movzx r9d, word [rdi + 6]
test r9d, r9d
je 0x1400474ef
mov eax, dword [rcx + 8]
test eax, eax
jne 0x1400474d3
mov eax, dword [rcx + 0x10]
mov r8d, dword [rcx + 0xc]
cmp r12d, r8d
jb 0x1400474e4
add eax, r8d
cmp r12d, eax
jb 0x1400474f2
inc edx
add rcx, 0x28
cmp edx, r9d
jb 0x1400474c9
mov rcx, r13
test rcx, rcx
je 0x1400475fc
mov esi, dword [rdi + 0xbc]
mov r8, qword [rsp + 0x50]
mov rdx, rdi
mov ecx, r12d
call fcn.140047964
jmp 0x1400475e8
mov r12d, dword [rdi + 0xa8]
test r12d, r12d
je 0x140047601
movzx eax, word [rdi + 0x14]
lea rsi, [rdi + 0x18]
add rsi, rax
xor eax, eax
cmp ax, word [rdi + 6]
jae 0x14004756a
mov r8d, 8
lea rdx, str..debug
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
je 0x140047565
inc r13d
add rsi, 0x28
movzx eax, word [rdi + 6]
cmp r13d, eax
jb 0x140047539
jmp 0x14004756a
xor r13d, r13d
jmp 0x140047570
xor r13d, r13d
mov esi, r13d
test rsi, rsi
je 0x14004758c
cmp dword [rsi + 0xc], r12d
jne 0x14004758c
mov eax, dword [rsi + 0x14]
add rax, qword [rsp + 0x50]
imul esi, dword [rdi + 0xac], 0x1c
jmp 0x1400475e8
movzx eax, word [rdi + 0x14]
lea rcx, [rdi + 0x18]
add rcx, rax
mov edx, r13d
movzx r9d, word [rdi + 6]
test r9d, r9d
je 0x1400475ca
mov eax, dword [rcx + 8]
test eax, eax
jne 0x1400475ae
mov eax, dword [rcx + 0x10]
mov r8d, dword [rcx + 0xc]
cmp r12d, r8d
jb 0x1400475bf
add eax, r8d
cmp r12d, eax
jb 0x1400475cd
inc edx
add rcx, 0x28
cmp edx, r9d
jb 0x1400475a4
mov rcx, r13
test rcx, rcx
je 0x1400475fc
mov esi, dword [rdi + 0xac]
mov r8, qword [rsp + 0x50]
mov rdx, rdi
mov ecx, r12d
call fcn.140047964
test rax, rax
je 0x1400475fc
movzx r15d, r15b
test esi, esi
mov eax, 1
cmovne r15d, eax
mov esi, 0x20b
lea rax, [0x140117550]
lea r9, [0x140117558]
test r15b, r15b
cmovne r9, rax
lea r8, str.Debug_info:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
mov rax, qword [rbx + 0x58]
mov r13, qword [rbx + 0x40]
xor r15d, r15d
mov edi, r15d
cmp word [rax + 0x18], si
jne 0x1400476cc
mov rax, qword [rbx + 0x60]
mov r12d, dword [rax + 0xa8]
test r12d, r12d
je 0x14004775e
mov r15d, dword [rax + 0xac]
test r15d, r15d
jle 0x14004775e
mov r14d, 1
mov esi, r12d
add rsi, r13
movzx r8d, word [rsi + 6]
lea rdx, str.__Type:______X
lea rcx, [rbp - 0x80]
call qword [sym.imp.msvcrt.dll__swprintf]
movzx ecx, word [rsi + 6]
dec ecx
je 0x1400476a8
dec ecx
je 0x14004769f
cmp ecx, 2
jne 0x1400476b9
lea rdx, str._TS_STACK_SIGNED_
jmp 0x1400476af
lea rdx, str._PKCS_SIGNED_DATA_
jmp 0x1400476af
lea rdx, str._X509_
lea rcx, [rbp - 0x80]
call qword [sym.imp.msvcrt.dll_wcscat]
sub r15d, dword [rsi]
add r12d, dword [rsi]
add edi, r14d
test r15d, r15d
jg 0x140047669
jmp 0x140047752
mov r12d, dword [rax + 0x98]
test r12d, r12d
je 0x14004775e
mov r15d, dword [rax + 0x9c]
test r15d, r15d
jle 0x14004775e
mov r14d, 1
mov esi, r12d
add rsi, r13
movzx r8d, word [rsi + 6]
lea rdx, str.__Type:______X
lea rcx, [rbp + 0x110]
call qword [sym.imp.msvcrt.dll__swprintf]
movzx ecx, word [rsi + 6]
dec ecx
je 0x140047730
dec ecx
je 0x140047727
cmp ecx, 2
jne 0x140047744
lea rdx, str._TS_STACK_SIGNED_
jmp 0x140047737
lea rdx, str._PKCS_SIGNED_DATA_
jmp 0x140047737
lea rdx, str._X509_
lea rcx, [rbp + 0x110]
call qword [sym.imp.msvcrt.dll_wcscat]
sub r15d, dword [rsi]
add r12d, dword [rsi]
add edi, r14d
test r15d, r15d
jg 0x1400476ee
lea r14, [0x14012da68]
mov rbx, qword [rsp + 0x60]
mov r8d, edi
lea rdx, [0x140111df8]
lea rcx, [rsp + 0x20]
call fcn.1400e7a18
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Certificates:
lea rdx, [rsp + 0x30]
call fcn.1400478b0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140047aac
test al, al
je 0x1400477c3
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Import
lea rdx, [rsp + 0x30]
call fcn.1400478b0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140047ecc
test al, al
je 0x1400477f4
mov r9, r14
mov rax, qword [rsp + 0x28]
test rax, rax
cmovne r9, rax
lea r8, str.Export
lea rdx, [rsp + 0x30]
call fcn.1400478b0
lea rdx, str.__table_
lea rcx, [rsp + 0x30]
call fcn.1400e7ce0
lea rdx, str.__body_
lea rcx, [rsp + 0x30]
call fcn.1400e7ce0
lea rdx, str.__html_
lea rcx, [rsp + 0x30]
call fcn.1400e7ce0
mov rcx, qword [rsp + 0x68]
call fcn.1400f18a4
mov rax, qword [rsp + 0x38]
test rax, rax
cmovne r14, rax
mov rdx, r14
mov rcx, qword [rsp + 0x68]
call fcn.1400f180c
nop
lea rbx, vtable.micro::utils::QString.0
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x20]
call fcn.1400e712c
nop
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x40]
call fcn.1400e712c
nop
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x30]
call fcn.1400e712c
mov eax, 1
jmp 0x14004788a
xor al, al
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.140001010
add rsp, 0x3b8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret