Function at 0x14009de88
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov ebp, r9d
mov rdi, r8
mov r14d, edx
mov ebx, ecx
cmp ecx, 6
jae 0x14009debe
lea rdx, [0x1400eb240]
mov rdx, qword [rdx + rbx*8]
jmp 0x14009dec5
lea rdx, str.unknown
lea rcx, str._n___s_n
call fcn.14000bce4
xor esi, esi
test ebx, ebx
je 0x14009e064
dec ebx
je 0x14009e04a
dec ebx
je 0x14009dff9
dec ebx
je 0x14009dfab
dec ebx
je 0x14009df2b
dec ebx
je 0x14009df1a
lea r8d, [rsi + 1]
mov edx, ebp
mov rcx, rdi
call fcn.14001290c
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000bce4
jmp 0x14009e14c
lea rcx, str.____Random_Value_:
call fcn.14000bce4
xor r8d, r8d
jmp 0x14009deff
mov r8d, dword [rdi + 0x10]
movzx edx, word [rdi + 0xc]
mov r9d, dword [rdi + 0x14]
lea rcx, str.____Default_Salt_:__.s_n____Default_Iterations_:__u_n
add r8, rdi
shr rdx, 1
call fcn.14000bce4
movzx r8d, word [rdi + 4]
lea rdx, [rdi + 0x18]
lea r9, str.Credentials
mov rcx, rdi
call fcn.14009e218
movzx r8d, word [rdi + 6]
lea r9, str.ServiceCredentials
mov rdx, rax
mov rcx, rdi
call fcn.14009e218
movzx r8d, word [rdi + 8]
lea r9, str.OldCredentials
mov rdx, rax
mov rcx, rdi
call fcn.14009e218
movzx r8d, word [rdi + 0xa]
lea r9, str.OlderCredentials
mov rdx, rax
mov rcx, rdi
call fcn.14009e218
jmp 0x14009e14c
mov r8d, dword [rdi + 0xc]
movzx edx, word [rdi + 8]
lea rcx, str.____Default_Salt_:__.s_n
add r8, rdi
shr rdx, 1
call fcn.14000bce4
movzx r8d, word [rdi + 4]
lea rdx, [rdi + 0x10]
lea r9, str.Credentials
mov rcx, rdi
call fcn.14009e168
movzx r8d, word [rdi + 6]
lea r9, str.OldCredentials
mov rdx, rax
mov rcx, rdi
call fcn.14009e168
jmp 0x14009e14c
cmp byte [rdi + 3], sil
jbe 0x14009e14c
mov ebp, 0x10
lea ebx, [rsi + 1]
lea rcx, str._____02u
mov edx, ebx
call fcn.14000bce4
mov ecx, esi
xor r8d, r8d
inc rcx
mov edx, ebp
shl rcx, 4
add rcx, rdi
call fcn.14001290c
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000bce4
movzx eax, byte [rdi + 3]
mov esi, ebx
cmp ebx, eax
jb 0x14009e008
jmp 0x14009e14c
mov rdx, rbp
lea rcx, str._____.s_n
mov r8, rdi
shr rdx, 1
call fcn.14000bce4
jmp 0x14009e14c
lea rcx, str.____NTLM_:
call fcn.14000bce4
mov ebp, 0x10
cmp byte [rdi + 0x20], sil
je 0x14009e088
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call fcn.14001290c
lea rcx, str._n____LM___:
call fcn.14000bce4
cmp byte [rdi + 0x21], sil
je 0x14009e0a8
lea rcx, [rdi + 0x10]
xor r8d, r8d
mov edx, ebp
call fcn.14001290c
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000bce4
cmp dword [rdi + 0x24], esi
je 0x14009e14c
cmp word [rdi + 0x44], si
je 0x14009e0dc
lea rcx, [rdi + 0x4c]
lea r9, str.NTLM
mov r8d, r14d
mov edx, ebp
mov dword [rsp + 0x20], esi
call fcn.1400b11a8
cmp word [rdi + 0x64], si
je 0x14009e101
movzx edx, word [rdi + 0x64]
lea rcx, [rdi + 0x6c]
lea r9, str.ntlm
mov r8d, r14d
mov dword [rsp + 0x20], 1
call fcn.1400b11a8
cmp word [rdi + 0x2c], si
je 0x14009e120
lea rcx, [rdi + 0x34]
lea r9, str.LM
mov r8d, r14d
mov edx, ebp
mov dword [rsp + 0x20], esi
call fcn.1400b11a8
cmp word [rdi + 0x5c], si
je 0x14009e14c
movzx eax, word [rdi + 0x64]
movzx edx, word [rdi + 0x5c]
lea rcx, [rdi + 0x6c]
lea r9, str.lm
add rcx, rax
mov r8d, r14d
mov dword [rsp + 0x20], 1
call fcn.1400b11a8
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret