Function at 0x1400c6af4
Capabilities:
Enumerate pe sections

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd8
mov rax, qword [0x14016f608]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x140]
xor ebx, ebx
mov r13, qword [rsp + 0x148]
mov rdi, rcx
mov r15, qword [rsp + 0x150]
xor ecx, ecx
mov qword [r8], rbx
mov r12, r8
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x158]
mov dword [r9], ebx
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], rax
mov qword [r11 - 0x68], rcx
mov qword [r11 - 0x60], rcx
mov byte [r13], bl
test rax, rax
je 0x1400c6b87
mov byte [rax], bl
mov rcx, qword [0x14016f048]
lea r14, [0x14016f048]
cmp rcx, r14
je 0x1400c6bd1
test byte [rcx + 0x1c], 4
je 0x1400c6bd1
cmp byte [rcx + 0x19], 5
jb 0x1400c6bd1
mov r9, qword [rdi + 0x38]
lea r8, [0x14014f560]
mov eax, dword [rdi + 0x38]
mov edx, reloc.OLEAUT32.dll_QueryPathOfRegTypeLib
mov rcx, qword [rcx + 0x10]
sar r9, 0x20
mov dword [rsp + 0x20], eax
call fcn.14000fa80
mov rcx, qword [0x14016f048]
cmp byte [rdi + 0x48], bl
jne 0x1400c6e1d
mov rax, qword [rdi + 0x18]
cmp qword [rdi + 0x38], rax
jl 0x1400c6bfc
lea r8, [0x14014605c]
mov edx, 0xd30
lea rcx, str.base_stor_blb_blbimg_backfile.cxx
call fcn.140082070
mov r8, r15
mov rdx, r13
mov rcx, rdi
call fcn.1400c53e0
test eax, eax
jne 0x1400c6c15
mov al, 1
jmp 0x1400c7635
cmp byte [r13], bl
jne 0x1400c7633
mov rbx, qword [rdi + 0x38]
mov ebp, 0x10000
mov dword [r15 + 0x10], ebx
mov rax, rbx
shr rax, 0x20
mov r14d, ebp
mov dword [r15 + 0x14], eax
mov rax, qword [rdi + 0x38]
mov rsi, qword [rdi + 0x18]
mov qword [rsp + 0x80], rbx
cmp rax, rsi
jl 0x1400c6c6f
lea r8, [0x14014f390]
mov edx, 0xd43
lea rcx, str.base_stor_blb_blbimg_backfile.cxx
call fcn.140082070
mov rax, qword [rdi + 0x38]
mov rsi, qword [rdi + 0x18]
add rax, rbp
mov qword [rsp + 0x88], rsi
cmp rax, rsi
jle 0x1400c6ca3
lea r8, [0x14014605c]
mov edx, 0xd4b
lea rcx, str.base_stor_blb_blbimg_backfile.cxx
call fcn.140082070
mov rsi, qword [rdi + 0x18]
mov qword [rsp + 0x88], rsi
mov rcx, rdi
call fcn.1400cd2c0
test al, al
je 0x1400c6cfa
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c6cf1
test byte [rcx + 0x1c], 4
je 0x1400c6cf1
cmp byte [rcx + 0x19], 5
jb 0x1400c6cf1
mov r9d, dword [rdi + 0xac]
lea r8, [0x14014f560]
mov rcx, qword [rcx + 0x10]
mov edx, 0xa4
call fcn.1400049f8
mov rcx, qword [0x14016f048]
mov r14d, dword [rdi + 0xac]
jmp 0x1400c6d08
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c6d79
test byte [rcx + 0x1c], 4
je 0x1400c6d47
cmp byte [rcx + 0x19], 5
jb 0x1400c6d47
mov eax, dword [rsp + 0x84]
lea r8, [0x14014f560]
mov rcx, qword [rcx + 0x10]
mov edx, 0xa5
mov dword [rsp + 0x28], ebx
mov r9d, r14d
mov dword [rsp + 0x20], eax
call fcn.1400abf8c
mov rcx, qword [0x14016f048]
cmp rcx, r13
je 0x1400c6d79
test byte [rcx + 0x1c], 4
je 0x1400c6d79
cmp byte [rcx + 0x19], 5
jb 0x1400c6d79
mov r9d, dword [rsp + 0x8c]
lea r8, [0x14014f560]
mov rcx, qword [rcx + 0x10]
mov edx, 0xa6
mov dword [rsp + 0x20], esi
call fcn.14000fa80
mov rdx, qword [rsp + 0x98]
mov r9, r15
mov rcx, qword [rdi]
mov r8d, r14d
call fcn.1400ba468
mov r8, qword [rsp + 0xa0]
movabs rax, 0x7ff8007ff8007ff9
imul qword [rdi + 0x40]
mov rcx, rdi
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x90]
mov dword [rax], edx
mov rdx, r12
call fcn.1400c5d48
mov rcx, qword [rsp + 0xa8]
mov dword [rcx], r14d
mov rcx, qword [0x14016f048]
cmp rcx, r13
je 0x1400c6e10
test byte [rcx + 0x1c], 4
je 0x1400c6e10
cmp byte [rcx + 0x19], 5
jb 0x1400c6e10
mov r9, qword [r12]
lea r8, [0x14014f560]
mov eax, dword [r12]
mov edx, 0xa7
mov rcx, qword [rcx + 0x10]
sar r9, 0x20
mov dword [rsp + 0x20], eax
call fcn.14000fa80
add qword [rdi + 0x40], rbp
add qword [rdi + 0x38], rbp
jmp 0x1400c6c0e
cmp rcx, r14
je 0x1400c6e47
test byte [rcx + 0x1c], 4
je 0x1400c6e47
cmp byte [rcx + 0x19], 5
jb 0x1400c6e47
mov r9d, dword [rdi + 0x68]
lea r8, [0x14014f560]
mov rcx, qword [rcx + 0x10]
mov edx, 0xa8
call fcn.1400049f8
mov rcx, rdi
call fcn.1400cb62c
xor r14d, r14d
mov ebp, 0x10000
movabs rsi, 0x7ff8007ff8007ff9
mov eax, dword [rdi + 0x68]
mov ebx, ebp
mov r12d, eax
sub ebx, eax
add r12, qword [rdi + 0x60]
cmp ebx, 0x20
jb 0x1400c6e87
mov ecx, dword [r12 + 0x10]
cmp ebx, ecx
jb 0x1400c6e87
add eax, ecx
mov dword [rdi + 0x68], eax
jmp 0x1400c6fb8
test ebx, ebx
je 0x1400c6e9a
mov rcx, qword [rdi + 0x50]
mov rdx, r12
mov r8d, ebx
call sub.msvcrt.dll_memcpy
mov rcx, rdi
mov r12, qword [rdi + 0x50]
cmp byte [rdi + 0xf8], r14b
je 0x1400c75f3
call fcn.1400cb720
test al, al
je 0x1400c759b
mov r14d, ebx
cmp ebx, 0x20
jae 0x1400c6edd
mov rax, qword [rdi + 0x50]
mov r8d, 0x20
mov rdx, qword [rdi + 0x60]
sub r8d, ebx
lea rcx, [rbx + rax]
call sub.msvcrt.dll_memcpy
mov esi, dword [r12 + 0x10]
cmp esi, 0x10020
ja 0x1400c7549
cmp esi, ebx
jb 0x1400c7501
mov rcx, qword [rdi + 0x50]
sub esi, ebx
mov rdx, qword [rdi + 0x60]
add rcx, r14
cmp esi, ebp
jae 0x1400c6f1a
mov r8d, esi
call sub.msvcrt.dll_memcpy
add dword [rdi + 0x68], esi
xor r14d, r14d
jmp 0x1400c6fae
mov eax, 0x200
mov r8d, 0x80
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r8
movups xmm1, xmmword [rdx + 0x70]
add rdx, r8
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x1400c6f25
xor r14d, r14d
cmp byte [rdi + 0xf8], r14b
je 0x1400c74ba
mov rcx, rdi
call fcn.1400cb720
test al, al
je 0x1400c7485
mov rdx, qword [rdi + 0x60]
lea ecx, [rbx + 0x10000]
add rcx, qword [rdi + 0x50]
add esi, 0xffff0000
mov r8d, esi
call sub.msvcrt.dll_memcpy
add dword [rdi + 0x68], esi
movabs rsi, 0x7ff8007ff8007ff9
mov ebx, 0x10
lea rdx, [0x14014f148]
mov r8d, ebx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1400c736d
mov r9d, dword [r12 + 0x10]
cmp r9d, 0x20
jb 0x1400c7328
test r9b, 0xf
jne 0x1400c7328
mov r8d, dword [r12 + 0x18]
mov r10d, dword [r12 + 0x14]
cmp r10d, r8d
ja 0x1400c72dd
cmp dword [r12 + 0x1c], r14d
jne 0x1400c72dd
lea eax, [r10 + 0x20]
cmp eax, r9d
ja 0x1400c72dd
test r8d, 0x1ff
jne 0x1400c72dd
test r8d, r8d
je 0x1400c72dd
test r10d, r10d
jne 0x1400c705a
movzx eax, r8w
test eax, eax
jne 0x1400c7103
cmp r8d, 0x200000
jae 0x1400c7103
add qword [rdi + 0x40], r8
jmp 0x1400c6e61
mov r11, qword [rdi + 0x40]
mov rax, rsi
imul r11
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r11
imul rcx, rdx, 0x200200
sub rax, rcx
jne 0x1400c7184
cmp r8d, 0x200
jne 0x1400c714a
mov r8, qword [rdi + 0xd0]
lea rax, [r11 + 0x200]
mov rcx, qword [rdi + 0x138]
mov rdx, r12
mov qword [rdi + 0x40], rax
call fcn.1400b6490
test al, al
jne 0x1400c6e61
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7592
test byte [rcx + 0x1c], 4
je 0x1400c7592
cmp byte [rcx + 0x19], 2
jb 0x1400c7592
mov edx, VariantTimeToSystemTime
mov eax, dword [r12 + 0x1c]
mov r9d, dword [r12 + 0x14]
mov dword [rsp + 0x30], eax
mov eax, dword [r12 + 0x10]
jmp 0x1400c7531
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7592
test byte [rcx + 0x1c], 4
je 0x1400c7592
cmp byte [rcx + 0x19], 2
jb 0x1400c7592
mov dword [rsp + 0x30], r14d
mov edx, 0xb3
mov dword [rsp + 0x28], r9d
xor r9d, r9d
mov dword [rsp + 0x20], r8d
jmp 0x1400c753e
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7592
test byte [rcx + 0x1c], 4
je 0x1400c7592
cmp byte [rcx + 0x19], 2
jb 0x1400c7592
mov edx, VariantTimeToSystemTime
mov dword [rsp + 0x30], r14d
jmp 0x1400c7316
cmp r8d, ebp
je 0x1400c71ea
mov al, byte [rdi + 0xf8]
test al, al
jne 0x1400c7198
cmp r8d, ebp
jbe 0x1400c71ea
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7592
test byte [rcx + 0x1c], 4
je 0x1400c7592
cmp byte [rcx + 0x19], 2
jb 0x1400c7592
mov rcx, qword [rcx + 0x10]
movzx eax, al
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r9d
mov r9d, r10d
mov dword [rsp + 0x20], r8d
call fcn.1400c26f0
jmp 0x1400c7592
mov r8, qword [rsp + 0x98]
mov rax, rsi
imul r11
sar rdx, 0x14
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, qword [rsp + 0x90]
mov dword [rax], edx
mov rdx, r12
mov rcx, qword [rdi + 0x138]
call fcn.1400b6490
test al, al
jne 0x1400c7258
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7592
test byte [rcx + 0x1c], 4
je 0x1400c7592
cmp byte [rcx + 0x19], 2
jb 0x1400c7592
mov edx, VariantTimeToSystemTime
jmp 0x1400c70eb
mov rcx, qword [r15 + 0x18]
mov qword [r15], r14
mov eax, dword [r12 + 0x18]
mov qword [r15 + 8], rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rsp + 0x80]
mov rcx, rdi
mov r8, qword [rsp + 0xa0]
mov rdx, rbx
call fcn.1400c5d48
mov rcx, qword [rsp + 0xa8]
mov eax, dword [r12 + 0x18]
mov dword [rcx], eax
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c72cf
test byte [rcx + 0x1c], 4
je 0x1400c72cf
cmp byte [rcx + 0x19], 5
jb 0x1400c72cf
mov r9, qword [rbx]
lea r8, [0x14014f560]
mov rcx, qword [rcx + 0x10]
mov edx, reloc.OLEAUT32.dll_VariantTimeToSystemTime
call fcn.1400ac878
mov eax, dword [r12 + 0x18]
add qword [rdi + 0x40], rax
jmp 0x1400c6c0e
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7592
test byte [rcx + 0x1c], 4
je 0x1400c7592
cmp byte [rcx + 0x19], 2
jb 0x1400c7592
mov eax, dword [r12 + 0x1c]
mov edx, 0xb2
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r9d
mov r9d, r10d
mov dword [rsp + 0x20], r8d
jmp 0x1400c753e
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7592
test byte [rcx + 0x1c], 4
je 0x1400c7592
cmp byte [rcx + 0x19], 2
jb 0x1400c7592
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014f560]
mov edx, 0xb1
call fcn.1400049f8
jmp 0x1400c7592
mov r8, rbx
lea rdx, [rsp + 0xb0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_RtlCompareMemory]
cmp rax, rbx
jne 0x1400c73d4
cmp byte [rdi + 0xf8], r14b
jne 0x1400c73d4
mov rcx, rdi
call fcn.1400cd548
mov byte [r13], al
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7633
test byte [rcx + 0x1c], 4
je 0x1400c7633
cmp byte [rcx + 0x19], 4
jb 0x1400c7633
mov r9d, dword [rdi + 0x68]
mov edx, 0xb0
jmp 0x1400c7623
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7592
test byte [rcx + 0x1c], 4
je 0x1400c7592
cmp byte [rcx + 0x19], 2
jb 0x1400c7592
movzx eax, byte [rdi + 0xf8]
movzx r9d, byte [r12 + 0xd]
movzx edx, byte [r12 + 0xf]
movzx r8d, byte [r12 + 0xe]
movzx r10d, byte [r12 + 0xc]
movzx r11d, byte [r12 + 0xb]
movzx ebx, byte [r12 + 0xa]
movzx edi, byte [r12 + 9]
movzx esi, byte [r12 + 8]
movzx ebp, word [r12 + 6]
movzx r14d, word [r12 + 4]
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x68], edx
mov dword [rsp + 0x60], r8d
mov dword [rsp + 0x58], r9d
mov r9d, dword [r12]
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], r14d
call fcn.1400c24e4
jmp 0x1400c7592
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c75cf
test byte [rcx + 0x1c], 4
je 0x1400c75cf
cmp byte [rcx + 0x19], 2
jb 0x1400c75cf
mov edx, 0xae
jmp 0x1400c75bf
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7592
test byte [rcx + 0x1c], 4
je 0x1400c7592
cmp byte [rcx + 0x19], 2
jb 0x1400c7592
mov rax, qword [rdi + 0x38]
sub ebp, esi
mov rcx, qword [rcx + 0x10]
mov r9d, ebp
mov qword [rsp + 0x20], rax
call fcn.1400c2830
jmp 0x1400c7592
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7592
test byte [rcx + 0x1c], 4
je 0x1400c7592
cmp byte [rcx + 0x19], 2
jb 0x1400c7592
mov eax, dword [r12 + 0x14]
mov edx, 0xac
mov dword [rsp + 0x30], ebx
mov r9d, esi
mov dword [rsp + 0x28], eax
mov eax, dword [r12 + 0x18]
mov dword [rsp + 0x20], eax
mov rcx, qword [rcx + 0x10]
call fcn.1400c268c
jmp 0x1400c7592
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7592
test byte [rcx + 0x1c], 4
je 0x1400c7592
cmp byte [rcx + 0x19], 2
jb 0x1400c7592
mov eax, dword [r12 + 0x14]
lea r8, [0x14014f560]
mov rcx, qword [rcx + 0x10]
mov edx, 0xab
mov dword [rsp + 0x28], eax
mov r9d, esi
mov eax, dword [r12 + 0x18]
mov dword [rsp + 0x20], eax
call fcn.1400abf8c
mov qword [r15], 0xffffffffc0000102
jmp 0x1400c75e4
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c75cf
test byte [rcx + 0x1c], 4
je 0x1400c75cf
cmp byte [rcx + 0x19], 2
jb 0x1400c75cf
mov edx, 0xaa
mov rcx, qword [rcx + 0x10]
lea r8, [0x14014f560]
call fcn.1400049d8
mov rax, qword [rdi + 0x110]
mov qword [r15], rax
mov rax, qword [rdi + 0x118]
mov qword [r15 + 8], rax
mov rcx, qword [r15 + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400c6c0e
call fcn.1400cd548
mov byte [r13], al
mov rcx, qword [0x14016f048]
lea r13, [0x14016f048]
cmp rcx, r13
je 0x1400c7633
test byte [rcx + 0x1c], 4
je 0x1400c7633
cmp byte [rcx + 0x19], 4
jb 0x1400c7633
mov edx, 0xa9
mov r9d, ebx
mov rcx, qword [rcx + 0x10]
movzx eax, al
mov dword [rsp + 0x20], eax
call fcn.1400c27e4
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14013e2a0
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret