Function at 0x14002b79c
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14006d678]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r15, qword [rsp + 0xb0]
mov rsi, r9
mov r12d, edx
mov r14, r8
mov rbp, rcx
test r15, r15
je 0x14002b7d7
and dword [r15], 0
test r14, r14
je 0x14002ba36
test rsi, rsi
je 0x14002ba36
and qword [rsp + 0x38], 0
or dword [rsp + 0x40], 0xffffffff
mov dword [r9], r12d
mov rax, qword [rcx + 0x68]
mov rcx, qword [rax + 0x20]
mov eax, dword [rcx + r12*4]
mov qword [r9 + 8], rax
movzx eax, word [r8 + 4]
mov word [r9 + 0x10], ax
movzx eax, word [r8 + 6]
mov word [r9 + 0x12], ax
movzx eax, word [r8 + 8]
mov word [r9 + 0x14], ax
movzx eax, word [r8 + 0xa]
mov word [r9 + 0x16], ax
movzx ecx, word [r8 + 0xe]
movzx edx, word [r8 + 0xc]
mov eax, ecx
shr eax, 9
add eax, 0x50
mov dword [rsp + 0x34], eax
mov eax, ecx
shr eax, 5
and ecx, 0x1f
and eax, 0xf
mov dword [rsp + 0x2c], ecx
dec eax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov eax, edx
shr eax, 0xb
mov dword [rsp + 0x28], eax
mov eax, edx
shr eax, 5
and edx, 0x1f
and eax, 0x3f
add edx, edx
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], edx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__mktime64]
mov qword [rsi + 0x18], rax
mov edi, 0x1ff
mov eax, dword [r14 + 0x10]
lea rdx, [r14 + 0x2e]
mov dword [rsi + 0x20], eax
mov eax, dword [r14 + 0x14]
mov qword [rsi + 0x28], rax
mov eax, dword [r14 + 0x18]
mov qword [rsi + 0x30], rax
movzx eax, word [r14 + 0x24]
mov word [rsi + 0x38], ax
mov eax, dword [r14 + 0x26]
mov dword [rsi + 0x3c], eax
mov eax, dword [r14 + 0x2a]
mov qword [rsi + 0x40], rax
mov eax, edi
movzx ecx, word [r14 + 0x1c]
cmp ecx, edi
cmovb eax, ecx
lea rcx, [rsi + 0x58]
mov r8d, eax
mov ebx, eax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi + 0x58], 0
movzx eax, word [r14 + 0x20]
cmp eax, edi
cmovb edi, eax
mov dword [rsi + 0x48], edi
movzx edx, word [r14 + 0x1c]
movzx ecx, word [r14 + 0x1e]
add rdx, r14
add rcx, 0x2e
mov r8d, edi
add rdx, rcx
lea rcx, [rsi + 0x258]
call sub.VCRUNTIME140.dll_memcpy
mov edx, r12d
mov byte [rdi + rsi + 0x258], 0
mov rcx, rbp
call fcn.14002d030
mov dword [rsi + 0x4c], eax
mov edx, r12d
mov rcx, rbp
call fcn.14002d08c
mov edx, r12d
mov dword [rsi + 0x50], eax
mov rcx, rbp
call fcn.14002d0d0
mov rcx, qword [rsi + 0x28]
mov ebx, 0xffffffff
cmp rcx, qword [rsi + 0x30]
mov r11d, 1
mov dword [rsi + 0x54], eax
cmovbe rcx, qword [rsi + 0x30]
mov rax, qword [rsi + 0x40]
cmp rcx, rax
cmova rax, rcx
cmp rax, rbx
jne 0x14002b9b3
movzx edx, word [r14 + 0x1e]
test edx, edx
je 0x14002b9b3
movzx r9d, word [r14 + 0x1c]
add r9, 0x2e
add r9, r14
cmp edx, 4
jb 0x14002ba2d
movzx r8d, word [r9 + 2]
mov eax, edx
lea rcx, [r8 + 4]
cmp rcx, rax
ja 0x14002ba2d
cmp word [r9], r11w
je 0x14002b9bb
add r9, 4
mov eax, 0xfffffffc
add r9, r8
sub eax, r8d
add edx, eax
jne 0x14002b97d
mov eax, r11d
jmp 0x14002ba44
lea rdx, [r9 + 4]
test r15, r15
je 0x14002b9c7
mov dword [r15], r11d
cmp qword [rsi + 0x30], rbx
jne 0x14002b9eb
cmp r8d, 8
jb 0x14002ba2d
mov ecx, dword [rdx + 4]
mov eax, dword [rdx]
add rdx, 8
shl rcx, 0x20
or rcx, rax
mov qword [rsi + 0x30], rcx
add r8d, 0xfffffff8
cmp qword [rsi + 0x28], rbx
jne 0x14002ba0f
cmp r8d, 8
jb 0x14002ba2d
mov ecx, dword [rdx + 4]
mov eax, dword [rdx]
add rdx, 8
shl rcx, 0x20
or rcx, rax
mov qword [rsi + 0x28], rcx
add r8d, 0xfffffff8
cmp qword [rsi + 0x40], rbx
jne 0x14002b9b3
cmp r8d, 8
jb 0x14002ba2d
mov ecx, dword [rdx + 4]
mov eax, dword [rdx]
shl rcx, 0x20
or rcx, rax
mov qword [rsi + 0x40], rcx
jmp 0x14002b9b3
mov dword [rbp + 0x1c], 9
jmp 0x14002ba42
test rbp, rbp
je 0x14002ba42
mov dword [rcx + 0x1c], 0x18
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140056240
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret