Function at 0x1400cf460
Capabilities:
Enumerate pe sections

Disassembly:
test r8d, r8d
je 0x1400cffd7
mov rax, rsp
mov dword [rax + 0x18], r8d
push r13
push r14
sub rsp, 0x88
mov qword [rax + 8], rbx
mov qword [rax - 0x18], rbp
mov qword [rax - 0x20], rsi
mov qword [rax - 0x28], rdi
mov qword [rax - 0x30], r12
xor r12d, r12d
mov r13, rdx
mov r14, rcx
mov qword [rax - 0x38], r15
lea r10d, [r12 + 1]
movabs r11, 0xffffffffffff
nop
nop
mov edx, dword [r13]
cmp edx, 0x454c4946
jne 0x1400cff43
test byte [r13 + 0x16], 1
je 0x1400cff8e
mov rax, qword [r13 + 0x20]
test rax, rax
je 0x1400cf622
test r11, rax
jne 0x1400cf622
mov ecx, dword [r14 + 0x18]
add rcx, 8
call fcn.1400ce030
mov r8d, dword [r14 + 0x18]
mov rdx, r13
lea rcx, [rax + 8]
mov rbx, rax
call fcn.1401a6b10
mov r9, qword [r13 + 0x20]
mov r8, qword [r14 + 0x30]
lea rdx, str.found_extended_MFT_file_record__016I64x_base__016I64x_n
mov ecx, 0xff00ffff
call fcn.1400b3610
lea rcx, str.extended_MFT_type__t_n
mov r8d, 4
mov rdx, r13
call fcn.1400b35e0
movzx edx, word [r13 + 4]
lea rcx, str.extended_MFT_USA_Offset__u_n
call fcn.1400b35e0
movzx edx, word [r13 + 6]
lea rcx, str.extended_MFT_USA_Count__u_n
call fcn.1400b35e0
mov rdx, qword [r13 + 8]
lea rcx, str.extended_MFT_lsn__I64u_n
call fcn.1400b35e0
movzx edx, word [r13 + 0x10]
lea rcx, str.extended_MFT_sequence_number__u_n
call fcn.1400b35e0
movzx edx, word [r13 + 0x12]
lea rcx, str.extended_MFT_name_count__u_n
call fcn.1400b35e0
movzx edx, word [r13 + 0x14]
lea rcx, str.extended_MFT_attribute_offset__u_n
call fcn.1400b35e0
movzx edx, word [r13 + 0x16]
lea rcx, str.extended_MFT_flags__u_n
call fcn.1400b35e0
mov edx, dword [r13 + 0x18]
lea rcx, str.extended_MFT_bytes_in_use__u_n
call fcn.1400b35e0
mov edx, dword [r13 + 0x1c]
lea rcx, str.extended_MFT_bytes_allocated__u_n
call fcn.1400b35e0
mov rdx, qword [r13 + 0x20]
lea rcx, str.extended_MFT_base_frn__u_n
call fcn.1400b35e0
movzx edx, word [r13 + 0x28]
lea rcx, str.extended_MFT_next_attribute_number__u_n
call fcn.1400b35e0
cmp qword [r14 + 0xc0], 0
je 0x1400cf5fc
mov rax, qword [r14 + 0xc8]
mov qword [rax], rbx
jmp 0x1400cf603
mov qword [r14 + 0xc0], rbx
mov qword [rbx], r12
mov r10d, 1
movabs r11, 0xffffffffffff
mov qword [r14 + 0xc8], rbx
jmp 0x1400cff8e
mov rax, qword [r14 + 0x30]
cmp rax, 0x10
jae 0x1400cf636
cmp rax, 5
jne 0x1400cff8e
movzx ecx, word [r13 + 4]
movzx r8d, word [r13 + 6]
add rcx, r13
cmp r8d, 1
jbe 0x1400cf75d
lea r9d, [r8 + r8]
test r9d, r9d
je 0x1400cf6a1
cmp rcx, r13
jb 0x1400cf675
mov edx, dword [r14 + 0x18]
lea rax, [r13 + rdx]
cmp rcx, rax
jae 0x1400cf675
mov eax, r13d
sub eax, ecx
add eax, edx
cmp r9d, eax
jbe 0x1400cf6a1
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b3610
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400cff8e
movzx r10d, word [rcx]
add r8d, 0xffffffff
add rcx, 2
mov r9d, r8d
lea rdx, [r13 + 0x1fe]
shl r9d, 9
je 0x1400cf703
mov r11d, dword [r14 + 0x18]
lea rax, [r13 + r11]
cmp r13, rax
jae 0x1400cf6d0
cmp r9d, r11d
jbe 0x1400cf6f9
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
xor r8d, r8d
mov ecx, 0xffff0000
call fcn.1400b3610
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400cff8e
movabs r11, 0xffffffffffff
test r8d, r8d
je 0x1400cf757
cmp word [rdx], r10w
jne 0x1400cf72f
movzx eax, word [rcx]
add rdx, 0x200
add rcx, 2
add r8d, 0xffffffff
mov word [rdx - 0x200], ax
jne 0x1400cf708
lea r10d, [r8 + 1]
jmp 0x1400cf75d
movzx edx, word [rdx]
lea rcx, str.bad_US__x____x_n
movzx r8d, r10w
call fcn.1400b35e0
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400cff8e
mov r10d, 1
mov r15b, byte [r13 + 0x16]
movzx ebx, word [r13 + 0x14]
xor ebp, ebp
and r15d, 2
mov esi, ebp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x48], 0xffffffffffffffff
mov qword [rsp + 0x40], 0xffffffffffffffff
mov qword [rsp + 0x38], 0xffffffffffffffff
add rbx, r13
mov qword [rsp + 0x30], rbp
mov rdi, rbp
nop
nop
cmp rbx, r13
jb 0x1400cfb62
mov edx, dword [r14 + 0x18]
lea r8, [rdx + r13]
cmp rbx, r8
jae 0x1400cfb62
mov ecx, r13d
sub ecx, ebx
add ecx, edx
cmp ecx, 4
jb 0x1400cfb62
mov eax, dword [rbx]
cmp eax, 0xffffffff
je 0x1400cfb7f
cmp ecx, 8
jb 0x1400cfb43
mov r9d, dword [rbx + 4]
test r9d, r9d
je 0x1400cf7f0
cmp r9d, ecx
ja 0x1400cfb0e
cmp r9d, 0x10
jb 0x1400cfb27
cmp byte [rbx + 9], bpl
jne 0x1400cfaf9
sub eax, 0x10
je 0x1400cfa3a
sub eax, 0x10
je 0x1400cfa1a
sub eax, 0x10
je 0x1400cf8b5
cmp eax, 0x50
jne 0x1400cfaf9
cmp dword [r14 + 0x2c], ebp
je 0x1400cfaf9
test byte [rbx + 8], 1
je 0x1400cf87b
cmp ecx, 0x48
jae 0x1400cf863
mov r8d, ebx
lea r9d, [rax - 8]
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b3610
mov r10d, 1
jmp 0x1400cfaf9
cmp qword [rbx + 0x10], rbp
jne 0x1400cfaf9
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x30], rax
jmp 0x1400cfaf9
cmp ecx, 0x16
jae 0x1400cf8a8
mov r8d, ebx
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, reloc.WS2_32.dll_shutdown
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b3610
mov r10d, 1
jmp 0x1400cfaf9
mov eax, dword [rbx + 0x10]
mov qword [rsp + 0x30], rax
jmp 0x1400cfaf9
test byte [rbx + 8], 1
jne 0x1400cfa03
cmp ecx, 0x16
jae 0x1400cf8ec
mov r8d, ebx
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, reloc.WS2_32.dll_shutdown
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b3610
mov r10d, 1
jmp 0x1400cfaf9
movzx ecx, word [rbx + 0x14]
add rcx, rbx
cmp rcx, r13
jb 0x1400cf9db
cmp rcx, r8
jae 0x1400cf9db
mov eax, r13d
sub eax, ecx
add edx, eax
cmp edx, 0x42
jb 0x1400cf9db
movzx eax, byte [rcx + 0x40]
lea r9d, [rax + rax + 0x42]
test r9d, r9d
je 0x1400cf94a
cmp r9d, edx
jbe 0x1400cf94a
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b3610
mov r10d, 1
jmp 0x1400cfaf9
movzx eax, byte [rcx + 0x41]
cmp al, 1
je 0x1400cf97c
cmp al, 3
je 0x1400cf97c
test al, al
je 0x1400cf97c
cmp al, 2
je 0x1400cfaf9
lea rcx, str.bad_name_flag__02x_n
movzx edx, al
call fcn.1400b35e0
mov r10d, 1
jmp 0x1400cfaf9
mov rdx, qword [rcx]
and rdx, r11
cmp rdx, 0x10
jae 0x1400cf9a5
cmp rdx, 5
je 0x1400cf9a5
lea rcx, str.ignore_name_attr_for_internal_ntfs_folder__016I64x_n
call fcn.1400b35e0
mov r10d, 1
jmp 0x1400cfaf9
test rdi, rdi
je 0x1400cf9c7
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xa8], rcx
mov qword [rax + 0x28], rcx
mov qword [rcx + 0x28], rbp
jmp 0x1400cfaf9
mov rdi, rcx
mov qword [rcx + 0x28], rbp
mov qword [rsp + 0xa8], rcx
jmp 0x1400cfaf9
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 0x42
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b3610
mov r10d, 1
jmp 0x1400cfaf9
lea rcx, str.nonresident_name_attribute_n
call fcn.1400b35e0
mov r10d, 1
jmp 0x1400cfaf9
cmp qword [r13 + 0x20], rbp
je 0x1400cfa32
lea rcx, str.attribute_list_attribute_with_base_frn_n
call fcn.1400b35e0
mov r10d, 1
mov esi, r10d
jmp 0x1400cfaf9
cmp dword [r14 + 0x28], ebp
je 0x1400cfaf9
test r12d, r12d
jne 0x1400cfaf9
test byte [rbx + 8], 1
je 0x1400cfa69
lea rcx, str.nonresident_standard_information_n
call fcn.1400b35e0
lea r10d, [r12 + 1]
jmp 0x1400cfaf9
cmp ecx, 0x16
jae 0x1400cfa93
mov r8d, ebx
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, reloc.WS2_32.dll_shutdown
sub r8d, r13d
mov ecx, 0xffff0000
call fcn.1400b3610
mov r10d, 1
jmp 0x1400cfaf9
movzx ecx, word [rbx + 0x14]
add rcx, rbx
cmp rcx, r13
jb 0x1400cfad6
cmp rcx, r8
jae 0x1400cfad6
mov eax, r13d
sub eax, ecx
add eax, edx
cmp eax, 0x24
jb 0x1400cfad6
mov eax, dword [rcx + 0x20]
mov r12d, r10d
mov dword [rsp + 0x50], eax
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x1400cfaf9
sub ecx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 0x24
mov r8d, ecx
mov ecx, 0xffff0000
call fcn.1400b3610
mov r10d, 1
mov eax, dword [rbx + 4]
movabs r11, 0xffffffffffff
add rbx, rax
jmp 0x1400cf7a0
sub ebx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov ecx, 0xffff0000
mov r8d, ebx
call fcn.1400b3610
jmp 0x1400cfb7f
mov r8d, dword [rbx + 4]
mov rdx, qword [r14 + 0x30]
lea rcx, str._t_I64u:_BAD_record_length__d____d_n
mov r9d, reloc.WS2_32.dll_recv
call fcn.1400b35e0
jmp 0x1400cfb7f
sub ebx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 8
mov r8d, ebx
mov ecx, 0xffff0000
call fcn.1400b3610
jmp 0x1400cfb7f
sub ebx, r13d
lea rdx, str.invalid_file_record_access_at_offset__u_len__u_n
mov r9d, 4
mov r8d, ebx
mov ecx, 0xffff0000
call fcn.1400b3610
mov rdx, qword [r13 + 0x20]
test rdx, rdx
je 0x1400cfd14
mov rax, rdx
movabs rcx, 0xffffffffffff
and rax, rcx
cmp rax, 0x10
jae 0x1400cfbcb
cmp rax, 5
je 0x1400cfbcb
lea rcx, str.ignore_internal_extended_fragmented_file_record__016I64x_n
call fcn.1400b35e0
xor r12d, r12d
movabs r11, 0xffffffffffff
lea r10d, [r12 + 1]
jmp 0x1400cff8e
mov rax, qword [r14 + 0x78]
add rax, 0x50
cmp rax, qword [r14 + 0x80]
jb 0x1400cfbea
lea rcx, [r14 + 0x68]
mov edx, 0x50
call fcn.1400e2f70
mov rsi, qword [r14 + 0x78]
lea rax, [rsi + 0x50]
mov qword [r14 + 0x78], rax
mov rax, qword [r13 + 0x20]
mov qword [rsi + 8], rax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x30], eax
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x18], rax
mov rax, qword [rsp + 0x48]
mov qword [rsi + 0x20], rax
mov rax, qword [rsp + 0x30]
mov dword [rsi + 0x38], r12d
xor r12d, r12d
test rdi, rdi
mov dword [rsi + 0x34], r15d
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x40], r12
mov qword [rsi + 0x48], r12
je 0x1400cfce5
nop
nop
nop
movzx eax, byte [rdi + 0x40]
lea edx, [rax + rax + 0x18]
cmp edx, 0x100
jle 0x1400cfc6e
lea rcx, [r14 + 0x68]
call fcn.1400e3040
mov rbx, rax
jmp 0x1400cfc9a
mov rax, qword [r14 + 0x78]
movsxd r12, edx
lea rcx, [r12 + rax]
cmp rcx, qword [r14 + 0x80]
jb 0x1400cfc8b
lea rcx, [r14 + 0x68]
call fcn.1400e2f70
mov rbx, qword [r14 + 0x78]
lea rax, [rbx + r12]
xor r12d, r12d
mov qword [r14 + 0x78], rax
movzx eax, byte [rdi + 0x40]
lea rdx, [rdi + 0x42]
lea rcx, [rbx + 0x18]
mov byte [rbx + 0x10], al
mov rax, qword [rdi]
mov qword [rbx], rax
movzx r8d, byte [rdi + 0x40]
add r8, r8
call fcn.1401a6b10
cmp qword [rsi + 0x40], rbp
je 0x1400cfccc
mov rax, qword [rsi + 0x48]
mov qword [rax + 8], rbx
jmp 0x1400cfcd0
mov qword [rsi + 0x40], rbx
mov qword [rbx + 8], r12
mov qword [rsi + 0x48], rbx
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400cfc50
cmp qword [r14 + 0x38], rbp
je 0x1400cfcf4
mov rax, qword [r14 + 0x40]
mov qword [rax], rsi
jmp 0x1400cfcf8
mov qword [r14 + 0x38], rsi
mov qword [rsi], r12
mov r10d, 1
movabs r11, 0xffffffffffff
mov qword [r14 + 0x40], rsi
jmp 0x1400cff8e
test esi, esi
je 0x1400cfec8
mov rax, qword [r14 + 0x50]
cmp qword [r14 + 0x48], rax
jne 0x1400cfdb6
mov eax, dword [r14 + 0x60]
mov ebx, dword [r14 + 0x64]
add eax, 1
cmp eax, ebx
jbe 0x1400cfd7b
mov eax, 1
add ebx, ebx
cmove ebx, eax
mov ecx, ebx
shl rcx, 3
call fcn.1400ce030
mov r8d, dword [r14 + 0x60]
mov rdx, qword [r14 + 0x58]
shl r8, 3
mov rcx, rax
mov rsi, rax
call fcn.1401a6b10
mov rcx, qword [r14 + 0x58]
test rcx, rcx
je 0x1400cfd73
call fcn.1400ce0b0
mov qword [r14 + 0x58], rsi
mov dword [r14 + 0x64], ebx
mov ecx, 0x10000
call fcn.1400ce030
mov edx, dword [r14 + 0x60]
mov rcx, qword [r14 + 0x58]
mov qword [rcx + rdx*8], rax
mov edx, dword [r14 + 0x60]
mov rcx, qword [r14 + 0x58]
mov rax, qword [rcx + rdx*8]
mov qword [r14 + 0x48], rax
mov rax, qword [rcx + rdx*8]
add rax, 0xfff0
mov qword [r14 + 0x50], rax
lea eax, [rdx + 1]
mov dword [r14 + 0x60], eax
mov rsi, qword [r14 + 0x48]
lea rax, [rsi + 0x48]
mov qword [r14 + 0x48], rax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsi + 8], rax
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x48]
mov dword [rsi + 0x30], r12d
mov qword [rsi + 0x18], rax
mov rax, qword [rsp + 0x30]
xor r12d, r12d
mov qword [rsi + 0x20], rax
movzx eax, word [r13 + 0x10]
shl rax, 0x30
or rax, qword [r14 + 0x30]
test rdi, rdi
mov qword [rsi + 0x38], r12
mov qword [rsi + 0x40], r12
mov dword [rsi + 0x2c], r15d
mov qword [rsi], rax
je 0x1400cff7e
nop
nop
movzx eax, byte [rdi + 0x40]
lea edx, [rax + rax + 0x18]
cmp edx, 0x100
jle 0x1400cfe3e
lea rcx, [r14 + 0x68]
call fcn.1400e3040
mov rbx, rax
jmp 0x1400cfe6a
mov rax, qword [r14 + 0x78]
movsxd r12, edx
lea rcx, [r12 + rax]
cmp rcx, qword [r14 + 0x80]
jb 0x1400cfe5b
lea rcx, [r14 + 0x68]
call fcn.1400e2f70
mov rbx, qword [r14 + 0x78]
lea rax, [rbx + r12]
xor r12d, r12d
mov qword [r14 + 0x78], rax
movzx eax, byte [rdi + 0x40]
lea rdx, [rdi + 0x42]
lea rcx, [rbx + 0x18]
mov byte [rbx + 0x10], al
mov rax, qword [rdi]
mov qword [rbx], rax
movzx r8d, byte [rdi + 0x40]
add r8, r8
call fcn.1401a6b10
cmp qword [rsi + 0x38], rbp
je 0x1400cfe9c
mov rax, qword [rsi + 0x40]
mov qword [rax + 8], rbx
jmp 0x1400cfea0
mov qword [rsi + 0x38], rbx
mov qword [rbx + 8], r12
mov qword [rsi + 0x40], rbx
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400cfe20
lea r10d, [rdi + 1]
movabs r11, 0xffffffffffff
jmp 0x1400cff8e
movzx eax, word [r13 + 0x10]
shl rax, 0x30
or rax, qword [r14 + 0x30]
test rdi, rdi
mov qword [rsp + 0x20], rax
je 0x1400cff6a
nop
nop
nop
nop
test r15d, r15d
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
lea rax, [rdi + 0x42]
mov qword [rsp + 0x58], rax
movzx eax, byte [rdi + 0x40]
mov byte [rsp + 0x54], al
je 0x1400cff15
or dword [rsp + 0x50], 0x10
jmp 0x1400cff1a
and dword [rsp + 0x50], 0xffffffef
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x20]
call qword [r14 + reloc.WS2_32.dll_recv]
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1400cfef0
xor r12d, r12d
lea r10d, [rdi + 1]
movabs r11, 0xffffffffffff
jmp 0x1400cff8e
cmp dword [0x14020b008], 0
je 0x1400cff8e
lea rcx, str.bad_file_record_type__08x_n
call fcn.1400b35e0
mov r10d, 1
movabs r11, 0xffffffffffff
jmp 0x1400cff8e
xor r12d, r12d
movabs r11, 0xffffffffffff
lea r10d, [r12 + 1]
jmp 0x1400cff8e
mov r10d, 1
movabs r11, 0xffffffffffff
mov eax, dword [r14 + 0x18]
add qword [r14 + 0x30], 1
add r13, rax
add dword [rsp + 0xb0], 0xffffffff
jne 0x1400cf4b0
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x88
pop r14
pop r13
ret 0