Function at 0x537380
Capabilities:
Enumerate pe sections

Disassembly:
lea r12, [rsp - 0x528]
cmp r12, qword [r14 + 0x10]
jbe 0x538e46
push rbp
mov rbp, rsp
sub rsp, 0x5a0
mov rdx, qword [rax]
mov r8, qword [rdx + 0x18]
test r8, r8
je 0x53779d
mov qword [rsp + 0x5b0], rax
mov r9d, dword [r8 + 0x10]
mov r10, qword [rdx + 0x20]
nop dword [rax]
cmp r9d, 0x77a67fae
jne 0x5373e0
lea r9, [0x0054ea00]
cmp r8, r9
jne 0x53779d
mov r8, qword [r10 + 0x18]
jmp 0x537401
cmp r9d, 0xd542923e
jne 0x53779d
lea r9, [0x0054e9c0]
cmp r8, r9
jne 0x53779d
mov r8d, dword [r10 + 0x1c]
mov qword [rsp + 0xc8], r8
mov rax, rdx
lea rbx, [0x005906c2]
mov ecx, 0xf
lea rdi, [0x00591077]
mov esi, 0x10
call sym.github.com_mandiant_GoReSym_objfile.loadPETable
test rdi, rdi
jne 0x537435
mov edx, 1
jmp 0x537463
mov rdx, qword [rsp + 0x5b0]
mov rax, qword [rdx]
lea rbx, [0x0058cf80]
mov ecx, 7
lea rdi, [0x0058d4e3]
mov esi, 8
call sym.github.com_mandiant_GoReSym_objfile.loadPETable
test rdi, rdi
sete dl
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x200], rax
mov byte [rsp + 0x47], dl
lea rax, [0x00553a40]
call sym.runtime.newobject
mov qword [rsp + 0x2f0], rax
mov dword [rax], 0xfffffff1
mov word [rax + 4], 0
lea rax, [0x00553a40]
call sym.runtime.newobject
mov qword [rsp + 0x2e8], rax
mov dword [rax], 0xfffffff0
mov word [rax + 4], 0
lea rax, [0x00553a40]
call sym.runtime.newobject
mov qword [rsp + 0x2e0], rax
mov dword [rax], 0xfffffffa
mov word [rax + 4], 0
lea rax, [0x00553a40]
call sym.runtime.newobject
mov dword [rax], 0xfffffffb
mov word [rax + 4], 0
lea rdi, [rsp + 0x540]
lea rdi, [rdi - 0x20]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004632cb
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x2f0]
mov qword [rsp + 0x540], rcx
mov qword [rsp + 0x548], 6
mov qword [rsp + 0x550], 6
mov rcx, qword [rsp + 0x2e8]
mov qword [rsp + 0x558], rcx
mov qword [rsp + 0x560], 6
mov qword [rsp + 0x568], 6
mov rcx, qword [rsp + 0x2e0]
mov qword [rsp + 0x570], rcx
mov qword [rsp + 0x578], 6
mov qword [rsp + 0x580], 6
mov qword [rsp + 0x588], rax
mov qword [rsp + 0x590], 6
mov qword [rsp + 0x598], 6
lea rax, [0x00553a40]
call sym.runtime.newobject
mov qword [rsp + 0x2d8], rax
mov dword [rax], 0xf1ffffff
mov word [rax + 4], 0
lea rax, [0x00553a40]
call sym.runtime.newobject
mov qword [rsp + 0x2d0], rax
mov dword [rax], 0xf0ffffff
mov word [rax + 4], 0
lea rax, [0x00553a40]
call sym.runtime.newobject
mov qword [rsp + 0x2c8], rax
mov dword [rax], 0xfaffffff
mov word [rax + 4], 0
lea rax, [0x00553a40]
call sym.runtime.newobject
mov dword [rax], 0xfbffffff
mov word [rax + 4], 0
lea rdi, [rsp + 0x4e0]
lea rdi, [rdi - 0x20]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004632cb
mov rbp, qword [rbp]
mov rcx, qword [rsp + 0x2d8]
mov qword [rsp + 0x4e0], rcx
mov qword [rsp + 0x4e8], 6
mov qword [rsp + 0x4f0], 6
mov rcx, qword [rsp + 0x2d0]
mov qword [rsp + 0x4f8], rcx
mov qword [rsp + 0x500], 6
mov qword [rsp + 0x508], 6
mov rcx, qword [rsp + 0x2c8]
mov qword [rsp + 0x510], rcx
mov qword [rsp + 0x518], 6
mov qword [rsp + 0x520], 6
mov qword [rsp + 0x528], rax
mov qword [rsp + 0x530], 6
mov qword [rsp + 0x538], 6
lea rax, [rsp + 0x540]
mov ebx, 8
mov ecx, 4
mov rdi, rcx
lea rsi, [0x0054f9c0]
call sym.runtime.growslice
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x78], rcx
lea rdx, [rcx - 4]
neg rdx
sar rdx, 0x3f
and edx, 0x60
lea rbx, [rax + rdx]
lea rdi, [rsp + 0x4e0]
mov esi, 4
lea rax, [0x0054f9c0]
mov rcx, rsi
call sym.runtime.typedslicecopy
mov rcx, qword [rsp + 0x5b0]
mov rdx, qword [rcx]
mov rbx, qword [rdx + 0x28]
mov qword [rsp + 0x2c0], rbx
mov rdx, qword [rdx + 0x30]
mov qword [rsp + 0x1d0], rdx
xor eax, eax
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x200]
xor r9d, r9d
xor r10d, r10d
xor r11d, r11d
xor r12d, r12d
lea r13, [rsp + 0x40]
xor r15d, r15d
jmp 0x537827
lea rax, [0x0059ae5a]
mov ebx, 0x1d
xor ecx, ecx
xor edi, edi
mov rsi, rdi
call sym.fmt.Errorf
xor ecx, ecx
mov rdi, rax
mov rsi, rbx
xor eax, eax
mov rbx, rcx
add rsp, 0x5a0
pop rbp
ret
mov rax, qword [rsp + 0x1b8]
inc rax
mov rcx, qword [rsp + 0x5b0]
mov rbx, qword [rsp + 0x2c0]
mov r8, qword [rsp + 0x200]
mov r9, qword [rsp + 0x1c8]
mov r10, qword [rsp + 0x2b8]
mov r11, qword [rsp + 0x1c0]
mov r12, rdi
mov r13, rsi
mov r15, rdx
mov rdx, qword [rsp + 0x1d0]
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov qword [rsp + 0x1c8], r9
mov qword [rsp + 0x1c0], r11
mov qword [rsp + 0x2b8], r10
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x1d8], r13
cmp rax, rdx
jge 0x537c1f
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x200], r8
mov rdx, qword [rbx + rax*8]
mov qword [rsp + 0x1f0], rdx
mov rsi, qword [rcx]
mov rax, rsi
mov rbx, rdx
call sym.github.com_mandiant_GoReSym_debug_pe._File_.DataAfterSection
mov qword [rsp + 0x238], rax
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0xe8], rcx
movzx edx, byte [rsp + 0x47]
test dl, dl
je 0x537b0e
mov rdi, qword [rsp + 0x200]
mov rsi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
call sym.bytes.Index
nop word [rax + rax]
nop
cmp rax, 0xffffffffffffffff
je 0x537a95
lea rdi, [rsp + 0x440]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004632d0
mov rbp, qword [rbp]
mov rdx, qword [rsp + 0x200]
mov qword [rsp + 0x458], rdx
mov r8, qword [rsp + 0x88]
mov qword [rsp + 0x460], r8
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x468], r9
mov r10, qword [rsp + 0x1f0]
mov r11d, dword [r10 + 0x14]
mov r12, qword [rsp + 0xc8]
add r11, r12
mov qword [rsp + 0x440], r11
add r11, rax
mov qword [rsp + 0x448], r11
mov rbx, qword [rsp + 0x1c0]
inc rbx
mov rcx, qword [rsp + 0x1c8]
cmp rcx, rbx
jb 0x53798f
mov rax, qword [rsp + 0x2b8]
jmp 0x5379d0
mov rax, qword [rsp + 0x2b8]
mov edi, 1
lea rsi, [0x005757e0]
call sym.runtime.growslice
mov rdx, qword [rsp + 0x200]
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x90]
mov r10, qword [rsp + 0x1f0]
mov r12, qword [rsp + 0xc8]
lea r11, [rbx + rbx*4]
shl r11, 4
lea rdi, [rax + r11]
lea rdi, [rdi - 0x50]
cmp dword [0x00717c60], 0
je 0x537a6d
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x1a8], rcx
mov qword [rsp + 0x2b8], rdi
lea rax, [0x005757e0]
mov rbx, rdi
lea rcx, [rsp + 0x440]
nop
call sym.runtime.wbMove
mov rax, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x1a8]
mov rdx, qword [rsp + 0x200]
mov rbx, qword [rsp + 0x1b0]
mov rdi, qword [rsp + 0x2b8]
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x90]
mov r10, qword [rsp + 0x1f0]
mov r12, qword [rsp + 0xc8]
lea rsi, [rsp + 0x440]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046363a
mov rbp, qword [rbp]
jmp 0x537ad5
mov rdx, qword [rsp + 0x200]
mov r8, qword [rsp + 0x88]
mov r9, qword [rsp + 0x90]
mov r10, qword [rsp + 0x1f0]
mov r12, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x1c8]
mov rbx, qword [rsp + 0x1c0]
mov rax, qword [rsp + 0x2b8]
mov rdx, qword [rsp + 0xd8]
mov r9, r10
mov r10, qword [rsp + 0x238]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x200]
mov r15, rcx
mov r12, rbx
mov r13, rax
mov rcx, qword [rsp + 0xe8]
jmp 0x537bac
mov rdi, qword [rsp + 0x1f8]
mov esi, 8
mov r8, qword [rsp + 0x78]
call sym.github.com_mandiant_GoReSym_objfile.findAllOccurrences
mov qword [rsp + 0x210], rax
mov qword [rsp + 0xa8], rbx
mov rdx, qword [rsp + 0xd8]
mov r9, qword [rsp + 0x1f0]
mov r10, qword [rsp + 0x238]
mov r11, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xe8]
mov r12, qword [rsp + 0x1c0]
mov r13, qword [rsp + 0x2b8]
mov r15, qword [rsp + 0x1c8]
mov rsi, qword [rsp + 0x200]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0x88]
mov qword [rsp + 0xf0], rax
xor eax, eax
mov qword [rsp + 0x1c8], rax
mov rax, qword [rsp + 0xf0]
jmp 0x5388ee
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x1c8], r15
mov qword [rsp + 0x1c0], r12
mov qword [rsp + 0x2b8], r13
mov qword [rsp + 0x90], rdi
mov r9d, dword [r9 + 0x14]
mov r11, qword [rsp + 0xc8]
add r9, r11
mov rax, r10
mov rbx, rdx
mov rdi, r9
call sym.github.com_mandiant_GoReSym_objfile.findModuleInitPCHeader
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x70], rbx
xor ecx, ecx
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x1d8]
mov rdi, qword [rsp + 0x60]
jmp 0x538b60
mov rdx, r10
xor eax, eax
xor ebx, ebx
xor esi, esi
lea rdi, [0x007179e0]
jmp 0x537c80
mov r10, qword [rsp + 0x2a8]
add r10, 0x50
mov rax, qword [rsp + 0x1d0]
inc rax
mov rdx, qword [rsp + 0x2b8]
mov r9, qword [rsp + 0x1c8]
mov r11, qword [rsp + 0x1c0]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x1d8]
mov rdi, rbx
mov rbx, rsi
mov rsi, rcx
mov rcx, qword [rsp + 0x5b0]
nop
cmp rax, r11
jge 0x537dda
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x208], rdi
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x2a8], r10
lea rdi, [rsp + 0x3f0]
mov rsi, r10
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046363a
mov rbp, qword [rbp]
lea rax, [rsp + 0x540]
mov ebx, 8
mov ecx, 4
mov rdi, rcx
lea rsi, [0x0054f9c0]
call sym.runtime.growslice
mov qword [rsp + 0x2a0], rax
lea rdx, [rcx - 4]
neg rdx
sar rdx, 0x3f
and edx, 0x60
lea rbx, [rax + rdx]
mov ecx, 4
lea rdi, [rsp + 0x4e0]
mov rsi, rcx
lea rax, [0x0054f9c0]
call sym.runtime.typedslicecopy
mov rdx, qword [rsp + 0x2a0]
xor eax, eax
jmp 0x538606
cmp rax, 8
jge 0x537d5c
mov rcx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x208]
jmp 0x537c31
lea rax, [rsp + 0x540]
mov ebx, 8
mov ecx, 4
mov rdi, rcx
lea rsi, [0x0054f9c0]
call sym.runtime.growslice
mov qword [rsp + 0x2a0], rax
lea rdx, [rcx - 4]
neg rdx
sar rdx, 0x3f
and edx, 0x60
lea rbx, [rax + rdx]
mov ecx, 4
lea rdi, [rsp + 0x4e0]
mov rsi, rcx
lea rax, [0x0054f9c0]
call sym.runtime.typedslicecopy
mov rdx, qword [rsp + 0x2a0]
xor eax, eax
mov rcx, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x208]
mov rsi, qword [rsp + 0x98]
jmp 0x5386ce
test rbx, rbx
cmovne r9, rsi
cmovne r11, rbx
cmovne rdx, rdi
test r12, r12
je 0x537e0d
mov r8, qword [rcx]
mov r10, qword [r8 + 0x28]
mov qword [rsp + 0x298], r10
mov r8, qword [r8 + 0x30]
mov qword [rsp + 0x1d0], r8
xor eax, eax
jmp 0x537e60
mov rax, rdx
mov rbx, r11
mov rcx, r9
xor edi, edi
xor esi, esi
add rsp, 0x5a0
pop rbp
ret
mov rax, qword [rsp + 0x1c8]
inc rax
mov rcx, qword [rsp + 0x5b0]
mov r8, qword [rsp + 0x1d0]
mov r10, qword [rsp + 0x298]
mov r9, r15
mov r11, r13
mov rdx, r12
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x1d8]
nop dword [rax]
cmp rax, r8
jge 0x537e0d
mov qword [rsp + 0x290], rdx
mov qword [rsp + 0x1c8], rax
mov qword [rsp + 0x1a0], r9
mov qword [rsp + 0x198], r11
mov rbx, qword [r10 + rax*8]
mov qword [rsp + 0x1e8], rbx
mov rdx, qword [rcx]
mov rax, rdx
call sym.github.com_mandiant_GoReSym_debug_pe._File_.DataAfterSection
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0x230], rax
mov qword [rsp + 0xe0], rcx
lea rax, [0x00569f40]
nop dword [rax + rax]
call sym.runtime.newobject
mov qword [rsp + 0x2f8], rax
mov rcx, qword [rsp + 0x1d8]
mov rdx, rcx
mov rsi, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xc8]
mov r8, qword [rsp + 0x1e8]
mov r9, qword [rsp + 0x230]
mov r10, qword [rsp + 0xe0]
mov r11, qword [rsp + 0x60]
mov r12, qword [rsp + 0x290]
mov r13, qword [rsp + 0x198]
mov r15, qword [rsp + 0x1a0]
xor ebx, ebx
nop
jmp 0x537f40
add rcx, 0x18
inc rbx
mov r9, qword [rsp + 0x230]
mov r11, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x1d8]
nop
cmp rbx, r11
jge 0x537e23
movzx edx, byte [rcx + 0x10]
mov r11, qword [rcx]
mov r9, qword [rcx + 8]
mov qword [rax], r11
mov qword [rax + 8], r9
mov byte [rax + 0x10], dl
mov r9, qword [rax]
mov r11d, dword [r8 + 0x14]
add r11, rdi
cmp r9, r11
jb 0x537f22
mov edi, dword [r8 + 0x18]
add rdi, r11
cmp r9, rdi
jae 0x53803f
lea rdi, [r11 + rsi]
cmp r9, rdi
jae 0x538032
mov rdi, r9
sub r9, r11
cmp rsi, r9
jb 0x5385f4
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x2a8], rcx
mov qword [rsp + 0x190], rdi
mov r11, r9
sub r9, r10
sar r9, 0x3f
and r9, r11
sub rsi, r11
mov qword [rsp + 0x88], rsi
mov r11, qword [rsp + 0x230]
add r9, r11
mov qword [rsp + 0x200], r9
nop dword [rax]
test dl, dl
je 0x53800b
lea rdx, [rsp + 0x540]
mov qword [rsp + 0xf8], rax
xor eax, eax
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0xf8]
jmp 0x5383bc
lea rdx, [rsp + 0x4e0]
mov qword [rsp + 0x100], rax
xor eax, eax
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x100]
jmp 0x5380dc
mov rdi, qword [rsp + 0xc8]
jmp 0x537f22
mov rdi, qword [rsp + 0xc8]
jmp 0x537f22
mov r11, rsi
lea rsi, [rsp + 0x350]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046363a
mov rbp, qword [rbp]
mov rsi, qword [rsp + 0x280]
add rsi, 0x18
mov rdi, qword [rsp + 0x1b8]
inc rdi
mov rax, r8
mov r8, rdx
mov r9, qword [rsp + 0x200]
mov r10, qword [rsp + 0xe0]
mov qword [rsp + 0x1b8], rdi
mov rdx, rsi
mov r15, rcx
mov r12, r11
mov r13, rbx
mov rcx, qword [rsp + 0x2a8]
mov rbx, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x190]
mov r11, qword [rsp + 0x230]
mov r11, qword [rsp + 0x1b8]
cmp r11, 4
jge 0x538314
mov qword [rsp + 0x188], r15
mov qword [rsp + 0x180], r13
mov qword [rsp + 0x288], r12
mov qword [rsp + 0x280], rdx
mov rdi, qword [rdx]
mov qword [rsp + 0x220], rdi
mov r8, qword [rdx + 8]
mov qword [rsp + 0xb8], r8
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
call sym.runtime.mallocgc
mov qword [rsp + 0x278], rax
mov rbx, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x88]
call sym.runtime.memmove
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x88]
cmp rdx, rcx
mov rax, rcx
cmovl rcx, rdx
mov rdx, qword [rsp + 0x278]
mov rbx, qword [rsp + 0x220]
cmp rdx, rbx
je 0x538195
mov rax, rdx
call sym.runtime.memmove
mov rax, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x278]
lea rdi, [rsp + 0x350]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004632d0
mov rbp, qword [rbp]
mov r8, qword [rsp + 0x2f8]
mov qword [rsp + 0x360], r8
mov qword [rsp + 0x368], rdx
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x378], rax
mov rdx, qword [rsp + 0x1e8]
mov r9d, dword [rdx + 0x14]
mov r10, qword [rsp + 0xc8]
add r9, r10
mov qword [rsp + 0x350], r9
mov r9, qword [rsp + 0x190]
mov qword [rsp + 0x358], r9
mov rbx, qword [rsp + 0x180]
inc rbx
mov rcx, qword [rsp + 0x188]
nop
cmp rcx, rbx
jb 0x53822f
mov rsi, qword [rsp + 0x288]
jmp 0x538273
mov rax, qword [rsp + 0x288]
mov edi, 1
lea rsi, [0x005757e0]
call sym.runtime.growslice
mov rdx, qword [rsp + 0x1e8]
mov r8, qword [rsp + 0x2f8]
mov r9, qword [rsp + 0x190]
mov r10, qword [rsp + 0xc8]
mov rsi, rax
mov rax, qword [rsp + 0x88]
lea r11, [rbx + rbx*4]
shl r11, 4
lea rdi, [rsi + r11]
lea rdi, [rdi - 0x50]
cmp dword [0x00717c60], 0
je 0x53804c
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x178], rbx
mov qword [rsp + 0x170], rcx
mov qword [rsp + 0x2b8], rdi
lea rax, [0x005757e0]
mov rbx, rdi
lea rcx, [rsp + 0x350]
call sym.runtime.wbMove
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x1e8]
mov rbx, qword [rsp + 0x178]
mov rsi, qword [rsp + 0x270]
mov rdi, qword [rsp + 0x2b8]
mov r8, qword [rsp + 0x2f8]
mov r9, qword [rsp + 0x190]
mov r10, qword [rsp + 0xc8]
jmp 0x53804c
mov rsi, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xc8]
jmp 0x537f22
mov r11, rsi
lea rsi, [rsp + 0x3a0]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046363a
mov rbp, qword [rbp]
mov rsi, qword [rsp + 0x280]
add rsi, 0x18
mov rdi, qword [rsp + 0x1b8]
inc rdi
mov rax, r8
mov r8, rdx
mov r9, qword [rsp + 0x200]
mov r10, qword [rsp + 0xe0]
mov qword [rsp + 0x1b8], rdi
mov rdx, rsi
mov r15, rcx
mov r12, r11
mov r13, rbx
mov rcx, qword [rsp + 0x2a8]
mov rbx, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x190]
mov r11, qword [rsp + 0x230]
mov r11, qword [rsp + 0x1b8]
cmp r11, 4
jge 0x538314
mov qword [rsp + 0x168], r15
mov qword [rsp + 0x268], r12
mov qword [rsp + 0x160], r13
mov qword [rsp + 0x280], rdx
mov rdi, qword [rdx]
mov qword [rsp + 0x218], rdi
mov r8, qword [rdx + 8]
mov qword [rsp + 0xb0], r8
mov rax, rsi
xor ebx, ebx
xor ecx, ecx
call sym.runtime.mallocgc
mov qword [rsp + 0x278], rax
mov rbx, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x88]
call sym.runtime.memmove
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x88]
cmp rdx, rcx
mov rax, rcx
cmovl rcx, rdx
mov rdx, qword [rsp + 0x278]
mov rbx, qword [rsp + 0x218]
cmp rdx, rbx
je 0x538475
mov rax, rdx
call sym.runtime.memmove
mov rax, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x278]
lea rdi, [rsp + 0x3a0]
lea rdi, [rdi - 0x30]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004632d0
mov rbp, qword [rbp]
mov r8, qword [rsp + 0x2f8]
mov qword [rsp + 0x3b0], r8
mov qword [rsp + 0x3b8], rdx
mov qword [rsp + 0x3c0], rax
mov qword [rsp + 0x3c8], rax
mov rdx, qword [rsp + 0x1e8]
mov r9d, dword [rdx + 0x14]
mov r10, qword [rsp + 0xc8]
add r9, r10
mov qword [rsp + 0x3a0], r9
mov r9, qword [rsp + 0x190]
mov qword [rsp + 0x3a8], r9
mov rbx, qword [rsp + 0x160]
inc rbx
mov rcx, qword [rsp + 0x168]
nop
cmp rcx, rbx
jb 0x53850f
mov rsi, qword [rsp + 0x268]
jmp 0x538553
mov rax, qword [rsp + 0x268]
mov edi, 1
lea rsi, [0x005757e0]
call sym.runtime.growslice
mov rdx, qword [rsp + 0x1e8]
mov r8, qword [rsp + 0x2f8]
mov r9, qword [rsp + 0x190]
mov r10, qword [rsp + 0xc8]
mov rsi, rax
mov rax, qword [rsp + 0x88]
lea r11, [rbx + rbx*4]
shl r11, 4
lea rdi, [rsi + r11]
lea rdi, [rdi - 0x50]
cmp dword [0x00717c60], 0
je 0x538329
mov qword [rsp + 0x260], rsi
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x150], rcx
mov qword [rsp + 0x2b8], rdi
lea rax, [0x005757e0]
mov rbx, rdi
lea rcx, [rsp + 0x3a0]
call sym.runtime.wbMove
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x1e8]
mov rbx, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x260]
mov rdi, qword [rsp + 0x2b8]
mov r8, qword [rsp + 0x2f8]
mov r9, qword [rsp + 0x190]
mov r10, qword [rsp + 0xc8]
jmp 0x538329
mov rax, r9
mov rcx, rsi
call sym.runtime.panicSliceBU
add rdx, 0x18
inc rax
cmp rax, 8
jge 0x537d3d
mov rcx, qword [rsp + 0x410]
cmp qword [rdx + 8], rcx
je 0x538622
xor ecx, ecx
jmp 0x538657
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x280], rdx
mov rbx, qword [rdx]
mov rax, qword [rsp + 0x408]
nop dword [rax]
call sym.runtime.memequal
mov rdx, qword [rsp + 0x280]
mov ecx, eax
mov rax, qword [rsp + 0x1b8]
test cl, cl
je 0x5385ff
nop dword [rax + rax]
jmp 0x537d39
mov r8, rsi
lea rsi, [rsp + 0x300]
nop word [rax + rax]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046363a
mov rbp, qword [rbp]
mov qword [rsp + 0x408], rax
mov qword [rsp + 0x410], rcx
mov qword [rsp + 0x418], rcx
mov r9, qword [rsp + 0x280]
add r9, 0x18
mov rax, qword [rsp + 0x1b8]
inc rax
mov rcx, rdx
mov rsi, rbx
mov rdx, r9
mov rbx, r8
cmp rax, 8
jge 0x537c31
mov qword [rsp + 0x148], rcx
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x258], rbx
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x280], rdx
mov rcx, qword [rsp + 0x410]
mov qword [rsp + 0x80], rcx
mov rsi, qword [rdx]
mov qword [rsp + 0x228], rsi
mov rdi, qword [rdx + 8]
mov qword [rsp + 0xc0], rdi
lea rax, [0x00551d00]
mov rbx, rcx
call sym.runtime.makeslice
mov qword [rsp + 0x278], rax
mov rbx, qword [rsp + 0x408]
mov rdx, qword [rsp + 0x410]
mov rcx, qword [rsp + 0x80]
cmp rdx, rcx
mov rsi, rcx
cmovl rsi, rdx
cmp rax, rbx
je 0x53877d
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0xc0]
cmp rcx, rdx
mov r8, rcx
cmovg r8, rdx
mov rbx, qword [rsp + 0x228]
cmp rax, rbx
je 0x5387b5
mov rcx, r8
nop
call sym.runtime.memmove
mov rax, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x80]
lea rdi, [rsp + 0x300]
lea rsi, [rsp + 0x3f0]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046363a
mov rbp, qword [rbp]
mov qword [rsp + 0x318], rax
mov qword [rsp + 0x320], rcx
mov qword [rsp + 0x328], rcx
mov rbx, qword [rsp + 0x140]
inc rbx
mov rdx, qword [rsp + 0x148]
cmp rdx, rbx
jb 0x538812
mov rsi, qword [rsp + 0x258]
jmp 0x538844
mov rax, qword [rsp + 0x258]
mov rcx, rdx
mov edi, 1
lea rsi, [0x005757e0]
call sym.runtime.growslice
mov rsi, rax
mov rdx, rcx
mov rax, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x80]
lea r8, [rbx + rbx*4]
shl r8, 4
lea rdi, [rsi + r8]
lea rdi, [rdi - 0x50]
cmp dword [0x00717c60], 0
nop dword [rax + rax]
je 0x538665
mov qword [rsp + 0x250], rsi
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x130], rdx
mov qword [rsp + 0x2b0], rdi
lea rax, [0x005757e0]
mov rbx, rdi
lea rcx, [rsp + 0x300]
call sym.runtime.wbMove
mov rax, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x250]
mov rdi, qword [rsp + 0x2b0]
jmp 0x538665
lea rax, [r11 + 1]
mov r11, qword [rsp + 0xc8]
mov qword [rsp + 0x1c8], rax
mov rax, qword [rsp + 0x210]
mov r11, qword [rsp + 0x1c8]
cmp rbx, r11
jle 0x537bac
mov rax, qword [rax + r11*8]
cmp rax, 0xffffffffffffffff
je 0x5388d2
cmp rdx, rax
jb 0x538e38
mov r8, rcx
sub r8, rax
mov qword [rsp + 0x90], r8
mov rsi, rdx
sub rdx, rax
mov qword [rsp + 0x88], rdx
neg r8
sar r8, 0x3f
and r8, rax
add r8, r10
mov qword [rsp + 0x200], r8
lea rdi, [rsp + 0x490]
lea rdi, [rdi - 0x30]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004632d0
mov rbp, qword [rbp]
mov qword [rsp + 0x4a8], r8
mov qword [rsp + 0x4b0], rdx
mov rdi, r10
mov r10, qword [rsp + 0x90]
mov qword [rsp + 0x4b8], r10
mov r9d, dword [r9 + 0x14]
mov r11, qword [rsp + 0xc8]
add r9, r11
mov qword [rsp + 0x490], r9
add r9, rax
mov qword [rsp + 0x498], r9
lea r9, [r12 + 1]
nop dword [rax]
cmp r15, r9
jae 0x538a28
mov rax, r13
mov rbx, r9
mov rcx, r15
mov edi, 1
lea rsi, [0x005757e0]
call sym.runtime.growslice
mov rdx, qword [rsp + 0x88]
mov rsi, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0x238]
mov r8, qword [rsp + 0x200]
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0xc8]
mov r9, rbx
mov r13, rax
mov r15, rcx
mov rcx, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xa8]
lea r12, [r9 + r9*4]
shl r12, 4
lea r12, [r13 + r12]
lea r12, [r12 - 0x50]
cmp dword [0x00717c60], 0
je 0x538ade
mov qword [rsp + 0x248], r13
mov qword [rsp + 0x128], r9
mov qword [rsp + 0x120], r15
mov qword [rsp + 0x2b8], r12
lea rax, [0x005757e0]
mov rbx, r12
lea rcx, [rsp + 0x490]
call sym.runtime.wbMove
mov rcx, qword [rsp + 0xe8]
mov rdx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0x238]
mov r8, qword [rsp + 0x200]
mov r9, qword [rsp + 0x128]
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0xc8]
mov r12, qword [rsp + 0x2b8]
mov r13, qword [rsp + 0x248]
mov r15, qword [rsp + 0x120]
mov rax, rdi
mov rdi, r12
lea rsi, [rsp + 0x490]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046363a
mov rbp, qword [rbp]
mov rdx, qword [rsp + 0xd8]
mov r10, rax
mov r11, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x90]
mov r8, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x200]
mov r12, r9
mov r9, qword [rsp + 0x1f0]
jmp 0x5388d2
mov r8, qword [rsp + 0x118]
inc r8
mov rdx, rcx
mov rsi, rax
mov rdi, rbx
mov rax, qword [rsp + 0x1e0]
mov rbx, qword [rsp + 0x70]
mov rcx, r8
nop
cmp rbx, rcx
jle 0x5377cb
mov qword [rsp + 0x118], rcx
mov qword [rsp + 0x110], rdx
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x240], rsi
mov rbx, qword [rax + rcx*8]
mov qword [rsp + 0x190], rbx
mov rax, qword [rsp + 0x5b0]
mov ecx, 8
call sym.github.com_mandiant_GoReSym_objfile._peFile_.read_memory
test rdi, rdi
je 0x538bd1
mov r9, qword [rsp + 0x190]
mov rcx, qword [rsp + 0x110]
mov rax, qword [rsp + 0x240]
mov rbx, qword [rsp + 0x108]
jmp 0x538d07
nop
cmp rbx, 7
jbe 0x538e2b
mov rbx, qword [rsp + 0x108]
add rbx, 2
movzx edx, byte [rax]
movzx r8d, byte [rax + 1]
mov r9, r8
shl r8, 8
or r8, rdx
movzx r10d, byte [rax + 2]
mov r11, r10
shl r10, 0x10
or r8, r10
movzx r10d, byte [rax + 3]
mov r12, r10
shl r10, 0x18
or r10, r8
movzx r8d, byte [rax + 4]
mov r13, r8
shl r8, 0x20
or r10, r8
movzx r8d, byte [rax + 5]
mov r15, r8
shl r8, 0x28
or r10, r8
movzx r8d, byte [rax + 6]
mov rcx, r8
shl r8, 0x30
or r8, r10
movzx r10d, byte [rax + 7]
mov rax, r10
shl r10, 0x38
shl rcx, 8
or rax, rcx
shl r15, 0x10
or rax, r15
shl r13, 0x18
or rax, r13
shl r12, 0x20
or rax, r12
shl r11, 0x28
or r11, rax
shl r9, 0x30
or r11, r9
shl rdx, 0x38
nop
or r10, r8
or r11, rdx
mov rcx, qword [rsp + 0x110]
cmp rcx, rbx
jb 0x538c9d
mov rax, qword [rsp + 0x240]
jmp 0x538ccf
mov qword [rsp + 0x58], r10
mov qword [rsp + 0x50], r11
mov rax, qword [rsp + 0x240]
mov edi, 2
lea rsi, [0x00569f40]
nop dword [rax + rax]
call sym.runtime.growslice
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x50]
lea r8, [rbx + rbx*2]
mov qword [rax + r8*8 - 0x30], r10
mov r9, qword [rsp + 0x190]
mov qword [rax + r8*8 - 0x28], r9
lea r10, [rax + r8*8]
lea r10, [r10 - 0x20]
mov byte [r10], 1
mov qword [rax + r8*8 - 0x18], r11
mov qword [rax + r8*8 - 0x10], r9
lea r8, [rax + r8*8]
lea r8, [r8 - 8]
mov byte [r8], 0
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x1d8], rax
mov rax, qword [rsp + 0x5b0]
mov rbx, r9
mov ecx, 4
call sym.github.com_mandiant_GoReSym_objfile._peFile_.read_memory
test rdi, rdi
je 0x538d4a
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x1d8]
jmp 0x538b3a
nop
cmp rbx, 3
jbe 0x538e1e
mov rbx, qword [rsp + 0x60]
add rbx, 2
movzx edx, byte [rax]
movzx r8d, byte [rax + 1]
mov r9d, r8d
shl r8d, 8
or r8d, edx
movzx r10d, byte [rax + 2]
mov r11d, r10d
shl r10d, 0x10
or r8d, r10d
movzx r10d, byte [rax + 3]
mov r12d, r10d
shl r10d, 0x18
shl r11d, 8
or r12d, r11d
shl r9d, 0x10
or r12d, r9d
shl edx, 0x18
nop
or r10d, r8d
or edx, r12d
mov rcx, qword [rsp + 0x68]
cmp rcx, rbx
jb 0x538db7
mov rax, qword [rsp + 0x1d8]
jmp 0x538de2
mov dword [rsp + 0x4c], r10d
mov dword [rsp + 0x48], edx
mov rax, qword [rsp + 0x1d8]
mov edi, 2
lea rsi, [0x00569f40]
call sym.runtime.growslice
mov edx, dword [rsp + 0x48]
mov r10d, dword [rsp + 0x4c]
lea r8, [rbx + rbx*2]
mov qword [rax + r8*8 - 0x30], r10
mov r9, qword [rsp + 0x190]
mov qword [rax + r8*8 - 0x28], r9
lea r10, [rax + r8*8]
lea r10, [r10 - 0x20]
mov byte [r10], 1
mov qword [rax + r8*8 - 0x18], rdx
mov qword [rax + r8*8 - 0x10], r9
lea rdx, [rax + r8*8]
lea rdx, [rdx - 8]
mov byte [rdx], 0
jmp 0x538b3a
mov eax, 3
mov rcx, rbx
call sym.runtime.panicIndex
mov eax, 7
mov rcx, rbx
call sym.runtime.panicIndex
mov rcx, rdx
nop dword [rax + rax]
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.github.com_mandiant_GoReSym_objfile._peFile_.pcln_scan