Function at 0x1400d07c8
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
xor r15d, r15d
mov r12, r8
mov rdi, rcx
mov ebx, 1
test edx, edx
je 0x1400d090b
sub edx, ebx
je 0x1400d0808
cmp edx, ebx
jmp 0x1400d0a39
cmp r9d, 0x10
jne 0x1400d0a2e
call fcn.1400cd7d4
mov rsi, rax
test rax, rax
je 0x1400d0901
mov r9, qword [rdi]
lea r8, str._ws.sys
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1400c7e14
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov r8b, bl
mov qword [rsp + 0x28], r15
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
test eax, eax
js 0x1400d08cd
mov r14, qword [rsp + 0x28]
test r14, r14
je 0x1400d08cd
mov ebp, r15d
cmp dword [rsi], r15d
jbe 0x1400d08c0
lea rdi, [rsi + 8]
movzx eax, word [rdi + 0x26]
lea rcx, [rdi + 0x28]
add rcx, rax
je 0x1400d089c
mov rdx, r14
call fcn.1400cec70
test eax, eax
je 0x1400d08ab
add ebp, ebx
add rdi, 0x128
cmp ebp, dword [rsi]
jb 0x1400d0883
jmp 0x1400d08c0
test rdi, rdi
je 0x1400d08c0
mov rax, qword [rdi + 0x10]
mov qword [r12], rax
mov eax, dword [rdi + 0x18]
mov dword [r12 + 8], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntdll.dll_RtlFreeAnsiString]
jmp 0x1400d08e0
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, r15d
mov rax, qword gs:[0x30]
mov r8, rsi
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1400d0a3c
mov ecx, 0x54f
jmp 0x1400d0a33
cmp r9d, 0xc
jne 0x1400d0a2e
mov r14, qword [rcx + 0x38]
mov rsi, qword [rcx + 0x48]
mov ebp, dword [rcx + 0x40]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400d0994
movzx edx, word [rax + 0x14]
movzx r8d, word [rax + 6]
add rdx, 0x18
add rdx, rax
test r8d, r8d
je 0x1400d0994
lea rdi, str..text
mov r9d, 6
mov rax, rdi
cmp rdx, rdi
je 0x1400d099e
test rdx, rdx
je 0x1400d098a
mov r10, rdx
sub r10, rdi
movsx ecx, byte [r10 + rax]
sub r9, rbx
movsx r11d, byte [rax]
add rax, rbx
test cl, cl
je 0x1400d0985
cmp cl, r11b
jne 0x1400d0985
test r9, r9
jne 0x1400d0968
cmp ecx, r11d
je 0x1400d099e
add rdx, 0x28
add r8d, 0xffffffff
jne 0x1400d094f
mov ecx, 0xe0000101
jmp 0x1400d0a33
mov edi, dword [rdx + 0xc]
add rdi, rsi
je 0x1400d0994
cmp dword [rdx + 8], r15d
je 0x1400d0994
mov esi, dword [rdx + 8]
mov r15, rbp
test ebp, ebp
je 0x1400d0a00
cmp rsi, rbp
jb 0x1400d0a00
movzx r13d, byte [r14]
mov r14, rdi
mov r8, rsi
mov edx, r13d
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbp, rax
test rax, rax
je 0x1400d0a00
sub rdi, rax
add rsi, rdi
cmp rsi, r15
jb 0x1400d0a00
mov rdx, qword [rsp + 0x20]
mov r8, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400d0a0f
lea rdi, [rbp + 1]
sub rsi, rbx
jne 0x1400d09c2
mov ecx, 0x490
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x1400d0a3c
movzx eax, bp
sub r14d, ebp
mov dword [r12], eax
and eax, 0xfff
sub r14d, 5
mov dword [r12 + 4], eax
mov dword [r12 + 8], r14d
jmp 0x1400d0a3c
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, r15d
lea r11, [rsp + 0x250]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret