Function at 0x140006180
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rbx
push r12
push r15
lea rbp, [rsp - 0x8038]
mov eax, 0x8138
call fcn.14000e360
sub rsp, rax
xor r12d, r12d
mov r15, rdx
mov rbx, rcx
test rdx, rdx
je 0x1400061b7
test r8, r8
je 0x1400061b7
mov word [rdx], r12w
xor eax, eax
mov qword [rbp + 0x8078], 0xffffffffffffffff
mov dword [rbp - 0x80], 0xc0000365
mov qword [rbp - 0x78], 0xffffffffffffffd5
mov qword [rbp - 0x68], rcx
mov dword [rbp - 0x7c], eax
call fcn.140014230
mov dword [rsp + 0x50], r12d
mov qword [rsp + 0x48], r12
add ax, ax
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 1
mov word [rbp - 0x70], ax
add ax, 2
mov dword [rsp + 0x30], 1
mov word [rbp - 0x6e], ax
lea rax, [rbp - 0x70]
lea r9, [rbp - 0x80]
lea r8, [rbp - 0x60]
lea rcx, [rbp + 0x8078]
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x80
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x60], 0x30
mov qword [rbp - 0x58], r12
mov dword [rbp - 0x48], 0x40
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov qword [rsp + 0x20], r12
call fcn.14000bf26
test eax, eax
js 0x14000695a
cmp dword [rbp - 0x80], r12d
jl 0x14000695a
lea rcx, str._ls:_n
mov rdx, rbx
mov qword [rsp + 0x8118], r14
call fcn.14000a700
mov rcx, qword [rbp + 0x8078]
xor eax, eax
lea r9d, [rax + 0x28]
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0xc0000365
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x68], 0xffffffffffffffd5
mov dword [rsp + 0x20], 4
call qword [0x1400c4190]
mov r8d, dword [rsp + 0x60]
test eax, eax
js 0x140006384
test r8d, r8d
js 0x140006384
mov rax, qword [rbp + 0x10]
movabs rbx, 0x5e6684f4b3960000
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x70]
mov r8d, 0x40
imul rax, rax, 0x64
add rax, rbx
mov qword [rsp + 0x70], rax
call fcn.14001aec0
lea rcx, str.____CreationTime:_____s_n
mov rdx, rax
call fcn.14000a700
mov r11, qword [rbp + 0x20]
lea rdx, [rbp - 0x30]
imul r11, r11, 0x64
add r11, rbx
lea rcx, [rsp + 0x70]
mov r8d, 0x40
mov qword [rsp + 0x70], r11
call fcn.14001aec0
lea rcx, str.____LastWriteTime:____s_n
mov rdx, rax
call fcn.14000a700
mov r11, qword [rbp + 0x28]
lea rdx, [rbp - 0x30]
imul r11, r11, 0x64
add r11, rbx
lea rcx, [rsp + 0x70]
mov r8d, 0x40
mov qword [rsp + 0x70], r11
call fcn.14001aec0
lea rcx, str.____ChangeTime:_______s_n
mov rdx, rax
call fcn.14000a700
mov edx, dword [rbp + 0x30]
lea rcx, str.____FileAttributes:___x_n
call fcn.14000a700
jmp 0x140006392
lea rcx, str.____FileBasicInformation_____x__x_n
mov edx, eax
call fcn.14000a700
mov rcx, qword [rbp + 0x8078]
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x60]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
call qword [0x1400c4190]
mov r8d, dword [rsp + 0x60]
test eax, eax
js 0x1400063d6
test r8d, r8d
js 0x1400063d6
mov rdx, qword [rbp + 0x18]
lea rcx, str.____Size:_____________llx_n
call fcn.14000a700
jmp 0x1400063e4
lea rcx, str.____FileStandardInformation_____x__x_n
mov edx, eax
call fcn.14000a700
mov qword [rsp + 0x8130], rsi
mov r14d, 0x8000
lea rcx, [rbp + 0x10]
xor edx, edx
mov r8d, r14d
mov qword [rsp + 0x8128], rdi
mov qword [rsp + 0x8120], r13
call sym.VBoxNetNAT.exe_nocrt_memset
mov rcx, qword [rbp + 0x8078]
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x8068]
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x10]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov qword [rbp + 0x8068], r12
mov qword [rsp + 0x20], rax
call qword [0x1400c4240]
mov r8d, dword [rsp + 0x60]
test eax, eax
js 0x140006920
test r8d, r8d
js 0x140006920
mov eax, 0x5a4d
mov ebx, r12d
cmp word [rbp + 0x10], ax
jne 0x140006497
mov ebx, dword [rbp + 0x4c]
cmp ebx, 0x7ef8
jb 0x140006497
lea rcx, str.____Nt_Headers___x:_out_side_buffer_n
mov edx, ebx
call fcn.14000a700
jmp 0x14000692e
mov eax, ebx
mov edx, ebx
lea rdi, [rbp + rax + 0x10]
cmp dword [rdi], 0x4550
jne 0x140006912
lea rcx, str.____NT_Headers:_______x_n
call fcn.14000a700
mov edx, dword [rdi + 8]
lea rcx, str.____Timestamp:________x_n
call fcn.14000a700
movzx r11d, word [rdi + 4]
mov eax, 0x14c
cmp r11w, ax
jne 0x1400064e0
lea r8, str.___i386
jmp 0x1400064fb
mov edx, 0x8664
lea rax, str.___amd64
lea r8, [0x14007a640]
cmp r11w, dx
cmove r8, rax
lea rcx, str.____Machine:__________x_s_n
movzx edx, r11w
call fcn.14000a700
mov edx, dword [rdi + 8]
lea rcx, str.____Timestamp:________x_n
call fcn.14000a700
movzx r8d, word [rdi + 0x46]
movzx edx, word [rdi + 0x44]
lea rcx, str.____Image_Version:____u._u_n
call fcn.14000a700
mov edx, dword [rdi + 0x50]
lea rcx, str.____SizeOfImage:______x___u__n
mov r8d, edx
call fcn.14000a700
movzx r11d, word [rdi + 0x14]
mov eax, 0xf0
mov r13d, r12d
mov qword [rbp + 0x8060], r12
lea rsi, [r11 + rdi + 0x18]
cmp r11w, ax
jne 0x140006580
cmp dword [rdi + 0x84], 2
jbe 0x140006580
mov rax, qword [rdi + 0x98]
mov qword [rbp + 0x8060], rax
mov r13d, dword [rbp + 0x8060]
jmp 0x1400065af
mov eax, 0xe0
cmp r11w, ax
jne 0x1400065a8
cmp dword [rdi + 0x74], 2
jbe 0x1400065a8
mov rax, qword [rdi + 0x88]
mov qword [rbp + 0x8060], rax
mov r13d, dword [rbp + 0x8060]
jmp 0x1400065af
mov rax, qword [rbp + 0x8060]
shr rax, 0x20
lea rcx, str.____Resource_Dir:_____x_LB__x_n
mov edx, r13d
mov r8d, eax
call fcn.14000a700
cmp r13d, ebx
jbe 0x14000692e
cmp dword [rbp + 0x8064], r12d
jbe 0x14000692e
movzx r8d, word [rdi + 6]
lea rax, [rbp + 0x8010]
lea rcx, [r8 + r8*4]
sub rax, rsi
shl rcx, 3
cmp rax, rcx
jb 0x14000692e
mov qword [rbp + 0x8068], r12
mov edx, r12d
test r8d, r8d
je 0x140006632
lea rcx, [rsi + 8]
nop
mov esi, dword [rcx + 4]
mov edi, dword [rcx]
mov r12d, dword [rcx + 0xc]
mov eax, r13d
sub eax, esi
cmp eax, edi
jae 0x140006627
cmp r12d, ebx
ja 0x140006643
inc edx
add rcx, 0x28
cmp edx, r8d
jb 0x140006610
lea rcx, str.____Resource_section_not_found._n
call fcn.14000a700
jmp 0x14000692e
mov eax, r12d
sub eax, esi
add eax, r13d
mov qword [rbp + 0x8068], rax
test rax, rax
jle 0x140006632
lea rcx, [rbp + 0x10]
mov r8, r14
xor edx, edx
call sym.VBoxNetNAT.exe_nocrt_memset
mov rcx, qword [rbp + 0x8078]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x8068]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x10]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [0x1400c4240]
lea rdx, [rbp + 0x10]
mov r13d, eax
mov qword [rsp + 0x78], rdx
test eax, eax
js 0x1400068f5
cmp dword [rsp + 0x60], 0
jl 0x140006793
lea r8, [rbp + 0x8060]
lea rcx, [rbp + 0x10]
mov edx, r14d
call fcn.140005f40
mov r11d, eax
cmp eax, 0xffffffff
je 0x14000678f
mov ebx, dword [rbp + 0x8060]
cmp ebx, edi
jae 0x14000678f
sub r11d, esi
sub edi, ebx
cmp r11d, edi
ja 0x14000678f
cmp r11d, r14d
jae 0x14000671e
lea eax, [r11 + rbx]
cmp eax, r14d
ja 0x14000671e
lea rdx, [rbp + r11 + 0x10]
mov r14d, ebx
mov qword [rsp + 0x78], rdx
jmp 0x140006793
lea ecx, [r11 + r12]
mov r8, r14
xor edx, edx
mov qword [rbp + 0x8068], rcx
lea rcx, [rbp + 0x10]
call sym.VBoxNetNAT.exe_nocrt_memset
mov rcx, qword [rbp + 0x8078]
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x8068]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x10]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [0x1400c4240]
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x78], rdx
mov r13d, eax
cmp ebx, r14d
ja 0x140006793
mov r14, rbx
jmp 0x140006793
lea rdx, [rbp + 0x10]
test r13d, r13d
js 0x1400068f5
cmp dword [rsp + 0x60], 0
jl 0x1400068f5
lea rsi, [0x14007d980]
mov r13d, 6
mov rcx, qword [rsi + 8]
lea rax, [rcx + 0xa]
cmp r14, rax
jbe 0x1400068e1
mov rax, qword [rsi]
mov rbx, r14
mov rdi, rdx
movzx r12d, word [rax]
sub rbx, rcx
sub rbx, 0xa
shr rbx, 1
je 0x1400068e1
dec rbx
cmp word [rdi], 1
jne 0x14000680a
cmp word [rdi + 2], r12w
lea rcx, [rdi + 2]
jne 0x14000680a
mov r8, qword [rsi + 8]
mov rdx, qword [rsi]
add r8, 2
call sym.VBoxNetNAT.exe_nocrt_memcmp
test eax, eax
je 0x140006818
add rdi, 2
test rbx, rbx
jne 0x1400067e2
jmp 0x1400068e1
mov r12, qword [rsi + 8]
mov rax, 0xfffffffffffffffe
shr r12, 1
sub rax, r12
add rbx, rax
xor eax, eax
lea rdi, [rdi + r12*2 + 4]
cmp word [rdi], 0
jne 0x140006847
inc eax
add rdi, 2
dec rbx
cmp eax, 3
jb 0x140006833
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call fcn.140014260
test eax, eax
js 0x1400068b3
cmp r12, 0xf
jae 0x14000686d
mov r8d, 0xf
sub r8, r12
jmp 0x140006870
xor r8d, r8d
mov rdx, qword [rsi]
lea r9, [0x14007a640]
lea rcx, str._____ls:_s__ls
mov qword [rsp + 0x20], rdi
call fcn.14000a700
cmp byte [rsi + 0x10], 0
je 0x1400068e1
test r15, r15
je 0x1400068e1
mov rax, qword [rbp + 0x8070]
cmp rax, 1
jbe 0x1400068e1
mov r8, rdi
mov rdx, rax
mov rcx, r15
call fcn.14001a110
jmp 0x1400068e1
cmp r12, 0xf
jae 0x1400068c4
mov r8d, 0xf
sub r8, r12
jmp 0x1400068c7
xor r8d, r8d
mov rdx, qword [rsi]
lea r9, [0x14007a640]
lea rcx, str._____ls:_s_rc_Rrc
mov dword [rsp + 0x20], eax
call fcn.14000a700
mov rdx, qword [rsp + 0x78]
add rsi, 0x18
dec r13
jne 0x1400067b4
jmp 0x14000692e
mov r9d, dword [rsp + 0x60]
mov rdx, qword [rbp + 0x8068]
lea rcx, str.____NtReadFile___llx_____x__x_n
mov r8d, r13d
call fcn.14000a700
jmp 0x14000692e
lea rcx, str.____Nt_Headers___x:_Invalid_signature_n
call fcn.14000a700
jmp 0x14000692e
lea rcx, str.____NtReadFile__0_____x__x_n
mov edx, eax
call fcn.14000a700
mov rcx, qword [rbp + 0x8078]
call fcn.14000bec0
mov r14, qword [rsp + 0x8118]
mov r13, qword [rsp + 0x8120]
mov rdi, qword [rsp + 0x8128]
mov rsi, qword [rsp + 0x8130]
add rsp, 0x8138
pop r15
pop r12
pop rbx
pop rbp
ret