Function at 0x14000f244
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14005f788]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov rcx, rdx
call fcn.1400104f0
test rax, rax
je 0x14000f2ed
mov rbx, rax
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x14000f2fd
mov ebp, dword [rbx + 0x50]
xor r15d, r15d
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14d, 0
test rax, rax
je 0x14000f31b
mov r12, rax
movzx eax, word [rbx + 0x14]
mov r13d, dword [rbx + rax + 0x24]
cmp byte [rsp + 0xf8], 0
cmovne r15d, r13d
sub ebp, r15d
cmp dword [rsp + 0x100], 1
jne 0x14000f342
mov rcx, rsi
mov edx, ebp
call fcn.14000f1c0
jmp 0x14000f34f
lea rcx, [0x140060d00]
lea rdx, str.____Invalid_format_of_PE_image
jmp 0x14000f30b
lea rcx, [0x140060d00]
lea rdx, str.____Image_is_not_64_bit
call fcn.140001c6b
mov rcx, rax
call fcn.14000165c
xor r14d, r14d
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140012be0
mov rax, r14
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, ebp
mov rcx, rsi
xor edx, edx
call fcn.140005267
mov r14, rax
test rax, rax
je 0x14000f5f2
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rsi
lea rcx, [0x140060d00]
lea rdx, str.___Image_base_has_been_allocated_at_0x
call fcn.140001c6b
mov rcx, rax
mov rdx, r14
call fcn.1400044fe
mov rcx, rax
call fcn.14000165c
mov r8d, dword [rbx + 0x54]
mov rcx, r12
mov rdx, rdi
call fcn.140018290
movzx eax, word [rbx + 6]
test ax, ax
je 0x14000f3e5
mov rcx, rbx
add rcx, 0x18
movzx ebp, word [rbx + 0x14]
add rbp, rcx
add rbp, 0xc
xor esi, esi
cmp byte [rbp + 0x18], 0
js 0x14000f3d6
mov ecx, dword [rbp]
mov r8d, dword [rbp + 4]
add rcx, r12
mov edx, dword [rbp + 8]
add rdx, rdi
call fcn.140018290
movzx eax, word [rbx + 6]
inc rsi
movzx ecx, ax
add rbp, 0x28
cmp rsi, rcx
jb 0x14000f3b7
mov rsi, r14
cmp byte [rsp + 0xf8], 0
je 0x14000f447
mov rsi, r14
sub rsi, r13
lea rcx, [0x140060d00]
lea rdx, str.___Skipped_0x
call fcn.140001c6b
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, r13d
call fcn.14000d0e0
lea rdx, str._bytes_of_PE_Header
mov rcx, rax
call fcn.140001c6b
mov rcx, rax
call fcn.14000165c
mov rdi, rsi
sub rdi, qword [rbx + 0x30]
lea rbp, [rsp + 0x58]
mov rcx, rbp
mov rdx, r12
call fcn.140010513
mov rcx, rbp
mov rdx, rdi
call fcn.14000f726
mov rcx, r12
mov rdx, rsi
call fcn.14000f7ad
test al, al
je 0x14000f626
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, r12
call fcn.14001066d
mov rbp, qword [rsp + 0x30]
mov rcx, rbp
mov rdx, rdi
call fcn.14000f888
test al, al
je 0x14000f639
mov r13d, dword [rsp + 0x28]
mov r8d, r15d
add r8, r12
mov rcx, rbp
mov rdx, r14
mov r9, r13
call fcn.140003bb2
test al, al
je 0x14000f649
mov rdi, qword [rsp + 0x110]
mov eax, dword [rbx + 0x28]
add rsi, rax
lea rcx, [0x140060d00]
lea rdx, str.____Calling_DriverEntry_0x
call fcn.140001c6b
mov rcx, rax
mov rdx, rsi
call fcn.1400044fe
mov rcx, rax
call fcn.14000165c
test rdi, rdi
je 0x14000f518
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x78]
mov r8, r14
mov r9, r13
call rdi
test al, al
je 0x14000f669
mov cl, byte [rsp + 0x108]
mov dword [rsp + 0x3c], 0
mov rax, qword [rsp + 0x78]
mov r9, r14
test cl, cl
jne 0x14000f538
mov r9, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x3c]
mov rcx, rbp
mov r8, rsi
call fcn.14000fa22
test al, al
je 0x14000f659
mov rax, qword [rsp + 0x118]
mov bl, byte [rsp + 0xf0]
test rax, rax
je 0x14000f56f
mov ecx, dword [rsp + 0x3c]
mov dword [rax], ecx
lea rcx, [0x140060d00]
lea rdx, str.___DriverEntry_returned_0x
call fcn.140001c6b
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov edx, dword [rsp + 0x3c]
mov rcx, rax
call fcn.14000fc96
mov rcx, rax
call fcn.14000165c
test bl, bl
je 0x14000f610
lea rcx, [0x140060d00]
lea rdx, str.___Freeing_memory
call fcn.140001c6b
mov rcx, rax
call fcn.14000165c
mov rcx, rbp
mov rdx, r14
cmp dword [rsp + 0x100], 1
jne 0x14000f6f4
mov r8, qword [rsp + 0x28]
call fcn.140004aa4
jmp 0x14000f6f9
lea rcx, [0x140060d00]
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
call fcn.140001c6b
mov rcx, rax
call fcn.14000165c
xor r14d, r14d
mov rcx, r12
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000f31b
lea rcx, [0x140060d00]
lea rdx, str.____Failed_to_fix_cookie
jmp 0x14000f30b
lea rcx, [0x140060d00]
lea rdx, str.____Failed_to_resolve_imports
jmp 0x14000f677
lea rcx, [0x140060d00]
lea rdx, str.____Failed_to_write_local_image_to_remote_image
jmp 0x14000f677
lea rcx, [0x140060d00]
lea rdx, str.____Failed_to_call_driver_entry
jmp 0x14000f677
lea rcx, [0x140060d00]
lea rdx, str.____Callback_returns_false__failed_
call fcn.140001c6b
mov rcx, rax
call fcn.14000165c
mov rcx, r12
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [0x140060d00]
lea rdx, str.___Freeing_memory
call fcn.140001c6b
mov rcx, rax
call fcn.14000165c
mov rcx, rbp
mov rdx, r14
cmp dword [rsp + 0x100], 1
jne 0x14000f6cc
mov r8, qword [rsp + 0x28]
call fcn.140004aa4
jmp 0x14000f6d1
call fcn.1400058e5
lea rcx, [0x140060d00]
test al, al
je 0x14000f6e8
lea rdx, str.___Memory_has_been_released
jmp 0x14000f30b
lea rdx, str.____WARNING:_Failed_to_free_memory_
jmp 0x14000f30b
call fcn.1400058e5
test al, al
je 0x14000f706
lea rdx, str.___Memory_has_been_released
jmp 0x14000f70d
lea rdx, str.____WARNING:_Failed_to_free_memory_
lea rcx, [0x140060d00]
call fcn.140001c6b
mov rcx, rax
call fcn.14000165c
jmp 0x14000f610