Function at 0x140011130
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140062788]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov rcx, rdx
call fcn.140012514
test rax, rax
je 0x1400111d9
mov rbx, rax
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x1400111e9
mov ebp, dword [rbx + 0x50]
xor r15d, r15d
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14d, 0
test rax, rax
je 0x140011207
mov r12, rax
movzx eax, word [rbx + 0x14]
mov r13d, dword [rbx + rax + 0x24]
cmp byte [rsp + 0xf8], 0
cmovne r15d, r13d
sub ebp, r15d
cmp dword [rsp + 0x100], 1
jne 0x14001122e
mov rcx, rsi
mov edx, ebp
call fcn.1400110ac
jmp 0x14001123b
lea rcx, [0x140063d60]
lea rdx, str.____Invalid_format_of_PE_image
jmp 0x1400111f7
lea rcx, [0x140063d60]
lea rdx, str.____Image_is_not_64_bit
call fcn.1400020c8
mov rcx, rax
call fcn.1400019b7
xor r14d, r14d
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140015aa0
mov rax, r14
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, ebp
mov rcx, rsi
xor edx, edx
call fcn.140005ae3
mov r14, rax
test rax, rax
je 0x1400114de
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rsi
lea rcx, [0x140063d60]
lea rdx, str.___Image_base_has_been_allocated_at_0x
call fcn.1400020c8
mov rcx, rax
mov rdx, r14
call fcn.140004cea
mov rcx, rax
call fcn.1400019b7
mov r8d, dword [rbx + 0x54]
mov rcx, r12
mov rdx, rdi
call fcn.14001b150
movzx eax, word [rbx + 6]
test ax, ax
je 0x1400112d1
mov rcx, rbx
add rcx, 0x18
movzx ebp, word [rbx + 0x14]
add rbp, rcx
add rbp, 0xc
xor esi, esi
cmp byte [rbp + 0x18], 0
js 0x1400112c2
mov ecx, dword [rbp]
mov r8d, dword [rbp + 4]
add rcx, r12
mov edx, dword [rbp + 8]
add rdx, rdi
call fcn.14001b150
movzx eax, word [rbx + 6]
inc rsi
movzx ecx, ax
add rbp, 0x28
cmp rsi, rcx
jb 0x1400112a3
mov rsi, r14
cmp byte [rsp + 0xf8], 0
je 0x140011333
mov rsi, r14
sub rsi, r13
lea rcx, [0x140063d60]
lea rdx, str.___Skipped_0x
call fcn.1400020c8
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, r13d
call fcn.14000e5f4
lea rdx, str._bytes_of_PE_Header
mov rcx, rax
call fcn.1400020c8
mov rcx, rax
call fcn.1400019b7
mov rdi, rsi
sub rdi, qword [rbx + 0x30]
lea rbp, [rsp + 0x58]
mov rcx, rbp
mov rdx, r12
call fcn.140012537
mov rcx, rbp
mov rdx, rdi
call fcn.140011612
mov rcx, r12
mov rdx, rsi
call fcn.1400116c0
test al, al
je 0x140011512
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov rdx, r12
call fcn.1400126b8
mov rbp, qword [rsp + 0x30]
mov rcx, rbp
mov rdx, rdi
call fcn.14001179b
test al, al
je 0x140011525
mov r13d, dword [rsp + 0x28]
mov r8d, r15d
add r8, r12
mov rcx, rbp
mov rdx, r14
mov r9, r13
call fcn.140004369
test al, al
je 0x140011535
mov rdi, qword [rsp + 0x110]
mov eax, dword [rbx + 0x28]
add rsi, rax
lea rcx, [0x140063d60]
lea rdx, str.____Calling_DriverEntry_0x
call fcn.1400020c8
mov rcx, rax
mov rdx, rsi
call fcn.140004cea
mov rcx, rax
call fcn.1400019b7
test rdi, rdi
je 0x140011404
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x78]
mov r8, r14
mov r9, r13
call rdi
test al, al
je 0x140011555
mov cl, byte [rsp + 0x108]
mov dword [rsp + 0x3c], 0
mov rax, qword [rsp + 0x78]
mov r9, r14
test cl, cl
jne 0x140011424
mov r9, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x3c]
mov rcx, rbp
mov r8, rsi
call fcn.140011a10
test al, al
je 0x140011545
mov rax, qword [rsp + 0x118]
mov bl, byte [rsp + 0xf0]
test rax, rax
je 0x14001145b
mov ecx, dword [rsp + 0x3c]
mov dword [rax], ecx
lea rcx, [0x140063d60]
lea rdx, str.___DriverEntry_returned_0x
call fcn.1400020c8
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov edx, dword [rsp + 0x3c]
mov rcx, rax
call fcn.140011cb4
mov rcx, rax
call fcn.1400019b7
test bl, bl
je 0x1400114fc
lea rcx, [0x140063d60]
lea rdx, str.___Freeing_memory
call fcn.1400020c8
mov rcx, rax
call fcn.1400019b7
mov rcx, rbp
mov rdx, r14
cmp dword [rsp + 0x100], 1
jne 0x1400115e0
mov r8, qword [rsp + 0x28]
call fcn.1400052c0
jmp 0x1400115e5
lea rcx, [0x140063d60]
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
call fcn.1400020c8
mov rcx, rax
call fcn.1400019b7
xor r14d, r14d
mov rcx, r12
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140011207
lea rcx, [0x140063d60]
lea rdx, str.____Failed_to_fix_cookie
jmp 0x1400111f7
lea rcx, [0x140063d60]
lea rdx, str.____Failed_to_resolve_imports
jmp 0x140011563
lea rcx, [0x140063d60]
lea rdx, str.____Failed_to_write_local_image_to_remote_image
jmp 0x140011563
lea rcx, [0x140063d60]
lea rdx, str.____Failed_to_call_driver_entry
jmp 0x140011563
lea rcx, [0x140063d60]
lea rdx, str.____Callback_returns_false__failed_
call fcn.1400020c8
mov rcx, rax
call fcn.1400019b7
mov rcx, r12
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, [0x140063d60]
lea rdx, str.___Freeing_memory
call fcn.1400020c8
mov rcx, rax
call fcn.1400019b7
mov rcx, rbp
mov rdx, r14
cmp dword [rsp + 0x100], 1
jne 0x1400115b8
mov r8, qword [rsp + 0x28]
call fcn.1400052c0
jmp 0x1400115bd
call fcn.1400062f1
lea rcx, [0x140063d60]
test al, al
je 0x1400115d4
lea rdx, str.___Memory_has_been_released
jmp 0x1400111f7
lea rdx, str.____WARNING:_Failed_to_free_memory_
jmp 0x1400111f7
call fcn.1400062f1
test al, al
je 0x1400115f2
lea rdx, str.___Memory_has_been_released
jmp 0x1400115f9
lea rdx, str.____WARNING:_Failed_to_free_memory_
lea rcx, [0x140063d60]
call fcn.1400020c8
mov rcx, rax
call fcn.1400019b7
jmp 0x1400114fc