Function at 0x1400a5b50
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1070
call fcn.140096210
sub rsp, rax
mov r13, r8
mov r14, rdx
mov rax, rcx
xor ebx, ebx
test r8, r8
je 0x1400a5c9c
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], gethostname
mov qword [rsp + 0x50], r8
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], 0x1000
mov dword [rsp + 0x10c0], ebx
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x10c0]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9d, Ordinal_45
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400a5bfc
lea rdx, str.____Cant_read_module_headers
jmp 0x1400a5c80
mov rdi, 0xffffffffffffffff
mov rsi, rdi
inc rsi
cmp byte [r14 + rsi], bl
jne 0x1400a5c06
movsxd rax, dword [rsp + 0xac]
lea r15, [rsp + 0x70]
add r15, rax
movzx eax, word [r15 + 0x14]
lea r12, [r15 + 0x18]
add r12, rax
mov ebp, ebx
cmp bx, word [r15 + 6]
jae 0x1400a5c79
nop dword [rax]
nop dword [rax + rax]
mov eax, ebp
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400a5c6e
mov rax, rdi
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x1400a5c60
cmp rsi, rax
je 0x1400a5ce0
inc ebp
movzx eax, word [r15 + 6]
cmp ebp, eax
jb 0x1400a5c40
lea rdx, str.____Cant_find_section
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14001be80
lea rdx, [0x140004eb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.____No_module_address_to_find_pattern
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14001be80
lea rdx, [0x140004eb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor r14d, r14d
mov rax, r14
mov rbx, qword [rsp + 0x10b8]
add rsp, 0x1070
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x1400a5c79
mov r8d, dword [rbx + 8]
lea rcx, [rsp + 0x70]
add rcx, rax
je 0x1400a5c79
test r8d, r8d
je 0x1400a5c79
lea rax, [rsp + 0x70]
sub rcx, rax
lea rbp, [rcx + r13]
mov ebx, r8d
test rbp, rbp
je 0x1400a5c9c
cmp rbx, 0x40000000
jbe 0x1400a5d27
lea rdx, str.____Cant_find_pattern__Too_big_section
jmp 0x1400a5ca3
mov rcx, rbx
call fcn.140095edc
mov rsi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x68], rsi
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], gethostname
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x10c0], r14d
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x10c0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, Ordinal_45
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, qword [rsp + 0x10b0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400a5ddb
lea rdx, str.____Read_failed_in_FindPatternAtKernel
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14001be80
lea rdx, [0x140004eb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rcx, rsi
call fcn.140095dd8
jmp 0x1400a5cc2
mov r10, qword [rsp + 0x10d0]
inc rdi
cmp byte [r10 + rdi], r14b
jne 0x1400a5de3
sub rbx, rdi
mov r9, r14
je 0x1400a5e46
movzx r11d, byte [r10]
mov rdi, rsi
mov rax, qword [rsp + 0x10c8]
sub rdi, rax
mov rdx, r10
test r11b, r11b
je 0x1400a5e31
movzx ecx, r11b
lea r8, [rdi + r9]
cmp cl, 0x78
jne 0x1400a5e24
movzx ecx, byte [rax]
cmp byte [r8 + rax], cl
jne 0x1400a5e36
inc rdx
inc rax
movzx ecx, byte [rdx]
test cl, cl
jne 0x1400a5e16
cmp byte [rdx], r14b
je 0x1400a5e52
inc r9
cmp r9, rbx
mov rax, qword [rsp + 0x10c8]
jb 0x1400a5e06
lea rdx, str.____Cant_find_pattern
jmp 0x1400a5db1
lea rax, [r9 + rsi]
test rax, rax
je 0x1400a5e46
sub rax, rsi
lea rbx, [rax + rbp]
mov rcx, rsi
call fcn.140095dd8
mov rax, rbx
jmp 0x1400a5cc5