Function at 0x1400039b0
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x40
mov rsi, rcx
test rcx, rcx
je 0x140004090
mov rax, qword [rcx + 0x10]
xor r15d, r15d
mov qword [rsp + 0x70], r15
lea rcx, [0x140008188]
mov edx, dword [rax + 0x50]
mov qword [rsp + 0x78], rdx
call qword [0x140008148]
mov rdx, qword [0x1400080d8]
mov ecx, dword [0x1400080d0]
call fcn.140005770
lea r9, [rsp + 0x78]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [rsp + 0x70]
lea rcx, [r15 - 1]
call fcn.14000579c
mov ebx, eax
test eax, eax
jns 0x140003a8a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [r15 + 8]
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140004090
lea rdi, str.C:UsersMALDEV01DesktopMaldev_codeNew_ModulesPePackerPePackerPePackerLocalPeExec.c
mov rcx, rdi
lea edx, [r15 + 0x5c]
call fcn.140002650
test rax, rax
je 0x140003a73
lea edx, [r15 + 0x5c]
mov rcx, rdi
call fcn.140002650
lea rdi, [rax + 1]
mov dword [rsp + 0x20], 0x18a
lea rdx, str.____NtAllocateVirtualMemory_Failed_With_Error:_0x_0.8X____s._d__n
mov r8d, ebx
jmp 0x14000404c
mov rax, qword [rsi + 0x10]
mov edi, r15d
mov r9, qword [rsp + 0x70]
mov ebp, dword [rax + 0x28]
add rbp, r9
cmp r15w, word [rax + 6]
jae 0x140003ae3
mov rbx, r15
nop word [rax + rax]
mov rax, qword [rsi + 0x18]
mov edx, dword [rax + rbx + 0x14]
mov ecx, dword [rax + rbx + 0xc]
add rdx, qword [rsi]
add rcx, r9
mov r8d, dword [rax + rbx + 0x10]
call fcn.1400025b0
mov rax, qword [rsi + 0x10]
lea rbx, [rbx + 0x28]
mov r9, qword [rsp + 0x70]
inc edi
movzx ecx, word [rax + 6]
cmp edi, ecx
jl 0x140003ab0
mov rcx, qword [rsi + 0x20]
mov rdx, r9
call fcn.140003350
test eax, eax
je 0x140004090
mov r8, qword [rsi + 0x10]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsi + 0x28]
mov r8, qword [r8 + 0x30]
call fcn.1400037f0
test eax, eax
je 0x140004090
mov r8, qword [rsi + 0x18]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x70]
call fcn.1400035a0
test eax, eax
je 0x140004090
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140003ba7
mov r9, qword [0x140008168]
lea rdx, str._i__Applying_PeFluctuation_On_0x_p_For__ld_Bytes_n
mov r8, qword [0x140008160]
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [0x140008160], r15
je 0x140004090
cmp qword [0x140008168], r15
je 0x140004090
lea rdx, [0x1400054f0]
mov ecx, 1
call qword [0x140008120]
mov rbx, rax
test rax, rax
jne 0x140003c3f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rbx + 8]
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140004090
lea rdi, str.C:UsersMALDEV01DesktopMaldev_codeNew_ModulesPePackerPePackerPePackerLocalPeExec.c
mov rcx, rdi
lea edx, [rbx + 0x5c]
call fcn.140002650
test rax, rax
je 0x140003c25
lea edx, [rbx + 0x5c]
mov rcx, rdi
call fcn.140002650
lea rdi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.____AddVectoredExceptionHandler_Failed_With_Error:__d____s._d_n
mov dword [rsp + 0x20], 0x1b1
jmp 0x140004049
call fcn.140004f70
mov rcx, rbx
call qword [0x140008128]
test eax, eax
jne 0x140003cbb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140004090
lea rdi, str.C:UsersMALDEV01DesktopMaldev_codeNew_ModulesPePackerPePackerPePackerLocalPeExec.c
mov edx, 0x5c
mov rcx, rdi
call fcn.140002650
test rax, rax
je 0x140003ca1
mov edx, 0x5c
mov rcx, rdi
call fcn.140002650
lea rdi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.____RemoveVectoredExceptionHandler_Failed_With_Error:__d____s._d_n
mov dword [rsp + 0x20], 0x1bc
jmp 0x140004049
mov rax, qword [rsi + 0x38]
lea rdi, str.C:UsersMALDEV01DesktopMaldev_codeNew_ModulesPePackerPePackerPePackerLocalPeExec.c
mov qword [rsp + 0x80], r14
mov edx, dword [rax + 4]
test edx, edx
je 0x140003dae
mov ecx, dword [rax]
movabs rax, 0xaaaaaaaaaaaaaaab
mov r8, qword [rsp + 0x70]
mul rdx
add rcx, r8
shr rdx, 3
dec edx
call qword [0x140008130]
test al, al
jne 0x140003dae
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x140003dae
mov edx, 0x5c
mov rcx, rdi
call fcn.140002650
test rax, rax
je 0x140003d4f
mov edx, 0x5c
mov rcx, rdi
call fcn.140002650
lea rbx, [rax + 1]
jmp 0x140003d52
mov rbx, rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rbx
mov dword [rsp + 0x20], 0x1c8
mov r8d, eax
lea rdx, str.____RtlAddFunctionTable_Failed_With_Error:__d____s._d_n
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [0x140004160]
mov ecx, 1
call qword [0x140008120]
test rax, rax
jne 0x140003e73
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x140003e73
mov edx, 0x5c
mov rcx, rdi
call fcn.140002650
test rax, rax
je 0x140003e14
mov edx, 0x5c
mov rcx, rdi
call fcn.140002650
lea rbx, [rax + 1]
jmp 0x140003e17
mov rbx, rdi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rbx
mov dword [rsp + 0x20], 0x1d1
mov r8d, eax
lea rdx, str.____AddVectoredExceptionHandler_Failed_With_Error:__d____s._d_n
mov rcx, r14
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [0x1400080f8]
mov ecx, dword [0x1400080f0]
call fcn.140005770
xor edx, edx
xor r8d, r8d
lea rcx, [rdx - 1]
call fcn.14000579c
mov r14, qword [rsp + 0x80]
mov ebx, eax
test eax, eax
jns 0x140003f01
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140004090
mov edx, 0x5c
mov rcx, rdi
call fcn.140002650
test rax, rax
je 0x140003eea
mov edx, 0x5c
mov rcx, rdi
call fcn.140002650
lea rdi, [rax + 1]
mov dword [rsp + 0x20], 0x1da
lea rdx, str.____NtFlushInstructionCache_Failed_With_Error:_0x_0.8X____s._d__n
mov r8d, ebx
jmp 0x14000404c
mov rax, qword [rsi + 0x30]
cmp dword [rax + 4], r15d
je 0x140003f3d
mov eax, dword [rax]
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rax + rcx + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x140003f3d
nop
xor r8d, r8d
lea edx, [r8 + 1]
call rax
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
je 0x140003f3d
mov rcx, qword [rsp + 0x70]
jmp 0x140003f20
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [0x140008118]
mov qword [0x140008178], rax
test rax, rax
jne 0x140003fbb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140004090
mov edx, 0x5c
mov rcx, rdi
call fcn.140002650
test rax, rax
je 0x140003fa1
mov edx, 0x5c
mov rcx, rdi
call fcn.140002650
lea rdi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.____CreateTimerQueue_Failed_With_Error:__d____s._d_n
mov dword [rsp + 0x20], 0x1ef
jmp 0x140004049
mov dword [rsp + 0x30], r15d
lea r8, [0x140004140]
mov dword [rsp + 0x28], r15d
lea rcx, [0x140008170]
xor r9d, r9d
mov dword [rsp + 0x20], 0x1f4
mov rdx, rax
call qword [0x140008110]
test eax, eax
jne 0x14000409d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140004090
mov edx, 0x5c
mov rcx, rdi
call fcn.140002650
test rax, rax
je 0x140004034
mov edx, 0x5c
mov rcx, rdi
call fcn.140002650
lea rdi, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.____CreateTimerQueueTimer_Failed_With_Error:__d____s._d_n
mov dword [rsp + 0x20], 0x1f7
mov r8d, eax
mov r9, rdi
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
add rsp, 0x40
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14000410a
mov r8, rbp
lea rdx, str.___Executing_Entry_Point___0x_p__:_n_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbp, rbp
je 0x140004092
cmp dword [rsi + 0x48], r15d
je 0x14000412e
mov rcx, qword [rsp + 0x70]
xor r8d, r8d
lea edx, [r8 + 1]
call rbp
add rsp, 0x40
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
call rbp
add rsp, 0x40
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret