Function at 0x140006d10
Capabilities:
Access pe header
Enumerate pe sections

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x30
mov rdi, qword [0x14000d940]
mov r12, r8
mov ebx, ecx
test rdi, rdi
je 0x140006d78
lea r9, str.SepInitializeCodeIntegrity
mov rax, qword [rdi + 8]
cmp r9, rax
je 0x140006dd5
test rax, rax
je 0x140006d70
mov r8, r9
sub r8, rax
nop dword [rax]
movzx ecx, word [r8 + rax]
movzx edx, word [rax]
lea rax, [rax + 2]
test cx, cx
je 0x140006d66
cmp cx, dx
je 0x140006d50
movzx eax, dx
movzx ecx, cx
sub ecx, eax
je 0x140006dd5
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140006d31
xor edi, edi
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
test rdi, rdi
jne 0x140006ee4
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
movzx ecx, word [rax + 0x14]
lea rdx, [rax + 0x18]
add rdx, rcx
movzx ecx, word [rax + 6]
test ecx, ecx
je 0x140006edd
cmp dword [rdx], 0x45474150
jne 0x140006dc5
cmp byte [rdx + 4], 0
je 0x140006ddb
add rdx, 0x28
add ecx, 0xffffffff
jne 0x140006db7
xor al, al
jmp 0x140006f6e
mov rdi, qword [rdi + 0x10]
jmp 0x140006d7a
mov r15d, dword [rdx + 0xc]
add r15, r12
je 0x140006edd
cmp ebx, 0x295a
ja 0x140006e36
je 0x140006e16
cmp ebx, 0x1db1
je 0x140006e28
cmp ebx, 0x23f0
je 0x140006e1f
cmp ebx, 0x2580
je 0x140006e1f
cmp ebx, 0x2800
jne 0x140006edd
lea rbp, [0x14000d138]
jmp 0x140006e81
lea rbp, [0x14000d070]
jmp 0x140006e81
lea rbp, [0x14000d248]
mov esi, 0xe
jmp 0x140006e86
cmp ebx, 0x3839
je 0x140006e7a
cmp ebx, 0x3ad7
je 0x140006e6c
cmp ebx, 0x3fab
je 0x140006e63
cmp ebx, 0x42ee
jne 0x140006edd
lea rbp, [0x14000d1e0]
jmp 0x140006e81
lea rbp, [0x14000d0a0]
jmp 0x140006e81
lea rbp, [0x14000d330]
mov esi, 0x14
jmp 0x140006e86
lea rbp, [0x14000d2f8]
mov esi, 0xf
mov r14d, dword [rdx + 8]
mov rdi, r15
cmp r14, rsi
jb 0x140006edd
sub r14, rsi
nop word [rax + rax]
movzx edx, byte [rbp]
mov r8, r14
sub r8, rdi
mov rcx, rdi
add r8, r15
call fcn.140007e70
mov rdi, rax
test rax, rax
je 0x140006edd
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.140008640
test eax, eax
je 0x140006ee4
inc rdi
mov rax, r14
sub rax, rdi
add rax, r15
jne 0x140006ea0
xor al, al
jmp 0x140006f6e
cmp ebx, 0x295a
ja 0x140006f94
je 0x140006f16
cmp ebx, 0x1db1
je 0x140006f8b
cmp ebx, 0x23f0
je 0x140006f16
cmp ebx, 0x2580
je 0x140006f16
cmp ebx, 0x2800
jne 0x140006edd
lea rsi, [0x14000d014]
mov rbx, rdi
movzx edx, byte [rsi]
mov r8, rdi
sub r8, rbx
mov rcx, rbx
add r8, 0x1fd
call fcn.140007e70
mov rbx, rax
test rax, rax
je 0x140006f66
movzx eax, word [rax]
cmp ax, word [rsi]
jne 0x140006f55
movzx eax, byte [rbx + 2]
cmp al, byte [rsi + 2]
je 0x140006fd4
inc rbx
mov rax, rdi
sub rax, rbx
add rax, 0x1fd
jne 0x140006f20
xor ebx, ebx
test rbx, rbx
setne al
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r12
pop rdi
pop rbx
ret
lea rsi, [0x14000d06c]
jmp 0x140006f1d
cmp ebx, 0x3839
je 0x140006f16
cmp ebx, 0x3ad7
je 0x140006fc8
cmp ebx, 0x3fab
je 0x140006fbc
cmp ebx, 0x42ee
jne 0x140006edd
lea rsi, [0x14000d050]
jmp 0x140006f1d
lea rsi, [0x14000d214]
jmp 0x140006f1d
test rbx, rbx
je 0x140006f6b
mov rcx, qword [rsp + 0x70]
mov r8d, ebx
sub r8d, r12d
mov rdx, r12
call qword [sym.imp.ntdll.dll_RtlAddressInSectionTable]
mov rcx, qword [rsp + 0x78]
sub rax, r12
mov qword [rcx], rax
lea rax, [0x14000d058]
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], 2
jmp 0x140006f68