Function at 0x140001810
Capabilities:
Enumerate pe sections
Print debug messages

Disassembly:
push rbp
push rbx
push r13
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
xor r13d, r13d
mov dword [rbp - 0x39], 0x20001e
lea rax, [0x140003f70]
mov qword [rbp + 0x77], r13
mov qword [rbp - 0x31], rax
xor r9d, r9d
lea rax, [rbp + 0x77]
xor r8d, r8d
mov qword [rsp + 0x38], rax
lea edx, [r13 + 0x40]
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
mov qword [rsp + 0x30], r13
mov byte [rsp + 0x28], r13b
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x39]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByName]
lea rbx, [0x140007350]
test eax, eax
js 0x1400018e2
mov eax, dword [0x140009330]
lea rcx, [0x140001140]
movaps xmm0, xmmword [rbp - 0x39]
mov edx, eax
shl rdx, 5
inc eax
mov dword [0x140009330], eax
mov rax, qword [rbp + 0x77]
add rax, 0xe0
movdqa xmmword [rbp - 0x19], xmm0
mov qword [rdx + rbx + 0x10], rax
xchg qword [rax], rcx
movaps xmm0, xmmword [rbp - 0x19]
mov qword [rdx + rbx + 0x18], rcx
movups xmmword [rdx + rbx], xmm0
mov qword [0x140006338], rcx
lea rdx, [rbp - 0x19]
lea rcx, [0x140003f90]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x1400018f9
lfence
mov r8d, eax
lea rdx, [rbp - 0x39]
lea rcx, [0x140003f40]
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
lea rax, [0x140003fb0]
mov dword [rbp - 0x29], 0x1a0018
mov qword [rbp - 0x21], rax
xor r9d, r9d
lea rax, [rbp + 0x6f]
mov qword [rbp + 0x6f], r13
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
mov qword [rsp + 0x30], r13
lea edx, [r9 + 0x40]
mov byte [rsp + 0x28], r13b
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByName]
test eax, eax
js 0x140001ea9
mov eax, dword [0x140009330]
lea rdx, [0x140001400]
movaps xmm0, xmmword [rbp - 0x29]
lea rcx, [0x140003f90]
mov r8d, eax
mov qword [rsp + 0x108], rsi
inc eax
shl r8, 5
mov dword [0x140009330], eax
mov rax, qword [rbp + 0x6f]
add rax, 0xe0
movdqa xmmword [rbp - 9], xmm0
mov qword [rsp + 0xc8], rdi
mov qword [r8 + rbx + 0x10], rax
mov qword [rsp + 0xc0], r12
xchg qword [rax], rdx
movaps xmm0, xmmword [rbp - 9]
mov qword [r8 + rbx + 0x18], rdx
mov qword [0x140006340], rdx
lea rdx, [rbp - 9]
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xb0], r15
movups xmmword [r8 + rbx], xmm0
call qword [sym.imp.ntoskrnl.exe_DbgPrint]
mov rsi, qword [rbp + 0x6f]
mov r14, r13
mov edi, r13d
mov r12, qword [rsi + 0x18]
movsxd rcx, dword [r12 + 0x3c]
lea r11, [r12 + 0x18]
add r11, rcx
movzx eax, word [rcx + r12 + 0x14]
movzx r15d, word [rcx + r12 + 6]
add r11, rax
mov rcx, 0xffffffffffffffff
test r15d, r15d
je 0x140001c4a
lea r8, [0x140003fd0]
mov qword [rbp + 0x67], r8
cmp dword [r11], 0x45474150
je 0x140001a38
cmp dword [r11], 0x7865742e
jne 0x140001ab2
cmp byte [r11 + 4], 0x74
jne 0x140001ab2
mov ebx, dword [r11 + 0xc]
mov rax, rcx
add rbx, r12
inc rax
cmp byte [r8 + rax], r13b
jne 0x140001a42
mov r10d, dword [r11 + 8]
mov r9d, r13d
sub r10d, eax
nop word [rax + rax]
mov rcx, r8
mov r14d, r9d
add r14, rbx
lea rdx, [0x140003ff0]
mov r8, r14
mov al, 0x78
sub r8, qword [rbp + 0x67]
nop dword [rax]
cmp al, 0x78
jne 0x140001a91
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140001eb5
movzx eax, byte [rcx + 1]
inc rcx
inc rdx
test al, al
jne 0x140001a80
test r14, r14
jne 0x140001aca
lea r8, [0x140003fd0]
mov rcx, 0xffffffffffffffff
inc edi
add r11, 0x28
cmp edi, r15d
jb 0x140001a17
test r14, r14
je 0x140001c4a
lea r9, [rbp + 0x67]
mov dword [rbp + 0x67], r13d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IoEnumerateDeviceObjectList]
cmp eax, 0xc0000023
jne 0x140001c46
mov eax, dword [rbp + 0x67]
test eax, eax
je 0x140001c46
lea ebx, [rax*8]
xor ecx, ecx
mov edx, ebx
mov r8d, 0x6e556353
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r15, rax
test rax, rax
je 0x140001c46
mov rcx, qword [rbp + 0x6f]
lea r9, [rbp + 0x67]
mov r8d, ebx
mov rdx, rax
call qword [sym.imp.ntoskrnl.exe_IoEnumerateDeviceObjectList]
test eax, eax
js 0x140001c3b
lfence
mov ecx, dword [rbp + 0x67]
test ecx, ecx
je 0x140001c3b
mov edi, r13d
lea r12, str._________
nop dword [rax]
mov eax, edi
mov rsi, qword [r15 + rax*8]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IoGetAttachedDeviceReference]
mov rbx, rax
test rax, rax
je 0x140001bf0
xorps xmm0, xmm0
lea rcx, [rbp + 7]
xor eax, eax
xor r8d, r8d
xor edx, edx
mov qword [rbp + 0x17], rax
movups xmmword [rbp + 7], xmm0
call qword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov qword [rsp + 0x40], r13
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov byte [rsp + 0x30], r13b
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov rdx, rbx
mov ecx, 0x70140
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntoskrnl.exe_IoBuildDeviceIoControlRequest]
test rax, rax
je 0x140001be7
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IofCallDriver]
cmp eax, 0x103
jne 0x140001be7
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
lea rcx, [rbp + 7]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsi + 0x40]
test rcx, rcx
je 0x140001c27
mov rax, qword [rcx + 0x208]
mov r8, r12
mov edx, dword [rax + 0x18]
add rdx, rax
nop dword [rax]
movzx eax, byte [r8]
lea r8, [r8 + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001c10
xor edx, edx
call r14
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
inc edi
cmp edi, dword [rbp + 0x67]
jb 0x140001b50
xor edx, edx
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rsi, qword [rbp + 0x6f]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rcx, [0x140004010]
call fcn.140003320
mov r12, rax
test rax, rax
je 0x140001e81
movsxd r15, dword [rax + 0x3c]
mov r14, r13
add r15, rax
mov edi, r13d
movzx ecx, word [r15 + 0x14]
lea r11, [r15 + 0x18]
movzx esi, word [r15 + 6]
add r11, rcx
test esi, esi
je 0x140001e81
lea rcx, [0x140004020]
mov qword [rbp + 0x67], rcx
nop dword [rax]
cmp dword [r11], 0x45474150
je 0x140001cb9
cmp dword [r11], 0x7865742e
jne 0x140001d21
cmp byte [r11 + 4], 0x74
jne 0x140001d21
mov ebx, dword [r11 + 0xc]
mov rax, 0xffffffffffffffff
add rbx, r12
inc rax
cmp byte [rcx + rax], r13b
jne 0x140001cc7
mov r10d, dword [r11 + 8]
mov r9d, r13d
sub r10d, eax
nop word [rax + rax]
mov r14d, r9d
lea rdx, [0x140004040]
add r14, rbx
mov al, 0x78
mov r8, r14
sub r8, qword [rbp + 0x67]
cmp al, 0x78
jne 0x140001d07
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140001ed0
movzx eax, byte [rcx + 1]
inc rcx
inc rdx
test al, al
jne 0x140001cf6
test r14, r14
jne 0x140001d38
lea rcx, [0x140004020]
inc edi
add r11, 0x28
cmp edi, esi
jb 0x140001ca0
test r14, r14
je 0x140001e81
movzx eax, word [r15 + 0x14]
lea rbx, [r15 + 0x18]
movzx r15d, word [r15 + 6]
lea r8, [0x140004060]
add rbx, rax
mov qword [rbp + 0x67], r8
mov r10, r13
mov esi, r13d
nop word [rax + rax]
cmp dword [rbx], 0x45474150
je 0x140001d76
cmp dword [rbx], 0x7865742e
jne 0x140001dec
cmp byte [rbx + 4], 0x74
jne 0x140001dec
mov edi, dword [rbx + 0xc]
mov rax, 0xffffffffffffffff
add rdi, r12
inc rax
cmp byte [r8 + rax], r13b
jne 0x140001d83
mov r11d, dword [rbx + 8]
mov r9d, r13d
sub r11d, eax
nop word [rax + rax]
mov rax, r8
mov r10d, r9d
add r10, rdi
lea rdx, [0x140004070]
mov r8, r10
mov cl, 0x78
sub r8, qword [rbp + 0x67]
nop dword [rax]
cmp cl, 0x78
jne 0x140001dd2
movzx ecx, byte [rdx]
cmp byte [r8 + rax], cl
jne 0x140001eeb
movzx ecx, byte [rax + 1]
inc rax
inc rdx
test cl, cl
jne 0x140001dc0
test r10, r10
jne 0x140001e04
lea r8, [0x140004060]
inc esi
add rbx, 0x28
cmp esi, r15d
jb 0x140001d60
test r10, r10
je 0x140001e81
lea rbx, [0x140004080]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], r13b
jne 0x140001e12
mov r11d, 0x20
sub r11d, eax
nop dword [rax]
nop dword [rax + rax]
mov r9d, r13d
lea rdx, [0x140004090]
add r9, r10
mov al, 0x78
mov r8, r9
mov rcx, rbx
sub r8, rbx
cmp al, 0x78
jne 0x140001e59
movzx eax, byte [rdx]
cmp byte [r8 + rcx], al
jne 0x140001f06
movzx eax, byte [rcx + 1]
inc rcx
inc rdx
test al, al
jne 0x140001e48
test r9, r9
je 0x140001e81
movsxd rcx, dword [r14 + 4]
movzx edx, byte [r9 + 3]
add rcx, 8
add rcx, r14
call fcn.1400014e0
mov r14, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0x108]
mov r15, qword [rsp + 0xb0]
add rsp, 0xd0
pop r13
pop rbx
pop rbp
ret
inc r9d
lea r8, [0x140003fd0]
cmp r9d, r10d
jbe 0x140001a60
mov r14, r13
jmp 0x140001aa4
inc r9d
lea rcx, [0x140004020]
cmp r9d, r10d
jbe 0x140001ce0
mov r14, r13
jmp 0x140001d1a
inc r9d
lea r8, [0x140004060]
cmp r9d, r11d
jbe 0x140001da0
mov r10, r13
jmp 0x140001de5
inc r13d
cmp r13d, r11d
jbe 0x140001e30
jmp 0x140001e81