Function at 0x140009690
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r8
mov rcx, rdx
call fcn.14000b8c0
test rax, rax
je 0x140009747
mov r15, rax
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140009757
mov r14d, dword [r15 + 0x50]
xor ebp, ebp
xor ecx, ecx
mov rdx, r14
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, 0
test rax, rax
je 0x140009795
mov rbx, rax
movzx eax, word [r15 + 0x14]
mov r13d, dword [r15 + rax + 0x24]
cmp byte [rsp + 0x108], 0
cmovne ebp, r13d
mov eax, dword [rsp + 0x110]
sub r14d, ebp
mov qword [rsp + 0x30], 0
cmp eax, 1
jne 0x1400097ac
mov edx, r14d
lea r8, [rsp + 0x30]
mov rcx, rsi
call fcn.140009390
jmp 0x1400097cb
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Invalid_format_of_PE_image
jmp 0x140009765
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Image_is_not_64_bit
call fcn.140060410
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
xor edi, edi
mov rax, rdi
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 2
jne 0x1400097be
mov rcx, rsi
mov edx, r14d
call fcn.1400095c0
jmp 0x1400097cb
mov r8d, r14d
mov rcx, rsi
xor edx, edx
call fcn.1400078b0
mov rdi, rax
test rax, rax
je 0x14000990a
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rsi
mov r8d, dword [r15 + 0x54]
mov rcx, rbx
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [r15 + 6]
test ax, ax
je 0x140009850
mov rcx, r15
add rcx, 0x18
movzx esi, word [r15 + 0x14]
add rsi, rcx
add rsi, 0xc
xor r14d, r14d
jmp 0x14000982f
inc r14
movzx ecx, ax
add rsi, 0x28
cmp r14, rcx
jae 0x140009850
test byte [rsi + 0x18], 0x80
jne 0x140009820
mov ecx, dword [rsi]
mov r8d, dword [rsi + 4]
add rcx, rbx
mov edx, dword [rsi + 8]
add rdx, r12
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [r15 + 6]
jmp 0x140009820
xor eax, eax
cmp byte [rsp + 0x108], 0
cmovne rax, r13
mov r12, rdi
sub r12, rax
mov r13, r12
sub r13, qword [r15 + 0x30]
lea rcx, [rsp + 0x60]
mov rdx, rbx
call fcn.14000b8f0
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
cmp rcx, rax
je 0x14000995e
mov r14, qword [rsp + 0x48]
jmp 0x1400098a9
add rcx, 0x18
cmp rcx, rax
je 0x1400098fb
mov r8d, dword [rcx + 0x10]
test r8d, r8d
je 0x1400098a0
xor edx, edx
jmp 0x1400098cb
inc rdx
mov r9d, r8d
cmp rdx, r9
jae 0x1400098a0
mov r9, qword [rcx + 8]
movzx r9d, word [r9 + rdx*2]
mov r10d, r9d
and r10d, 0xf000
cmp r10d, 0xa000
jne 0x1400098c0
and r9d, 0xfff
mov r8, qword [rcx]
add qword [r8 + r9], r13
mov r8d, dword [rcx + 0x10]
jmp 0x1400098c0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
jne 0x140009968
jmp 0x1400099ab
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
call fcn.140060410
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
xor edi, edi
mov rcx, rbx
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140009795
mov r14, qword [rsp + 0x48]
test rcx, rcx
je 0x1400099ab
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140009995
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140009cf8
add rdx, 0x27
mov rcx, rax
call fcn.1401658ec
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rcx, rbx
mov rdx, r12
call fcn.140009d00
test al, al
je 0x140009b46
lea r13, [rsp + 0x80]
mov rcx, r13
mov rdx, rbx
call fcn.14000bac0
mov rcx, r14
mov rdx, r13
call fcn.140009e10
test al, al
je 0x140009b59
mov r13d, dword [rsp + 0x40]
mov r8d, ebp
add r8, rbx
mov rcx, r14
mov rdx, rdi
mov r9, r13
call fcn.1400046d0
test al, al
je 0x140009b97
mov rax, qword [rsp + 0x120]
mov esi, dword [r15 + 0x28]
test rax, rax
je 0x140009a3a
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x58]
mov r8, rdi
mov r9, r13
call rax
test al, al
je 0x140009bb7
movzx ecx, byte [rsp + 0x118]
add r12, rsi
mov dword [rsp + 0x3c], 0
mov rax, qword [rsp + 0x58]
mov r9, rdi
test cl, cl
jne 0x140009a5e
mov r9, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x3c]
mov rcx, r14
mov r8, r12
call fcn.14000a060
test al, al
je 0x140009ba7
mov rax, qword [rsp + 0x128]
movzx esi, byte [rsp + 0x100]
test rax, rax
je 0x140009a96
mov ecx, dword [rsp + 0x3c]
mov dword [rax], ecx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___DriverEntry_returned_0x
call fcn.140060410
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov edx, dword [rsp + 0x3c]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rcx, rax
call fcn.140060800
test sil, sil
je 0x140009948
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Freeing_memory
call fcn.140060410
mov rcx, rax
call fcn.140060800
mov eax, dword [rsp + 0x110]
cmp eax, 1
jne 0x140009cad
mov r8, qword [rsp + 0x30]
mov rcx, r14
mov rdx, rdi
call fcn.140007000
test al, al
je 0x140009cc6
mov rdx, qword [rsp + 0x30]
mov rcx, r14
call fcn.140007460
test al, al
je 0x140009cc6
mov rdx, qword [rsp + 0x30]
mov rcx, r14
jmp 0x140009ccf
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_fix_cookie
jmp 0x140009765
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_resolve_imports
call fcn.140060410
mov r15, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, r15
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x140009bd2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_write_local_image_to_remote_image
jmp 0x140009bc5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_call_driver_entry
jmp 0x140009bc5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Callback_returns_false__failed_
call fcn.140060410
mov rcx, rax
call fcn.140060800
mov rcx, rbx
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Freeing_memory
call fcn.140060410
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rbx
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
mov eax, dword [rsp + 0x110]
cmp eax, 1
jne 0x140009c5a
mov r8, qword [rsp + 0x30]
mov rcx, r14
mov rdx, rdi
call fcn.140007000
test al, al
je 0x140009c9a
mov rdx, qword [rsp + 0x30]
mov rcx, r14
call fcn.140007460
test al, al
je 0x140009c9a
mov rdx, qword [rsp + 0x30]
mov rcx, r14
jmp 0x140009c71
mov rcx, r14
mov rdx, rdi
cmp eax, 2
jne 0x140009c71
mov r8, qword [rsp + 0x40]
call fcn.140005400
jmp 0x140009c76
call fcn.140007d30
test al, al
je 0x140009c9a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Memory_has_been_released
call fcn.140060410
mov rcx, rax
call fcn.140060800
jmp 0x140009793
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____WARNING:_Failed_to_free_memory_
jmp 0x140009765
mov rcx, r14
mov rdx, rdi
cmp eax, 2
jne 0x140009ccf
mov r8, qword [rsp + 0x40]
call fcn.140005400
test al, al
jne 0x140009cd8
lea rdx, str.____WARNING:_Failed_to_free_memory_
jmp 0x140009cdf
call fcn.140007d30
test al, al
je 0x140009cc6
lea rdx, str.___Memory_has_been_released
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140060410
mov rcx, rax
call fcn.140060800
jmp 0x140009948
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3