Function at 0x14006af60
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r12
push r14
push r15
mov eax, 0x1070
call fcn.1400d07d0
sub rsp, rax
xor r12d, r12d
mov r15, r9
mov rdi, r8
mov r14, rcx
test r8, r8
je 0x14006b08a
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea r9d, [r12 + 0x28]
lea rax, [rsp + 0x10a8]
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], r12d
mov edx, 0x80862007
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], gethostname
mov qword [rsp + 0x60], 0x1000
mov dword [rsp + 0x10a8], r12d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14006b000
lea rdx, str.____Cant_read_module_headers
jmp 0x14006b06e
movsxd rax, dword [rsp + 0xac]
lea rcx, [rsp + 0x70]
add rcx, rax
mov r8d, r12d
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
movzx r9d, word [rcx + 6]
add r10, rax
test r9d, r9d
je 0x14006b067
mov rbx, 0xffffffffffffffff
nop
mov eax, r8d
lea rcx, [rax + rax*4]
cmp dword [r10 + rcx*8], 0x45474150
lea rdx, [r10 + rcx*8]
jne 0x14006b05f
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rdx + rax], r12b
jne 0x14006b050
cmp rax, 4
je 0x14006b093
inc r8d
cmp r8d, r9d
jb 0x14006b030
lea rdx, str.____Cant_find_section
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006c1f0
lea rdx, [0x14006c3d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.____No_module_address_to_find_pattern
jmp 0x14006b0ca
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x14006b067
mov ecx, dword [rdx + 8]
lea rbp, [rsp + 0x70]
add rbp, rax
je 0x14006b067
test ecx, ecx
je 0x14006b067
lea rax, [rsp + 0x70]
sub rbp, rax
add rbp, rdi
mov edi, ecx
je 0x14006b08a
cmp rcx, 0x40000000
jbe 0x14006b0ee
lea rdx, str.____Cant_find_pattern__Too_big_section
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006c1f0
lea rdx, [0x14006c3d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rax, r12
jmp 0x14006b18a
mov qword [rsp + 0x10a0], rsi
call fcn.1400d0410
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x40]
mov rsi, rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x10a8]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x30], rax
mov r9d, Ordinal_45
mov dword [rsp + 0x28], r12d
mov edx, 0x80862007
mov rcx, r14
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x40], gethostname
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x10a8], r12d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14006b1a2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Read_failed_in_FindPatternAtKernel
call fcn.14006c1f0
lea rdx, [0x14006c3d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rax, r12
mov rsi, qword [rsp + 0x10a0]
mov rbx, qword [rsp + 0x10b0]
add rsp, 0x1070
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov r10, qword [rsp + 0x10c0]
nop word [rax + rax]
inc rbx
cmp byte [r10 + rbx], r12b
jne 0x14006b1b0
mov r9, r12
sub rdi, rbx
je 0x14006b20c
movzx r11d, byte [r10]
mov rbx, rsi
sub rbx, r15
nop dword [rax + rax]
mov rdx, r10
mov rax, r15
test r11b, r11b
je 0x14006b1ff
movzx ecx, r11b
lea r8, [rbx + r9]
cmp cl, 0x78
jne 0x14006b1f1
movzx ecx, byte [rax]
cmp byte [r8 + rax], cl
jne 0x14006b204
movzx ecx, byte [rdx + 1]
inc rdx
inc rax
test cl, cl
jne 0x14006b1e3
cmp byte [rdx], r12b
je 0x14006b23c
inc r9
cmp r9, rdi
jb 0x14006b1d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_find_pattern
call fcn.14006c1f0
lea rdx, [0x14006c3d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rsi
call fcn.1400d017c
jmp 0x14006b17f
lea rbx, [r9 + rsi]
test rbx, rbx
je 0x14006b20c
mov rcx, rsi
call fcn.1400d017c
sub rbx, rsi
lea rax, [rbx + rbp]
jmp 0x14006b182