Function at 0x14009deb0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1070
call fcn.14008db20
sub rsp, rax
mov r13, r8
mov r14, rdx
mov rax, rcx
xor edi, edi
test r8, r8
je 0x14009dff8
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], gethostname
mov qword [rsp + 0x50], r8
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], 0x1000
mov dword [rsp + 0x10c0], edi
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x10c0]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9d, [rdi + 0x28]
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14009df5a
lea rdx, str.____Cant_read_module_headers
jmp 0x14009dfdc
mov rbx, 0xffffffffffffffff
mov rsi, rbx
inc rsi
cmp byte [r14 + rsi], dil
jne 0x14009df64
movsxd rax, dword [rsp + 0xac]
lea rcx, [rsp + 0x70]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
add r12, rax
mov ebp, edi
movzx r15d, word [rcx + 6]
test r15d, r15d
je 0x14009dfd5
nop dword [rax]
nop dword [rax + rax]
mov eax, ebp
lea rcx, [rax + rax*4]
lea rdi, [r12 + rcx*8]
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14009dfce
mov rax, rbx
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x14009dfc0
cmp rsi, rax
je 0x14009e03c
inc ebp
cmp ebp, r15d
jb 0x14009dfa0
lea rdx, str.____Cant_find_section
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400176e0
lea rdx, [0x140010da0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.____No_module_address_to_find_pattern
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400176e0
lea rdx, [0x140010da0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor r14d, r14d
mov rax, r14
mov rbx, qword [rsp + 0x10b8]
add rsp, 0x1070
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rdi + 0xc]
test eax, eax
je 0x14009dfd5
mov ecx, dword [rdi + 8]
lea rbp, [rsp + 0x70]
add rbp, rax
je 0x14009dfd5
test ecx, ecx
je 0x14009dfd5
lea rax, [rsp + 0x70]
sub rbp, rax
add rbp, r13
mov edi, ecx
je 0x14009dff8
cmp rcx, 0x40000000
jbe 0x14009e075
lea rdx, str.____Cant_find_pattern__Too_big_section
jmp 0x14009dfff
call fcn.14008d7e8
mov rsi, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x68], rsi
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], gethostname
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x10c0], r14d
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x10c0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 0x28]
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, qword [rsp + 0x10b0]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14009e124
lea rdx, str.____Read_failed_in_FindPatternAtKernel
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400176e0
lea rdx, [0x140010da0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rcx, rsi
call fcn.14008d6e4
jmp 0x14009e01e
mov r10, qword [rsp + 0x10d0]
nop dword [rax]
inc rbx
cmp byte [r10 + rbx], r14b
jne 0x14009e130
sub rdi, rbx
mov r8, r14
je 0x14009e193
movzx r11d, byte [r10]
mov rbx, rsi
mov rax, qword [rsp + 0x10c8]
sub rbx, rax
mov rdx, r10
test r11b, r11b
je 0x14009e17e
movzx ecx, r11b
lea r9, [rbx + r8]
cmp cl, 0x78
jne 0x14009e171
movzx ecx, byte [rax]
cmp byte [r9 + rax], cl
jne 0x14009e183
inc rdx
inc rax
movzx ecx, byte [rdx]
test cl, cl
jne 0x14009e163
cmp byte [rdx], r14b
je 0x14009e19f
inc r8
cmp r8, rdi
mov rax, qword [rsp + 0x10c8]
jb 0x14009e153
lea rdx, str.____Cant_find_pattern
jmp 0x14009e0fa
lea rax, [r8 + rsi]
test rax, rax
je 0x14009e193
lea rbx, [r8 + rbp]
mov rcx, rsi
call fcn.14008d6e4
mov rax, rbx
jmp 0x14009e021