Function at 0x140009248
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
lea rsi, [rcx + 0x20]
mov r13b, dl
mov rbx, qword [rsi]
mov r15, rcx
cmp rbx, rsi
je 0x1400094b6
cmp byte [rbx + 0x51], 0
jne 0x14000948e
movups xmm0, xmmword [rbx + 0x20]
xor edx, edx
lea rax, [rbp - 0x10]
lea r9, [0x14000fd40]
mov qword [rsp + 0x20], rax
lea r8, [0x14000fd60]
movdqu xmmword [rbp - 0x10], xmm0
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov r14, rax
test r13b, r13b
jne 0x1400092c8
mov rdx, qword [rbx + 0x10]
mov rcx, r15
call fcn.140001558
mov edx, dword [r14 + 0x28]
test edx, edx
je 0x140009316
mov rcx, qword [rbx + 0x10]
mov r9d, 3
and qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x20], rcx
lea r8, [rcx + rdx]
mov rdx, r15
xor ecx, ecx
call fcn.1400094d0
test eax, eax
je 0x140009316
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov rcx, rax
call fcn.140001f00
test al, al
jne 0x140009496
movzx eax, word [r14 + 6]
mov edx, 0x10b
cmp word [r14 + 0x18], dx
lea ecx, [rdx - 3]
lea r12d, [rdx - 0x13]
cmovne r12d, ecx
lea rcx, [rax + rax*4]
add r12, r14
mov rdi, r12
lea rax, [r12 + rcx*8]
cmp r12, rax
jae 0x1400093f8
test dword [rdi + 0x24], 0x2000000
je 0x1400093de
mov ecx, dword [rdi + 0xc]
add rcx, qword [rbx + 0x10]
mov r8d, dword [rdi + 8]
mov eax, dword [rbx + 0x4c]
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x40], r8
test al, 0x10
je 0x140009377
xor edx, edx
call fcn.1400025c0
jmp 0x1400093de
and qword [rsp + 0x20], 0
lea r8, [rbp + 0x40]
mov r9d, 4
lea rdx, [rbp + 0x50]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
test eax, eax
js 0x1400093a8
mov r8, qword [rbp + 0x40]
xor edx, edx
mov rcx, qword [rbp + 0x50]
call fcn.1400025c0
and qword [rsp + 0x20], 0
lea r8, [rbp + 0x40]
mov r9d, 1
lea rdx, [rbp + 0x50]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
mov r9d, 0x4000
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x50]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwFreeVirtualMemory]
movzx eax, word [r14 + 6]
add rdi, 0x28
lea rcx, [rax + rax*4]
lea rax, [r12 + rcx*8]
cmp rdi, rax
jb 0x140009347
mov eax, dword [rbx + 0x4c]
test al, 4
je 0x14000948a
mov r8d, dword [r14 + 0x54]
mov rcx, qword [rbx + 0x10]
mov qword [rbp + 0x40], r8
test al, 0x10
je 0x14000941c
xor edx, edx
call fcn.1400025c0
jmp 0x14000948a
and qword [rsp + 0x20], 0
lea r8, [rbp + 0x40]
mov qword [rbp + 0x50], rcx
lea rdx, [rbp + 0x50]
or rcx, 0xffffffffffffffff
mov r9d, 4
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
test eax, eax
js 0x140009471
mov r8, qword [rbp + 0x40]
xor edx, edx
mov rcx, qword [rbx + 0x10]
call fcn.1400025c0
and qword [rsp + 0x20], 0
lea r8, [rbp + 0x40]
mov r9d, 2
lea rdx, [rbp + 0x50]
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwProtectVirtualMemory]
jmp 0x14000948a
xor edx, edx
lea r9, [0x14000fd40]
lea r8, [0x14000fdf0]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov byte [rbx + 0x51], 1
mov rbx, qword [rbx]
jmp 0x14000926c
xor edx, edx
lea r9, [0x14000fd40]
lea r8, [0x14000fda0]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov eax, 0xc000010a
jmp 0x1400094b8
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret