Function at 0x1400ac780
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x118]
sub rsp, 0x218
mov r13, rdx
mov rdi, rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400adfbb
movsxd rsi, dword [rdx + 0x3c]
add rsi, rdx
mov qword [rbp + 0x178], rsi
cmp dword [rsi], 0x4550
jne 0x1400adfbb
mov eax, 0x20b
cmp word [rsi + 0x18], ax
jne 0x1400adfbb
mov ebx, dword [rsi + 0x50]
mov edx, ebx
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400adfbb
movzx ecx, word [rsi + 0x14]
mov eax, dword [rcx + rsi + 0x24]
mov dword [rbp + 0x170], eax
sub ebx, eax
mov r12d, ebx
mov qword [rsp + 0x68], r12
test ebx, 0x1fffff
mov r14d, 0
mov ecx, r14d
setne cl
shr rbx, 0x16
inc rcx
add rbx, rcx
shl rbx, 0x15
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x14023591c], eax
jle 0x1400ac93a
lea rcx, [0x14023591c]
call fcn.1401189ac
cmp dword [0x14023591c], 0xffffffff
jne 0x1400ac93a
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], recv
lea ecx, [r14 + 0x20]
call fcn.140118894
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], 0x1a
mov qword [rsp + 0x58], 0x1f
movups xmm0, xmmword [0x14016c8e8]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14016c8f8]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x14016c900]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], r14b
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402358e8], rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400ac92e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ac928
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ac928
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011888c
nop
lea rcx, [0x14023591c]
call fcn.140118940
cmp qword [0x1402358e8], 0
je 0x1400adfaa
mov qword [rbp + 0x168], r14
mov qword [rsp + 0x20], 0xffffffffffffffff
mov r9, rbx
lea rdx, [rbp + 0x168]
mov rcx, rdi
call fcn.1400ab6c0
test al, al
je 0x1400adfaa
mov rbx, qword [rbp + 0x168]
test rbx, rbx
je 0x1400adfaa
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x40], 0x25
mov qword [rsp + 0x58], rbx
mov dword [rbp + 0x168], r14d
mov qword [rsp + 0x38], r14
lea rax, [rbp + 0x168]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, 0x20
lea r8, [rsp + 0x40]
mov edx, 0x80862007
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, r14
test eax, eax
cmovne rcx, qword [rsp + 0x50]
and ecx, 0x1fffff
mov eax, 0x200000
sub rax, rcx
add rax, rbx
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x168], rax
mov r8d, dword [rsi + 0x54]
mov rdx, r13
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsi + 0x14]
mov esi, r14d
mov rbx, qword [rbp + 0x178]
cmp r14w, word [rbx + 6]
jae 0x1400acb00
lea rdi, [rbx + 0x18]
add rdi, rax
lea rbx, [rdi + 0x10]
mov r12, qword [rbp + 0x178]
nop word [rax + rax]
test dword [rbx + 0x14], 0x80
ja 0x1400acae0
mov r14d, dword [rbx - 4]
add r14, r15
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, r13
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
movsxd rax, esi
lea rcx, [rax + rax*4]
lea r15, [rdi + rcx*8]
mov rdx, r15
lea rcx, str._i__copying_section:__s_n
call fcn.14000c5a0
lea rdx, [0x140176644]
mov rcx, r15
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400acaad
lea rcx, str.___nulled_.rdata_n
call fcn.14000c5a0
mov r8d, dword [rbx]
xor edx, edx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
lea rdx, [0x14017666c]
mov rcx, r15
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400acadb
lea rcx, str.___nulled_.pdata_n
call fcn.14000c5a0
mov r8d, dword [rbx]
xor edx, edx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
mov r15, qword [rsp + 0x60]
inc esi
add rbx, 0x28
movzx eax, word [r12 + 6]
cmp esi, eax
jl 0x1400aca40
mov rdi, qword [rbp + 0x160]
mov r12, qword [rsp + 0x68]
mov rax, qword [rbp + 0x168]
mov r14, rax
mov esi, dword [rbp + 0x170]
sub rax, rsi
mov qword [rbp + 0x168], rax
mov rbx, rax
mov r13, qword [rbp + 0x178]
sub rbx, qword [r13 + 0x30]
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.1400ae7a0
mov rdx, rbx
mov rcx, rax
call fcn.1400adfe0
mov rdx, qword [rbp + 0x168]
mov rcx, r15
call fcn.1400ae0e0
test al, al
je 0x1400adfbb
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.1400ae8d0
mov rdx, rax
mov rcx, rdi
call fcn.1400ae190
test al, al
je 0x1400adf8a
add rsi, r15
xor ebx, ebx
test r12, r12
je 0x1400acbbc
sub rsi, r14
nop dword [rax]
nop dword [rax + rax]
mov rax, r12
sub rax, rbx
mov r9d, 0x4f
cmp rax, r9
cmovb r9, rax
lea rdx, [rbx + r14]
lea r8, [rdx + rsi]
mov rcx, rdi
call fcn.1400a9310
add rbx, 0x4f
cmp rbx, r12
jb 0x1400acb90
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d150]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.IoCreateDriver]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140176698]
mov dword [rsp + 0x48], eax
movzx eax, word [0x14017669c]
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x4e], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402343e0], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400acc2b
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, setsockopt
lea rdx, str.IofCompleteRequest
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402343e8], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400acc84
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.IoCreateSymbolicLink
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402343f0], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400accdd
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d150]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.IoCreateDevice]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140176708]
mov dword [rsp + 0x48], eax
movzx eax, word [0x14017670c]
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x4e], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402343f8], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400acd4c
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [0x1401766e8]
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234400], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400acda5
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x18
lea rdx, str.ZwQuerySystemInformation
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234408], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400acdfe
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.ZwFreeVirtualMemory
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234410], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ace57
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, socket
lea rdx, str.ZwProtectVirtualMemory
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234418], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400aceb0
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.ZwAllocateVirtualMemory
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234420], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400acf09
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.ZwQueryVirtualMemory
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234428], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400acf62
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d150]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.ExAllocatePool]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140176780]
mov dword [rsp + 0x48], eax
movzx eax, word [0x140176784]
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x4e], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234430], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400acfd1
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x1a
lea rdx, str.PsLookupProcessByProcessId
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234438], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad02a
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.MmCopyVirtualMemory
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234440], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad083
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.ObfDereferenceObject
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234448], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad0dc
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d160]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.PsGetProcessPeb]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x1401767e0]
mov dword [rsp + 0x48], eax
movzx eax, word [0x1401767e4]
mov word [rsp + 0x4c], ax
movzx eax, byte [0x1401767e6]
mov byte [rsp + 0x4e], al
mov byte [rsp + 0x4f], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234450], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad156
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d160]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.KeAttachProcess]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140176818]
mov dword [rsp + 0x48], eax
movzx eax, word [0x14017681c]
mov word [rsp + 0x4c], ax
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rsp + 0x4e], al
mov byte [rsp + 0x4f], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234458], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad1d0
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d160]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.KeDetachProcess]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140176808]
mov dword [rsp + 0x48], eax
movzx eax, word [0x14017680c]
mov word [rsp + 0x4c], ax
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rsp + 0x4e], al
mov byte [rsp + 0x4f], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234460], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad24a
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d140]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.IoAllocateMdl]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140176840]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x140176844]
mov byte [rsp + 0x4c], al
mov byte [rsp + 0x4d], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234468], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad2b8
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.MmProbeAndLockPages
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234470], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad311
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x1c
lea rdx, str.MmMapLockedPagesSpecifyCache
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234478], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad36a
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x19
lea rdx, str.MmProtectMdlSystemAddress
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234480], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad3c3
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, setsockopt
lea rdx, str.MmUnmapLockedPages
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234488], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad41c
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d140]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.MmUnlockPages]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140176890]
mov dword [rsp + 0x48], eax
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rsp + 0x4c], al
mov byte [rsp + 0x4d], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234490], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad48a
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_htons]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.IoFreeMdl]
movsd qword [rsp + 0x40], xmm0
movzx eax, byte [0x1401768d0]
mov byte [rsp + 0x48], al
mov byte [rsp + 0x49], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234498], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad4ee
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.IoGetCurrentProcess
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402344a0], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad547
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d130]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.MmCopyMemory]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x1401768f0]
mov dword [rsp + 0x48], eax
mov byte [rsp + 0x4c], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402344a8], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad5aa
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d150]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.MmMapIoSpaceEx]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x1401768e0]
mov dword [rsp + 0x48], eax
movzx eax, word [0x1401768e4]
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x4e], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402344b0], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad619
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d150]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.MmUnmapIoSpace]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140176918]
mov dword [rsp + 0x48], eax
movzx eax, word [0x14017691c]
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x4e], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402344b8], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad688
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.ExFreePoolWithTag
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402344c0], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad6e1
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x19
lea rdx, str.MmGetPhysicalMemoryRanges
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402344c8], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad73a
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.MmGetVirtualForPhysical
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402344d0], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad793
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x1e
lea rdx, str.PsGetProcessSectionBaseAddress
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402344d8], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad7ec
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x18
lea rdx, str.IoGetDeviceObjectPointer
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402344e0], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad845
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.MmIsAddressValid
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402344e8], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad89e
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d150]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.PsGetProcessId]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x1401769a0]
mov dword [rsp + 0x48], eax
movzx eax, word [0x1401769a4]
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x4e], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402344f0], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad90d
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.ObReferenceObjectByName
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x1402344f8], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad966
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, setsockopt
lea rdx, str.IoDriverObjectType
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234500], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ad9bf
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x1b
lea rdx, str.RtlCreateSecurityDescriptor
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234508], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ada18
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d130]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.RtlLengthSid]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x1401769f8]
mov dword [rsp + 0x48], eax
mov byte [rsp + 0x4c], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234510], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ada7b
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d130]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.RtlCreateAcl]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140176a40]
mov dword [rsp + 0x48], eax
mov byte [rsp + 0x4c], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234518], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400adade
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, socket
lea rdx, str.RtlAddAccessAllowedAce
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234520], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400adb37
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x1c
lea rdx, str.RtlSetDaclSecurityDescriptor
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234528], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400adb90
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d160]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.ZwCreateSection]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140176a50]
mov dword [rsp + 0x48], eax
movzx eax, word [0x140176a54]
mov word [rsp + 0x4c], ax
movzx eax, byte [0x140176a56]
mov byte [rsp + 0x4e], al
mov byte [rsp + 0x4f], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234530], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400adc0a
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x14017d0f0]
movdqu xmmword [rsp + 0x50], xmm1
mov rax, qword [str.ZwClose]
mov dword [rsp + 0x40], eax
movzx eax, word [0x140176a94]
mov word [rsp + 0x44], ax
movzx eax, byte [0x140176a96]
mov byte [rsp + 0x46], al
mov byte [rsp + 0x47], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234538], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400adc77
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, setsockopt
lea rdx, str.ZwMapViewOfSection
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234540], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400adcd0
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_inet_addr]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.KeLowerIrql]
movsd qword [rsp + 0x40], xmm0
movzx eax, word [0x140176ab0]
mov word [rsp + 0x48], ax
movzx eax, byte [0x140176ab2]
mov byte [rsp + 0x4a], al
mov byte [rsp + 0x4b], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234548], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400add40
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_inet_addr]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.KfRaiseIrql]
movsd qword [rsp + 0x40], xmm0
movzx eax, word [0x140176aa0]
mov word [rsp + 0x48], ax
movzx eax, byte [0x140176aa2]
mov byte [rsp + 0x4a], al
mov byte [rsp + 0x4b], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234550], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400addb0
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, socket
lea rdx, str.KeDelayExecutionThread
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234558], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ade09
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_htons]
movdqu xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [str.SeExports]
movsd qword [rsp + 0x40], xmm0
movzx eax, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rsp + 0x48], al
mov byte [rsp + 0x49], 0
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234560], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400ade6d
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.MmGetPhysicalAddress
lea rcx, [rsp + 0x40]
call fcn.140008b20
nop
lea r8, [rsp + 0x40]
mov rdx, qword [0x140234368]
mov rcx, rdi
call fcn.1400a9620
mov qword [0x140234568], rax
mov r8, qword [rsp + 0x58]
cmp r8, 0xf
jbe 0x1400adec6
mov rdx, qword [rsp + 0x40]
call fcn.140008a10
mov r8d, dword [r13 + 0x28]
add r8, qword [rbp + 0x168]
mov dword [rbp + 0x168], 0
lea rax, [rbp - 0x80]
lea rcx, [0x1402343e0]
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x1400adef0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
lea r9, [rbp - 0x80]
lea rdx, [rbp + 0x168]
mov rcx, rdi
call fcn.1400ae320
test al, al
je 0x1400adf8a
mov edx, dword [rbp + 0x168]
mov r8d, edx
lea rcx, str.__driver_returned_0x_x____d__n
call fcn.14000c5a0
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r14
jmp 0x1400adfbd
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x70]
mov rcx, rdi
call fcn.1400a94f0
jmp 0x1400adfbb
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x218
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret