Function at 0x14000fc30
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x88
mov r15, rdx
mov rdi, rcx
xor r14d, r14d
mov qword [rbp - 0x39], r14
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400103ca
movsxd rsi, dword [rdx + 0x3c]
add rsi, rdx
cmp dword [rsi], 0x4550
jne 0x1400103ca
test rsi, rsi
je 0x1400103ca
mov eax, 0x20b
cmp word [rsi + 0x18], ax
jne 0x1400103ca
mov r12d, dword [rsi + 0x50]
mov edx, r12d
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rbp + 0x67], rax
test rax, rax
je 0x1400103ca
movzx ecx, word [rsi + 0x14]
mov eax, dword [rcx + rsi + 0x24]
mov dword [rbp + 0x77], eax
sub r12d, eax
mov dword [rbp + 0x87], r12d
mov r13d, r14d
mov qword [rbp + 0x8f], r14
mov ecx, 4
mov eax, dword [rbp + 0x7f]
cmp eax, 1
jne 0x14000fd1a
mov edx, r12d
lea r8, [rbp + 0x8f]
mov rcx, rdi
call fcn.14000f7f0
mov r14, rax
mov r13, qword [rbp + 0x8f]
jmp 0x14000ff7f
cmp eax, 2
jne 0x14000fe5b
mov qword [rbp - 0x41], r14
cmp qword [0x140025690], r13
jne 0x14000fd90
lea rax, str.x____xxxxxxxx____xxxxxxxxx____xxxxxxxx
mov qword [rsp + 0x20], rax
lea r9, [0x14001e250]
mov r8, qword [0x140025678]
lea rdx, str.PAGELK
mov rcx, rdi
call fcn.14000b110
mov qword [0x140025690], rax
test rax, rax
je 0x14000ff7f
mov r9d, 5
mov r8d, 1
mov rdx, rax
mov rcx, rdi
call fcn.14000a6f0
mov qword [0x140025690], rax
test rax, rax
je 0x14000ff7f
mov r9d, r12d
lea rdx, [rbp - 0x41]
mov rcx, rdi
call fcn.14000d3b0
test al, al
je 0x14000ff7f
mov r14, qword [rbp - 0x41]
test r14, r14
je 0x14000ff7f
cmp qword [0x1400255e8], r13
jne 0x14000fe1d
lea rax, str.xx____x___x_x____xxxxxxx____x
mov qword [rsp + 0x20], rax
lea r9, [0x14001e2d0]
mov r8, qword [0x140025678]
lea rdx, str.PAGE
mov rcx, rdi
call fcn.14000b110
mov qword [0x1400255e8], rax
test rax, rax
je 0x14000fe43
lea rdx, [rax + 0xc]
mov qword [0x1400255e8], rdx
mov r9d, 5
mov r8d, 1
mov rcx, rdi
call fcn.14000a6f0
mov qword [0x1400255e8], rax
test rax, rax
je 0x14000fe43
mov byte [rbp + 0x6f], r13b
mov dword [rsp + 0x20], r12d
mov r9, r14
lea rdx, [rbp + 0x6f]
mov rcx, rdi
call fcn.14000d8b0
test al, al
je 0x14000fe43
cmp byte [rbp + 0x6f], r13b
jne 0x14000ff7f
mov r8d, r12d
mov rdx, r14
mov rcx, rdi
call fcn.140009a50
xor eax, eax
mov r14d, eax
jmp 0x14000ff7f
mov ebx, r12d
test r12d, r12d
je 0x14000ff7b
mov edx, ecx
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400256d8], eax
jle 0x14000ff4d
lea rcx, [0x1400256d8]
call fcn.140012aa0
cmp dword [0x1400256d8], 0xffffffff
jne 0x14000ff4d
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x21], xmm1
mov ecx, 0x20
call fcn.140012988
mov qword [rbp - 0x31], rax
movdqa xmm0, xmmword [0x14001e9b0]
movdqu xmmword [rbp - 0x21], xmm0
movups xmm0, xmmword [str.ExAllocatePoolWithTag]
movups xmmword [rax], xmm0
mov ecx, dword [0x14001e388]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14001e38c]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea r8, [rbp - 0x31]
mov rdx, qword [0x140025678]
mov rcx, rdi
call fcn.140009eb0
mov qword [0x1400257c0], rax
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x14000ff41
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ff3b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400129c4
nop
lea rcx, [0x1400256d8]
call fcn.140012a34
cmp qword [0x1400257c0], 0
je 0x14000ff7b
mov qword [rbp - 0x41], r14
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x41]
mov rcx, rdi
call fcn.14000e7a0
mov r14, qword [rbp - 0x41]
test al, al
mov eax, 0
cmove r14, rax
mov rbx, qword [rbp + 0x67]
mov rcx, rbx
test r14, r14
jne 0x14000ff9a
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400103ca
mov r8d, dword [rsi + 0x54]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rsi + 0x14]
add rbx, 0x24
xor ecx, ecx
mov r15d, ecx
cmp cx, word [rsi + 6]
jae 0x140010003
add rbx, rsi
mov r13, qword [rbp + 0x67]
mov rdi, qword [rbp + 0x57]
test dword [rbx + 0x18], 0x80
ja 0x14000ffe1
mov ecx, dword [rbx]
add rcx, r13
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
inc r15d
add rbx, 0x28
movzx eax, word [rsi + 6]
cmp r15d, eax
jl 0x14000ffc4
mov r12d, dword [rbp + 0x87]
mov rdi, qword [rbp + 0x4f]
mov r13, qword [rbp + 0x8f]
mov r15, r14
mov eax, dword [rbp + 0x77]
sub r14, rax
mov rbx, r14
sub rbx, qword [rsi + 0x30]
mov rdx, qword [rbp + 0x67]
lea rcx, [rbp - 0x31]
call fcn.140010d90
mov rdx, rbx
mov rcx, rax
call fcn.1400103e0
mov rdx, r14
mov rcx, qword [rbp + 0x67]
call fcn.1400104e0
test al, al
je 0x1400103ca
mov rdx, qword [rbp + 0x67]
lea rcx, [rbp - 0x31]
call fcn.140010ec0
mov rdx, rax
mov rcx, rdi
call fcn.1400105a0
test al, al
je 0x14001027f
mov eax, dword [rbp + 0x77]
add rax, qword [rbp + 0x67]
je 0x14001027f
mov ebx, r12d
test r12d, r12d
je 0x14001027f
xor ecx, ecx
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x31], 0x33
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], rbx
mov dword [rbp + 0x6f], ecx
mov qword [rsp + 0x38], rcx
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
mov r9d, 0x28
lea r8, [rbp - 0x31]
mov edx, 0x80862007
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14001027f
mov esi, dword [rsi + 0x28]
add rsi, r14
mov qword [rsp + 0x20], r13
mov r9d, ebx
mov r8, r15
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x5f]
call fcn.1400077d0
test al, al
je 0x14001027f
xor eax, eax
mov dword [rbp + 0x6f], eax
mov rax, qword [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x5f]
mov r8, rsi
lea rdx, [rbp + 0x6f]
mov rcx, rdi
call fcn.1400108a0
test al, al
je 0x14001027f
mov rcx, qword [rbp + 0x97]
test rcx, rcx
je 0x14001012c
mov eax, dword [rbp + 0x6f]
mov dword [rcx], eax
mov eax, dword [rbp + 0x7f]
mov rdx, r15
mov rcx, rdi
cmp eax, 1
jne 0x140010251
mov r8, r13
call fcn.140009b10
test al, al
je 0x140010265
mov rdx, r13
mov rcx, rdi
call fcn.140009c60
test al, al
je 0x140010265
test r13, r13
je 0x140010265
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140025770], eax
jle 0x140010238
lea rcx, [0x140025770]
call fcn.140012aa0
cmp dword [0x140025770], 0xffffffff
jne 0x140010238
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x14001e980]
movdqu xmmword [rbp - 0x21], xmm1
movsd xmm0, qword [str.ExFreePool]
movsd qword [rbp - 0x31], xmm0
movzx eax, word [0x14001e398]
mov word [rbp - 0x29], ax
mov byte [rbp - 0x27], 0
lea r8, [rbp - 0x31]
mov rdx, qword [0x140025678]
mov rcx, rdi
call fcn.140009eb0
mov qword [0x140025720], rax
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x14001022c
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010226
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010226
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400129c4
nop
lea rcx, [0x140025770]
call fcn.140012a34
mov r8, qword [0x140025720]
test r8, r8
je 0x140010265
mov r9, r13
mov rcx, rdi
call fcn.14000d150
jmp 0x140010265
cmp eax, 2
jne 0x140010260
mov r8d, r12d
call fcn.140009a50
jmp 0x140010265
call fcn.140009d90
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r15
jmp 0x1400103cc
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 0x7f]
mov rdx, r15
mov rcx, rdi
cmp eax, 1
jne 0x1400103b6
mov r8, r13
call fcn.140009b10
test al, al
je 0x1400103ca
mov rdx, r13
mov rcx, rdi
call fcn.140009c60
test al, al
je 0x1400103ca
test r13, r13
je 0x1400103ca
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140025770], eax
jle 0x14001039d
lea rcx, [0x140025770]
call fcn.140012aa0
cmp dword [0x140025770], 0xffffffff
jne 0x14001039d
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x14001e980]
movdqu xmmword [rbp - 0x21], xmm1
movsd xmm0, qword [str.ExFreePool]
movsd qword [rbp - 0x31], xmm0
movzx eax, word [0x14001e398]
mov word [rbp - 0x29], ax
mov byte [rbp - 0x27], 0
lea r8, [rbp - 0x31]
mov rdx, qword [0x140025678]
mov rcx, rdi
call fcn.140009eb0
mov qword [0x140025720], rax
mov rdx, qword [rbp - 0x19]
cmp rdx, 0xf
jbe 0x140010391
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001038b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001038b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400129c4
nop
lea rcx, [0x140025770]
call fcn.140012a34
mov r8, qword [0x140025720]
test r8, r8
je 0x1400103ca
mov r9, r13
mov rcx, rdi
call fcn.14000d150
jmp 0x1400103ca
cmp eax, 2
jne 0x1400103c5
mov r8d, r12d
call fcn.140009a50
jmp 0x1400103ca
call fcn.140009d90
xor eax, eax
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret