Function at 0x14004b040
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xe0
mov rax, qword [0x1401530c0]
xor rax, rsp
mov qword [rbp - 9], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rbp - 0x71], rcx
mov rax, qword [rbp + 0x8f]
mov qword [rbp - 0x59], rax
xor r15d, r15d
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x19], r15
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14004b6eb
movsxd r13, dword [rdx + 0x3c]
add r13, rdx
cmp dword [r13], 0x4550
jne 0x14004b6eb
test r13, r13
je 0x14004b6eb
mov eax, 0x20b
cmp word [r13 + 0x18], ax
je 0x14004b0ce
lea rdx, str.____Image_is_not_64_bit
jmp 0x14004b6f2
mov ebx, dword [r13 + 0x50]
mov edx, ebx
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x14004b70e
movzx eax, word [r13 + 0x14]
mov r12d, dword [rax + r13 + 0x24]
mov dword [rsp + 0x30], r12d
sub ebx, r12d
mov qword [rsp + 0x40], r15
mov eax, ebx
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x40]
mov edx, ebx
mov rcx, rdi
call fcn.14004aba0
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rbp - 0x61], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test rax, rax
jne 0x14004b16b
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
call fcn.140048590
lea rdx, [0x140048770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14004b70e
lea rdx, str.___Image_base_has_been_allocated_at_0x
call fcn.140048590
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140048770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, dword [r13 + 0x54]
mov rdx, rsi
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r13 + 0x14]
add rbx, 0x24
mov edi, r15d
xor eax, eax
cmp ax, word [r13 + 6]
jae 0x14004b1ec
add rbx, r13
nop word [rax + rax]
test dword [rbx + 0x18], 0x80
ja 0x14004b1dd
mov ecx, dword [rbx]
add rcx, r14
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
inc edi
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp edi, eax
jl 0x14004b1c0
mov r15, qword [rsp + 0x38]
mov qword [rbp - 0x69], r15
sub r15, r12
mov qword [rsp + 0x38], r15
lea rdx, str.___Skipped_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140048590
lea rdx, [0x1400438a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, r12d
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._bytes_of_PE_Header
call fcn.140048590
lea rdx, [0x140048770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rsi, r15
sub rsi, qword [r13 + 0x30]
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x14004b32b
movsxd rax, dword [r14 + 0x3c]
add rax, r14
cmp dword [rax], 0x4550
jne 0x14004b32b
test rax, rax
je 0x14004b32b
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x49], xmm1
xor edx, edx
mov r11d, edx
mov qword [rbp - 0x39], rdx
mov ecx, dword [rax + 0xb0]
test ecx, ecx
jne 0x14004b2a0
jmp 0x14004b336
lea rbx, [r14 + rcx]
mov edi, dword [rax + 0xb4]
add rdi, rbx
mov r10, qword [rbp - 0x41]
cmp rbx, rdi
jae 0x14004b325
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x14004b325
mov eax, dword [rbx]
add rax, r14
mov qword [rsp + 0x50], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x58], rax
lea rax, [rcx - 8]
shr rax, 1
mov dword [rbp - 0x79], eax
cmp r10, r11
je 0x14004b301
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [r10], xmm0
movsd xmm1, qword [rbp - 0x79]
movsd qword [r10 + 0x10], xmm1
mov r10, qword [rbp - 0x41]
add r10, 0x18
mov qword [rbp - 0x41], r10
jmp 0x14004b316
lea r8, [rsp + 0x50]
mov rdx, r10
lea rcx, [rbp - 0x49]
call fcn.14004ccf0
mov r10, qword [rbp - 0x41]
mov eax, dword [rbx + 4]
add rbx, rax
mov r11, qword [rbp - 0x39]
cmp rbx, rdi
jb 0x14004b2b6
mov rbx, qword [rbp - 0x49]
jmp 0x14004b345
xorps xmm1, xmm1
xor eax, eax
mov r11d, eax
xorps xmm0, xmm0
psrldq xmm0, 8
movq rbx, xmm1
movq r10, xmm0
cmp rbx, r10
je 0x14004b3b5
lea r9, [rbx + 0x10]
mov edi, 0xf000
mov r12d, 0xa000
xor r15d, r15d
nop dword [rax]
mov edx, r15d
cmp dword [r9], r15d
jbe 0x14004b39e
nop dword [rax + rax]
mov ecx, edx
mov rax, qword [r9 - 8]
movzx r8d, word [rax + rcx*2]
movzx eax, r8w
and ax, di
cmp ax, r12w
jne 0x14004b397
and r8d, 0xfff
mov rax, qword [r9 - 0x10]
add qword [r8 + rax], rsi
inc edx
cmp edx, dword [r9]
jb 0x14004b370
add r9, 0x18
lea rax, [r9 - 0x10]
cmp rax, r10
jne 0x14004b360
mov r12d, dword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
test rbx, rbx
je 0x14004b410
sub r11, rbx
movabs rax, 0x2aaaaaaaaaaaaaab
imul r11
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x14004b408
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b408
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400d4f10
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x14004b4bb
movsxd rax, dword [r14 + 0x3c]
add rax, r14
cmp dword [rax], 0x4550
jne 0x14004b4bb
test rax, rax
je 0x14004b4bb
mov ecx, dword [rax + 0xd8]
test ecx, ecx
jne 0x14004b46d
lea rdx, str.___Load_config_directory_wasnt_found__probably_StackCookie_not_defined__fix_cookie_skipped
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140048590
lea rdx, [0x140048770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14004b50d
mov rdi, qword [rcx + r14 + 0x58]
test rdi, rdi
jne 0x14004b480
lea rdx, str.___StackCookie_not_defined__fix_cookie_skipped
jmp 0x14004b44c
mov rax, r14
sub rax, r15
add rdi, rax
movabs rsi, 0x2b992ddfa232
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
cmp qword [rdi], rsi
je 0x14004b4c7
lea rdx, str.____StackCookie_already_fixed___this_probably_wrong
call fcn.140048590
lea rdx, [0x140048770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.____Failed_to_fix_cookie
jmp 0x14004b6f2
lea rdx, str.___Fixing_stack_cookie
call fcn.140048590
lea rdx, [0x140048770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
xor rcx, rbx
xor rcx, rsi
movabs rax, 0x2b992ddfa233
cmp rcx, rsi
cmove rcx, rax
mov qword [rdi], rcx
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14004c2c0
mov rdx, rax
mov rsi, qword [rbp - 0x71]
mov rcx, rsi
call fcn.14004b740
mov rbx, qword [rsp + 0x40]
test al, al
jne 0x14004b53e
lea rdx, str.____Failed_to_resolve_imports
jmp 0x14004b5f7
mov r8d, r12d
add r8, r14
mov r9, qword [rsp + 0x48]
mov r12, qword [rbp - 0x69]
mov rdx, r12
mov rcx, rsi
call fcn.140044cc0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
jne 0x14004b56f
lea rdx, str.____Failed_to_write_local_image_to_remote_image
jmp 0x14004b5fe
mov edi, dword [r13 + 0x28]
add rdi, r15
lea rdx, str.____Calling_DriverEntry_0x
call fcn.140048590
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140048770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0x20], rbx
mov r9, qword [rsp + 0x48]
mov r8, r12
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.140052870
test al, al
jne 0x14004b5c5
lea rdx, str.____Callback_returns_false__failed_
jmp 0x14004b5f7
xor eax, eax
mov dword [rsp + 0x30], eax
mov rax, qword [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x19]
mov r8, rdi
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14004ba50
test al, al
jne 0x14004b688
lea rdx, str.____Failed_to_call_driver_entry
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140048590
lea rdx, [0x140048770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rdx, str.___Freeing_memory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140048590
lea rdx, [0x140048770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8, rbx
mov rdx, qword [rbp - 0x61]
mov rcx, rsi
call fcn.140044fc0
test al, al
je 0x14004b67f
mov rdx, rbx
mov rcx, rsi
call fcn.1400450f0
test al, al
je 0x14004b67f
mov rdx, rbx
mov rcx, rsi
call fcn.140045220
test al, al
lea rdx, str.___Memory_has_been_released
jne 0x14004b6f2
lea rdx, str.____WARNING:_Failed_to_free_memory_
jmp 0x14004b6f2
mov ebx, dword [rsp + 0x30]
mov rax, qword [rbp - 0x59]
test rax, rax
je 0x14004b697
mov dword [rax], ebx
lea rdx, str.___DriverEntry_returned_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140048590
lea rdx, [0x1400438a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140048770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r12
jmp 0x14004b710
lea rdx, str.____Invalid_format_of_PE_image
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140048590
lea rdx, [0x140048770]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.1400d4c50
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret