Function at 0x14004f270
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xc0
mov rax, qword [0x140198190]
xor rax, rsp
mov qword [rbp - 9], rax
mov rbx, rcx
mov qword [rbp - 0x61], rcx
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x51], rax
xor r15d, r15d
mov eax, 0x5a4d
cmp word [0x140198cd0], ax
jne 0x14004f9d5
movsxd r12, dword [0x140198d0c]
lea r13, [0x140198cd0]
add r12, r13
mov qword [rbp - 0x69], r12
cmp dword [r12], 0x4550
jne 0x14004f9d5
mov eax, 0x20b
cmp word [r12 + 0x18], ax
je 0x14004f302
lea rdx, str.____Image_is_not_64_bit
jmp 0x14004f9dc
mov edi, dword [r12 + 0x50]
mov qword [rbp - 0x59], rdi
mov r9d, 4
mov r8d, 0x3000
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x14004fa0f
lea rsi, [0x14019cdb0]
test rdi, rdi
je 0x14004f46e
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x14019ee74], eax
jle 0x14004f42a
lea rcx, [0x14019ee74]
call fcn.14010f760
cmp dword [0x14019ee74], 0xffffffff
jne 0x14004f42a
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14010f648
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x19], reloc.WS2_32.dll_setsockopt
mov qword [rbp - 0x11], Ordinal_33
movups xmm0, xmmword [0x140175fe8]
movups xmmword [rax], xmm0
mov ecx, dword [0x140175ff8]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x140175ffc]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea r8, [rbp - 0x29]
mov rdx, qword [0x14019e838]
mov rcx, rbx
call fcn.140048d20
mov qword [0x14019eee0], rax
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x14004f41e
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f418
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004fa44
call fcn.14010f640
nop
lea rcx, [0x14019ee74]
call fcn.14010f6f4
cmp qword [0x14019eee0], 0
jne 0x14004f4ba
lea rdx, str.____Failed_to_find_ExAllocatePool
mov rcx, rsi
call fcn.140009320
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140009110
movzx edx, ax
mov rcx, rbx
call fcn.14004ed00
mov rcx, rbx
call fcn.14000a0f0
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
mov rcx, rsi
call fcn.140009320
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140009110
movzx edx, ax
mov rcx, rbx
call fcn.14004ed00
mov rcx, rbx
call fcn.14000a0f0
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14004fa0f
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14004d8e0
test al, al
je 0x14004f46e
mov r15, qword [rsp + 0x30]
test r15, r15
je 0x14004f46e
lea rdx, str.___Image_base_has_been_allocated_at_0x
lea rsi, [0x14019cdb0]
mov rcx, rsi
call fcn.140009320
mov rdx, r15
mov rcx, rax
call fcn.14004b100
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140009110
movzx edx, ax
mov rcx, rbx
call fcn.14004ed00
mov rcx, rbx
call fcn.14000a0f0
mov r8d, dword [r12 + 0x54]
mov rdx, r13
mov rcx, r14
call fcn.140111970
movzx ebx, word [r12 + 0x14]
add rbx, 0x24
xor edx, edx
mov edi, edx
cmp dx, word [r12 + 6]
jae 0x14004f57f
add rbx, r12
test dword [rbx + 0x18], 0x80
ja 0x14004f56d
mov ecx, dword [rbx]
add rcx, r14
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, r13
call fcn.140111970
inc edi
add rbx, 0x28
movzx eax, word [r12 + 6]
cmp edi, eax
jl 0x14004f550
xor edx, edx
mov rdi, r15
sub rdi, qword [r12 + 0x30]
mov eax, 0x5a4d
lea r13, [r14 + 0x3c]
cmp word [r14], ax
jne 0x14004f5a4
movsxd rax, dword [r13]
cmp dword [rax + r14], 0x4550
je 0x14004f5af
xorps xmm1, xmm1
mov rbx, rdx
jmp 0x14004f66e
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov r8, rdx
mov qword [rbp - 0x71], rdx
mov ecx, dword [rax + r14 + 0xb0]
test ecx, ecx
jne 0x14004f5d3
mov rbx, rdx
jmp 0x14004f66e
lea rbx, [r14 + rcx]
mov r15d, dword [rax + r14 + 0xb4]
add r15, rbx
cmp rbx, r15
jae 0x14004f65b
mov rdx, qword [rbp - 0x79]
nop dword [rax + rax]
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x14004f653
mov eax, dword [rbx]
add rax, r14
mov qword [rbp - 0x41], rax
lea rax, [rbx + 8]
mov qword [rbp - 0x39], rax
lea rax, [rcx - 8]
shr rax, 1
mov dword [rbp - 0x31], eax
cmp rdx, r8
je 0x14004f632
movups xmm0, xmmword [rbp - 0x41]
movups xmmword [rdx], xmm0
movsd xmm1, qword [rbp - 0x31]
movsd qword [rdx + 0x10], xmm1
add rdx, 0x18
mov qword [rbp - 0x79], rdx
jmp 0x14004f648
lea r8, [rbp - 0x41]
lea rcx, [rsp + 0x38]
call fcn.140050a30
mov r8, qword [rbp - 0x71]
mov rdx, qword [rbp - 0x79]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r15
jb 0x14004f5f0
movdqu xmm1, xmmword [rsp + 0x38]
xor edx, edx
movsd xmm0, qword [rbp - 0x71]
movsd qword [rbp - 0x19], xmm0
mov rbx, qword [rbp - 0x19]
mov r15, qword [rsp + 0x30]
movq r10, xmm1
psrldq xmm1, 8
movq r11, xmm1
cmp r10, r11
je 0x14004f6e6
lea r9, [r10 + 0x10]
mov r15d, 0xf000
mov r12d, 0xa000
mov r8d, edx
cmp dword [r9], 0
jbe 0x14004f6d0
nop dword [rax + rax]
mov ecx, r8d
mov rax, qword [r9 - 8]
movzx edx, word [rax + rcx*2]
movzx eax, dx
and ax, r15w
cmp ax, r12w
jne 0x14004f6c6
and edx, 0xfff
mov rax, qword [r9 - 0x10]
add qword [rdx + rax], rdi
inc r8d
cmp r8d, dword [r9]
jb 0x14004f6a0
xor edx, edx
add r9, 0x18
lea rax, [r9 - 0x10]
cmp rax, r11
jne 0x14004f692
mov r12, qword [rbp - 0x69]
mov r15, qword [rsp + 0x30]
test r10, r10
je 0x14004f73e
sub rbx, r10
movabs rax, 0x2aaaaaaaaaaaaaab
imul rbx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r10
cmp rdx, 0x1000
jb 0x14004f736
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004fa3e
mov rcx, r10
call fcn.14010f640
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x14004f807
movsxd rax, dword [r13]
cmp dword [rax + r14], 0x4550
jne 0x14004f807
mov ecx, dword [rax + r14 + 0xd8]
test ecx, ecx
jne 0x14004f7a6
lea rdx, str.___Load_config_directory_wasnt_found__probably_StackCookie_not_defined__fix_cookie_skipped
mov rcx, rsi
call fcn.140009320
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140009110
movzx edx, ax
mov rcx, rbx
call fcn.14004ed00
mov rcx, rbx
call fcn.14000a0f0
jmp 0x14004f870
mov rdi, qword [rcx + r14 + 0x58]
test rdi, rdi
jne 0x14004f7b9
lea rdx, str.___StackCookie_not_defined__fix_cookie_skipped
jmp 0x14004f772
mov rax, r14
sub rax, r15
add rdi, rax
movabs r13, 0x2b992ddfa232
mov rcx, rsi
cmp qword [rdi], r13
je 0x14004f813
lea rdx, str.____StackCookie_already_fixed___this_probably_wrong
call fcn.140009320
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140009110
movzx edx, ax
mov rcx, rbx
call fcn.14004ed00
mov rcx, rbx
call fcn.14000a0f0
lea rdx, str.____Failed_to_fix_cookie
jmp 0x14004f95f
lea rdx, str.___Fixing_stack_cookie
call fcn.140009320
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140009110
movzx edx, ax
mov rcx, rbx
call fcn.14004ed00
mov rcx, rbx
call fcn.14000a0f0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
xor rcx, rbx
xor rcx, r13
movabs rax, 0x2b992ddfa233
cmp rcx, r13
cmove rcx, rax
mov qword [rdi], rcx
mov rdx, r14
lea rcx, [rbp - 0x29]
call fcn.140050580
mov rdx, rax
mov rdi, qword [rbp - 0x61]
mov rcx, rdi
call fcn.14004fa50
test al, al
jne 0x14004f898
lea rdx, str.____Failed_to_resolve_imports
jmp 0x14004f90a
mov r9, qword [rbp - 0x59]
mov r8, r14
mov rdx, r15
mov rcx, rdi
call fcn.140048880
mov rcx, rsi
test al, al
jne 0x14004f8ba
lea rdx, str.____Failed_to_write_local_image_to_remote_image
jmp 0x14004f90d
mov ebx, dword [r12 + 0x28]
add rbx, r15
lea rdx, str.____Calling_DriverEntry_0x
call fcn.140009320
mov rdx, rbx
mov rcx, rax
call fcn.14004b100
mov rcx, rax
call fcn.14004d660
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140050180
test al, al
jne 0x14004f974
lea rdx, str.____Failed_to_call_driver_entry
mov rcx, rsi
call fcn.140009320
mov rcx, rax
call fcn.14004d660
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rdx, str.___Freeing_memory
mov rcx, rsi
call fcn.140009320
mov rcx, rax
call fcn.14004d660
mov rdx, r15
mov rcx, rdi
call fcn.140048bb0
test al, al
lea rdx, str.___Memory_has_been_released
jne 0x14004f95f
lea rdx, str.____WARNING:_Failed_to_free_memory_
mov rcx, rsi
call fcn.140009320
mov rcx, rax
call fcn.14004d660
jmp 0x14004fa0f
mov ebx, dword [rsp + 0x30]
mov rax, qword [rbp - 0x51]
test rax, rax
je 0x14004f983
mov dword [rax], ebx
lea rdx, str.___DriverEntry_returned_0x
mov rcx, rsi
call fcn.140009320
mov rcx, qword [rax]
movsxd r8, dword [rcx + 4]
mov ecx, dword [r8 + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [r8 + rax + 0x18], ecx
mov edx, ebx
mov rcx, rax
call fcn.14004ff30
mov rcx, rax
call fcn.14004d660
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r15
jmp 0x14004fa11
lea rdx, str.____Invalid_format_of_PE_image
lea rcx, [0x14019cdb0]
call fcn.140009320
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rbx, rax
mov dl, 0xa
add rcx, rax
call fcn.140009110
movzx edx, ax
mov rcx, rbx
call fcn.14004ed00
mov rcx, rbx
call fcn.14000a0f0
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14010f620
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140118cb4
nop
call fcn.140118cb4
nop
int3