Function at 0x140063ba0
Capabilities:
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x48]
sub rsp, 0x148
mov rax, qword [0x1400fe080]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r12, rdx
mov qword [rsp + 0x78], rdx
mov r14, rcx
mov qword [rsp + 0x70], rcx
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], r9
movzx eax, byte [rbp + 0xb8]
mov byte [rsp + 0x40], al
mov rax, qword [rbp + 0xd0]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0xd8]
mov qword [rbp - 0x70], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
lea rcx, [rbp + 0x88]
movabs rdx, 0xff0f0ff0f0ff00f
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], rcx
mov rax, qword [rcx]
xor rax, rdx
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
xor esi, esi
mov qword [rcx], rsi
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov r15d, esi
mov qword [rbp - 0x30], rsi
lea ebx, [rsi + 0x64]
mov rdi, qword [rbp - 0x38]
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x10624dd3
imul r8d
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x3e8
sub r8d, ecx
mov dword [rsp + 0x44], r8d
cmp rdi, r15
je 0x140063c8b
mov dword [rdi], r8d
add rdi, 4
mov qword [rbp - 0x38], rdi
jmp 0x140063ca4
lea r8, [rsp + 0x44]
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.140064cb0
mov r15, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x38]
sub rbx, 1
jne 0x140063c50
mov qword [rbp - 0x80], r15
lea rax, [rbp + 0x88]
mov rcx, qword [rax]
mov qword [rax], rsi
mov r8d, 0x5a4d
mov rdx, qword [rbp - 0x40]
mov qword [rsp + 0x68], rdx
cmp word [r12], r8w
jne 0x140063ce3
movsxd r13, dword [r12 + 0x3c]
add r13, r12
cmp dword [r13], 0x4550
je 0x140063cef
mov qword [rax], rcx
lea rdx, str.____Invalid_format_of_PE_image
jmp 0x140063d05
mov qword [rax], rcx
mov eax, 0x20b
cmp word [r13 + 0x18], ax
je 0x140063d26
lea rdx, str.____Image_is_not_64_bit
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008230
lea rdx, [0x140008410]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14006435d
mov r15d, dword [r13 + 0x50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov rcx, rsi
mov qword [rbp - 8], rcx
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp], rdx
mov byte [rbp - 0x18], cl
mov bl, 0x41
cmp rcx, rdx
jae 0x140063d6a
lea rax, [rcx + 1]
mov qword [rbp - 8], rax
lea rax, [rbp - 0x18]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x18]
mov byte [rax + rcx], bl
mov byte [rax + rcx + 1], 0
jmp 0x140063d7e
movzx r9d, bl
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x18]
call fcn.14000ac50
inc bl
cmp bl, 0x5a
jg 0x140063d8f
mov rdx, qword [rbp]
mov rcx, qword [rbp - 8]
jmp 0x140063d46
mov rdx, r15
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14006430a
movzx ecx, word [r13 + 0x14]
mov ecx, dword [rcx + r13 + 0x24]
mov dword [rsp + 0x44], ecx
mov eax, esi
cmp byte [rsp + 0x40], sil
cmovne eax, ecx
mov dword [rbp - 0x48], eax
sub r15d, eax
mov dword [rsp + 0x48], r15d
mov r12, rsi
mov qword [rsp + 0x58], rsi
mov eax, dword [rbp + 0xc0]
mov rcx, r14
cmp eax, 1
jne 0x140063e02
mov edx, r15d
lea r8, [rsp + 0x58]
call fcn.140063590
mov r12, qword [rsp + 0x58]
jmp 0x140063e19
cmp eax, 2
jne 0x140063e11
mov edx, r15d
call fcn.1400639b0
jmp 0x140063e19
mov r8d, r15d
call fcn.140004780
mov r15, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test rax, rax
jne 0x140063e64
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
call fcn.140008230
lea rdx, [0x140008410]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14006430a
lea rdx, str.___Image_base_has_been_allocated_at_0x
call fcn.140008230
mov rdx, r15
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140008410]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, dword [r13 + 0x54]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r13 + 0x14]
add rbx, 0x24
mov r15d, esi
cmp si, word [r13 + 6]
jae 0x140063ef5
add rbx, r13
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x78]
nop dword [rax]
test dword [rbx + 0x18], 0x80
ja 0x140063edd
mov ecx, dword [rbx]
add rcx, rsi
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, r14
call sub.VCRUNTIME140.dll_memcpy
inc r15d
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp r15d, eax
jl 0x140063ec0
xor esi, esi
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x50]
mov r15, rbx
cmp byte [rsp + 0x40], 0
je 0x140063f5f
mov eax, dword [rsp + 0x44]
sub rbx, rax
mov qword [rsp + 0x50], rbx
lea rdx, str.___Skipped_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008230
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._bytes_of_PE_Header
call fcn.140008230
lea rdx, [0x140008410]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
sub rbx, qword [r13 + 0x30]
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp + 8]
call fcn.140065020
mov rdx, rbx
mov rcx, rax
call fcn.1400643f0
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.140064510
test al, al
jne 0x140063f9e
lea rdx, str.____Failed_to_fix_cookie
jmp 0x1400642ed
mov rdx, rbx
lea rcx, [rbp + 8]
call fcn.1400651c0
mov rdx, rax
mov rcx, r14
call fcn.140064660
test al, al
jne 0x140063fc5
lea rdx, str.____Failed_to_resolve_imports
jmp 0x14006424e
sub rdi, qword [rsp + 0x68]
sar rdi, 2
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
xor edx, edx
div rdi
mov rax, qword [rsp + 0x68]
test byte [rax + rdx*4], 1
jne 0x140064009
lea rdx, str.____Random_number_is_even_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008230
lea rdx, [0x140008410]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, dword [rsp + 0x48]
mov ecx, dword [rbp - 0x48]
add rcx, rbx
lea rdx, [rbp + 0x88]
mov rdi, qword [rdx]
mov qword [rdx], rsi
je 0x140064244
test rax, rax
je 0x140064244
mov qword [rbp + 0x10], rsi
mov qword [rbp + 8], gethostname
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], rax
mov dword [rbp - 0x48], esi
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, Ordinal_41
lea r8, [rbp + 8]
mov edx, 0x80862007
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rbp + 0x88]
mov qword [rcx], rdi
test eax, eax
je 0x140064247
mov edi, dword [r13 + 0x28]
add rdi, qword [rsp + 0x50]
lea rdx, str.____Calling_DriverEntry_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008230
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140008410]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rax, qword [rbp - 0x78]
test rax, rax
je 0x1400640f6
mov qword [rsp + 0x20], r12
mov r13d, dword [rsp + 0x48]
mov r9d, r13d
mov r8, r15
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x28]
call rax
test al, al
jne 0x1400640fb
lea rdx, str.____Callback_returns_false__failed_
jmp 0x14006424e
mov r13d, dword [rsp + 0x48]
mov dword [rsp + 0x44], esi
mov r9, qword [rbp - 0x28]
cmp byte [rbp + 0xc8], 0
cmovne r9, r15
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r8, rdi
lea rdx, [rsp + 0x44]
mov rcx, r14
call fcn.1400649e0
test al, al
jne 0x140064137
lea rdx, str.____Failed_to_call_driver_entry
jmp 0x14006424e
mov edi, dword [rsp + 0x44]
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x140064146
mov dword [rax], edi
lea rdx, str.___DriverEntry_returned_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008230
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140008410]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
cmp byte [rbp + 0xb0], 0
je 0x140064219
lea rdx, str.___Freeing_memory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008230
lea rdx, [0x140008410]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, dword [rbp + 0xc0]
mov rdx, r15
cmp eax, 1
jne 0x140064232
mov r8, r12
mov rcx, r14
call fcn.140004490
test al, al
je 0x1400641f6
mov rdx, r12
mov rcx, r14
call fcn.140004610
test al, al
je 0x1400641f6
mov rdx, r12
mov rcx, r14
call fcn.140004920
test al, al
lea rdx, str.___Memory_has_been_released
jne 0x1400641fd
lea rdx, str.____WARNING:_Failed_to_free_memory_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008230
lea rdx, [0x140008410]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, r15
jmp 0x14006430a
cmp eax, 2
jne 0x1400641e3
mov r8d, r13d
mov rcx, r14
call fcn.140003ce0
jmp 0x1400641eb
mov qword [rdx], rdi
lea rdx, str.____Failed_to_write_local_image_to_remote_image
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008230
lea rdx, [0x140008410]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rdx, str.___Freeing_memory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008230
lea rdx, [0x140008410]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, dword [rbp + 0xc0]
mov rdx, qword [rsp + 0x58]
cmp eax, 1
jne 0x140064343
mov r8, r12
mov rcx, r14
call fcn.140004490
test al, al
je 0x1400642e6
mov rdx, r12
mov rcx, r14
call fcn.140004610
test al, al
je 0x1400642e6
mov rdx, r12
mov rcx, r14
call fcn.140004920
test al, al
lea rdx, str.___Memory_has_been_released
jne 0x1400642ed
lea rdx, str.____WARNING:_Failed_to_free_memory_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140008230
lea rdx, [0x140008410]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x14006435d
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064357
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140064357
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp eax, 2
jne 0x1400642d3
mov r8d, dword [rsp + 0x48]
mov rcx, r14
call fcn.140003ce0
jmp 0x1400642db
call fcn.1400cc0a0
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400643a8
mov rdx, qword [rbp - 0x80]
sub rdx, rcx
sar rdx, 2
lea rdx, [rdx*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400643a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400643a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400cc0a0
nop
mov rax, qword [rbp - 0x68]
movabs rcx, 0xff0f0ff0f0ff00f
xor rax, rcx
lea rcx, [rbp + 0x88]
mov qword [rcx], rax
mov rax, rsi
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1400cc080
add rsp, 0x148
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret