Function at 0x14001b380
Capabilities:
Load ntoskrnl
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1400a3c40]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, rdx
mov r14, qword [0x1409ffc00]
mov ebx, reloc.WS2_32.dll_recv
mov rax, qword gs:[0x58]
add rbx, qword [rax]
xor edi, edi
mov eax, dword [rbx]
cmp dword [0x1409ffe20], eax
jle 0x14001b46e
lea rcx, [0x1409ffe20]
call fcn.14005b8a8
cmp dword [0x1409ffe20], 0xffffffff
jne 0x14001b46e
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], send
mov byte [rsp + 0x20], dil
lea r8d, [rdi + 0xc]
lea rdx, [0x140091748]
lea rcx, [rsp + 0x20]
call fcn.140003650
nop
lea rcx, [rsp + 0x20]
call fcn.140019f40
mov qword [0x1409ffe00], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001b462
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b45c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b640
call fcn.14005bc54
nop
lea rcx, [0x1409ffe20]
call fcn.14005b848
mov eax, dword [rbx]
cmp dword [0x1409ffe1c], eax
jle 0x14001b4b3
lea rcx, [0x1409ffe1c]
call fcn.14005b8a8
cmp dword [0x1409ffe1c], 0xffffffff
jne 0x14001b4b3
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140091748]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x1409ffde8], rax
lea rcx, [0x1409ffe1c]
call fcn.14005b848
mov eax, dword [rbx]
cmp dword [0x1409ffdbc], eax
jle 0x14001b4ec
lea rcx, [0x1409ffdbc]
call fcn.14005b8a8
cmp dword [0x1409ffdbc], 0xffffffff
jne 0x14001b4ec
mov rax, qword [0x1409ffde8]
mov qword [0x1409ffdc0], rax
lea rcx, [0x1409ffdbc]
call fcn.14005b848
mov ecx, 0x5a4d
mov rax, qword [0x1409ffdc0]
cmp word [rax], cx
je 0x14001b507
mov rcx, rdi
mov eax, edi
jmp 0x14001b5e8
mov eax, dword [rbx]
cmp dword [0x1409ffe30], eax
jle 0x14001b54b
lea rcx, [0x1409ffe30]
call fcn.14005b8a8
cmp dword [0x1409ffe30], 0xffffffff
jne 0x14001b54b
mov rax, qword [0x1409ffdc0]
movsxd rcx, dword [rax + 0x3c]
add rcx, qword [0x1409ffde8]
mov qword [0x1409ffdf0], rcx
lea rcx, [0x1409ffe30]
call fcn.14005b848
mov rax, qword [0x1409ffdf0]
cmp dword [rax], 0x4550
jne 0x14001b4fd
mov ebx, dword [rax + 0x50]
movdqa xmm0, xmmword [0x140092770]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x78737850
mov dword [rsp + 0x34], 0x78757853
mov rsi, qword [0x1409ffde8]
add rbx, rsi
mov rax, rbx
mov rcx, rbx
sub rcx, rsi
cmp rcx, 0xc
jl 0x14001b5da
lea r11, [rbx - 0xc]
mov r10, rsi
nop dword [rax + rax]
mov r8, r10
lea rcx, [rsp + 0x20]
nop dword [rax + rax]
movzx r9d, word [rcx]
movzx edx, r9w
shr dx, 8
cmp dl, 0x3f
je 0x14001b5c6
cmp byte [r8], r9b
jne 0x14001b633
inc r8
add rcx, 2
lea rdx, [rsp + 0x38]
cmp rcx, rdx
jne 0x14001b5b0
mov rax, r10
mov rcx, rdi
cmp rax, rbx
cmovne rcx, rax
mov eax, ecx
sub eax, esi
mov r8d, dword [rcx + 1]
mov r10d, eax
add r8, qword [0x1409ffe00]
add r10, 5
add r8, r10
mov r9, rbp
mov rcx, r14
call fcn.1400100f0
test al, al
setne dil
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005b700
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
cmp r10, r11
je 0x14001b5da
inc r10
jmp 0x14001b5a0
call fcn.140026f88
nop
int3