Function at 0x140028620
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140028d5a
movsxd r13, dword [rdx + 0x3c]
add r13, rdx
cmp dword [r13], 0x4550
jne 0x140028d5a
test r13, r13
je 0x140028d5a
mov eax, 0x20b
cmp word [r13 + 0x18], ax
je 0x14002868f
lea rdx, str.____Image_is_not_64_bit
jmp 0x140028d61
mov ebx, dword [r13 + 0x50]
mov edx, ebx
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x140028d7d
movzx eax, word [r13 + 0x14]
mov r12d, dword [rax + r13 + 0x24]
sub ebx, r12d
mov ecx, ebx
mov qword [rbp + 0x50], rcx
je 0x1400287e8
mov edx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rdx + rax]
cmp dword [0x1403079fc], eax
jle 0x1400287bb
lea rcx, [0x1403079fc]
call fcn.14012ae80
cmp dword [0x1403079fc], 0xffffffff
jne 0x1400287b7
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14012aef8
mov qword [rbp - 0x30], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_setsockopt]
movdqu xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [0x14016e558]
movups xmmword [rax], xmm0
mov ecx, dword [0x14016e568]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14016e56c]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea r8, [rbp - 0x30]
mov rdx, qword [0x140307778]
mov rcx, rdi
call fcn.140022b90
mov qword [0x140307a60], rax
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400287ab
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400287a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400287a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012b174
nop
lea rcx, [0x1403079fc]
call fcn.14012ae14
mov rcx, qword [rbp + 0x50]
cmp qword [0x140307a60], 0
jne 0x140028821
lea rdx, str.____Failed_to_find_ExAllocatePool
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400266b0
lea rdx, [0x140026890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400266b0
lea rdx, [0x140026890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140028d7d
mov qword [rbp + 0x60], r15
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x60]
mov rcx, rdi
call fcn.140026da0
test al, al
je 0x1400287e8
mov rbx, qword [rbp + 0x60]
mov qword [rbp + 0x58], rbx
test rbx, rbx
je 0x1400287e8
lea rdx, str.___Image_base_has_been_allocated_at_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400266b0
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140026890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, dword [r13 + 0x54]
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r13 + 0x14]
add rbx, 0x24
mov edi, r15d
xor eax, eax
cmp ax, word [r13 + 6]
jae 0x1400288d1
add rbx, r13
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x58], rax
test dword [rbx + 0x18], 0x80
ja 0x1400288c2
mov ecx, dword [rbx]
add rcx, rsi
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, r14
call sub.VCRUNTIME140.dll_memcpy
inc edi
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp edi, eax
jl 0x1400288a5
mov r15, qword [rbp + 0x58]
mov rbx, r15
sub rbx, r12
mov qword [rbp + 0x60], rbx
lea rdx, str.___Skipped_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400266b0
lea rdx, [0x140020fb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, r12d
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._bytes_of_PE_Header
call fcn.1400266b0
lea rdx, [0x140026890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r14, rbx
sub r14, qword [r13 + 0x30]
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140028a0d
movsxd rax, dword [rsi + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
jne 0x140028a0d
test rax, rax
je 0x140028a0d
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
xor edx, edx
mov r8d, edx
mov qword [rbp - 0x38], rdx
mov ecx, dword [rax + 0xb0]
test ecx, ecx
jne 0x140028980
mov ebx, edx
jmp 0x140028a14
lea rbx, [rsi + rcx]
mov edi, dword [rax + 0xb4]
add rdi, rbx
cmp rbx, rdi
jae 0x1400289fd
mov rdx, qword [rbp - 0x40]
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x1400289f8
mov eax, dword [rbx]
add rax, rsi
mov qword [rbp - 0x30], rax
lea rax, [rbx + 8]
mov qword [rbp - 0x28], rax
lea rax, [rcx - 8]
shr rax, 1
mov dword [rbp - 0x20], eax
cmp rdx, r8
je 0x1400289d8
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdx], xmm0
movsd xmm1, qword [rbp - 0x20]
movsd qword [rdx + 0x10], xmm1
add rdx, 0x18
mov qword [rbp - 0x40], rdx
jmp 0x1400289ed
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x48]
call fcn.14002a200
mov r8, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rdi
jb 0x140028996
movdqu xmm1, xmmword [rbp - 0x48]
movsd xmm0, qword [rbp - 0x38]
movsd qword [rbp - 0x20], xmm0
mov rbx, qword [rbp - 0x20]
jmp 0x140028a14
xorps xmm1, xmm1
xor eax, eax
mov ebx, eax
movq r10, xmm1
psrldq xmm1, 8
movq r11, xmm1
cmp r10, r11
je 0x140028a81
lea r8, [r10 + 0x10]
mov edi, 0xfff
xor r15d, r15d
mov edx, r15d
cmp dword [r8], edx
jbe 0x140028a70
nop dword [rax]
mov ecx, edx
mov rax, qword [r8 - 8]
movzx r9d, word [rax + rcx*2]
movzx eax, r9w
shr ax, 0xc
and r9w, di
cmp ax, 0xa
jne 0x140028a69
movzx ecx, r9w
mov rax, qword [r8 - 0x10]
add qword [rax + rcx], r14
inc edx
cmp edx, dword [r8]
jb 0x140028a40
add r8, 0x18
lea rax, [r8 - 0x10]
cmp rax, r11
jne 0x140028a34
mov r15, qword [rbp + 0x58]
test r10, r10
je 0x140028adc
sub rbx, r10
movabs rax, 0x2aaaaaaaaaaaaaab
imul rbx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r10
cmp rdx, 0x1000
jb 0x140028ad4
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028ad4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.14012b174
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140028b8e
movsxd rax, dword [rsi + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
jne 0x140028b8e
test rax, rax
je 0x140028b8e
mov ecx, dword [rax + 0xd8]
test ecx, ecx
jne 0x140028b3c
lea rdx, str.___Load_config_directory_wasnt_found__probably_StackCookie_not_defined__fix_cookie_skipped
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400266b0
lea rdx, [0x140026890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r14, qword [rbp + 0x60]
jmp 0x140028bea
mov rdi, qword [rcx + rsi + 0x58]
test rdi, rdi
jne 0x140028b4f
lea rdx, str.___StackCookie_not_defined__fix_cookie_skipped
jmp 0x140028b17
mov rax, rsi
mov r14, qword [rbp + 0x60]
sub rax, r14
add rdi, rax
movabs rax, 0x2b992ddfa232
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
cmp qword [rdi], rax
je 0x140028b9a
lea rdx, str.____StackCookie_already_fixed___this_probably_wrong
call fcn.1400266b0
lea rdx, [0x140026890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.____Failed_to_fix_cookie
jmp 0x140028d61
lea rdx, str.___Fixing_stack_cookie
call fcn.1400266b0
lea rdx, [0x140026890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
xor rcx, rbx
movabs rdx, 0x2b992ddfa232
xor rcx, rdx
movabs rax, 0x2b992ddfa233
cmp rcx, rdx
cmove rcx, rax
mov qword [rdi], rcx
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.140029950
mov rdx, rax
mov rdi, qword [rbp + 0x48]
mov rcx, rdi
call fcn.140028d90
test al, al
jne 0x140028c12
lea rdx, str.____Failed_to_resolve_imports
jmp 0x140028c8f
lea r8, [rsi + r12]
mov r9, qword [rbp + 0x50]
mov rdx, r15
mov rcx, rdi
call fcn.140022760
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
jne 0x140028c39
lea rdx, str.____Failed_to_write_local_image_to_remote_image
jmp 0x140028c96
mov ebx, dword [r13 + 0x28]
add rbx, r14
lea rdx, str.____Calling_DriverEntry_0x
call fcn.1400266b0
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x140026890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov dword [rbp + 0x68], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
lea rdx, [rbp + 0x68]
mov rcx, rdi
call fcn.140029080
test al, al
jne 0x140028d05
lea rdx, str.____Failed_to_call_driver_entry
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400266b0
lea rdx, [0x140026890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rdx, str.___Freeing_memory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400266b0
lea rdx, [0x140026890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r15
mov rcx, rdi
call fcn.140022a50
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
lea rdx, str.___Memory_has_been_released
jne 0x140028d68
lea rdx, str.____WARNING:_Failed_to_free_memory_
jmp 0x140028d68
lea rdx, str.___DriverEntry_returned_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400266b0
lea rdx, [0x140020fb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x140026890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r15
jmp 0x140028d7f
lea rdx, str.____Invalid_format_of_PE_image
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400266b0
lea rdx, [0x140026890]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret