Function at 0x140086ba0
Capabilities:
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xd8
mov rax, qword [0x14033c680]
xor rax, rsp
mov qword [rbp - 9], rax
mov r15, rdx
mov qword [rbp - 0x61], rdx
mov rdi, rcx
mov qword [rbp - 0x69], rcx
mov qword [rbp - 0x19], r8
mov qword [rbp - 0x11], r9
movzx r14d, byte [rbp + 0x77]
mov byte [rsp + 0x41], r14b
mov rax, qword [rbp + 0x8f]
mov qword [rbp - 0x59], rax
mov rax, qword [rbp + 0x97]
mov qword [rbp - 0x51], rax
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140086d27
movsxd rsi, dword [rdx + 0x3c]
add rsi, rdx
cmp dword [rsi], 0x4550
jne 0x140086d27
mov eax, 0x20b
cmp word [rsi + 0x18], ax
jne 0x140086d27
mov r12d, dword [rsi + 0x50]
mov edx, r12d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140086d27
movzx ecx, word [rsi + 0x14]
mov ecx, dword [rcx + rsi + 0x24]
mov dword [rbp - 0x79], ecx
xor r8d, r8d
mov eax, r8d
test r14b, r14b
cmovne eax, ecx
mov dword [rbp - 0x45], eax
sub r12d, eax
mov r13d, r8d
mov qword [rbp - 0x71], r8
mov eax, dword [rbp + 0x7f]
cmp eax, 1
jne 0x140086c9e
mov edx, r12d
lea r8, [rbp - 0x71]
mov rcx, rdi
call fcn.1400867f0
mov r14, rax
mov r13, qword [rbp - 0x71]
jmp 0x140086f5a
cmp eax, 2
jne 0x140086e58
mov qword [rsp + 0x48], r8
cmp qword [0x140346808], r8
jne 0x140086d5d
lea rax, str.x____xxxxxxxx____xxxxxxxxx____xxxxxxxx
mov qword [rsp + 0x20], rax
lea r9, [0x140311830]
mov r8, qword [0x1403464d8]
lea rdx, str.PAGELK
mov rcx, rdi
call fcn.140083d30
mov r14, rax
mov qword [0x140346808], rax
test rax, rax
je 0x140086d16
mov dword [rbp - 0x49], r13d
lea r8, [rax + 1]
mov r9d, 4
lea rdx, [rbp - 0x49]
mov rcx, rdi
call fcn.140082680
test al, al
jne 0x140086d49
mov qword [0x140346808], r13
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140223b70
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
movsxd rcx, dword [rbp - 0x49]
add rcx, 5
add rcx, r14
mov qword [0x140346808], rcx
je 0x140086d16
mov r9d, r12d
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140084a60
test al, al
je 0x140086d16
mov r14, qword [rsp + 0x48]
test r14, r14
je 0x140086d16
cmp qword [0x1403467f8], r13
jne 0x140086e1c
lea rax, str.xx____x___x_x____xxxxxxx____x
mov qword [rsp + 0x20], rax
lea r9, [0x1403118b0]
mov r8, qword [0x1403464d8]
lea rdx, str.PAGE
mov rcx, rdi
call fcn.140083d30
mov qword [0x1403467f8], rax
test rax, rax
je 0x140086e45
lea r15, [rax + 0xc]
mov qword [0x1403467f8], r15
mov dword [rbp - 0x49], r13d
lea r8, [r15 + 1]
mov r9d, 4
lea rdx, [rbp - 0x49]
mov rcx, rdi
call fcn.140082680
test al, al
jne 0x140086e04
mov qword [0x1403467f8], r13
mov r8d, r12d
mov rdx, r14
mov rcx, rdi
call fcn.1400828e0
jmp 0x140086d16
movsxd rcx, dword [rbp - 0x49]
add rcx, 5
add rcx, r15
mov qword [0x1403467f8], rcx
je 0x140086e45
mov r15, qword [rbp - 0x61]
mov byte [rsp + 0x40], r13b
mov dword [rsp + 0x20], r12d
mov r9, r14
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140084e60
test al, al
je 0x140086e45
cmp byte [rsp + 0x40], r13b
jne 0x140086f5a
mov r8d, r12d
mov rdx, r14
mov rcx, rdi
call fcn.1400828e0
jmp 0x140086d16
mov r14d, r12d
test r12d, r12d
je 0x140086d16
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140346858], eax
jle 0x140086f28
lea rcx, [0x140346858]
call fcn.140223c40
cmp dword [0x140346858], 0xffffffff
jne 0x140086f25
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.ExAllocatePoolWithTag
lea rcx, [rbp - 0x41]
call fcn.1400749d0
nop
lea r8, [rbp - 0x41]
mov rdx, qword [0x1403464d8]
mov rcx, rdi
call fcn.140082d00
mov qword [0x140346940], rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x140086f19
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140086f13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400871d3
call fcn.140223b90
nop
lea rcx, [0x140346858]
call fcn.140223bd4
xor r8d, r8d
cmp qword [0x140346940], 0
je 0x140086d16
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x20], r14
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140085a80
test al, al
je 0x140086d16
mov r14, qword [rsp + 0x48]
test r14, r14
je 0x140086d16
mov r8d, dword [rsi + 0x54]
mov rdx, r15
mov rcx, rbx
call fcn.1402636e0
movzx ebx, word [rsi + 0x14]
add rbx, 0x28
xor eax, eax
mov r15d, eax
cmp ax, word [rsi + 6]
jae 0x140086fc6
add rbx, rsi
mov r13, qword [rsp + 0x50]
mov rdi, qword [rbp - 0x61]
test dword [rbx + 0x14], 0x80
ja 0x140086fae
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, rdi
mov ecx, dword [rbx - 4]
add rcx, r13
call fcn.1402636e0
inc r15d
add rbx, 0x28
movzx eax, word [rsi + 6]
cmp r15d, eax
jl 0x140086f91
mov rdi, qword [rbp - 0x69]
mov r13, qword [rbp - 0x71]
mov r15, r14
cmp byte [rsp + 0x41], 0
je 0x140086fd6
mov eax, dword [rbp - 0x79]
sub r14, rax
mov rbx, r14
sub rbx, qword [rsi + 0x30]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x41]
call fcn.140087a10
mov rdx, rbx
mov rcx, rax
call fcn.1400871e0
mov rdx, r14
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.1400872e0
test al, al
je 0x140086d27
mov rdx, rbx
lea rcx, [rbp - 0x41]
call fcn.140087b60
mov rdx, rax
mov rcx, rdi
call fcn.140087390
test al, al
je 0x14008716c
mov eax, r12d
mov ecx, dword [rbp - 0x45]
add rcx, rbx
je 0x14008716c
test r12d, r12d
je 0x14008716c
xor edx, edx
mov qword [rbp - 0x39], rdx
mov qword [rbp - 0x41], gethostname
mov qword [rbp - 0x31], rcx
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], rax
mov dword [rbp - 0x45], edx
mov qword [rsp + 0x38], rdx
lea rax, [rbp - 0x45]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rdx
lea r9d, [rdx + 0x28]
lea r8, [rbp - 0x41]
mov edx, 0x80862007
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14008716c
mov ebx, dword [rsi + 0x28]
add rbx, r14
mov rax, qword [rbp - 0x59]
test rax, rax
je 0x1400870c3
mov qword [rsp + 0x20], r13
mov r9d, r12d
mov r8, r15
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x19]
call rax
test al, al
je 0x140087167
xor eax, eax
mov dword [rbp - 0x49], eax
mov r9, qword [rbp - 0x19]
cmp byte [rbp + 0x87], al
cmovne r9, r15
mov rax, qword [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp - 0x49]
mov rcx, rdi
call fcn.1400875f0
test al, al
je 0x140087167
mov rcx, qword [rbp - 0x51]
test rcx, rcx
je 0x140087100
mov eax, dword [rbp - 0x49]
mov dword [rcx], eax
cmp byte [rbp + 0x6f], 0
je 0x14008713a
mov eax, dword [rbp + 0x7f]
mov rdx, r15
cmp eax, 1
jne 0x140087155
mov r8, r13
mov rcx, rdi
call fcn.1400829d0
test al, al
je 0x14008713a
mov rdx, r13
mov rcx, rdi
call fcn.140082ae0
test al, al
je 0x14008713a
mov rdx, r13
mov rcx, rdi
call fcn.140082bf0
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r15
jmp 0x140086d29
cmp eax, 2
jne 0x140087132
mov r8d, r12d
mov rcx, rdi
call fcn.1400828e0
jmp 0x14008713a
mov rbx, qword [rsp + 0x50]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 0x7f]
mov rdx, r15
cmp eax, 1
jne 0x1400871be
mov r8, r13
mov rcx, rdi
call fcn.1400829d0
test al, al
je 0x140086d27
mov rdx, r13
mov rcx, rdi
call fcn.140082ae0
test al, al
je 0x140086d27
mov rdx, r13
mov rcx, rdi
call fcn.140082bf0
jmp 0x140086d27
cmp eax, 2
jne 0x1400871b1
mov r8d, r12d
mov rcx, rdi
call fcn.1400828e0
jmp 0x140086d27
call fcn.140239db0
int3