Function at 0x13e50
Capabilities:
Parse pe header
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
xor eax, eax
mov word [ebp - 0x140], ax
xor ecx, ecx
mov dword [ebp - 0x13e], ecx
mov word [ebp - 0x13a], cx
xor edx, edx
mov word [ebp - 0x128], dx
xor eax, eax
mov dword [ebp - 0x126], eax
mov word [ebp - 0x122], ax
mov dword [ebp - 0x138], 0xc0000001
mov dword [ebp - 0x118], 0
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], ecx
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 8], 0
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x130], 0
xor eax, eax
mov dword [ebp - 0x12c], eax
xor ecx, ecx
mov word [ebp - 0x180], cx
push 0x3e
push 0
lea edx, [ebp - 0x17e]
push edx
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp - 0x100], 0
push 0xf4
push 0
lea eax, [ebp - 0xfc]
push eax
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
cmp dword [ebp + 8], 0
je 0x13f47
cmp dword [ebp + 0xc], 0
je 0x13f47
cmp dword [ebp + 0x10], 0
jne 0x13f51
mov eax, 0xc000000d
jmp 0x14446
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x140]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
push 1
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jge 0x13f91
mov eax, 0xc0000001
jmp 0x14446
mov dword [ebp - 0x118], 0x18
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x10c], 0x240
lea edx, [ebp - 0x128]
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0
push 0
push 0
push 0x60
push 1
push 1
push 0x80
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x118]
push ecx
push 1
lea edx, [ebp - 0x134]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jge 0x14020
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, 0xc0000001
jmp 0x14446
push 0
lea ecx, [ebp - 0x130]
push ecx
push 0x40
lea edx, [ebp - 0x180]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jl 0x14067
movzx edx, word [ebp - 0x180]
cmp edx, 0x5a4d
je 0x1408b
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, 0xc0000001
jmp 0x14446
mov edx, dword [ebp - 0x144]
mov dword [ebp - 0x130], edx
push 0
lea eax, [ebp - 0x130]
push eax
push 0xf8
lea ecx, [ebp - 0x100]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jl 0x140de
cmp dword [ebp - 0x100], 0x4550
je 0x14102
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, 0xc0000001
jmp 0x14446
movzx eax, word [ebp - 0xfa]
imul eax, eax, 0x28
push eax
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov dword [ebp - 0x11c], eax
mov ecx, dword [ebp - 0xb0]
push ecx
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x11c], 0
je 0x14142
cmp dword [ebp - 0x120], 0
jne 0x14196
cmp dword [ebp - 0x11c], 0
je 0x1415a
push 0
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 0x120], 0
je 0x14172
push 0
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, 0xc0000001
jmp 0x14446
mov eax, dword [ebp - 0xb0]
push eax
push 0
mov ecx, dword [ebp - 0x120]
push ecx
call sub.ntoskrnl.exe_memset
add esp, 0xc
mov edx, dword [ebp - 0x144]
add edx, 0xf8
mov dword [ebp - 0x130], edx
push 0
lea eax, [ebp - 0x130]
push eax
movzx ecx, word [ebp - 0xfa]
imul ecx, ecx, 0x28
push ecx
mov edx, dword [ebp - 0x11c]
push edx
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jge 0x14243
push 0
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, dword [ebp - 0x134]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea edx, [ebp - 0x128]
push edx
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, 0xc0000001
jmp 0x14446
mov dword [ebp - 0x184], 0
jmp 0x1425e
mov eax, dword [ebp - 0x184]
add eax, 1
mov dword [ebp - 0x184], eax
movzx ecx, word [ebp - 0xfa]
cmp dword [ebp - 0x184], ecx
jge 0x1437f
mov edx, dword [ebp - 0x184]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax + edx + 0x10]
push ecx
mov edx, dword [ebp - 0x184]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax + edx + 0x14]
push ecx
mov edx, dword [ebp - 0x184]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x11c]
mov ecx, dword [eax + edx + 0xc]
push ecx
mov edx, dword [ebp - 0x120]
push edx
push str.LoadPe_pImageBuffer0x_08x__VirtualAddress0x_08x__PointerToRawData0x_08x__SizeOfRawData0x_08x_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
add esp, 0x14
mov eax, dword [ebp - 0x184]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ecx + eax + 0x14]
mov dword [ebp - 0x130], edx
push 0
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x184]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x11c]
mov eax, dword [edx + ecx + 0x10]
push eax
mov ecx, dword [ebp - 0x184]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x120]
add eax, dword [edx + ecx + 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jge 0x1437a
push 0
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, 0xc0000001
jmp 0x14446
jmp 0x1424f
mov dword [ebp - 0x130], 0
push 0
lea ecx, [ebp - 0x130]
push ecx
mov edx, dword [ebp - 0xac]
push edx
mov eax, dword [ebp - 0x120]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jge 0x14405
push 0
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
push 0
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
mov eax, 0xc0000001
jmp 0x14446
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x120]
mov dword [ecx], edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xb0]
mov dword [eax], ecx
push 0
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlFreeUnicodeString]
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc