Function at 0x140028330
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov r14, rdx
mov rdi, rcx
xor r15d, r15d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140028a6a
movsxd r13, dword [rdx + 0x3c]
add r13, rdx
cmp dword [r13], 0x4550
jne 0x140028a6a
test r13, r13
je 0x140028a6a
mov eax, 0x20b
cmp word [r13 + 0x18], ax
je 0x14002839f
lea rdx, str.____Image_is_not_64_bit
jmp 0x140028a71
mov ebx, dword [r13 + 0x50]
mov edx, ebx
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x140028a8d
movzx eax, word [r13 + 0x14]
mov r12d, dword [rax + r13 + 0x24]
sub ebx, r12d
mov ecx, ebx
mov qword [rbp + 0x50], rcx
je 0x1400284f8
mov edx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rdx + rax]
cmp dword [0x14030fab4], eax
jle 0x1400284cb
lea rcx, [0x14030fab4]
call fcn.1400bd210
cmp dword [0x14030fab4], 0xffffffff
jne 0x1400284c7
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400bd288
mov qword [rbp - 0x30], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_setsockopt]
movdqu xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [0x140186858]
movups xmmword [rax], xmm0
mov ecx, dword [0x140186868]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14018686c]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea r8, [rbp - 0x30]
mov rdx, qword [0x14030f828]
mov rcx, rdi
call fcn.140022a60
mov qword [0x14030fb18], rax
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400284bb
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400284b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400284b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd504
nop
lea rcx, [0x14030fab4]
call fcn.1400bd1a4
mov rcx, qword [rbp + 0x50]
cmp qword [0x14030fb18], 0
jne 0x140028531
lea rdx, str.____Failed_to_find_ExAllocatePool
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400264f0
lea rdx, [0x1400266d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400264f0
lea rdx, [0x1400266d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140028a8d
mov qword [rbp + 0x60], r15
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x60]
mov rcx, rdi
call fcn.140026be0
test al, al
je 0x1400284f8
mov rbx, qword [rbp + 0x60]
mov qword [rbp + 0x58], rbx
test rbx, rbx
je 0x1400284f8
lea rdx, str.___Image_base_has_been_allocated_at_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400264f0
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x1400266d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, dword [r13 + 0x54]
mov rdx, r14
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r13 + 0x14]
add rbx, 0x24
mov edi, r15d
xor eax, eax
cmp ax, word [r13 + 6]
jae 0x1400285e1
add rbx, r13
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x58], rax
test dword [rbx + 0x18], 0x80
ja 0x1400285d2
mov ecx, dword [rbx]
add rcx, rsi
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, r14
call sub.VCRUNTIME140.dll_memcpy
inc edi
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp edi, eax
jl 0x1400285b5
mov r15, qword [rbp + 0x58]
mov rbx, r15
sub rbx, r12
mov qword [rbp + 0x60], rbx
lea rdx, str.___Skipped_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400264f0
lea rdx, [0x140020e80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, r12d
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._bytes_of_PE_Header
call fcn.1400264f0
lea rdx, [0x1400266d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r14, rbx
sub r14, qword [r13 + 0x30]
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14002871d
movsxd rax, dword [rsi + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
jne 0x14002871d
test rax, rax
je 0x14002871d
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
xor edx, edx
mov r8d, edx
mov qword [rbp - 0x38], rdx
mov ecx, dword [rax + 0xb0]
test ecx, ecx
jne 0x140028690
mov ebx, edx
jmp 0x140028724
lea rbx, [rsi + rcx]
mov edi, dword [rax + 0xb4]
add rdi, rbx
cmp rbx, rdi
jae 0x14002870d
mov rdx, qword [rbp - 0x40]
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x140028708
mov eax, dword [rbx]
add rax, rsi
mov qword [rbp - 0x30], rax
lea rax, [rbx + 8]
mov qword [rbp - 0x28], rax
lea rax, [rcx - 8]
shr rax, 1
mov dword [rbp - 0x20], eax
cmp rdx, r8
je 0x1400286e8
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdx], xmm0
movsd xmm1, qword [rbp - 0x20]
movsd qword [rdx + 0x10], xmm1
add rdx, 0x18
mov qword [rbp - 0x40], rdx
jmp 0x1400286fd
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x48]
call fcn.140029ef0
mov r8, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rdi
jb 0x1400286a6
movdqu xmm1, xmmword [rbp - 0x48]
movsd xmm0, qword [rbp - 0x38]
movsd qword [rbp - 0x20], xmm0
mov rbx, qword [rbp - 0x20]
jmp 0x140028724
xorps xmm1, xmm1
xor eax, eax
mov ebx, eax
movq r10, xmm1
psrldq xmm1, 8
movq r11, xmm1
cmp r10, r11
je 0x140028791
lea r8, [r10 + 0x10]
mov edi, 0xfff
xor r15d, r15d
mov edx, r15d
cmp dword [r8], edx
jbe 0x140028780
nop dword [rax]
mov ecx, edx
mov rax, qword [r8 - 8]
movzx r9d, word [rax + rcx*2]
movzx eax, r9w
shr ax, 0xc
and r9w, di
cmp ax, 0xa
jne 0x140028779
movzx ecx, r9w
mov rax, qword [r8 - 0x10]
add qword [rax + rcx], r14
inc edx
cmp edx, dword [r8]
jb 0x140028750
add r8, 0x18
lea rax, [r8 - 0x10]
cmp rax, r11
jne 0x140028744
mov r15, qword [rbp + 0x58]
test r10, r10
je 0x1400287ec
sub rbx, r10
movabs rax, 0x2aaaaaaaaaaaaaab
imul rbx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r10
cmp rdx, 0x1000
jb 0x1400287e4
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400287e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.1400bd504
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14002889e
movsxd rax, dword [rsi + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
jne 0x14002889e
test rax, rax
je 0x14002889e
mov ecx, dword [rax + 0xd8]
test ecx, ecx
jne 0x14002884c
lea rdx, str.___Load_config_directory_wasnt_found__probably_StackCookie_not_defined__fix_cookie_skipped
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400264f0
lea rdx, [0x1400266d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r14, qword [rbp + 0x60]
jmp 0x1400288fa
mov rdi, qword [rcx + rsi + 0x58]
test rdi, rdi
jne 0x14002885f
lea rdx, str.___StackCookie_not_defined__fix_cookie_skipped
jmp 0x140028827
mov rax, rsi
mov r14, qword [rbp + 0x60]
sub rax, r14
add rdi, rax
movabs rax, 0x2b992ddfa232
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
cmp qword [rdi], rax
je 0x1400288aa
lea rdx, str.____StackCookie_already_fixed___this_probably_wrong
call fcn.1400264f0
lea rdx, [0x1400266d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.____Failed_to_fix_cookie
jmp 0x140028a71
lea rdx, str.___Fixing_stack_cookie
call fcn.1400264f0
lea rdx, [0x1400266d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
xor rcx, rbx
movabs rdx, 0x2b992ddfa232
xor rcx, rdx
movabs rax, 0x2b992ddfa233
cmp rcx, rdx
cmove rcx, rax
mov qword [rdi], rcx
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.140029660
mov rdx, rax
mov rdi, qword [rbp + 0x48]
mov rcx, rdi
call fcn.140028aa0
test al, al
jne 0x140028922
lea rdx, str.____Failed_to_resolve_imports
jmp 0x14002899f
lea r8, [rsi + r12]
mov r9, qword [rbp + 0x50]
mov rdx, r15
mov rcx, rdi
call fcn.140022630
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
jne 0x140028949
lea rdx, str.____Failed_to_write_local_image_to_remote_image
jmp 0x1400289a6
mov ebx, dword [r13 + 0x28]
add rbx, r14
lea rdx, str.____Calling_DriverEntry_0x
call fcn.1400264f0
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x1400266d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov dword [rbp + 0x68], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
lea rdx, [rbp + 0x68]
mov rcx, rdi
call fcn.140028d90
test al, al
jne 0x140028a15
lea rdx, str.____Failed_to_call_driver_entry
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400264f0
lea rdx, [0x1400266d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rdx, str.___Freeing_memory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400264f0
lea rdx, [0x1400266d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r15
mov rcx, rdi
call fcn.140022920
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
lea rdx, str.___Memory_has_been_released
jne 0x140028a78
lea rdx, str.____WARNING:_Failed_to_free_memory_
jmp 0x140028a78
lea rdx, str.___DriverEntry_returned_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400264f0
lea rdx, [0x140020e80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x1400266d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r15
jmp 0x140028a8f
lea rdx, str.____Invalid_format_of_PE_image
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400264f0
lea rdx, [0x1400266d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret