Function at 0x14014fbd0
Capabilities:
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb8
mov rax, qword [0x1401dd140]
xor rax, rsp
mov qword [rbp - 9], rax
mov qword [rbp - 0x69], rdx
mov rdi, rcx
mov qword [rbp - 0x19], r8
mov qword [rbp - 0x11], r9
movzx esi, byte [rbp + 0x77]
mov byte [rsp + 0x30], sil
mov rcx, qword [rbp + 0x8f]
mov qword [rbp - 0x29], rcx
mov rcx, qword [rbp + 0x97]
mov qword [rbp - 0x21], rcx
mov ecx, 0x5a4d
cmp word [rdx], cx
jne 0x14015000f
movsxd r14, dword [rdx + 0x3c]
add r14, rdx
cmp dword [r14], 0x4550
jne 0x14015000f
mov eax, 0x20b
cmp word [r14 + 0x18], ax
je 0x14014fc5f
lea rdx, str.____Image_is_not_64_bit
jmp 0x140150016
mov r15d, dword [r14 + 0x50]
mov edx, r15d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rbp - 0x51], rax
test rax, rax
je 0x14015002a
movzx eax, word [r14 + 0x14]
mov ecx, dword [rax + r14 + 0x24]
mov dword [rbp - 0x79], ecx
xor r8d, r8d
mov eax, r8d
test sil, sil
cmovne eax, ecx
mov dword [rbp - 0x61], eax
sub r15d, eax
mov dword [rbp - 0x7d], r15d
mov r13d, r8d
mov qword [rbp - 0x59], r8
lea rsi, [0x140295be0]
mov eax, dword [rbp + 0x7f]
cmp eax, 1
jne 0x14014fcdc
mov edx, r15d
lea r8, [rbp - 0x59]
mov rcx, rdi
call fcn.1401502f0
mov r12, rax
mov r13, qword [rbp - 0x59]
jmp 0x14014fd89
cmp eax, 2
jne 0x14014fcf4
mov edx, r15d
mov rcx, rdi
call fcn.140150100
mov r12, rax
jmp 0x14014fd89
test r15, r15
je 0x14014fd3f
mov edx, reloc.WS2_32.dll_sendto
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1402977b8], eax
jg 0x14015005d
jmp 0x14014fd1e
xor r8d, r8d
cmp qword [0x1402978a8], 0
jne 0x14014fd6c
lea rdx, str.____Failed_to_find_ExAllocatePool
mov rcx, rsi
call fcn.140033b90
mov rcx, rax
call fcn.140033e50
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
mov rcx, rsi
call fcn.140033b90
mov rcx, rax
call fcn.140033e50
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14015002a
mov qword [rbp - 0x71], r8
mov qword [rsp + 0x20], r15
lea rdx, [rbp - 0x71]
mov rcx, rdi
call fcn.1400356f0
test al, al
je 0x14014fd3f
mov r12, qword [rbp - 0x71]
test r12, r12
je 0x14014fd3f
mov r8d, dword [r14 + 0x54]
mov rdx, qword [rbp - 0x69]
mov rcx, rbx
call fcn.140175e80
movzx ebx, word [r14 + 0x14]
add rbx, 0x28
xor eax, eax
mov r15d, eax
cmp ax, word [r14 + 6]
jae 0x14014fdf9
add rbx, r14
mov rsi, qword [rbp - 0x51]
mov r13, qword [rbp - 0x69]
nop
test dword [rbx + 0x14], 0x80
ja 0x14014fddd
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, r13
mov ecx, dword [rbx - 4]
add rcx, rsi
call fcn.140175e80
inc r15d
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp r15d, eax
jl 0x14014fdc0
lea rsi, [0x140295be0]
mov r13, qword [rbp - 0x59]
mov r15, r12
cmp byte [rsp + 0x30], 0
je 0x14014fe09
mov eax, dword [rbp - 0x79]
sub r12, rax
mov rbx, r12
sub rbx, qword [r14 + 0x30]
mov rdx, qword [rbp - 0x51]
lea rcx, [rbp - 0x49]
call fcn.14016e450
mov rdx, rbx
mov rcx, rax
call fcn.14014fad0
mov rdx, r12
mov rbx, qword [rbp - 0x51]
mov rcx, rbx
call fcn.14014f9e0
test al, al
jne 0x14014fe4a
lea rdx, str.____Failed_to_fix_cookie
mov rcx, rsi
jmp 0x14015001d
mov rdx, rbx
lea rcx, [rbp - 0x49]
call fcn.14016e5a0
mov rdx, rax
mov rcx, rdi
call fcn.14014f840
test al, al
jne 0x14014fe71
lea rdx, str.____Failed_to_resolve_imports
jmp 0x14014ff04
mov r9d, dword [rbp - 0x7d]
mov r8d, dword [rbp - 0x61]
add r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.14014e480
test al, al
jne 0x14014fe94
lea rdx, str.____Failed_to_write_local_image_to_remote_image
jmp 0x14014ff04
mov r14d, dword [r14 + 0x28]
add r14, r12
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x14014fec7
mov qword [rsp + 0x20], r13
mov r9d, dword [rbp - 0x7d]
mov r8, r15
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x19]
call rax
test al, al
jne 0x14014fec7
lea rdx, str.____Callback_returns_false__failed_
jmp 0x14014ff04
mov dword [rbp - 0x79], 0
mov r9, qword [rbp - 0x19]
cmp byte [rbp + 0x87], 0
cmovne r9, r15
mov rax, qword [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r8, r14
lea rdx, [rbp - 0x79]
mov rcx, rdi
call fcn.140037ad0
test al, al
jne 0x14014ff83
lea rdx, str.____Failed_to_call_driver_entry
mov rcx, rsi
call fcn.140033b90
mov rcx, rax
call fcn.140033e50
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 0x7f]
mov rdx, r15
cmp eax, 1
jne 0x14014ff70
mov r8, r13
mov rcx, rdi
call fcn.14014d7e0
test al, al
je 0x14014ff61
mov rdx, r13
mov rcx, rdi
call fcn.14014d6b0
test al, al
je 0x14014ff61
mov rdx, r13
mov rcx, rdi
call fcn.14014d430
test al, al
jne 0x14015002a
lea rdx, str.____WARNING:_Failed_to_free_memory_
mov rcx, rsi
jmp 0x14015001d
cmp eax, 2
jne 0x14014ff51
mov r8d, dword [rbp - 0x7d]
mov rcx, rdi
call fcn.14014de50
jmp 0x14014ff59
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14014ff91
mov eax, dword [rbp - 0x79]
mov dword [rcx], eax
cmp byte [rbp + 0x6f], 0
je 0x14014ffe6
mov eax, dword [rbp + 0x7f]
mov rdx, r15
cmp eax, 1
jne 0x14014fffc
mov r8, r13
mov rcx, rdi
call fcn.14014d7e0
test al, al
je 0x14014ffcf
mov rdx, r13
mov rcx, rdi
call fcn.14014d6b0
test al, al
je 0x14014ffcf
mov rdx, r13
mov rcx, rdi
call fcn.14014d430
test al, al
jne 0x14014ffe6
lea rdx, str.____WARNING:_Failed_to_free_memory_
mov rcx, rsi
call fcn.140033b90
mov rcx, rax
call fcn.140033e50
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r15
jmp 0x14015002c
cmp eax, 2
jne 0x14014ffc3
mov r8d, dword [rbp - 0x7d]
mov rcx, rdi
call fcn.14014de50
jmp 0x14014ffcb
lea rdx, str.____Invalid_format_of_PE_image
lea rcx, [0x140295be0]
call fcn.140033b90
mov rcx, rax
call fcn.140033e50
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14008acf0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [0x1402977b8]
call fcn.14008ad54
jmp 0x14014fd1b
lea rcx, [0x1402977b8]
call fcn.14008adc0
cmp dword [0x1402977b8], 0xffffffff
jne 0x14014fd1b
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x39], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.ExAllocatePoolWithTag
lea rcx, [rbp - 0x49]
call fcn.14001a8d0
nop
lea r8, [rbp - 0x49]
mov rdx, qword [0x1402973e8]
mov rcx, rdi
call fcn.14014d0f0
mov qword [0x1402978a8], rax
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x14015004c
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401500ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401500ee
call fcn.1400a0e94
int3
call fcn.14008ad10
jmp 0x14015004c