Function at 0x1400033c0
Capabilities:
Access pe header
Get file version info
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x580], rax
movzx ecx, word [0x14000d980]
lea rax, [rsp + 0x60]
xor r15d, r15d
mov dword [rsp + 0x40], r15d
mov r14d, r15d
mov r13d, r15d
mov r12d, r15d
test cx, cx
je 0x140003440
lea rdx, [0x14000d980]
lea rdi, [rsp + 0x60]
sub rdx, rdi
nop dword [rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140003430
cmp dword [0x14000d8dc], r12d
mov word [rax], r15w
lea rax, [rsp + 0x60]
je 0x140003492
cmp word [rsp + 0x60], r12w
je 0x14000346a
nop word [rax + rax]
add rax, 2
cmp word [rax], r12w
jne 0x140003460
lea rdx, str.osloader.efi
mov ecx, 0x6f
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140003480
jmp 0x1400034d0
cmp word [rsp + 0x60], r12w
je 0x1400034aa
nop word [rax + rax]
add rax, 2
cmp word [rax], r12w
jne 0x1400034a0
lea rdx, str.osloader.exe
mov ecx, 0x6f
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400034c0
lea rdx, [rsp + 0x50]
mov word [rax], r15w
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x50], r15d
mov esi, r15d
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test eax, eax
je 0x140003a60
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140003a60
mov r9, rax
lea rcx, [rsp + 0x60]
mov r8d, ebx
xor edx, edx
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140003572
lea r9, [rsp + 0x54]
mov rcx, rdi
lea r8, [rsp + 0x48]
lea rdx, [0x14000a138]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov esi, eax
test eax, eax
je 0x140003572
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + 8]
mov r14d, eax
movzx r13d, ax
mov eax, dword [rcx + 0xc]
mov r12d, eax
shr r14d, 0x10
shr r12d, 0x10
movzx ebx, ax
jmp 0x140003576
mov ebx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x140003a60
xor eax, eax
lea rdi, [rbp + 0x370]
mov ecx, 0x208
rep stosb byte [rdi], al
mov rdi, qword [0x14000dc58]
mov rcx, rdi
call qword [0x1400092d8]
mov dword [rsp + 0x38], ebx
lea r9, str.Patch:_Winload_version:__lu._lu._lu._lu_n
mov edx, 0x104
mov dword [rsp + 0x30], r12d
mov r8d, edx
mov dword [rsp + 0x28], r13d
lea rcx, [rbp + 0x370]
mov dword [rsp + 0x20], r14d
call rdi
lea rdx, [rbp + 0x370]
call fcn.140002d10
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.140007480
mov r13, rax
test rax, rax
je 0x140003a4f
mov rcx, rax
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rdx, r13
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rax
call fcn.140005da0
test eax, eax
je 0x14000375d
mov r8, qword [0x14000d940]
test r8, r8
je 0x140003687
lea r9, str.ImgpValidateImageHash
nop word [rax + rax]
mov rax, qword [r8 + 8]
cmp r9, rax
je 0x1400036dc
test rax, rax
je 0x14000367f
mov rdi, r9
sub rdi, rax
nop dword [rax + rax]
movzx ecx, word [rdi + rax]
movzx edx, word [rax]
lea rax, [rax + 2]
test cx, cx
je 0x140003675
cmp cx, dx
je 0x140003660
movzx eax, dx
movzx ecx, cx
sub ecx, eax
je 0x1400036dc
mov r8, qword [r8]
test r8, r8
jne 0x140003640
lea rdx, str.Cannot_query_ImgpValidateImageHash_offset_using_symbols
mov ecx, 0x3eb
call fcn.140007010
xor bl, bl
mov rdi, qword [0x14000d918]
mov rcx, rdi
call qword [0x1400092d8]
mov rdx, r13
mov rcx, 0xffffffffffffffff
call rdi
mov rdi, qword [0x14000d8f8]
mov rcx, rdi
call qword [0x1400092d8]
mov rcx, 0xffffffffffffffff
call rdi
test bl, bl
jne 0x140003933
jmp 0x140003771
mov rax, qword [r8 + 0x10]
test rax, rax
je 0x140003687
mov rcx, qword [rsp + 0x40]
sub eax, r13d
mov r8d, eax
mov rdx, r13
call qword [sym.imp.ntdll.dll_RtlAddressInSectionTable]
mov rdi, qword [0x14000dc58]
mov rbx, rax
lea rax, [0x14000d0cc]
mov dword [0x14000d970], 3
sub rbx, r13
mov qword [0x14000d968], rax
mov rcx, rdi
mov qword [0x14000d960], rbx
call qword [0x1400092d8]
lea r9, str.___ImgpValidateImageHash_t_08llX
mov qword [rsp + 0x20], rbx
mov edx, 0x208
lea rcx, [rsp + 0x60]
mov r8d, 0x104
call rdi
lea rdx, [rsp + 0x60]
call fcn.140002d10
mov bl, 1
jmp 0x14000369a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.Cannot_load_symbols_for_the_winload
call fcn.140007010
mov esi, dword [0x14000d8d8]
lea r14, str.Patch:_Running_signature_scan_for_ImgpValidateImageHash
mov rbx, qword [0x14000d8d0]
mov rdi, r14
nop dword [rax + rax]
add rdi, 2
cmp word [rdi], r15w
jne 0x140003790
sub rdi, r14
sar rdi, 1
lea rax, [rdi - 1]
cmp rax, 0x40f
ja 0x14000387e
lea rdi, [rdi*2 + 6]
call qword [sym.imp.ntdll.dll_RtlGetCurrentPeb]
mov r8, rdi
mov edx, 8
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x14000387e
mov rdx, r14
mov rcx, rax
call fcn.140005990
mov rax, rdi
cmp word [rdi], r15w
je 0x1400037fa
add rax, 2
cmp word [rax], r15w
jne 0x1400037f0
lea rdx, [0x140009904]
mov ecx, 0xd
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140003810
mov word [rax], r15w
mov rax, rdi
cmp word [rdi], r15w
je 0x14000383a
nop dword [rax]
add rax, 2
cmp word [rax], r15w
jne 0x140003830
sub rax, rdi
mov qword [rsp + 0x20], r15
sar rax, 1
lea r9, [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
test esi, esi
je 0x14000385f
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x140003869
lea r8d, [rax + rax]
call qword [sym.imp.KERNEL32.dll_WriteFile]
call qword [sym.imp.ntdll.dll_RtlGetCurrentPeb]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp r12d, 0x295a
ja 0x1400038fc
je 0x1400038ee
cmp r12d, 0x1db1
je 0x1400038e0
cmp r12d, 0x23f0
je 0x1400038cf
cmp r12d, 0x2580
je 0x1400038be
cmp r12d, 0x2800
jne 0x140003920
lea rsi, [0x14000d220]
mov ebx, 0x24
jmp 0x140003969
lea rsi, [0x14000d018]
mov ebx, 0x1f
jmp 0x140003969
lea rsi, [0x14000d080]
mov ebx, 0x1d
jmp 0x140003969
lea rsi, [0x14000d148]
mov ebx, 0x1e
jmp 0x140003969
lea rsi, [0x14000d1f0]
mov ebx, 0x21
jmp 0x140003969
cmp r12d, 0x3839
je 0x14000395d
cmp r12d, 0x3ad7
je 0x140003954
cmp r12d, 0x3fab
je 0x14000394b
cmp r12d, 0x42ee
je 0x14000394b
xor bl, bl
lea rdx, str.Cannot_query_ImgpValidateImageHash_offset_using_signatures
mov ecx, 0x3eb
call fcn.140007010
mov rdx, r13
mov rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtUnmapViewOfSection]
movzx eax, bl
jmp 0x140003a73
lea rsi, [0x14000d0e8]
jmp 0x140003964
lea rsi, [0x14000d1b0]
jmp 0x140003964
lea rsi, [0x14000d110]
mov ebx, 0x26
mov r14, qword [rsp + 0x48]
mov rdi, r13
cmp r14, rbx
jb 0x1400039fc
sub r14, rbx
nop dword [rax]
movzx edx, byte [rsi]
mov r8, r14
sub r8, rdi
mov rcx, rdi
add r8, r13
call fcn.140007e70
mov rdi, rax
test rax, rax
je 0x1400039fc
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140008640
test eax, eax
je 0x1400039be
inc rdi
mov rax, r14
sub rax, rdi
add rax, r13
jne 0x140003980
jmp 0x1400039fc
mov r15, rdi
test rdi, rdi
je 0x1400039fc
mov rcx, qword [rsp + 0x40]
sub edi, r13d
mov r8d, edi
mov rdx, r13
call qword [sym.imp.ntdll.dll_RtlAddressInSectionTable]
sub rax, r13
mov dword [0x14000d970], 3
mov qword [0x14000d960], rax
lea rax, [0x14000d0cc]
mov qword [0x14000d968], rax
test r15, r15
setne bl
test r15, r15
je 0x140003922
mov rdi, qword [0x14000dc58]
mov rcx, rdi
call qword [0x1400092d8]
mov rax, qword [0x14000d960]
lea r9, str.___ImgpValidateImageHash_t_08llX
mov edx, 0x208
mov qword [rsp + 0x20], rax
mov r8d, 0x104
lea rcx, [rsp + 0x60]
call rdi
lea rdx, [rsp + 0x60]
call fcn.140002d10
jmp 0x140003933
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.Cannot_map_winload_file
jmp 0x140003a6c
lea rdx, str.Cannot_query_winload_build_number
mov ecx, 0x309
call fcn.140007010
xor al, al
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.1400081d0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret