Function at 0x1400b1750
Capabilities:
Access pe header
Allocate or change rwx memory
Parse pe header

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13, rdx
xor r14d, r14d
mov qword [r11 - 0x48], r14
mov esi, r14d
mov qword [r11 - 0x40], r14
mov edi, r14d
mov qword [rcx], r14
mov r12, rdx
mov qword [r11 - 0x48], rdx
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x1400b17a9
mov edi, 0xc000007b
mov dword [rsp + 0x20], edi
mov dword [r11 + 0x20], 0xc00000bb
jmp 0x1400b1816
movsxd rsi, dword [rdx + 0x3c]
add rsi, rdx
mov qword [rsp + 0x38], rsi
cmp dword [rsi], 0x4550
jne 0x1400b1801
test byte [rsi + 0x38], 1
jne 0x1400b1801
mov eax, 0x8664
mov r15d, 0x2000
cmp word [rsi + 4], ax
mov eax, 0xc00000bb
je 0x1400b17eb
mov edi, 0x4000000e
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x98], eax
jmp 0x1400b181c
mov dword [rsp + 0x98], eax
test word [rsi + 0x16], r15w
jne 0x1400b181c
mov edi, eax
mov dword [rsp + 0x20], eax
jmp 0x1400b181c
mov edi, 0xc000007b
mov dword [rsp + 0x20], edi
mov eax, 0xc00000bb
mov dword [rsp + 0x98], eax
mov r15d, 0x2000
jmp 0x1400b184b
test edi, edi
js 0x1400b1c2c
cmp edi, 0x4000000e
je 0x1400b1c2c
mov rbx, r14
mov qword [rsp + 0x28], rbx
test byte [rsi + 0x5e], 0x40
jne 0x1400b188b
mov edx, dword [rsi + 0x50]
mov r9d, 0x40
mov r8d, r15d
mov rcx, qword [rsi + 0x30]
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x1400b18bb
mov edx, dword [rsi + 0x50]
mov r9d, 0x40
mov r8d, r15d
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x28], rax
mov r15d, 0xc0000017
test rax, rax
cmove edi, r15d
jmp 0x1400b18c1
mov r15d, 0xc0000017
test edi, edi
js 0x1400b1c2c
mov rax, qword [0x140108820]
mov r8d, dword [rax + 0x1c]
mov edx, dword [rsi + 0x54]
add edx, 0x3f
add edx, r8d
neg r8d
mov eax, r8d
and rdx, rax
mov r9d, 4
mov r8d, 0x1000
mov rcx, rbx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rcx, rbx
test rax, rax
jne 0x1400b1924
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.kernel32.dll_VirtualFree]
mov eax, r15d
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
movsxd r15, dword [r12 + 0x3c]
add r15, rbx
mov r8d, dword [rsi + 0x54]
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov qword [r15 + 0x30], rbx
movsxd rdx, dword [rbx + 0x3c]
movzx eax, word [rdx + rbx + 6]
lea ecx, [rax + rax*4]
lea edx, [rdx + rcx*8]
add edx, 0x108
movzx eax, word [r15 + 0x14]
mov r8d, r14d
movzx r9d, word [r15 + 6]
movsxd r10, edx
test r9d, r9d
je 0x1400b1988
lea rdx, [r10 + 0x40]
lea rcx, [r15 + 0x24]
add rcx, rax
mov eax, dword [rcx]
cmp rax, rdx
jb 0x1400b1b05
inc r8d
add rcx, 0x28
cmp r8d, r9d
jl 0x1400b1971
xorps xmm0, xmm0
movups xmmword [r10 + rbx], xmm0
movups xmmword [r10 + rbx + 0x10], xmm0
movups xmmword [r10 + rbx + 0x20], xmm0
movups xmmword [r10 + rbx + 0x30], xmm0
mov rax, qword [r15 + 0x30]
mov qword [r10 + rbx + 0x10], rax
mov eax, dword [rsp + 0x90]
mov dword [r10 + rbx + 0x30], eax
movabs rcx, 0xaabbcc11ffee00
mov qword [r10 + rbx], rcx
mov eax, dword [r15 + 0x54]
mov dword [r10 + rbx + 8], eax
mov qword [r10 + rbx + 0x18], r13
mov dword [r10 + rbx + 0x2c], 1
mov r12d, r14d
mov dword [rsp + 0x98], r14d
test r12d, r12d
js 0x1400b1b91
movzx edi, word [r15 + 0x14]
add rdi, 0x28
mov r12d, r14d
cmp r14w, word [r15 + 6]
jae 0x1400b1a70
add rdi, r15
nop word [rax + rax]
mov ecx, dword [r15 + 0x38]
lea edx, [rcx - 1]
add edx, dword [rdi - 8]
neg ecx
and edx, ecx
cmp edx, dword [rdi]
jb 0x1400b1b1b
mov ecx, dword [rdi - 4]
add rcx, qword [r15 + 0x30]
mov r9d, 4
mov r8d, 0x1000
call qword [sym.imp.kernel32.dll_VirtualAlloc]
test rax, rax
je 0x1400b1b10
mov ecx, dword [rdi]
test ecx, ecx
je 0x1400b1a5f
mov r8d, ecx
mov edx, dword [rdi + 4]
add rdx, r13
mov rcx, rax
call sub.msvcrt.dll_memcpy
inc r12d
add rdi, 0x28
movzx eax, word [r15 + 6]
cmp r12d, eax
jb 0x1400b1a10
mov r12d, dword [rsp + 0x98]
test r12d, r12d
js 0x1400b1b91
mov r11, qword [r15 + 0x30]
sub r11, qword [rsi + 0x30]
je 0x1400b1b6a
mov ecx, dword [r15 + 0xb0]
lea r8, [rcx + rbx]
mov eax, dword [r15 + 0xb4]
test eax, eax
je 0x1400b1b6a
test ecx, ecx
je 0x1400b1b6a
add rax, rcx
add rax, rbx
cmp r8, rax
jae 0x1400b1b6a
cmp dword [r8], 0
jbe 0x1400b1b6a
lea r9, [r8 + 8]
mov r10d, r14d
mov ecx, dword [r8 + 4]
lea eax, [rcx - 8]
test eax, 0xfffffffe
jbe 0x1400b1b48
nop
movzx eax, word [r9]
mov ecx, eax
shr ecx, 0xc
cmp ecx, 3
je 0x1400b1b23
cmp ecx, 0xa
jne 0x1400b1b33
and eax, 0xfff
mov edx, dword [r8]
lea rcx, [rbx + rax]
add qword [rdx + rcx], r11
jmp 0x1400b1b33
mov r12d, 0xc00000bb
jmp 0x1400b19e7
mov r12d, 0xc0000017
jmp 0x1400b1a78
mov r12d, 0xc000007b
jmp 0x1400b1b91
and eax, 0xfff
mov edx, dword [r8]
lea rcx, [rbx + rax]
add dword [rdx + rcx], r11d
inc r10d
add r9, 2
mov ecx, dword [r8 + 4]
lea eax, [rcx - 8]
shr eax, 1
cmp r10d, eax
jb 0x1400b1ae0
mov eax, ecx
add r8, rax
mov eax, dword [r15 + 0xb4]
mov ecx, dword [r15 + 0xb0]
add rax, rbx
add rcx, rax
cmp r8, rcx
jb 0x1400b1ac0
mov rax, qword [rsp + 0x80]
mov qword [rax], rbx
jmp 0x1400b1c19
movabs rdi, 0xaabbcc11ffee00
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test rax, rax
je 0x1400b1bd9
movsxd rdx, dword [rbx + 0x3c]
movzx ecx, word [rdx + rbx + 6]
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*8]
movsxd rcx, ecx
cmp qword [rcx + rbx + 0x108], rdi
jne 0x1400b1bd9
cmp qword [rcx + rbx + 0x118], rbx
jne 0x1400b1bd9
lea r14, [rbx + 0x108]
add r14, rcx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
test r14, r14
je 0x1400b1c19
movzx eax, byte [r14 + 0xc]
and al, 6
cmp al, 2
je 0x1400b1c19
cmp qword [r14 + 0x20], 0
je 0x1400b1c01
mov rcx, r14
call fcn.1400b1e20
cmp qword [r14 + 0x10], 0
je 0x1400b1c19
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.kernel32.dll_VirtualFree]
mov eax, r12d
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, edi
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret