Function at 0x140001e28
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov edx, 0x10
xor ecx, ecx
mov r8d, 0x58585858
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, rsi
mov r14, rax
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rbp, rax
call fcn.140001df4
mov ecx, dword [rbp + 0x50]
mov r12, rax
shr r12, 9
mov r15, rax
mov qword [rsp + 0x80], rax
xor r13d, r13d
movabs rax, 0x7fc0000000
mov qword [r14 + 8], rcx
and r12, rax
mov qword [r14], rbx
or r12, r15
test rbx, rbx
je 0x1400022e5
lea rax, [rcx + rbx]
mov rdi, rbx
cmp rbx, rax
jae 0x140001f4f
movabs rsi, 0x7ffffffff8
mov rax, rdi
shr rax, 0x12
and eax, 0x3ffffff8
mov rcx, qword [rax + r12]
mov r9, rcx
shr r9, 0xb
and r9d, 1
jne 0x140001ee8
bts rcx, 0xb
mov qword [rax + r12], rcx
jmp 0x140001f33
xor edx, edx
lea r8, [0x140002c20]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rax, rdi
mov ecx, 0x800
shr rax, 9
and rax, rsi
mov r9, qword [rax + r15]
test rcx, r9
jne 0x140001f19
or r9, rcx
mov qword [rax + r15], r9
xor edx, edx
shr r9, 0xb
and r9d, 1
lea r8, [0x140002c20]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rax, qword [r14]
add rdi, 0x1000
add rax, qword [r14 + 8]
cmp rdi, rax
jb 0x140001ec0
mov rsi, qword [rsp + 0x78]
mov r8d, dword [rbp + 0x50]
xor edx, edx
mov rcx, rbx
call fcn.140002740
mov r8d, dword [rbp + 0x54]
mov rdx, rsi
mov rcx, rbx
call fcn.140002480
lea rdi, [rbp + 0x108]
jmp 0x140001f8e
mov edx, dword [rdi + 0x14]
mov ecx, dword [rdi + 0xc]
add rdx, rsi
mov r8d, dword [rdi + 0x10]
add rcx, rbx
call fcn.140002480
add rdi, 0x28
movzx eax, word [rbp + 6]
lea rcx, [rax + rax*4]
lea rax, [rcx*8 + 0x108]
add rax, rbp
cmp rdi, rax
jb 0x140001f75
mov r9d, 0xc000007b
xor edx, edx
mov rcx, rbx
lea r8d, [r9 - 0x63]
call fcn.140001720
mov edi, eax
test eax, eax
jns 0x140001fe2
lea r8, [0x140002c60]
xor edx, edx
mov dword [rsp + 0x20], eax
lea r9, [0x140002c50]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
jmp 0x1400022ea
mov dword [rsp + 0x28], r13d
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov dl, 1
mov rcx, rbx
call fcn.140001b14
mov dword [rsp + 0x70], eax
mov edi, eax
mov r13d, eax
test eax, eax
jns 0x140002012
lea r8, [0x140002ca0]
jmp 0x140001fc7
mov rcx, rbx
call fcn.140001820
mov esi, dword [rbp + 0x28]
test esi, esi
je 0x1400022ea
xor edx, edx
lea r8, [0x140002ce0]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
lea rax, [rbx + rsi]
xor edx, edx
mov rcx, r14
call qword [0x1400030e8]
movzx edi, word [rbp + 0x14]
xor eax, eax
add rdi, 0x18
mov esi, eax
add rdi, rbp
cmp word [rbp + 6], ax
je 0x1400020f6
mov r15d, dword [rdi + 8]
test r15d, r15d
je 0x1400020d7
lea rdx, [0x140002d10]
mov rcx, rdi
call sub.ntoskrnl.exe_strcmp
test eax, eax
je 0x1400020c7
lea rdx, [0x140002d20]
mov rcx, rdi
call sub.ntoskrnl.exe_strcmp
test eax, eax
je 0x1400020c7
lea rdx, [0x140002d30]
mov rcx, rdi
call sub.ntoskrnl.exe_strcmp
test eax, eax
je 0x1400020c7
lea rdx, [0x140002d40]
mov rcx, rdi
call sub.ntoskrnl.exe_strcmp
test eax, eax
je 0x1400020c7
lea rdx, [0x140002d50]
mov rcx, rdi
call sub.ntoskrnl.exe_strcmp
test eax, eax
jne 0x1400020d7
mov ecx, dword [rdi + 0xc]
mov r8, r15
add rcx, rbx
xor edx, edx
call fcn.140002740
movzx eax, word [rbp + 6]
inc esi
add rdi, 0x28
cmp esi, eax
jne 0x14000205f
mov r13d, dword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
mov r8d, dword [rbp + 0x54]
xor edx, edx
mov rcx, rbx
call fcn.140002740
mov ecx, 8
mov qword [rsp + 0x80], 0x5000
lea rsi, [rsp + 0x80]
mov rdi, rbx
rep movsb byte [rdi], byte [rsi]
mov rdi, qword [r14]
mov rcx, qword [r14 + 8]
add rcx, rdi
cmp rdi, rcx
jae 0x1400021cb
movabs r13, 0x7ffffffff8
mov rax, rdi
shr rax, 0x12
and eax, 0x3ffffff8
mov rcx, qword [rax + r12]
bt rcx, 0xb
jae 0x140002161
btr rcx, 0xb
mov qword [rax + r12], rcx
jmp 0x1400021af
xor edx, edx
lea r8, [0x140002c20]
xor r9d, r9d
lea esi, [rdx + 0x4d]
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rax, rdi
shr rax, 9
and rax, r13
mov r9, qword [rax + r15]
bt r9, 0xb
jae 0x140002196
btr r9, 0xb
mov qword [rax + r15], r9
shr r9, 0xb
lea r8, [0x140002c20]
and r9d, 1
xor edx, edx
mov ecx, esi
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov rax, qword [r14]
add rdi, 0x1000
add rax, qword [r14 + 8]
cmp rdi, rax
jb 0x14000213f
mov r13d, dword [rsp + 0x70]
xor eax, eax
mov edi, r13d
cmp dword [rbp + 0xbc], eax
jbe 0x1400022ea
lea r15d, [rax + 0x4d]
xor edx, edx
mov ecx, r15d
lea r8, [0x140002d60]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov esi, dword [rbp + 0xb8]
lea r8, [0x140002d90]
mov edi, dword [rbp + 0xbc]
mov r9d, esi
xor edx, edx
mov ecx, r15d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r9d, edi
lea r8, [0x140002dd0]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
movabs rax, 0x2492492492492493
lea r15, [rbx + rsi]
mul rdi
mov ebp, edi
mov r12d, edi
sub rbp, rdx
shr rbp, 1
add rbp, rdx
xor edx, edx
shr rbp, 4
mov esi, edx
test ebp, ebp
je 0x1400022c1
lea rdi, [r15 + 0x14]
mov eax, dword [rdi]
test eax, eax
je 0x1400022b7
mov ecx, dword [rdi - 4]
test ecx, ecx
je 0x1400022b7
xor edx, edx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea r8, [0x140002e00]
mov r9d, esi
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor edx, edx
lea r8, [0x140002e40]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov ecx, dword [rdi]
xor edx, edx
mov r8d, dword [rdi - 4]
add rcx, rbx
call fcn.140002740
xor edx, edx
lea r8, [0x140002e70]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
xor edx, edx
inc esi
add rdi, 0x1c
cmp esi, ebp
jb 0x140002257
xor edx, edx
lea r8, [0x140002ea0]
lea ecx, [rdx + 0x4d]
call qword [sym.imp.ntoskrnl.exe_DbgPrintEx]
mov r8, r12
xor edx, edx
mov rcx, r15
call fcn.140002740
mov edi, r13d
jmp 0x1400022ea
mov edi, 0xc00000a0
mov edx, 0x58585858
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rbx, qword [rsp + 0x88]
mov eax, edi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret