Function at 0x14000b1c0
Capabilities:
Parse pe header

Disassembly:
push rsi
push r15
sub rsp, 0xa8
mov rax, qword [0x140019008]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
call fcn.140004cb0
mov qword [rsp + 0x50], rax
mov r15, rax
test rsi, rsi
jne 0x14000b214
call fcn.140004d60
lea r8, str.atom::MapUserImage
mov rcx, rax
lea rdx, str._s:_image_data_is_not_valid_
call fcn.140004e20
xor al, al
jmp 0x14000b63f
mov qword [rsp + 0xd0], rbp
mov ebp, 0x5a4d
mov qword [rsp + 0x98], r13
cmp word [rsi], bp
jne 0x14000b6e3
movsxd r13, dword [rsi + 0x3c]
add r13, rsi
cmp dword [r13], 0x4550
jne 0x14000b6e3
mov qword [rsp + 0xd8], rdi
mov edi, dword [r13 + 0x50]
mov qword [rsp + 0x40], rdi
test rdi, rdi
jne 0x14000b27f
call fcn.140004d60
lea r8, str.atom::MapUserImage
mov rcx, rax
lea rdx, str._s:_image_size_is_not_valid_
call fcn.140004e20
xor al, al
jmp 0x14000b627
mov r9d, 4
mov qword [rsp + 0xa0], r12
mov r8d, 0x1000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
mov qword [rsp + 0x48], rax
cmp word [rsi], bp
jne 0x14000b6c1
movsxd rcx, dword [rsi + 0x3c]
cmp dword [rcx + rsi], 0x4550
jne 0x14000b6c1
mov qword [rsp + 0xc8], rbx
mov ebx, dword [rcx + rsi + 0x54]
call fcn.140004d60
mov r9, rsi
mov dword [rsp + 0x28], ebx
lea r8, str.atom::MapImageHeader
mov qword [rsp + 0x20], r12
lea rdx, str._s:__0x_016llX______0x_016llX___0x_08X_
mov rcx, rax
call fcn.140004e20
mov r8d, ebx
mov rdx, rsi
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call fcn.14000a9c0
test eax, eax
jne 0x14000b32f
call fcn.140004d60
lea r8, str.atom::MapUserImage
mov rcx, rax
lea rdx, str._s:_resolve_import__...___error_
call fcn.140004e20
xor al, al
jmp 0x14000b617
mov qword [rsp + 0x90], r14
test r12, r12
je 0x14000b6a1
cmp word [r12], bp
jne 0x14000b6a1
movsxd rbp, dword [r12 + 0x3c]
add rbp, r12
cmp dword [rbp], 0x4550
jne 0x14000b6a1
movzx r14d, word [rbp + 0x14]
add r14, 0x18
add r14, rbp
je 0x14000b6a1
xor eax, eax
movzx ebx, ax
cmp ax, word [rbp + 6]
jae 0x14000b410
nop dword [rax]
nop word [rax + rax]
movzx eax, bx
lea rcx, [rax + rax*4]
lea rdi, [r14 + rcx*8]
test rdi, rdi
je 0x14000b400
mov rax, qword [rdi]
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x78], 0
call fcn.140004d60
mov ecx, dword [rdi + 0x10]
lea r9, [rsp + 0x70]
mov r8d, dword [rdi + 0xc]
mov edx, dword [rdi + 0x14]
add r8, r12
mov dword [rsp + 0x30], ecx
add rdx, rsi
mov qword [rsp + 0x28], r8
mov rcx, rax
mov qword [rsp + 0x20], rdx
lea r8, str.atom::MapImageSection
lea rdx, str._s:___s___0x_016llX______0x_016llX___0x_08X_
call fcn.140004e20
mov edx, dword [rdi + 0x14]
mov ecx, dword [rdi + 0xc]
add rdx, rsi
mov r8d, dword [rdi + 0x10]
add rcx, r12
call sub.VCRUNTIME140.dll_memcpy
inc bx
cmp bx, word [rbp + 6]
jb 0x14000b390
mov rdi, qword [rsp + 0x40]
xor eax, eax
mov qword [rsp + 0x58], rax
mov rdx, rdi
mov qword [rsp + 0x60], rax
mov rcx, r15
lea rax, [rsp + 0x60]
mov dword [rsp + 0x68], 1
mov qword [rsp + 0x28], rax
call fcn.140004960
mov r15, rax
test rax, rax
je 0x14000b67e
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14000b67e
call fcn.140004d60
mov r8, r15
lea rdx, str.image_block.m_address:_0x_016llX
mov rcx, rax
call fcn.140004e20
call fcn.140004d60
mov r8, rbx
lea rdx, str.image_block.m_size:_0x_016llX
mov rcx, rax
call fcn.140004e20
mov rcx, qword [r13 + 0xb0]
test ecx, ecx
je 0x14000b65a
mov rax, rcx
shr rax, 0x20
test eax, eax
je 0x14000b65a
mov r14d, ecx
add r14, r12
lea r8, [rax + r14]
mov qword [rsp + 0x70], r8
je 0x14000b58c
mov r9d, 0xfff
nop dword [rax + rax]
mov eax, dword [r14]
test eax, eax
je 0x14000b587
mov edx, dword [r14 + 4]
test edx, edx
je 0x14000b587
cmp rax, r8
jae 0x14000b587
add r12, rax
lea rsi, [r14 + 8]
lea rax, [rdx - 8]
shr rax, 1
test eax, eax
je 0x14000b575
mov ebp, eax
nop dword [rax + rax]
movzx edi, word [rsi]
movzx ebx, di
and di, r9w
shr bx, 0xc
cmp bx, 3
je 0x14000b51a
cmp bx, 0xa
jne 0x14000b566
call fcn.140004d60
movzx ecx, di
mov r8, r15
sub r8, qword [r13 + 0x30]
mov r9, r12
mov qword [rsp + 0x30], r8
lea r8, str.atom::MapImageRelocation
mov dword [rsp + 0x28], ecx
mov rcx, rax
movzx edx, bx
mov dword [rsp + 0x20], edx
lea rdx, str._s:__0x_016llX___0x_04X___0x_04X___0x_016llX_
call fcn.140004e20
movzx ecx, di
mov rax, r15
sub rax, qword [r13 + 0x30]
mov r9d, 0xfff
add qword [rcx + r12], rax
add rsi, 2
sub rbp, 1
jne 0x14000b500
mov r8, qword [rsp + 0x70]
mov eax, dword [r14 + 4]
mov r12, qword [rsp + 0x48]
add r14, rax
jne 0x14000b4c0
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov r9, rdi
mov rcx, rbx
mov qword [rsp + 0x20], 0
mov r8, r12
mov rdx, r15
call fcn.1400047e0
test al, al
jne 0x14000b5ce
call fcn.140004d60
mov r9, r12
mov qword [rsp + 0x20], rdi
mov r8, r15
lea rdx, str._s:_driver.WriteMemory__0x_016llX__0x_016llX__0x_016llX___error_
mov rcx, rax
call fcn.140004e20
mov ecx, dword [rbx + 0x38]
mov r8, r13
mov rdx, r15
call fcn.14000ae20
test al, al
jne 0x14000b67a
call fcn.140004d60
mov r9d, dword [rbx + 0x38]
lea r8, str.atom::MapUserImage
lea rdx, str._s:_ExecuteProcedure__0x_08X__0x_016llX__0x_016llX___error_
mov qword [rsp + 0x28], r13
mov rcx, rax
mov qword [rsp + 0x20], r15
call fcn.140004e20
xor al, al
mov r14, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xd8]
mov rbp, qword [rsp + 0xd0]
mov r13, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000ec70
add rsp, 0xa8
pop r15
pop rsi
ret
call fcn.140004d60
lea r8, str.atom::MapImageRelocation
mov rcx, rax
lea rdx, str._s:_No_relocations...
call fcn.140004e20
jmp 0x14000b58c
mov al, 1
jmp 0x14000b60f
call fcn.140004d60
mov r9, rdi
lea r8, str.atom::MapUserImage
lea rdx, str._s:_control.Commit__0x_016llX___error_
mov rcx, rax
call fcn.140004e20
jmp 0x14000b60d
call fcn.140004d60
lea r8, str.atom::MapUserImage
mov rcx, rax
lea rdx, str._s:_MapImageSection__...___error_
call fcn.140004e20
jmp 0x14000b60d
call fcn.140004d60
lea r8, str.atom::MapUserImage
mov rcx, rax
lea rdx, str._s:_MapImageHeader__...___error_
call fcn.140004e20
xor al, al
jmp 0x14000b61f
call fcn.140004d60
lea r8, str.atom::MapUserImage
mov rcx, rax
lea rdx, str._s:_image_nt_headers_is_not_valid_
call fcn.140004e20
xor al, al
jmp 0x14000b62f