Function at 0x1800171c0
Capabilities:
Parse pe header
Print debug messages
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor r9d, r9d
mov qword [rcx + 0x20], rdx
mov eax, 0x5a4d
mov rbp, r8
mov rsi, rcx
mov edi, r9d
cmp word [rdx], ax
jne 0x18001722a
mov edi, dword [rdx + 0x3c]
cmp edi, 0x800
jbe 0x18001722a
mov rdx, rcx
mov r8d, edi
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_e_lfanew_x__expected_a_lower_value_n
call sym.VBoxVideo.dll_RTLogBackdoorPrintf
mov r8d, edi
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_e_lfanew_x__expected_a_lower_value_n
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
xor al, al
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x38], rbx
mov ebx, edi
add rbx, rdx
mov qword [rcx + 0x28], rbx
mov r8d, dword [rbx]
cmp r8d, 0x4550
je 0x18001726a
mov rdx, rsi
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Invalid_PE_signature:__x
call sym.VBoxVideo.dll_RTLogBackdoorPrintf
mov r8d, dword [rbx]
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Invalid_PE_signature:__x
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x18001754c
movzx eax, word [rbx + 0x14]
mov ecx, pe_nt_image_headers64
cmp ax, cx
je 0x1800172a3
mov r8d, eax
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Unexpected_optional_header_size:__x_n
mov rdx, rsi
call sym.VBoxVideo.dll_RTLogBackdoorPrintf
movzx r8d, word [rbx + 0x14]
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Unexpected_optional_header_size:__x_n
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x18001754c
movzx eax, word [rbx + 0x18]
mov ecx, 0x20b
cmp ax, cx
je 0x1800172dc
mov r8d, eax
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Unexpected_optional_header_magic:__x_n
mov rdx, rsi
call sym.VBoxVideo.dll_RTLogBackdoorPrintf
movzx r8d, word [rbx + 0x18]
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Unexpected_optional_header_magic:__x_n
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x18001754c
mov r8d, dword [rbx + 0x84]
cmp r8d, 0x10
je 0x180017313
mov rdx, rsi
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Unexpected_number_of_RVA_and_sizes:__x_n
call sym.VBoxVideo.dll_RTLogBackdoorPrintf
mov r8d, dword [rbx + 0x84]
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Unexpected_number_of_RVA_and_sizes:__x_n
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x18001754c
mov dword [rsi + 0x34], edi
movzx eax, word [rbx + 6]
lea r10d, [rax*4 + 0x21]
add r10d, eax
lea r10d, [rdi + r10*8]
mov dword [rsi + 0x38], r10d
mov r8d, dword [rbx + 0x50]
mov dword [rsi + 0x3c], r8d
cmp r8, rbp
jbe 0x180017367
mov r9, rbp
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_The_image_size__x_is_larger_than_the_mapping:__x_n
mov rdx, rsi
call sym.VBoxVideo.dll_RTLogBackdoorPrintf
mov r8d, dword [rsi + 0x3c]
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_The_image_size__x_is_larger_than_the_mapping:__x_n
mov r9, rbp
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x18001754c
mov rbx, qword [rbx + 0x88]
mov rax, rbx
mov qword [rsp + 0x30], rbx
shr rax, 0x20
cmp eax, 0x28
jb 0x1800174fe
cmp ebx, r10d
jb 0x18001751e
cmp ebx, r8d
jae 0x18001751e
add eax, ebx
cmp eax, r8d
ja 0x18001751e
mov dword [rsi + 0x40], ebx
mov rax, rbx
shr rax, 0x20
mov dword [rsi + 0x44], eax
mov ebx, ebx
add rbx, rdx
mov r11d, dword [rbx + 0x14]
lea eax, [r11 - 1]
cmp eax, 0xffffe
ja 0x1800174d7
mov ecx, dword [rbx + 0x18]
lea eax, [rcx - 1]
cmp eax, 0xffffe
ja 0x1800174d7
mov dword [rsi + 0x54], ecx
mov ecx, dword [rbx + 0x18]
cmp ecx, dword [rbx + 0x14]
cmovb ecx, dword [rbx + 0x14]
mov dword [rsi + 0x50], ecx
mov r9d, dword [rbx + 0x1c]
cmp r9d, r10d
jb 0x1800174b0
cmp r9d, r8d
jae 0x1800174b0
lea rcx, [r9 + rcx*4]
cmp rcx, r8
ja 0x1800174b0
lea rax, [r9 + rdx]
mov qword [rsi + 0x48], rax
mov r9d, dword [rbx + 0x20]
cmp r9d, r10d
jb 0x180017486
cmp r9d, r8d
jae 0x180017486
mov eax, dword [rbx + 0x18]
lea rcx, [r9 + rax*4]
cmp rcx, r8
ja 0x180017486
lea rax, [r9 + rdx]
mov qword [rsi + 0x58], rax
mov r9d, dword [rbx + 0x24]
cmp r9d, r10d
jb 0x18001745c
cmp r9d, r8d
jae 0x18001745c
mov eax, dword [rbx + 0x18]
lea rcx, [r9 + rax*4]
cmp rcx, r8
ja 0x18001745c
lea rax, [r9 + rdx]
mov qword [rsi + 0x60], rax
mov al, 1
jmp 0x18001754e
mov r8d, r9d
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Bad_AddressOfNameOrdinals:__x_n
mov rdx, rsi
call sym.VBoxVideo.dll_RTLogBackdoorPrintf
mov r8d, dword [rbx + 0x24]
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Bad_AddressOfNameOrdinals:__x_n
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x18001754c
mov r8d, r9d
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Bad_AddressOfNames:__x_n
mov rdx, rsi
call sym.VBoxVideo.dll_RTLogBackdoorPrintf
mov r8d, dword [rbx + 0x20]
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Bad_AddressOfNames:__x_n
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x18001754c
mov r8d, r9d
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Bad_AddressOfFunctions:__x_n
mov rdx, rsi
call sym.VBoxVideo.dll_RTLogBackdoorPrintf
mov r8d, dword [rbx + 0x1c]
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Bad_AddressOfFunctions:__x_n
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x18001754c
mov r9d, dword [rbx + 0x18]
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_NumberOfNames_or_and_NumberOfFunctions_are_outside_the_expected_range:_nof_x_non_x_n
mov r8d, r11d
mov rdx, rsi
call sym.VBoxVideo.dll_RTLogBackdoorPrintf
mov r9d, dword [rbx + 0x18]
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_NumberOfNames_or_and_NumberOfFunctions_are_outside_the_expected_range:_nof_x_non_x_n
mov r8d, dword [rbx + 0x14]
jmp 0x180017544
test eax, eax
jne 0x18001751e
test ebx, ebx
jne 0x18001751e
mov qword [rsi + 0x40], r9
mov al, 1
mov qword [rsi + 0x50], r9
mov qword [rsi + 0x48], r9
mov qword [rsi + 0x58], r9
mov qword [rsi + 0x60], r9
jmp 0x18001754e
mov r9d, dword [rsp + 0x34]
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Missing_or_invalid_export_directory:__lx_LB__x_n
mov r8d, ebx
mov rdx, rsi
call sym.VBoxVideo.dll_RTLogBackdoorPrintf
mov r9d, dword [rsp + 0x34]
lea rcx, str.rtR0DbgKrnlNtParseModule:__s:_Missing_or_invalid_export_directory:__lx_LB__x_n
mov r8d, ebx
mov rdx, rsi
call sub.ntoskrnl.exe_DbgPrint
xor al, al
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret