Function at 0x140008d60
Capabilities:
Get common file path
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [0x140019008]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov qword [rsp + 0x50], rcx
xor r13d, r13d
call fcn.140004d60
lea rdx, str.
mov rcx, rax
call fcn.140004e20
mov ebx, r13d
mov qword [rsp + 0x48], rbx
mov qword [rbp - 0x58], rbx
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x10]
mov ecx, 0x200
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140008e13
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.140003450
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x80]
jmp 0x140008e55
call fcn.140004d60
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.atom::GetCurrentDirectory
lea rdx, str._s:_GetCurrentDirectoryW__...___error___0x_08X_
mov rcx, rdi
call fcn.140004e20
mov qword [rsp + 0x70], r13
mov rcx, r13
mov qword [rbp - 0x80], rcx
mov edx, 7
mov qword [rbp - 0x78], rdx
mov word [rsp + 0x70], r13w
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 0xb
jb 0x140009511
lea r9, [rsp + 0x70]
cmp rdx, 8
cmovae r9, qword [rsp + 0x70]
mov qword [rsp + 0x30], 0xb
lea rax, str.Driver.sys
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x50]
call fcn.140007300
nop
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
mov qword [rbp - 0x60], r13
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.14000e040
test al, al
je 0x140008efd
mov rdi, qword [rbp - 0x68]
sub rdi, qword [rbp - 0x70]
mov rcx, rdi
call fcn.14000f1bc
mov rbx, rax
mov qword [rsp + 0x48], rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x58], rbx
test rbx, rbx
je 0x140008efd
mov r8, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x70]
sub r8, rdx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
call fcn.140004d60
mov r8, rbx
lea rdx, str.file_base__0x_016llX
mov rcx, rax
call fcn.140004e20
test rbx, rbx
jne 0x140008f32
call fcn.140004d60
mov rcx, rax
xor r8d, r8d
lea rdx, str.file_nt_headers__0x_016llX
call fcn.140004e20
jmp 0x140008f67
mov esi, 0x5a4d
cmp word [rbx], si
jne 0x140008f19
movsxd rdi, dword [rbx + 0x3c]
add rdi, rbx
cmp dword [rdi], 0x4550
jne 0x140008f19
call fcn.140004d60
mov r8, rdi
lea rdx, str.file_nt_headers__0x_016llX
mov rcx, rax
call fcn.140004e20
test rdi, rdi
jne 0x140008f8a
call fcn.140004d60
mov r9, rbx
lea r8, str.atom::kernel::Loader::Map
lea rdx, str._s:_GetImageNtHeaders__0x_016llX___error_
mov rcx, rax
call fcn.140004e20
jmp 0x1400093bb
mov r12d, dword [rdi + 0x50]
mov qword [rsp + 0x68], r12
call fcn.140004d60
mov r9d, r12d
mov r8d, r12d
lea rdx, str.image_size__0x_016llX___llu_
mov rcx, rax
call fcn.140004e20
test r12, r12
jne 0x140008fd2
call fcn.140004d60
lea r8, str.atom::kernel::Loader::Map
lea rdx, str._s:_file_nt_headers__OptionalHeader.SizeOfImage_is_0_
mov rcx, rax
call fcn.140004e20
jmp 0x1400093bb
mov rcx, r12
call fcn.14000f1bc
mov r15, rax
mov r8, r12
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x30], r15
call fcn.140004d60
mov r8, r15
lea rdx, str.image_base__0x_016llX
mov rcx, rax
call fcn.140004e20
test rbx, rbx
je 0x14000938f
cmp word [rbx], si
jne 0x14000938f
movsxd rdi, dword [rbx + 0x3c]
cmp dword [rdi + rbx], 0x4550
jne 0x14000938f
call fcn.140004d60
mov ecx, dword [rdi + rbx + 0x54]
mov dword [rsp + 0x20], ecx
mov r9, r15
mov r8, rbx
lea rdx, str.Mapping_image_header_from_0x_016llX_to_0x_016llX_with_size_0x_08X
mov rcx, rax
call fcn.140004e20
mov r8d, 0x1000
mov rdx, rbx
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [r15]
cmp cx, si
jne 0x140009381
movsxd r14, dword [r15 + 0x3c]
add r14, r15
cmp dword [r14], 0x4550
jne 0x140009381
movzx edi, word [r14 + 0x14]
add rdi, 0x18
add rdi, r14
je 0x140009381
mov esi, r13d
cmp r13w, word [r14 + 6]
jae 0x14000910b
add rdi, 0x14
nop dword [rax]
lea rax, [rdi - 0x14]
test rax, rax
je 0x1400090f8
mov byte [rbp - 0x20], 0
mov rax, qword [rax]
mov qword [rbp - 0x28], rax
call fcn.140004d60
mov edx, dword [rdi - 4]
mov ecx, dword [rdi - 8]
add rcx, r15
mov r9d, dword [rdi]
add r9, rbx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x28]
lea rdx, str.Mapping___s__section_from_0x_016llX_to_0x_016llX_with_size_0x_08X
mov rcx, rax
call fcn.140004e20
mov r8d, dword [rdi - 4]
mov edx, dword [rdi]
add rdx, rbx
mov ecx, dword [rdi - 8]
add rcx, r15
call sub.VCRUNTIME140.dll_memcpy
inc esi
add rdi, 0x28
movzx eax, word [r14 + 6]
cmp esi, eax
jl 0x1400090a0
movzx ecx, word [r15]
mov r14d, 0x5a4d
cmp cx, r14w
jne 0x140009361
movsxd rax, dword [r15 + 0x3c]
add rax, r15
mov qword [rsp + 0x58], rax
cmp dword [rax], 0x4550
jne 0x140009361
mov rcx, qword [rax + 0xb0]
test ecx, ecx
je 0x140009243
mov rax, rcx
shr rax, 0x20
test eax, eax
je 0x140009243
mov r13d, ecx
add r13, r15
mov qword [rsp + 0x40], r13
lea r8, [rax + r13]
mov qword [rsp + 0x60], r8
je 0x140009243
mov r9d, 0xfff
mov eax, dword [r13]
test eax, eax
je 0x140009233
mov edx, dword [r13 + 4]
test edx, edx
je 0x140009233
cmp rax, r8
jae 0x140009233
lea rbx, [rax + r15]
lea r14, [r13 + 8]
lea rax, [rdx - 8]
shr rax, 1
test eax, eax
je 0x140009221
mov r12d, eax
mov r13, qword [rsp + 0x58]
nop dword [rax]
movzx esi, word [r14]
movzx edi, si
shr di, 0xc
and si, r9w
cmp di, 0xa
je 0x1400091cb
cmp di, 3
jne 0x14000920d
call fcn.140004d60
mov rdx, r15
sub rdx, qword [r13 + 0x30]
movzx ecx, si
movzx r9d, di
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ecx
mov r8, rbx
lea rdx, str.Mapping_relocation:_0x_016llX__0x_04X__0x_04X__0x_016llX
mov rcx, rax
call fcn.140004e20
movzx ecx, si
mov rax, r15
sub rax, qword [r13 + 0x30]
add qword [rcx + rbx], rax
mov r9d, 0xfff
add r14, 2
sub r12, 1
jne 0x1400091b0
mov r13, qword [rsp + 0x40]
mov r8, qword [rsp + 0x60]
mov eax, dword [r13 + 4]
add r13, rax
mov qword [rsp + 0x40], r13
jne 0x140009171
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x68]
mov r14d, 0x5a4d
mov rdx, r15
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call fcn.140005ea0
test al, al
jne 0x14000927a
call fcn.140004d60
mov r9, r15
lea r8, str.atom::kernel::Loader::Map
lea rdx, str._s:_MapImportDescriptor__0x_016llX___error_
mov rcx, rax
call fcn.140004e20
jmp 0x1400093b3
lea rcx, [rdi + 8]
mov rdx, r12
call fcn.140007090
mov rsi, rax
test rax, rax
je 0x140009341
call fcn.140004d60
mov r8, rsi
lea rdx, str.remote_image_base__0x_016llX
mov rcx, rax
call fcn.140004e20
cmp word [r15], r14w
jne 0x1400092ff
movsxd rax, dword [r15 + 0x3c]
cmp dword [rax + r15], 0x4550
jne 0x1400092ff
mov r9d, dword [rax + r15 + 0x50]
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call fcn.140005070
test al, al
je 0x1400092ff
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call fcn.1400060d0
test al, al
je 0x1400092f6
mov rcx, r15
call fcn.14000ec90
mov dil, 1
jmp 0x1400093d9
lea r14, str._s:_ExecuteImageEntry__0x_016llX__0x_016llX___error_
jmp 0x140009306
lea r14, str._s:_MapImage__0x_016llX__0x_016llX___error_
mov r13, rsi
mov r12, r15
lea rdi, str.atom::kernel::Loader::Map
call fcn.140004d60
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov r9, r15
mov r8, rdi
mov rdx, r14
call fcn.140004e20
mov rdx, rsi
mov rcx, qword [rsp + 0x50]
add rcx, 8
call fcn.1400071d0
jmp 0x1400093b3
call fcn.140004d60
mov r9, r12
lea r8, str.atom::kernel::Loader::Map
lea rdx, str._s:_m_sub_system.Allocate__0x_016llX___error_
mov rcx, rax
call fcn.140004e20
jmp 0x1400093b3
call fcn.140004d60
mov r9, r15
lea r8, str.atom::kernel::Loader::Map
lea rdx, str._s:_MapRelocation__0x_016llX___error_
mov rcx, rax
call fcn.140004e20
jmp 0x1400093b3
call fcn.140004d60
lea rdx, str._s:_MapSection__0x_016llX__0x_016llX___error_
jmp 0x14000939b
call fcn.140004d60
lea rdx, str._s:_MapHeader__0x_016llX__0x_016llX___error_
mov qword [rsp + 0x20], rbx
mov r9, r15
lea r8, str.atom::kernel::Loader::Map
mov rcx, rax
call fcn.140004e20
nop
mov rcx, r15
call fcn.14000ec90
call fcn.140004d60
lea r8, str.herby
lea rdx, str.Cant_map___s__driver_
mov rcx, rax
call fcn.140004e20
xor dil, dil
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140009426
mov rdx, qword [rbp - 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009411
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009411
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ec90
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
xor esi, esi
mov qword [rbp - 0x60], rsi
jmp 0x140009428
xor esi, esi
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14000946b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009466
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009466
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ec90
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], si
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400094bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400094ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000ec90
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], si
test rbx, rbx
je 0x1400094dd
mov rcx, rbx
call fcn.14000ec90
movzx eax, dil
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.14000ec70
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001310
nop
int3