Function at 0x1801d5210
Capabilities:
Parse pe header

Disassembly:
push rbx
push r13
sub rsp, 0x48
mov r13, rdx
mov rbx, rcx
lea rdx, str.NtDeviceIoControlFile
lea rcx, str.NTDLL.DLL
call qword [sym.imp.VBoxRT.dll_RTLdrGetSystemSymbol]
mov qword [0x1805985f0], rax
test rax, rax
je 0x1801d5548
mov rcx, rbx
mov qword [rsp + 0x40], r12
call qword [sym.imp.VBoxRT.dll_RTLdrGetNativeHandle]
mov r12, rax
movzx ecx, word [rax]
mov eax, 0x5a4d
cmp cx, ax
jne 0x1801d5523
movsxd rcx, dword [r12 + 0x3c]
mov r9d, dword [rcx + r12]
cmp r9d, 0x4550
jne 0x1801d54fd
mov rax, qword [rcx + r12 + 0x90]
mov rdx, rax
mov qword [rsp + 0x60], rbp
mov ebp, dword [rcx + r12 + 0x50]
shr rdx, 0x20
mov qword [rsp + 0x70], rax
test edx, edx
je 0x1801d54d1
cmp edx, ebp
jae 0x1801d54d1
test eax, eax
je 0x1801d54a7
mov ecx, ebp
sub ecx, edx
cmp eax, ecx
ja 0x1801d54a7
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rdi
mov rdi, qword [0x1805985f8]
mov qword [rsp + 0x38], r14
mov r14d, eax
add r14, r12
mov qword [rsp + 0x30], r15
cmp dword [r14 + 0xc], 0
je 0x1801d540d
nop dword [rax + rax]
cmp dword [r14 + 0x10], 0
je 0x1801d540d
mov r9d, dword [r14 + 0xc]
cmp r9d, ebp
jae 0x1801d5487
lea rcx, [r12 + r9]
lea rdx, str.ntdll.dll
call qword [sym.imp.VBoxRT.dll_RTStrICmpAscii]
test eax, eax
jne 0x1801d53f7
mov r9d, dword [r14 + 0x10]
cmp r9d, ebp
jae 0x1801d544c
mov ecx, dword [r14]
cmp ecx, ebp
jae 0x1801d544c
lea rbx, [r12 + r9]
test ecx, ecx
je 0x1801d53b7
cmp ecx, r9d
je 0x1801d53b7
cmova r9d, ecx
mov esi, ebp
sub esi, r9d
shr rsi, 3
test rsi, rsi
je 0x1801d53f7
mov rdi, qword [0x1805985f8]
mov r15d, ecx
sub r15, rbx
add r15, r12
nop dword [rax]
mov r9, qword [r15 + rbx]
dec rsi
test r9, r9
je 0x1801d53fe
js 0x1801d53ac
cmp r9, rbp
jae 0x1801d5435
lea rcx, [r12 + 2]
add rcx, r9
lea rdx, str.NtDeviceIoControlFile
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
cmove rdi, rbx
mov qword [0x1805985f8], rdi
add rbx, 8
test rsi, rsi
jne 0x1801d5370
jmp 0x1801d53fe
mov ecx, ebp
sub ecx, r9d
shr rcx, 3
test rcx, rcx
je 0x1801d53f7
mov rdx, qword [0x1805985f0]
mov rdi, qword [0x1805985f8]
mov rax, qword [rbx]
dec rcx
test rax, rax
je 0x1801d53fe
cmp rax, rdx
cmove rdi, rbx
add rbx, 8
mov qword [0x1805985f8], rdi
test rcx, rcx
jne 0x1801d53d3
jmp 0x1801d53fe
mov rdi, qword [0x1805985f8]
add r14, 0x14
cmp dword [r14 + 0xc], 0
jne 0x1801d52f0
test rdi, rdi
je 0x1801d5490
mov edx, 8
mov dword [rsp + 0x70], 2
lea r9, [rsp + 0x70]
mov rcx, rdi
lea r8d, [rdx + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor eax, eax
jmp 0x1801d5461
lea r8, str.VID.DLL_bad_thunk_entry:__x
mov edx, 0xffffe56e
mov rcx, r13
call qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
jmp 0x1801d5461
lea r8, str.VID.DLL_bad_FirstThunk:__x
mov edx, 0xffffe56e
mov rcx, r13
call qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop r13
pop rbx
ret
lea r8, str.VID.DLL_bad_import_directory_entry_name:__x
jmp 0x1801d5453
lea r8, str.Failed_to_patch_NtDeviceIoControlFile_import_in_VID.DLL_
mov edx, 0xffffe56e
mov rcx, r13
call qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
jmp 0x1801d5461
mov r9d, eax
lea r8, str.VID.DLL_bad_import_directory_RVA:__x
mov edx, 0xffffe56e
mov rcx, r13
mov rbp, qword [rsp + 0x60]
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop r13
pop rbx
jmp qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
mov r9d, dword [rsp + 0x74]
lea r8, str.VID.DLL_bad_import_directory_size:__x
mov edx, 0xffffe56e
mov rcx, r13
mov rbp, qword [rsp + 0x60]
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop r13
pop rbx
jmp qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
mov dword [rsp + 0x20], ecx
lea r8, str.VID.DLL_has_invalid_PE_signaturre:__x___x
mov rcx, r13
mov edx, 0xffffe56e
call qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop r13
pop rbx
ret
mov r9d, ecx
lea r8, str.VID.DLL_mapping_doesnt_start_with_MZ_signature:__x
mov rcx, r13
mov edx, 0xffffe56e
mov r12, qword [rsp + 0x40]
add rsp, 0x48
pop r13
pop rbx
jmp qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]
lea r8, str.Failed_to_resolve_NtDeviceIoControlFile_from_NTDLL.DLL
mov edx, 0xffffe56e
mov rcx, r13
add rsp, 0x48
pop r13
pop rbx
jmp qword [sym.imp.VBoxRT.dll_RTErrInfoSetF]