Function at 0x140002020
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
sub rsp, 0x78
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov ebp, dword [0x14003e330]
call fcn.1400010b0
mov r15, rax
test rax, rax
jne 0x140002056
lea rax, str.____Invalid_Library
jmp 0x140002150
mov eax, 0x5a4d
mov qword [rsp + 0x70], r14
cmp word [r15], ax
jne 0x140002342
movsxd r14, dword [r15 + 0x3c]
add r14, r15
cmp dword [r14], 0x4550
jne 0x140002342
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], r12
xor r12d, r12d
mov edi, r12d
mov esi, r12d
test esi, esi
je 0x1400020af
test edi, edi
jne 0x140002124
mov rbx, r12
mov dword [rsp + 0x40], r12d
nop word [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
lea rdx, [rsp + 0x44]
mov dword [rsp + 0x44], r12d
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x44], ebp
je 0x1400020f4
test rbx, rbx
jne 0x1400020c0
jmp 0x14000210f
lea rdx, [rsp + 0x40]
mov qword [0x14003e328], rbx
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, dword [rsp + 0x40]
mov edi, eax
test esi, esi
je 0x140002117
test edi, edi
jne 0x140002165
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400020a7
lea rax, str.Unknown_error
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov r14, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400029c0
add rsp, 0x78
pop r15
pop rbp
ret
mov dword [0x14003e340], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
lea rcx, str..SOSI4
mov edx, 0xc0000000
mov dword [0x14003e334], eax
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x14003e338], rax
cmp rax, 0xffffffffffffffff
jne 0x1400021c4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, str.____Failed_to_Load_the_Driver_
jmp 0x14000212b
mov ecx, dword [r14 + 0x50]
call fcn.140001000
mov r8, r14
mov rdx, r15
mov rcx, rax
mov rbx, rax
call fcn.140001730
test eax, eax
jne 0x140002260
mov r10, qword [0x14003e338]
cmp r10, 0xffffffffffffffff
je 0x140002254
mov eax, dword [r14 + 0x50]
lea r8, [rsp + 0x48]
mov ecx, dword [0x14003e340]
mov r9d, 0x18
mov qword [rsp + 0x38], r12
mov edx, 0x220400
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x48], ecx
mov rcx, r10
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x4c], 0x8000
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [0x14003e338]
cmp rcx, 0xffffffffffffffff
je 0x140002254
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, str.____Relocation_Failed_
jmp 0x14000212b
mov r8, r14
mov rdx, r15
mov ecx, edi
call fcn.1400018c0
test eax, eax
jne 0x1400022ec
mov rcx, qword [0x14003e338]
cmp rcx, 0xffffffffffffffff
je 0x1400022e0
mov eax, dword [0x14003e340]
lea r8, [rsp + 0x48]
mov dword [rsp + 0x48], eax
mov r9d, 0x18
mov eax, dword [r14 + 0x50]
mov edx, 0x220400
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x4c], 0x8000
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [0x14003e338]
cmp rcx, 0xffffffffffffffff
je 0x1400022e0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, str.Import_Failed_
jmp 0x14000212b
mov r8, r14
mov rdx, r15
mov rcx, rbx
call fcn.140001b10
mov r8, r14
mov rdx, rbx
mov ecx, edi
call fcn.140001450
mov rdx, r14
mov rcx, rbx
call fcn.140001c00
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [0x14003e338]
cmp rcx, 0xffffffffffffffff
je 0x140002336
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, str.___Injector:_Inject_success_
jmp 0x14000212b
lea rax, str.____Invalid_PE_Header
jmp 0x14000214b