Function at 0x140011a60
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb0
mov rax, qword [0x14005e060]
xor rax, rsp
mov qword [rbp - 9], rax
mov rbx, rdx
mov qword [rbp - 0x59], rdx
mov rdi, rcx
mov rax, qword [rbp + 0x8f]
mov qword [rbp - 0x31], rax
xor r14d, r14d
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x29], r14
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140012026
movsxd rsi, dword [rdx + 0x3c]
add rsi, rdx
cmp dword [rsi], 0x4550
jne 0x140012026
mov eax, 0x20b
cmp word [rsi + 0x18], ax
je 0x140011ae2
lea rdx, str.____Image_is_not_64_bit
jmp 0x14001202d
mov r13d, dword [rsi + 0x50]
mov edx, r13d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x140012041
movzx eax, word [rsi + 0x14]
mov eax, dword [rax + rsi + 0x24]
mov dword [rbp - 0x79], eax
sub r13d, eax
mov r12, r14
mov qword [rbp - 0x61], r14
mov eax, dword [rbp + 0x77]
cmp eax, 1
jne 0x140011b43
mov edx, r13d
lea r8, [rbp - 0x61]
mov rcx, rdi
call fcn.1400113a0
mov r14, rax
mov qword [rbp - 0x71], rax
mov r12, qword [rbp - 0x61]
jmp 0x140011ca9
cmp eax, 2
jne 0x140011b5f
mov edx, r13d
mov rcx, rdi
call fcn.140011870
mov r14, rax
mov qword [rbp - 0x71], rax
jmp 0x140011ca9
mov r14d, r13d
test r13d, r13d
je 0x140011c55
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140061138], eax
jle 0x140011c30
lea rcx, [0x140061138]
call fcn.140018800
cmp dword [0x140061138], 0xffffffff
jne 0x140011c30
xor eax, eax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], 0xf
mov byte [rbp - 0x51], al
lea r8d, [rax + 0x15]
lea rdx, [0x14004c750]
lea rcx, [rbp - 0x51]
call fcn.1400099c0
nop
lea r8, [rbp - 0x51]
mov rdx, qword [0x1400610a8]
mov rcx, rdi
call fcn.1400045e0
mov qword [0x140061230], rax
mov rdx, qword [rbp - 0x39]
cmp rdx, 0x10
jb 0x140011c24
inc rdx
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011c1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001206a
call fcn.140018670
nop
lea rcx, [0x140061138]
call fcn.1400187a0
cmp qword [0x140061230], 0
jne 0x140011c86
lea rdx, str.____Failed_to_find_ExAllocatePool
lea rcx, [0x14005f750]
call fcn.14000af50
mov rcx, rax
call fcn.14000b1e0
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
lea rcx, [0x14005f750]
call fcn.14000af50
mov rcx, rax
call fcn.14000b1e0
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140012041
xor eax, eax
mov qword [rbp - 0x69], rax
mov qword [rsp + 0x20], r14
lea rdx, [rbp - 0x69]
mov rcx, rdi
call fcn.14000cbe0
test al, al
je 0x140011c55
mov r14, qword [rbp - 0x69]
mov qword [rbp - 0x71], r14
mov qword [rbp - 0x69], r14
test r14, r14
je 0x140011c55
lea rdx, str.___Image_base_has_been_allocated_at_0x
lea rcx, [0x14005f750]
call fcn.14000af50
mov rdx, r14
mov rcx, rax
call fcn.140007aa0
mov rcx, rax
call fcn.14000b1e0
mov r8d, dword [rsi + 0x54]
mov rdx, rbx
mov rcx, r15
call fcn.14001a960
movzx ebx, word [rsi + 0x14]
add rbx, 0x28
xor eax, eax
mov r14d, eax
cmp ax, word [rsi + 6]
jae 0x140011d32
add rbx, rsi
mov r12, qword [rbp - 0x59]
test dword [rbx + 0x14], 0x80
ja 0x140011d1e
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, r12
mov ecx, dword [rbx - 4]
add rcx, r15
call fcn.14001a960
inc r14d
add rbx, 0x28
movzx eax, word [rsi + 6]
cmp r14d, eax
jl 0x140011d01
mov r12, qword [rbp - 0x61]
mov rcx, qword [rbp - 0x71]
mov r14, rcx
mov eax, dword [rbp - 0x79]
sub rcx, rax
mov qword [rbp - 0x71], rcx
lea rdx, str.___Skipped_0x
lea rcx, [0x14005f750]
call fcn.14000af50
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140002710
mov edx, dword [rbp - 0x79]
mov rcx, rbx
call fcn.140010dd0
mov rcx, rax
lea rdx, str._bytes_of_PE_Header
call fcn.14000af50
mov rcx, rax
call fcn.14000b1e0
mov rbx, qword [rbp - 0x71]
sub rbx, qword [rsi + 0x30]
mov rdx, r15
lea rcx, [rbp - 0x51]
call fcn.140013390
mov rdx, rbx
mov rcx, rax
call 0x140012070
mov rbx, qword [rbp - 0x71]
mov rdx, rbx
mov rcx, r15
call fcn.140012170
test al, al
jne 0x140011dc8
lea rdx, str.____Failed_to_fix_cookie
jmp 0x14001202d
mov rdx, r15
lea rcx, [rbp - 0x51]
call fcn.1400134e0
mov rdx, rax
mov rcx, rdi
call fcn.1400122a0
test al, al
jne 0x140011def
lea rdx, str.____Failed_to_resolve_imports
jmp 0x140011e9c
mov r9d, r13d
mov r8d, dword [rbp - 0x79]
add r8, r15
mov rdx, r14
mov rcx, rdi
call fcn.140003e90
test al, al
jne 0x140011e14
lea rdx, str.____Failed_to_write_local_image_to_remote_image
jmp 0x140011e9c
mov esi, dword [rsi + 0x28]
add rsi, rbx
lea rdx, str.____Calling_DriverEntry_0x
lea rcx, [0x14005f750]
call fcn.14000af50
mov rdx, rsi
mov rcx, rax
call fcn.140007aa0
mov rcx, rax
call fcn.14000b1e0
mov qword [rsp + 0x20], r12
mov r9d, r13d
mov r8, r14
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x29]
call fcn.140010250
test al, al
jne 0x140011e65
lea rdx, str.____Callback_returns_false__failed_
jmp 0x140011e9c
xor eax, eax
mov dword [rbp - 0x79], eax
mov r9, qword [rbp - 0x29]
cmp byte [rbp + 0x7f], al
cmovne r9, r14
mov rax, qword [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r8, rsi
lea rdx, [rbp - 0x79]
mov rcx, rdi
call fcn.140012830
test al, al
jne 0x140011f3e
lea rdx, str.____Failed_to_call_driver_entry
lea rcx, [0x14005f750]
call fcn.14000af50
mov rcx, rax
call fcn.14000b1e0
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rdx, str.___Freeing_memory
lea rcx, [0x14005f750]
call fcn.14000af50
mov rcx, rax
call fcn.14000b1e0
mov eax, dword [rbp + 0x77]
mov rdx, qword [rbp - 0x69]
cmp eax, 1
jne 0x140011f2c
mov r8, r12
mov rcx, rdi
call fcn.140004240
test al, al
je 0x140011f20
mov rdx, r12
mov rcx, rdi
call fcn.140004370
test al, al
je 0x140011f20
mov rdx, r12
mov rcx, rdi
call fcn.1400044a0
test al, al
lea rdx, str.___Memory_has_been_released
jne 0x14001202d
lea rdx, str.____WARNING:_Failed_to_free_memory_
jmp 0x14001202d
cmp eax, 2
jne 0x140011f09
mov r8d, r13d
mov rcx, rdi
call fcn.140004160
jmp 0x140011f11
mov esi, dword [rbp - 0x79]
mov rax, qword [rbp - 0x31]
test rax, rax
je 0x140011f4c
mov dword [rax], esi
lea rdx, str.___DriverEntry_returned_0x
lea rcx, [0x14005f750]
call fcn.14000af50
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call fcn.140002710
mov edx, esi
mov rcx, rbx
call fcn.140012630
mov rcx, rax
call fcn.14000b1e0
cmp byte [rbp + 0x67], 0
je 0x140011ffe
lea rdx, str.___Freeing_memory
lea rcx, [0x14005f750]
call fcn.14000af50
mov rcx, rax
call fcn.14000b1e0
mov eax, dword [rbp + 0x77]
mov rdx, r14
cmp eax, 1
jne 0x140012014
mov r8, r12
mov rcx, rdi
call fcn.140004240
test al, al
je 0x140011fe3
mov rdx, r12
mov rcx, rdi
call fcn.140004370
test al, al
je 0x140011fe3
mov rdx, r12
mov rcx, rdi
call fcn.1400044a0
test al, al
lea rdx, str.___Memory_has_been_released
jne 0x140011fea
lea rdx, str.____WARNING:_Failed_to_free_memory_
lea rcx, [0x14005f750]
call fcn.14000af50
mov rcx, rax
call fcn.14000b1e0
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r14
jmp 0x140012043
cmp eax, 2
jne 0x140011fd0
mov r8d, r13d
mov rcx, rdi
call fcn.140004160
jmp 0x140011fd8
lea rdx, str.____Invalid_format_of_PE_image
lea rcx, [0x14005f750]
call fcn.14000af50
mov rcx, rax
call fcn.14000b1e0
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140018650
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140022050
nop
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov r11, qword [rbx + 8]
cmp rcx, r11
je 0x1400120f2
mov qword [rsp + 0x38], rsi
mov esi, 0xa000
mov qword [rsp + 0x40], rdi
mov edi, 0xf000
nop dword [rax]
xor r8d, r8d
cmp dword [rcx + 0x10], r8d
jbe 0x1400120dc
nop dword [rax]
mov rax, qword [rcx + 8]
movzx r9d, word [rax + r8*2]
movzx eax, r9w
and ax, di
cmp ax, si
jne 0x1400120d3
mov rax, qword [rcx]
and r9d, 0xfff
add qword [r9 + rax], rdx
inc r8d
cmp r8d, dword [rcx + 0x10]
jb 0x1400120b0
add rcx, 0x18
cmp rcx, r11
jne 0x1400120a0
mov rcx, qword [rbx]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
test rcx, rcx
je 0x14001215e
mov rdx, qword [rbx + 0x10]
movabs rax, 0x2aaaaaaaaaaaaaab
sub rdx, rcx
imul rdx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
cmp rdx, 0x1000
jb 0x140012142
mov rax, qword [rcx - 8]
add rdx, 0x27
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x140012164
mov rcx, rax
call fcn.140018670
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
add rsp, 0x20
pop rbx
ret
call fcn.140022050
int3