Function at 0x140009200
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push r12
push r14
sub rsp, 0x50
mov qword [rax + 0x10], rdi
mov esi, ecx
mov qword [rax + 0x18], r13
lea rcx, [0x140009120]
mov qword [rax + 0x20], r15
mov r13, rdx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov ebp, 1
lea rdi, [r13 + 8]
mov r15d, ebp
cmp esi, ebp
jle 0x1400092d9
mov rbx, rdi
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009250
cmp rax, 5
jne 0x140009282
add rcx, 2
lea rdx, [0x14001b6a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140009282
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x140009605
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009290
cmp rax, 6
jne 0x1400092c9
add rcx, 4
lea rdx, [0x14001b6a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400092c9
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x1400092c9
cmp word [rax + 2], 0x2d
je 0x140009605
inc r15d
add rbx, 8
cmp r15d, esi
jl 0x140009243
xor r12b, r12b
mov r14d, ebp
mov r15d, 0xffffffff
cmp esi, ebp
jle 0x140009385
nop dword [rax]
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009300
cmp rax, 4
jne 0x14000932e
add rcx, 2
lea rdx, [0x14001b6b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000932e
mov rax, qword [rdi]
cmp word [rax], 0x2f
je 0x140009393
mov rcx, qword [rdi]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009340
cmp rax, 5
jne 0x140009375
add rcx, 4
lea rdx, [0x14001b6b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140009375
mov rax, qword [rdi]
cmp word [rax], 0x2d
jne 0x140009375
cmp word [rax + 2], 0x2d
je 0x140009393
inc r14d
add rdi, 8
cmp r14d, esi
jl 0x1400092f0
mov r14d, 0xffffffff
cmp esi, ebp
jle 0x140009437
lea rbx, [r13 + 8]
nop word [rax + rax]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400093b0
cmp rax, 9
jne 0x1400093e2
add rcx, 2
lea rdx, str.indPages
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400093e2
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x140009614
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400093f0
cmp rax, 0xa
jne 0x140009429
add rcx, 4
lea rdx, str.indPages
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140009429
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x140009429
cmp word [rax + 2], 0x2d
je 0x140009614
inc ebp
add rbx, 8
cmp ebp, esi
jl 0x1400093a0
mov edi, 1
lea ebp, [rdi - 2]
cmp esi, edi
jle 0x1400094e3
lea rbx, [r13 + 8]
nop dword [rax + rax]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009460
cmp rax, 0x12
jne 0x14000948e
add rcx, 2
lea rdx, str.PassAllocationPtr
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14000948e
mov rax, qword [rbx]
cmp word [rax], 0x2f
je 0x1400094e8
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400094a0
cmp rax, 0x13
jne 0x1400094d5
add rcx, 4
lea rdx, str.PassAllocationPtr
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400094d5
mov rax, qword [rbx]
cmp word [rax], 0x2d
jne 0x1400094d5
cmp word [rax + 2], 0x2d
je 0x1400094e8
inc edi
add rbx, 8
cmp edi, esi
jl 0x140009450
mov edi, 0xffffffff
mov r13, qword [rsp + 0x90]
test edi, edi
setg sil
test r15d, r15d
mov r15, qword [rsp + 0x98]
jle 0x140009526
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Free_pool_memory_after_usage_enabled
call fcn.140006450
lea rdx, [0x140006630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test r14d, r14d
jle 0x14000954e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Mdl_memory_usage_enabled
call fcn.140006450
lea rdx, [0x140006630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test ebp, ebp
jle 0x140009575
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Allocate_Independent_Pages_mode_enabled
call fcn.140006450
lea rdx, [0x140006630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
test edi, edi
mov rdi, qword [rsp + 0x88]
jle 0x1400095a4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Pass_Allocation_Ptr_as_first_param_enabled
call fcn.140006450
lea rdx, [0x140006630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call fcn.140001850
mov qword [0x140021a00], rax
cmp rax, 0xffffffffffffffff
je 0x1400095f4
xor ecx, ecx
mov edx, 0x1800
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x14000961e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_allocate_memory_n
call fcn.140006450
mov rcx, qword [0x140021a00]
call fcn.140002480
mov eax, 0xffffffff
add rsp, 0x50
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret
test r15d, r15d
mov r14d, ebp
setg r12b
jmp 0x1400092f0
mov edi, 1
jmp 0x140009447
mov r8d, 0x1800
lea rdx, [0x140019df0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
test r14d, r14d
jle 0x140009694
test ebp, ebp
jle 0x14000968d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Too_many_allocation_modes
call fcn.140006450
lea rdx, [0x140006630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [0x140021a00]
call fcn.140002480
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 0xffffffff
add rsp, 0x50
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
jmp 0x1400096a0
xor eax, eax
mov ecx, 2
test ebp, ebp
cmovg eax, ecx
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x80], 0
mov qword [rsp + 0x48], rcx
mov rdx, rbx
mov byte [rsp + 0x38], sil
mov dword [rsp + 0x30], eax
mov byte [rsp + 0x20], r12b
call fcn.140009ef0
test rax, rax
jne 0x1400096eb
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_map_driver_n
call fcn.140006450
jmp 0x14000965f
mov rcx, qword [0x140021a00]
call fcn.140002480
test al, al
jne 0x14000971e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Warning_failed_to_fully_unload_vulnerable_driver
call fcn.140006450
lea rdx, [0x140006630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___success
call fcn.140006450
lea rdx, [0x140006630]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov ecx, 0x2328
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
add rsp, 0x50
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret