Function at 0x1400bc570
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov rbx, rdx
mov r14, rcx
xor r12d, r12d
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400bcbf0
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x1400bcbf0
test rdi, rdi
je 0x1400bcbf0
mov eax, 0x20b
cmp word [rdi + 0x18], ax
je 0x1400bc5e9
lea rdx, str.____Image_is_not_64_bit
jmp 0x1400bcbf7
mov esi, dword [rdi + 0x50]
mov edx, esi
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x1400bcc13
movzx eax, word [rdi + 0x14]
mov eax, dword [rax + rdi + 0x24]
mov dword [rbp + 0x68], eax
sub esi, eax
mov dword [rbp + 0x70], esi
mov r13d, esi
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x60], r12
mov ecx, 4
mov eax, dword [rbp + 0x78]
cmp eax, 1
jne 0x1400bc650
lea r8, [rbp + 0x60]
mov edx, r13d
mov rcx, r14
call fcn.1400bbe20
mov r12, rax
jmp 0x1400bc7a8
cmp eax, 2
jne 0x1400bc667
mov edx, esi
mov rcx, r14
call fcn.1400bc360
mov r12, rax
jmp 0x1400bc7a8
test esi, esi
je 0x1400bc7a8
mov edx, ecx
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401ee440], eax
jle 0x1400bc755
lea rcx, [0x1401ee440]
call fcn.1400bed68
cmp dword [0x1401ee440], 0xffffffff
jne 0x1400bc755
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
mov ecx, 0x20
call fcn.1400bede0
mov qword [rbp - 0x28], rax
movdqa xmm0, xmmword [0x1400eae50]
movdqu xmmword [rbp - 0x18], xmm0
movups xmm0, xmmword [str.ExAllocatePoolWithTag]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400e8920]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1400e8924]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea r8, [rbp - 0x28]
mov rdx, qword [0x1401c8498]
mov rcx, r14
call fcn.1400b6e50
mov qword [0x1401ee528], rax
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400bc749
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400bc743
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400bc743
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bf12c
nop
lea rcx, [0x1401ee440]
call fcn.1400becfc
cmp qword [0x1401ee528], 0
jne 0x1400bc784
lea rdx, str.____Failed_to_find_ExAllocatePool
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14009a940
lea rdx, [0x14009ab10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x1400bc7a8
mov qword [rbp + 0x58], r12
mov qword [rsp + 0x20], r13
lea rdx, [rbp + 0x58]
mov rcx, r14
call fcn.1400bab60
mov r12, qword [rbp + 0x58]
test al, al
mov eax, 0
cmove r12, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test r12, r12
jne 0x1400bc7e6
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
call fcn.14009a940
lea rdx, [0x14009ab10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400bcc13
lea rdx, str.___Image_base_has_been_allocated_at_0x
call fcn.14009a940
mov rdx, r12
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x14009ab10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, dword [rdi + 0x54]
mov rdx, rbx
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rdi + 0x14]
add rbx, 0x24
xor ecx, ecx
mov esi, ecx
cmp cx, word [rdi + 6]
jae 0x1400bc86c
add rbx, rdi
mov r13, qword [rbp + 0x50]
test dword [rbx + 0x18], 0x80
ja 0x1400bc853
mov ecx, dword [rbx]
add rcx, r15
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, r13
call sub.VCRUNTIME140.dll_memcpy
inc esi
add rbx, 0x28
movzx eax, word [rdi + 6]
cmp esi, eax
jl 0x1400bc836
mov r13d, dword [rbp + 0x88]
mov r14, qword [rbp + 0x48]
mov rsi, r12
mov ebx, dword [rbp + 0x68]
sub r12, rbx
lea rdx, str.___Skipped_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14009a940
lea rdx, [0x140068c50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._bytes_of_PE_Header
call fcn.14009a940
lea rdx, [0x14009ab10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rbx, r12
sub rbx, qword [rdi + 0x30]
mov rdx, r15
lea rcx, [rbp - 0x28]
call fcn.1400bd5b0
mov rdx, rbx
mov rcx, rax
call fcn.1400bcc30
mov rdx, r12
mov rcx, r15
call fcn.1400bcd30
test al, al
jne 0x1400bc8fb
lea rdx, str.____Failed_to_fix_cookie
jmp 0x1400bcbf7
mov rdx, r15
lea rcx, [rbp - 0x28]
call fcn.1400bd6e0
mov rdx, rax
mov rcx, r14
call fcn.1400bce90
test al, al
jne 0x1400bc942
lea rdx, str.____Failed_to_resolve_imports
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14009a940
lea rdx, [0x14009ab10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rbx, qword [rbp + 0x60]
jmp 0x1400bca0e
mov r8d, dword [rbp + 0x68]
add r8, r15
mov r9, r13
mov rdx, rsi
mov rcx, r14
call fcn.1400b6670
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
jne 0x1400bc96b
lea rdx, str.____Failed_to_write_local_image_to_remote_image
jmp 0x1400bc924
mov edi, dword [rdi + 0x28]
add rdi, r12
lea rdx, str.____Calling_DriverEntry_0x
call fcn.14009a940
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x14009ab10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rbx, qword [rbp + 0x60]
mov qword [rsp + 0x20], rbx
mov r9, r13
mov r8, rsi
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x30]
call fcn.14008d940
test al, al
jne 0x1400bc9c2
lea rdx, str.____Callback_returns_false__failed_
jmp 0x1400bc9f2
xor eax, eax
mov dword [rbp + 0x68], eax
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x30]
mov r8, rdi
lea rdx, [rbp + 0x68]
mov rcx, r14
call fcn.1400bd190
test al, al
jne 0x1400bcb8b
lea rdx, str.____Failed_to_call_driver_entry
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14009a940
lea rdx, [0x14009ab10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rdx, str.___Freeing_memory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14009a940
lea rdx, [0x14009ab10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, dword [rbp + 0x78]
mov rdx, rsi
mov rcx, r14
cmp eax, 1
jne 0x1400bcb62
mov r8, rbx
call fcn.1400b6a50
test al, al
je 0x1400bcb82
mov rdx, rbx
mov rcx, r14
call fcn.1400b6bc0
test al, al
je 0x1400bcb82
test rbx, rbx
jne 0x1400bca83
xor al, al
jmp 0x1400bcb77
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401ee4d8], eax
jle 0x1400bcb22
lea rcx, [0x1401ee4d8]
call fcn.1400bed68
cmp dword [0x1401ee4d8], 0xffffffff
jne 0x1400bcb22
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movdqa xmm1, xmmword [0x1400eada0]
movdqu xmmword [rbp - 0x18], xmm1
movsd xmm0, qword [str.ExFreePool]
movsd qword [rbp - 0x28], xmm0
movzx eax, word [0x1400e8980]
mov word [rbp - 0x20], ax
mov byte [rbp - 0x1e], 0
lea r8, [rbp - 0x28]
mov rdx, qword [0x1401c8498]
mov rcx, r14
call fcn.1400b6e50
mov qword [0x1401ee488], rax
mov r8, qword [rbp - 0x10]
cmp r8, 0xf
jbe 0x1400bcb16
mov rdx, qword [rbp - 0x28]
call fcn.140060480
nop
lea rcx, [0x1401ee4d8]
call fcn.1400becfc
mov r8, qword [0x1401ee488]
test r8, r8
jne 0x1400bcb55
lea rdx, str.____Failed_to_find_ExAllocatePool
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14009a940
lea rdx, [0x14009ab10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x1400bcb77
mov r9, rbx
mov rcx, r14
call fcn.1400b9510
jmp 0x1400bcb77
cmp eax, 2
jne 0x1400bcb72
mov r8d, dword [rbp + 0x70]
call fcn.1400b6960
jmp 0x1400bcb77
call fcn.1400b6d10
test al, al
lea rdx, str.___Memory_has_been_released
jne 0x1400bcbf7
lea rdx, str.____WARNING:_Failed_to_free_memory_
jmp 0x1400bcbf7
mov ebx, dword [rbp + 0x68]
mov rax, qword [rbp + 0x90]
test rax, rax
je 0x1400bcb9c
mov dword [rax], ebx
lea rdx, str.___DriverEntry_returned_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14009a940
lea rdx, [0x140068c50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x14009ab10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rsi
jmp 0x1400bcc15
lea rdx, str.____Invalid_format_of_PE_image
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14009a940
lea rdx, [0x14009ab10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret