Function at 0x1400091b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x78], r8
mov r13, rdx
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x80], rax
mov rdi, qword [0x1400a1aa8]
mov qword [rsp + 0x48], rdi
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14000979f
movsxd rsi, dword [rdx + 0x3c]
add rsi, rdx
cmp dword [rsi], 0x4550
jne 0x14000979f
test rsi, rsi
je 0x14000979f
mov eax, 0x20b
cmp word [rsi + 0x18], ax
je 0x14000922c
lea rdx, str.__Saturn__Image_is_not_64_bit
jmp 0x1400097a6
mov ebp, dword [rsi + 0x50]
mov edx, ebp
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x1400097c2
movzx eax, word [rsi + 0x14]
mov eax, dword [rax + rsi + 0x24]
mov dword [rsp + 0x30], eax
sub ebp, eax
mov dword [rsp + 0x40], ebp
mov ebx, ebp
mov qword [rsp + 0x70], rbx
xor r8d, r8d
mov r12d, r8d
mov qword [rsp + 0x38], r8
mov eax, dword [rsp + 0x100]
cmp eax, 1
jne 0x14000929d
lea r8, [rsp + 0x38]
mov edx, ebx
mov rcx, rdi
call fcn.140008ae0
mov r15, rax
mov r12, qword [rsp + 0x38]
jmp 0x1400093e9
cmp eax, 2
jne 0x1400092b4
mov edx, ebp
mov rcx, rdi
call fcn.140008fa0
mov r15, rax
jmp 0x1400093e9
test ebp, ebp
jne 0x1400092c0
mov r15, r8
jmp 0x1400093e9
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400e5e60], eax
jle 0x1400093b3
lea rcx, [0x1400e5e60]
call fcn.140072380
cmp dword [0x1400e5e60], 0xffffffff
jne 0x1400093b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400723f8
mov qword [rsp + 0x50], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_setsockopt]
movdqu xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [0x140084708]
movups xmmword [rax], xmm0
mov ecx, dword [0x140084718]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14008471c]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea r8, [rsp + 0x50]
mov rdx, qword [0x1400e5b78]
mov rcx, rdi
call fcn.140003440
mov qword [0x1400e5f48], rax
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400093a4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000939e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000939e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400722d0
nop
lea rcx, [0x1400e5e60]
call fcn.140072314
xor r8d, r8d
cmp qword [0x1400e5f48], 0
jne 0x1400093c2
mov r15, r8
jmp 0x1400093e9
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140007800
mov r15, qword [rsp + 0x38]
test al, al
mov eax, 0
cmove r15, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test r15, r15
jne 0x140009427
lea rdx, str.__Saturn__Failed_to_allocate_remote_image_in_kernel
call fcn.1400061d0
mov rcx, rax
lea rdx, [0x1400063b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400097c2
lea rdx, str.__Saturn__Image_base_has_been_allocated_at_0x
call fcn.1400061d0
mov rcx, rax
mov rdx, r15
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400063b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, dword [rsi + 0x54]
mov rdx, r13
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [rsi + 0x14]
add rcx, 0x28
xor edx, edx
mov ebp, edx
cmp dx, word [rsi + 6]
jae 0x1400094a8
lea rbx, [rcx + rsi]
test dword [rbx + 0x14], 0x80
ja 0x140009491
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, r13
mov ecx, dword [rbx - 4]
add rcx, r14
call sub.VCRUNTIME140.dll_memcpy
inc ebp
add rbx, 0x28
movzx eax, word [rsi + 6]
cmp ebp, eax
jl 0x140009474
mov ebx, dword [rsp + 0x70]
mov rdi, qword [rsp + 0x48]
mov rbp, r15
mov r13d, dword [rsp + 0x30]
sub r15, r13
lea rdx, str.__Saturn__Skipped_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400061d0
mov rcx, rax
lea rdx, [0x140008ac0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, dword [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._bytes_of_PE_Header
call fcn.1400061d0
mov rcx, rax
lea rdx, [0x1400063b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14000a6e0
mov rdx, r15
sub rdx, qword [rsi + 0x30]
mov rcx, rax
call fcn.1400097e0
mov rdx, r15
mov rcx, r14
call fcn.1400098e0
test al, al
jne 0x140009539
lea rdx, str.__Saturn__Failed_to_fix_cookie
jmp 0x1400097a6
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14000a840
mov rdx, rax
mov rcx, rdi
call fcn.140009a40
test al, al
jne 0x140009561
lea rdx, str.__Saturn__Failed_to_resolve_imports
jmp 0x1400095e4
lea r8, [r14 + r13]
mov r9, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.140002d90
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
jne 0x140009587
lea rdx, str.__Saturn__Failed_to_write_local_image_to_remote_image
jmp 0x1400095eb
mov ebx, dword [rsi + 0x28]
add rbx, r15
lea rdx, str.__Saturn__Calling_DriverEntry_0x
call fcn.1400061d0
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x1400063b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x78]
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140009e10
test al, al
jne 0x14000969b
lea rdx, str.__Saturn__Failed_to_call_driver_entry
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400061d0
lea rdx, [0x1400063b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rdx, str.__Saturn__Freeing_memory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400061d0
mov rcx, rax
lea rdx, [0x1400063b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, dword [rsp + 0x100]
mov rdx, rbp
cmp eax, 1
jne 0x140009687
mov r8, r12
mov rcx, rdi
call fcn.1400030c0
test al, al
je 0x14000967b
mov rdx, r12
mov rcx, rdi
call fcn.1400031f0
test al, al
je 0x14000967b
mov rdx, r12
mov rcx, rdi
call fcn.140003320
test al, al
lea rdx, str.__Saturn__Memory_has_been_released
jne 0x1400097a6
lea rdx, str.__Saturn__WARNING:_Failed_to_free_memory_
jmp 0x1400097a6
cmp eax, 2
jne 0x140009664
mov r8d, dword [rsp + 0x40]
mov rcx, rdi
call fcn.140002fd0
jmp 0x14000966c
mov ebx, dword [rsp + 0x30]
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x1400096ae
mov dword [rax], ebx
lea rdx, str.__Saturn__DriverEntry_returned_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400061d0
mov rcx, rax
lea rdx, [0x140008ac0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400063b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.__Saturn__Freeing_memory
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400061d0
mov rcx, rax
lea rdx, [0x1400063b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, dword [rsp + 0x100]
mov rdx, rbp
cmp eax, 1
jne 0x14000978b
mov r8, r12
mov rcx, rdi
call fcn.1400030c0
test al, al
je 0x140009752
mov rdx, r12
mov rcx, rdi
call fcn.1400031f0
test al, al
je 0x140009752
mov rdx, r12
mov rcx, rdi
call fcn.140003320
test al, al
lea rdx, str.__Saturn__Memory_has_been_released
jne 0x140009759
lea rdx, str.__Saturn__WARNING:_Failed_to_free_memory_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400061d0
lea rdx, [0x1400063b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbp
jmp 0x1400097c4
cmp eax, 2
jne 0x14000973f
mov r8d, dword [rsp + 0x40]
mov rcx, rdi
call fcn.140002fd0
jmp 0x140009747
lea rdx, str.__Saturn__Invalid_format_of_PE_image
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400061d0
lea rdx, [0x1400063b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret