Function at 0x140002220
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x14004d080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r14, rcx
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov qword [r11 - 0x78], rbx
mov qword [r11 - 0x68], rbx
cmp byte [0x14004fb08], bl
je 0x140002281
lea rcx, str.____Cannot_reinitialize_kdmapper__n
call fcn.140001178
jmp 0x1400022b5
lea rcx, [0x140002170]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.1400078e0
mov qword [0x14004fb00], rax
cmp rax, 0xffffffffffffffff
jne 0x1400022ae
lea rcx, str.Failed_to_initialize_vulnerable_driver_n
call fcn.140001178
jmp 0x1400022b5
mov byte [0x14004fb08], 1
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x14000262c
movsxd rdi, dword [r14 + 0x3c]
add rdi, r14
cmp dword [rdi], 0x4550
jne 0x14000262c
test rdi, rdi
je 0x14000262c
mov eax, 0x20b
cmp word [rdi + 0x18], ax
je 0x1400022f7
lea rcx, str.____Image_is_not_64_bit_n
jmp 0x140002633
mov r13d, dword [rdi + 0x50]
mov r9d, 4
mov r8d, 0x3000
mov edx, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x140002638
movzx eax, word [rdi + 0x14]
mov eax, dword [rax + rdi + 0x24]
mov qword [rsp + 0x40], rax
sub r13, rax
test r13, 0x1fffff
mov rsi, rbx
setne sil
mov rax, r13
shr rax, 0x16
add rsi, rax
lea r12, [rsi + 1]
shl r12, 0x15
mov r8, 0xffffffffffffffff
mov rdx, r12
call fcn.1400087b0
mov r15, rax
xor ecx, ecx
test rax, rax
je 0x1400023d2
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xa0], 0x25
mov qword [rsp + 0xb8], rax
mov dword [rsp + 0x70], ecx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
lea r8, [rsp + 0xa0]
mov edx, 0x80862007
mov rcx, qword [0x14004fb00]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
cmovne rbx, qword [rsp + 0xb0]
mov rax, rbx
and eax, 0x1fffff
mov ecx, 0x200000
sub rcx, rax
add r15, rcx
lea r8, [rcx + rbx]
mov r9, r12
mov rdx, r15
lea rcx, str.___Relocated_:_0x_llx___0x_llx___0x_llx_n
call fcn.140001178
shl esi, 0x15
mov r8d, esi
mov rdx, r15
call fcn.1400082b0
mov rbx, rax
test rax, rax
jne 0x14000241d
lea rcx, str.____Cant_allocate_mdl_n
jmp 0x140002633
mov rdx, rbx
call fcn.140008400
mov rdx, rbx
call fcn.140008520
test rax, rax
jne 0x14000243e
lea rcx, str.____Cant_set_mdl_pages_cache__cleaning_up._n
jmp 0x140002633
mov rdx, rbx
call fcn.140008680
test al, al
jne 0x140002456
lea rcx, str.____Cant_change_protection_for_mdl_pages__cleaning_up_n
jmp 0x140002633
lea rcx, str.___Changed_permissions_to_PAGE_EXECUTE_READWRITE_n
call fcn.140001178
mov qword [rsp + 0x48], r15
test r15, r15
jne 0x140002478
lea rcx, str.____Failed_to_allocate_remote_image_in_kernel_n
jmp 0x1400025d1
mov rdx, r15
lea rcx, str.___Image_base_has_been_allocated_at__p_n
call fcn.140001178
mov r8d, dword [rdi + 0x54]
mov rdx, r14
mov rcx, rbp
call fcn.14002f630
movzx ebx, word [rdi + 0x14]
add rbx, 0x24
xor eax, eax
mov esi, eax
cmp ax, word [rdi + 6]
jae 0x1400024db
add rbx, rdi
nop dword [rax + rax]
test dword [rbx + 0x18], 0x80
ja 0x1400024cd
mov ecx, dword [rbx]
add rcx, rbp
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, r14
call fcn.14002f630
inc esi
add rbx, 0x28
movzx eax, word [rdi + 6]
cmp esi, eax
jl 0x1400024b0
mov rsi, r15
mov r14, qword [rsp + 0x40]
sub r15, r14
mov edx, r14d
lea rcx, str.___Skipped_0x_x_bytes_of_PE_Header_n
call fcn.140001178
mov rbx, r15
sub rbx, qword [rdi + 0x30]
mov rdx, rbp
lea rcx, [rsp + 0x58]
call fcn.14000c450
mov rdx, rbx
mov rcx, rax
call fcn.140002670
mov rdx, rbp
lea rcx, [rsp + 0x58]
call fcn.14000c5b0
mov rcx, rax
call fcn.140002770
test al, al
jne 0x140002539
lea rcx, str.____Failed_to_resolve_imports_n
jmp 0x1400025d1
lea r8, [r14 + rbp]
mov r9, r13
mov rdx, rsi
mov rcx, qword [0x14004fb00]
call fcn.140008010
test al, al
jne 0x14000255c
lea rcx, str.____Failed_to_write_local_image_to_remote_image_n
jmp 0x1400025d1
mov ebx, dword [rdi + 0x28]
add rbx, r15
mov rdx, rbx
lea rcx, str.____Calling_DriverEntry__p_n
call fcn.140001178
xor edi, edi
mov qword [rsp + 0x20], rdi
mov r9, r13
mov r8, rsi
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x90]
call fcn.140001360
test al, al
jne 0x1400025a0
lea rcx, str.____Callback_returns_false__failed__n
jmp 0x1400025d1
mov dword [rsp + 0x70], edi
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x90]
mov r8, rbx
lea rdx, [rsp + 0x70]
call fcn.140002da0
test al, al
jne 0x1400025fa
lea rcx, str.____Failed_to_call_driver_entry_n
call fcn.140001178
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [0x14004fb00]
call fcn.140008910
jmp 0x140002638
mov edx, dword [rsp + 0x70]
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14000260a
mov dword [rax], edx
lea rcx, str.___DriverEntry_returned_0x_x_n
call fcn.140001178
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rsi
jmp 0x14000263a
lea rcx, str.____Invalid_format_of_PE_image_n
call fcn.140001178
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14000f290
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret