Function at 0x14006d330
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rsi, rdx
mov rdi, rcx
xor r13d, r13d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14006d8df
movsxd r14, dword [rdx + 0x3c]
add r14, rdx
cmp dword [r14], 0x4550
jne 0x14006d8df
mov eax, 0x20b
cmp word [r14 + 0x18], ax
je 0x14006d395
lea rdx, str.____Image_is_not_64_bit
jmp 0x14006d8e6
mov ebx, dword [r14 + 0x50]
mov edx, ebx
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x14006d902
movzx eax, word [r14 + 0x14]
mov r12d, dword [rax + r14 + 0x24]
sub ebx, r12d
mov ecx, ebx
mov qword [rbp + 0x60], rcx
je 0x14006d51a
mov edx, reloc.WS2_32.dll_recv
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rdx + rax]
cmp dword [0x14020cb34], eax
jle 0x14006d4bf
lea rcx, [0x14020cb34]
call fcn.1400fd498
cmp dword [0x14020cb34], 0xffffffff
jne 0x14006d4bb
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400fd8a0
mov qword [rbp - 0x30], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_setsockopt]
movdqu xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [str.ExAllocatePoolWithTag]
movups xmmword [rax], xmm1
mov ecx, dword [0x14012ec38]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14012ec3c]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea r8, [rbp - 0x30]
mov rdx, qword [0x14020c518]
mov rcx, rdi
call fcn.140068d40
mov qword [0x14020cb98], rax
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14006d4af
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006d4a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006d4a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fd820
nop
lea rcx, [0x14020cb34]
call fcn.1400fd42c
mov rcx, qword [rbp + 0x60]
cmp qword [0x14020cb98], 0
jne 0x14006d4f8
lea rdx, str.____Failed_to_find_ExAllocatePool
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006b780
lea rdx, [0x14006b960]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
jmp 0x14006d850
mov qword [rbp + 0x58], r13
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x58]
mov rcx, rdi
call fcn.14006b9a0
test al, al
je 0x14006d51a
mov r13, qword [rbp + 0x58]
test r13, r13
jne 0x14006d526
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
jmp 0x14006d850
lea rdx, str.___Image_base_has_been_allocated_at_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006b780
mov rdx, r13
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x14006b960]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, dword [r14 + 0x54]
mov rdx, rsi
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r14 + 0x14]
add rbx, 0x24
xor eax, eax
mov edi, eax
cmp ax, word [r14 + 6]
jae 0x14006d5ac
add rbx, r14
nop dword [rax + rax]
test dword [rbx + 0x18], 0x80
ja 0x14006d59d
mov ecx, dword [rbx]
add rcx, r15
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
inc edi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp edi, eax
jl 0x14006d580
mov rbx, r13
sub rbx, r12
mov qword [rbp + 0x58], rbx
lea rdx, str.___Skipped_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006b780
lea rdx, [0x140067c40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, r12d
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._bytes_of_PE_Header
call fcn.14006b780
lea rdx, [0x14006b960]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rsi, rbx
sub rsi, qword [r14 + 0x30]
mov eax, 0x5a4d
cmp word [r15], ax
jne 0x14006d6e1
movsxd rax, dword [r15 + 0x3c]
cmp dword [rax + r15], 0x4550
jne 0x14006d6e1
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
xor edx, edx
mov r8d, edx
mov qword [rbp - 0x38], rdx
mov ecx, dword [rax + r15 + 0xb0]
test ecx, ecx
jne 0x14006d650
mov ebx, edx
jmp 0x14006d6e8
lea rbx, [r15 + rcx]
mov edi, dword [rax + r15 + 0xb4]
add rdi, rbx
cmp rbx, rdi
jae 0x14006d6d1
mov rdx, qword [rbp - 0x40]
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x14006d6ca
mov eax, dword [rbx]
add rax, r15
mov qword [rbp - 0x30], rax
lea rax, [rbx + 8]
mov qword [rbp - 0x28], rax
lea rax, [rcx - 8]
shr rax, 1
mov dword [rbp - 0x20], eax
cmp rdx, r8
je 0x14006d6aa
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdx], xmm0
movsd xmm1, qword [rbp - 0x20]
movsd qword [rdx + 0x10], xmm1
add rdx, 0x18
mov qword [rbp - 0x40], rdx
jmp 0x14006d6bf
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x48]
call fcn.14006eb70
mov r8, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rdi
jb 0x14006d668
movdqu xmm1, xmmword [rbp - 0x48]
xor edx, edx
movsd xmm0, qword [rbp - 0x38]
movsd qword [rbp - 0x20], xmm0
mov rbx, qword [rbp - 0x20]
jmp 0x14006d6e8
xorps xmm1, xmm1
xor edx, edx
mov ebx, edx
movq r10, xmm1
psrldq xmm1, 8
movq r11, xmm1
cmp r10, r11
je 0x14006d74f
lea r8, [r10 + 0x10]
mov edi, 0xfff
mov eax, edx
cmp dword [r8], 0
jbe 0x14006d742
nop dword [rax]
mov edx, eax
mov rcx, qword [r8 - 8]
movzx r9d, word [rcx + rdx*2]
movzx ecx, r9w
shr cx, 0xc
and r9w, di
cmp cx, 0xa
jne 0x14006d739
movzx edx, r9w
mov rcx, qword [r8 - 0x10]
add qword [rcx + rdx], rsi
inc eax
cmp eax, dword [r8]
jb 0x14006d710
xor edx, edx
add r8, 0x18
lea rax, [r8 - 0x10]
cmp rax, r11
jne 0x14006d705
test r10, r10
je 0x14006d7aa
sub rbx, r10
movabs rax, 0x2aaaaaaaaaaaaaab
imul rbx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r10
cmp rdx, 0x1000
jb 0x14006d7a2
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006d7a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.1400fd820
mov rdx, r15
lea rcx, [rbp - 0x30]
call fcn.14006e2a0
mov rdx, rax
mov rdi, qword [rbp + 0x48]
mov rcx, rdi
call fcn.14006d920
test al, al
jne 0x14006d7d2
lea rdx, str.____Failed_to_resolve_imports
jmp 0x14006d850
lea r8, [r15 + r12]
mov r9, qword [rbp + 0x60]
mov rdx, r13
mov rcx, rdi
call fcn.140068910
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
jne 0x14006d7f9
lea rdx, str.____Failed_to_write_local_image_to_remote_image
jmp 0x14006d857
mov ebx, dword [r14 + 0x28]
add rbx, qword [rbp + 0x58]
lea rdx, str.____Calling_DriverEntry_0x
call fcn.14006b780
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x14006b960]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov dword [rbp + 0x68], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
lea rdx, [rbp + 0x68]
mov rcx, rdi
call fcn.14006dc10
test al, al
jne 0x14006d88a
lea rdx, str.____Failed_to_call_driver_entry
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006b780
lea rdx, [0x14006b960]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, r13
mov rcx, rdi
call fcn.140068c00
jmp 0x14006d902
lea rdx, str.___DriverEntry_returned_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006b780
lea rdx, [0x140067c40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x14006b960]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r13
jmp 0x14006d904
lea rdx, str.____Invalid_format_of_PE_image
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006b780
lea rdx, [0x14006b960]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret