Function at 0x14000d180
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x320]
sub rsp, 0x420
mov rax, qword [0x140055080]
xor rax, rsp
mov qword [rbp + 0x310], rax
mov rsi, r8
mov qword [rsp + 0x40], r8
mov rdi, rdx
mov qword [rsp + 0x38], rdx
xor r14d, r14d
mov r13d, r14d
mov dword [rsp + 0x34], r14d
test rdx, rdx
jne 0x14000d1e6
lea r8, str.You_need_to_pass_a_valid_process_object_for_import_mapping_
lea edx, [rdi + 3]
call fcn.140006060
xor al, al
jmp 0x14000dbc5
mov eax, dword [rdx]
mov dword [rbp + 0x28], eax
mov qword [rbp + 0x30], r14
mov dword [rsp + 0x28], 0x10
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [rbp + 0x28]
mov edx, 0x222054
mov rcx, qword [0x140057cd0]
call fcn.140002880
test al, al
jne 0x14000d232
lea r8, str.Failed_to_get_base_address_
mov edx, 3
call fcn.140006060
jmp 0x14000d23b
mov r12, qword [rbp + 0x30]
test r12, r12
jne 0x14000d253
lea r8, str.Failed_to_get_process_base_address_for_import_mapping_
mov edx, 3
call fcn.140006060
xor al, al
jmp 0x14000dbc5
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
mov eax, dword [rdi]
mov dword [rbp - 0x70], eax
mov qword [rbp - 0x68], r12
lea rax, [rbp + 0xc0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x40
mov dword [rsp + 0x28], 0x20
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp - 0x70]
mov edx, 0x22200c
mov rcx, qword [0x140057cd0]
call fcn.140002880
test al, al
jne 0x14000d2c7
lea r8, str.Failed_to_read_memory___Ioctl_failed_
jmp 0x14000d2d4
cmp qword [rbp - 0x58], r13
jne 0x14000d2de
lea r8, str.Failed_to_read_memory___Partial_read_
mov edx, 3
call fcn.140006060
mov eax, 0x5a4d
cmp word [rbp + 0xc0], ax
jne 0x14000dbfb
movsxd rbx, dword [rbp + 0xfc]
add rbx, r12
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x100]
call fcn.14003f900
mov eax, dword [rdi]
mov dword [rbp - 0x30], eax
mov qword [rbp - 0x28], rbx
lea rax, [rbp + 0x100]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], pe_nt_image_headers64
mov dword [rsp + 0x28], 0x20
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp - 0x30]
mov edx, 0x22200c
mov rcx, qword [0x140057cd0]
call fcn.140002880
test al, al
jne 0x14000d363
lea r8, str.Failed_to_read_memory___Ioctl_failed_
jmp 0x14000d370
cmp qword [rbp - 0x18], r13
jne 0x14000d37a
lea r8, str.Failed_to_read_memory___Partial_read_
mov edx, 3
call fcn.140006060
cmp dword [rbp + 0x100], 0x4550
jne 0x14000dc14
mov ecx, dword [rbp + 0x190]
add rcx, r12
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x20], eax
mov eax, dword [rdi]
mov dword [rbp + 0x68], eax
mov qword [rbp + 0x70], rcx
lea rax, [rbp + 0x10]
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x80], 0x14
mov dword [rsp + 0x28], 0x20
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp + 0x68]
mov edx, 0x22200c
mov rcx, qword [0x140057cd0]
call fcn.140002880
test al, al
jne 0x14000d3f4
lea r8, str.Failed_to_read_memory___Ioctl_failed_
jmp 0x14000d404
cmp qword [rbp + 0x80], r13
jne 0x14000d40e
lea r8, str.Failed_to_read_memory___Partial_read_
mov edx, 3
call fcn.140006060
cmp dword [rbp + 0x1c], r13d
je 0x14000dc2d
mov dword [rsp + 0x34], r14d
movabs r15, 0xcccccccccccccccd
mov ecx, dword [rbp + 0x20]
nop word [rax + rax]
add rcx, r12
mov qword [rbp + 0xb0], r14
mov eax, dword [rdi]
mov dword [rbp - 0x70], eax
mov qword [rbp - 0x68], rcx
lea rax, [rbp + 0xb0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 8
mov dword [rsp + 0x28], 0x20
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp - 0x70]
mov edx, 0x22200c
mov rcx, qword [0x140057cd0]
call fcn.140002880
test al, al
jne 0x14000d48f
lea r8, str.Failed_to_read_memory___Ioctl_failed_
jmp 0x14000d49d
cmp qword [rbp - 0x58], 0
jne 0x14000d4a7
lea r8, str.Failed_to_read_memory___Partial_read_
mov edx, 3
call fcn.140006060
mov ecx, dword [rbp + 0x10]
add rcx, r12
mov qword [rbp + 0xa8], r14
mov eax, dword [rdi]
mov dword [rbp + 0x88], eax
mov qword [rbp + 0x90], rcx
lea rax, [rbp + 0xa8]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], 8
mov dword [rsp + 0x28], 0x20
lea rax, [rbp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp + 0x88]
mov edx, 0x22200c
mov rcx, qword [0x140057cd0]
call fcn.140002880
test al, al
jne 0x14000d51b
lea r8, str.Failed_to_read_memory___Ioctl_failed_
jmp 0x14000d52c
cmp qword [rbp + 0xa0], 0
jne 0x14000d536
lea r8, str.Failed_to_read_memory___Partial_read_
mov edx, 3
call fcn.140006060
mov ebx, r14d
mov dword [rsp + 0x30], ebx
mov rax, qword [rbp + 0xa8]
test rax, rax
je 0x14000db05
nop dword [rax]
lea rcx, [r12 + 2]
add rcx, rax
mov eax, dword [rdi]
mov dword [rbp - 0x50], eax
mov qword [rbp - 0x48], rcx
lea rax, [rbp + 0x210]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0x100
mov dword [rsp + 0x28], 0x20
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp - 0x50]
mov edx, 0x22200c
mov rcx, qword [0x140057cd0]
call fcn.140002880
test al, al
jne 0x14000d5ad
lea r8, str.Failed_to_read_memory___Ioctl_failed_
jmp 0x14000d5be
cmp qword [rbp - 0x38], 0x100
je 0x14000d5c8
lea r8, str.Failed_to_read_memory___Partial_read_
mov edx, 3
call fcn.140006060
mov byte [rbp + 0x30f], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
lea rax, [rbp + 0x210]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000d5f0
lea rdx, [rbp + 0x210]
lea rcx, [rbp - 0x70]
call fcn.140001c50
nop
cmp qword [rbp - 0x60], 0
jbe 0x14000d9a2
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.14000ea40
mov r8, qword [rax]
movsxd rdx, ebx
mov ecx, dword [rbp + 0x20]
add rcx, r12
lea rax, [rcx + rdx*8]
mov qword [r8 + 0x40], rax
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x80]
mov rcx, rsi
call fcn.14000ea40
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x40]
lea r9, [rbp - 0x3b]
nop word [rax + rax]
dec r9
mov rax, r15
mul rcx
shr rdx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r9], cl
mov rcx, rdx
test rdx, rdx
jne 0x14000d660
lea r8, [rbp - 0x3b]
mov rdx, r9
lea rcx, [rbp + 0x28]
call fcn.1400020d0
or r13d, 3
mov r14, qword [rbp - 0x60]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0x18
jb 0x14000dbef
lea r15, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r15, qword [rbp - 0x70]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
lea rsi, [r14 + 0x18]
mov ebx, 0xf
lea rdi, [rbp - 0x30]
cmp rsi, rbx
jbe 0x14000d764
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000d70d
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000d734
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000d753
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000dc46
mov rcx, rax
call fcn.140015e40
test rax, rax
je 0x14000dc5e
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000d760
test rcx, rcx
je 0x14000d75d
call fcn.140015e40
mov rdi, rax
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rbx
movups xmm0, xmmword [str.Found_import_in_target:]
movups xmmword [rdi], xmm0
movsd xmm0, qword [0x14004e020]
movsd qword [rdi + 0x10], xmm0
lea rcx, [rdi + 0x18]
mov r8, r14
mov rdx, r15
call fcn.14003f1c0
mov byte [rdi + rsi], 0
mov r8d, 2
lea rdx, [0x14004e00c]
lea rcx, [rbp - 0x30]
call fcn.140001a70
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x58], xmm1
mov qword [rax + 0x18], 0xf
xor r14d, r14d
mov qword [rax + 0x10], r14
mov byte [rax], r14b
lea r9, [rbp + 0x28]
lea r8, [rbp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.140001ee0
nop
lea r8d, [r14 + 1]
lea rdx, [0x14004d9a0]
lea rcx, [rsp + 0x50]
call fcn.140001a70
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
or r13d, 0x3c
lea r8, [rbp - 0x10]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0xf
cmova r8, rcx
lea edx, [r14 + 1]
call fcn.140006060
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14000d878
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d872
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dc4c
call fcn.140015e38
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000d8b5
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d8b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dc52
call fcn.140015e38
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x14000d904
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d8fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dc58
call fcn.140015e38
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14000d93f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d93a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dc5e
call fcn.140015e38
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x14000d98a
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d985
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dc64
call fcn.140015e38
movabs r15, 0xcccccccccccccccd
mov rsi, qword [rsp + 0x40]
mov ebx, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
inc ebx
mov dword [rsp + 0x30], ebx
movsxd rbx, ebx
shl rbx, 3
mov ecx, dword [rbp + 0x20]
add rcx, rbx
add rcx, r12
mov qword [rsp + 0x48], r14
mov eax, dword [rdi]
mov dword [rbp - 0x50], eax
mov qword [rbp - 0x48], rcx
lea rax, [rsp + 0x48]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 8
mov dword [rsp + 0x28], 0x20
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp - 0x50]
mov edx, 0x22200c
mov rcx, qword [0x140057cd0]
call fcn.140002880
test al, al
jne 0x14000da10
lea r8, str.Failed_to_read_memory___Ioctl_failed_
jmp 0x14000da1e
cmp qword [rbp - 0x38], 0
jne 0x14000da28
lea r8, str.Failed_to_read_memory___Partial_read_
mov edx, 3
call fcn.140006060
mov rax, qword [rsp + 0x48]
mov qword [rbp + 0xb0], rax
mov ecx, dword [rbp + 0x10]
add rcx, rbx
add rcx, r12
mov qword [rbp + 0x28], r14
mov eax, dword [rdi]
mov dword [rbp + 0x48], eax
mov qword [rbp + 0x50], rcx
lea rax, [rbp + 0x28]
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], 8
mov dword [rsp + 0x28], 0x20
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp + 0x48]
mov edx, 0x22200c
mov rcx, qword [0x140057cd0]
call fcn.140002880
test al, al
jne 0x14000da93
lea r8, str.Failed_to_read_memory___Ioctl_failed_
jmp 0x14000daa1
cmp qword [rbp + 0x60], 0
jne 0x14000daab
lea r8, str.Failed_to_read_memory___Partial_read_
mov edx, 3
call fcn.140006060
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0xa8], rax
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x14000daf8
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000daec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dbf5
call fcn.140015e38
mov rax, qword [rbp + 0xa8]
test rax, rax
mov ebx, dword [rsp + 0x30]
jne 0x14000d550
mov ebx, dword [rsp + 0x34]
inc ebx
mov dword [rsp + 0x34], ebx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], eax
mov eax, dword [rdi]
mov dword [rbp - 0x10], eax
movsxd rax, ebx
lea rdx, [rax + rax*4]
mov ecx, dword [rbp + 0x190]
add rcx, r12
lea rax, [rcx + rdx*4]
mov qword [rbp - 8], rax
lea rax, [rbp - 0x50]
mov qword [rbp], rax
mov qword [rbp + 8], 0x14
mov dword [rsp + 0x28], 0x20
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rbp - 0x10]
mov edx, 0x22200c
mov rcx, qword [0x140057cd0]
call fcn.140002880
test al, al
jne 0x14000db81
lea r8, str.Failed_to_read_memory___Ioctl_failed_
jmp 0x14000db8f
cmp qword [rbp + 8], 0
jne 0x14000db99
lea r8, str.Failed_to_read_memory___Partial_read_
mov edx, 3
call fcn.140006060
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rbp + 0x10], xmm0
mov ecx, dword [rbp - 0x40]
mov dword [rbp + 0x20], ecx
psrldq xmm0, 8
movq rax, xmm0
shr rax, 0x20
test eax, eax
jne 0x14000d430
cmp qword [rsi + 8], 0
seta al
mov rcx, qword [rbp + 0x310]
xor rcx, rsp
call fcn.140015bd0
mov rbx, qword [rsp + 0x460]
add rsp, 0x420
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140001680
nop
call fcn.14001c8bc
int3
lea rdx, str.Target_process_invalid_DOS_header_
lea rcx, [rbp - 0x10]
call fcn.140001910
mov rdx, rax
call fcn.140001880
int3
lea rdx, str.Target_process_invalid_NT_header_
lea rcx, [rbp - 0x10]
call fcn.140001910
mov rdx, rax
call fcn.140001880
int3
lea rdx, str.Target_process_invalid_import_descriptor_
lea rcx, [rbp - 0x10]
call fcn.140001910
mov rdx, rax
call fcn.140001880
nop
call fcn.1400015e0
nop
call fcn.14001c8bc
nop
call fcn.14001c8bc
nop
call fcn.14001c8bc
nop
call fcn.14001c8bc
nop
call fcn.14001c8bc
int3