Function at 0x14006f6e0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rsi, rdx
mov rdi, rcx
xor r13d, r13d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14006fc8f
movsxd r14, dword [rdx + 0x3c]
add r14, rdx
cmp dword [r14], 0x4550
jne 0x14006fc8f
mov eax, 0x20b
cmp word [r14 + 0x18], ax
je 0x14006f745
lea rdx, str.____Image_is_not_64_bit
jmp 0x14006fc96
mov ebx, dword [r14 + 0x50]
mov edx, ebx
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
je 0x14006fcb2
movzx eax, word [r14 + 0x14]
mov r12d, dword [rax + r14 + 0x24]
sub ebx, r12d
mov ecx, ebx
mov qword [rbp + 0x60], rcx
je 0x14006f8ca
mov edx, reloc.WS2_32.dll_recv
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rdx + rax]
cmp dword [0x14020fb34], eax
jle 0x14006f86f
lea rcx, [0x14020fb34]
call fcn.1400ff648
cmp dword [0x14020fb34], 0xffffffff
jne 0x14006f86b
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400ffa50
mov qword [rbp - 0x30], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_setsockopt]
movdqu xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [str.ExAllocatePoolWithTag]
movups xmmword [rax], xmm1
mov ecx, dword [0x1401310d8]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1401310dc]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea r8, [rbp - 0x30]
mov rdx, qword [0x14020f518]
mov rcx, rdi
call fcn.14006b0f0
mov qword [0x14020fb98], rax
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14006f85f
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006f859
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006f859
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ff9d0
nop
lea rcx, [0x14020fb34]
call fcn.1400ff5dc
mov rcx, qword [rbp + 0x60]
cmp qword [0x14020fb98], 0
jne 0x14006f8a8
lea rdx, str.____Failed_to_find_ExAllocatePool
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006db30
lea rdx, [0x14006dd10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
jmp 0x14006fc00
mov qword [rbp + 0x58], r13
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x58]
mov rcx, rdi
call fcn.14006dd50
test al, al
je 0x14006f8ca
mov r13, qword [rbp + 0x58]
test r13, r13
jne 0x14006f8d6
lea rdx, str.____Failed_to_allocate_remote_image_in_kernel
jmp 0x14006fc00
lea rdx, str.___Image_base_has_been_allocated_at_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006db30
mov rdx, r13
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x14006dd10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, dword [r14 + 0x54]
mov rdx, rsi
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r14 + 0x14]
add rbx, 0x24
xor eax, eax
mov edi, eax
cmp ax, word [r14 + 6]
jae 0x14006f95c
add rbx, r14
nop dword [rax + rax]
test dword [rbx + 0x18], 0x80
ja 0x14006f94d
mov ecx, dword [rbx]
add rcx, r15
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
inc edi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp edi, eax
jl 0x14006f930
mov rbx, r13
sub rbx, r12
mov qword [rbp + 0x58], rbx
lea rdx, str.___Skipped_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006db30
lea rdx, [0x140069ff0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, r12d
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._bytes_of_PE_Header
call fcn.14006db30
lea rdx, [0x14006dd10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rsi, rbx
sub rsi, qword [r14 + 0x30]
mov eax, 0x5a4d
cmp word [r15], ax
jne 0x14006fa91
movsxd rax, dword [r15 + 0x3c]
cmp dword [rax + r15], 0x4550
jne 0x14006fa91
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
xor edx, edx
mov r8d, edx
mov qword [rbp - 0x38], rdx
mov ecx, dword [rax + r15 + 0xb0]
test ecx, ecx
jne 0x14006fa00
mov ebx, edx
jmp 0x14006fa98
lea rbx, [r15 + rcx]
mov edi, dword [rax + r15 + 0xb4]
add rdi, rbx
cmp rbx, rdi
jae 0x14006fa81
mov rdx, qword [rbp - 0x40]
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x14006fa7a
mov eax, dword [rbx]
add rax, r15
mov qword [rbp - 0x30], rax
lea rax, [rbx + 8]
mov qword [rbp - 0x28], rax
lea rax, [rcx - 8]
shr rax, 1
mov dword [rbp - 0x20], eax
cmp rdx, r8
je 0x14006fa5a
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdx], xmm0
movsd xmm1, qword [rbp - 0x20]
movsd qword [rdx + 0x10], xmm1
add rdx, 0x18
mov qword [rbp - 0x40], rdx
jmp 0x14006fa6f
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x48]
call fcn.140070d20
mov r8, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x40]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rdi
jb 0x14006fa18
movdqu xmm1, xmmword [rbp - 0x48]
xor edx, edx
movsd xmm0, qword [rbp - 0x38]
movsd qword [rbp - 0x20], xmm0
mov rbx, qword [rbp - 0x20]
jmp 0x14006fa98
xorps xmm1, xmm1
xor edx, edx
mov ebx, edx
movq r10, xmm1
psrldq xmm1, 8
movq r11, xmm1
cmp r10, r11
je 0x14006faff
lea r8, [r10 + 0x10]
mov edi, 0xfff
mov eax, edx
cmp dword [r8], 0
jbe 0x14006faf2
nop dword [rax]
mov edx, eax
mov rcx, qword [r8 - 8]
movzx r9d, word [rcx + rdx*2]
movzx ecx, r9w
shr cx, 0xc
and r9w, di
cmp cx, 0xa
jne 0x14006fae9
movzx edx, r9w
mov rcx, qword [r8 - 0x10]
add qword [rcx + rdx], rsi
inc eax
cmp eax, dword [r8]
jb 0x14006fac0
xor edx, edx
add r8, 0x18
lea rax, [r8 - 0x10]
cmp rax, r11
jne 0x14006fab5
test r10, r10
je 0x14006fb5a
sub rbx, r10
movabs rax, 0x2aaaaaaaaaaaaaab
imul rbx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r10
cmp rdx, 0x1000
jb 0x14006fb52
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006fb52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r10
call fcn.1400ff9d0
mov rdx, r15
lea rcx, [rbp - 0x30]
call fcn.140070450
mov rdx, rax
mov rdi, qword [rbp + 0x48]
mov rcx, rdi
call fcn.14006fcd0
test al, al
jne 0x14006fb82
lea rdx, str.____Failed_to_resolve_imports
jmp 0x14006fc00
lea r8, [r15 + r12]
mov r9, qword [rbp + 0x60]
mov rdx, r13
mov rcx, rdi
call fcn.14006acc0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
jne 0x14006fba9
lea rdx, str.____Failed_to_write_local_image_to_remote_image
jmp 0x14006fc07
mov ebx, dword [r14 + 0x28]
add rbx, qword [rbp + 0x58]
lea rdx, str.____Calling_DriverEntry_0x
call fcn.14006db30
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
lea rdx, [0x14006dd10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov dword [rbp + 0x68], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbx
lea rdx, [rbp + 0x68]
mov rcx, rdi
call fcn.14006ffc0
test al, al
jne 0x14006fc3a
lea rdx, str.____Failed_to_call_driver_entry
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006db30
lea rdx, [0x14006dd10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, r13
mov rcx, rdi
call fcn.14006afb0
jmp 0x14006fcb2
lea rdx, str.___DriverEntry_returned_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006db30
lea rdx, [0x140069ff0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, dword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x14006dd10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r13
jmp 0x14006fcb4
lea rdx, str.____Invalid_format_of_PE_image
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14006db30
lea rdx, [0x14006dd10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret