Function at 0x14000ad60
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
push r12
push r14
sub rsp, 0xa8
mov rax, qword [0x140023040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x118]
xor esi, esi
mov qword [rsp + 0x40], rax
mov r14, rdx
mov eax, 0x5a4d
mov qword [rsp + 0x70], rsi
mov r12, rcx
mov qword [rsp + 0x60], rsi
cmp word [rdx], ax
jne 0x14000b2e6
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x14000b2e6
test rdi, rdi
je 0x14000b2e6
mov eax, 0x20b
cmp word [rdi + 0x18], ax
je 0x14000adfe
lea rdx, str.____Image_is_not_64_bit
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140005e70
lea rdx, [0x140006050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
jmp 0x14000b1f8
mov qword [rsp + 0xa0], rbp
xor ecx, ecx
mov qword [rsp + 0x90], r15
mov r9d, 4
mov r15d, dword [rdi + 0x50]
mov r8d, 0x3000
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov rbp, rax
test rax, rax
jne 0x14000ae5b
lea rdx, str.____Failed_to_allocate_virtual_memory_for_local_image_base
call fcn.140005e70
lea rdx, [0x140006050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
jmp 0x14000b1e8
lea rdx, str.___Successfully_allocated_virtual_memory_for_local_image_base
mov qword [rsp + 0xe0], rbx
call fcn.140005e70
lea rdx, [0x140006050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
movzx eax, word [rdi + 0x14]
mov rcx, r12
mov eax, dword [rax + rdi + 0x24]
sub r15d, eax
mov edx, r15d
mov dword [rsp + 0x30], eax
call fcn.14000a9d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x14000aee1
lea rdx, str.____Failed_to_allocate_independent_pages_in_kernel
call fcn.140005e70
lea rdx, [0x140006050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14000b1e0
lea rdx, str.___Image_base_has_been_allocated_at_0x
mov qword [rsp + 0x98], r13
call fcn.140005e70
lea rdx, [0x140001290]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140006050]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, dword [rdi + 0x54]
mov rdx, r14
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rdi + 0x14]
xor eax, eax
add rbx, 0x28
cmp ax, word [rdi + 6]
jae 0x14000af6e
add rbx, rdi
test dword [rbx + 0x14], 0x80
ja 0x14000af60
mov edx, dword [rbx + 4]
mov ecx, dword [rbx - 4]
add rdx, r14
mov r8d, dword [rbx]
add rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rdi + 6]
inc esi
add rbx, 0x28
cmp esi, eax
jl 0x14000af43
mov r14, qword [rsp + 0x38]
lea rdx, str.___Skipped_0x
mov ebx, dword [rsp + 0x30]
mov rsi, r14
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
sub r14, rbx
mov r13d, ebx
call fcn.140005e70
lea rdx, [0x140001290]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._bytes_of_PE_Header
call fcn.140005e70
lea rdx, [0x140006050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rbx, r14
lea rcx, [rsp + 0x48]
sub rbx, qword [rdi + 0x30]
mov rdx, rbp
call fcn.14000c2d0
mov rdx, rbx
mov rcx, rax
call fcn.14000b300
mov rdx, r14
mov rcx, rbp
call fcn.14000b400
test al, al
jne 0x14000b00e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Failed_to_fix_security_cookie
jmp 0x14000b1c1
mov rdx, rbp
lea rcx, [rsp + 0x48]
call fcn.14000c430
mov rdx, rax
mov rcx, r12
call fcn.14000b630
test al, al
jne 0x14000b036
lea rdx, str.____Failed_to_resolve_imports
jmp 0x14000b14a
mov r8, rbp
mov r9d, r15d
add r8, r13
mov ebx, r15d
mov rdx, rsi
mov rcx, r12
call fcn.140002850
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
test al, al
jne 0x14000b064
lea rdx, str.____Failed_to_write_local_image_to_kernel_memory
jmp 0x14000b151
lea rdx, str.___Successfully_wrote_image_to_kernel_memory_at_0x
call fcn.140005e70
lea rdx, [0x140001290]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140006050]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov edi, dword [rdi + 0x28]
lea rdx, str.____Calling_DriverEntry_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
add rdi, r14
call fcn.140005e70
lea rdx, [0x140001290]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140006050]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor r14d, r14d
lea rdx, [rsp + 0x70]
mov r9, rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea rcx, [rsp + 0x60]
call fcn.140009180
test al, al
jne 0x14000b10b
lea rdx, str.____Callback_returned_false__failed_
jmp 0x14000b14a
mov r9, qword [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov rax, qword [rsp + 0x70]
mov r8, rdi
cmp byte [rsp + 0x108], r14b
mov rcx, r12
mov dword [rsp + 0x30], r14d
cmovne r9, rsi
mov qword [rsp + 0x20], rax
call fcn.14000ba00
test al, al
jne 0x14000b216
lea rdx, str.____Failed_to_call_driver_entry
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140005e70
lea rdx, [0x140006050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Freeing_memory_due_to_failure
call fcn.140005e70
lea rdx, [0x140006050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, r15d
mov rdx, rsi
mov rcx, r12
call fcn.140002b50
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Memory_successfully_freed
test al, al
jne 0x14000b1c1
lea rdx, str.____WARNING:_Failed_to_free_memory_
call fcn.140005e70
lea rdx, [0x140006050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov r13, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xa0]
mov r15, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000ec00
add rsp, 0xa8
pop r14
pop r12
pop rdi
pop rsi
ret
mov rax, qword [rsp + 0x40]
mov ebx, dword [rsp + 0x30]
test rax, rax
je 0x14000b226
mov dword [rax], ebx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___DriverEntry_returned_0x
call fcn.140005e70
lea rdx, [0x140001290]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140006050]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
cmp byte [rsp + 0xf0], r14b
je 0x14000b2cd
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Freeing_allocated_memory
call fcn.140005e70
lea rdx, [0x140006050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r8d, r15d
mov rdx, rsi
mov rcx, r12
call fcn.140002b50
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___Memory_successfully_freed
test al, al
jne 0x14000b2b8
lea rdx, str.____WARNING:_Failed_to_free_memory_
call fcn.140005e70
lea rdx, [0x140006050]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rsi
jmp 0x14000b1d8
lea rdx, str.____Invalid_format_of_PE_image
jmp 0x14000addb