Function at 0x11c38
Capabilities:
Parse pe header
Print debug messages
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
xor esi, esi
xor eax, eax
mov rbx, rcx
mov qword [rsp + 0x52], rax
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
lea eax, [rsi + 8]
mov dword [rsp + 0x60], esi
lea edx, [rsi + 0x40]
mov word [rsp + 0x70], ax
lea eax, [rsi + 0xa]
xor ecx, ecx
mov word [rsp + 0x72], ax
lea rax, [0x00017c80]
mov r8d, 0x6c697475
mov qword [r11 - 0x70], rax
xor eax, eax
mov bpl, sil
mov dword [rsp + 0x64], eax
mov r13, rsi
mov r14, rsi
mov r15, rsi
mov rdi, rsi
mov dword [r11 + 0x10], esi
mov qword [r11 - 0x80], rax
mov word [rsp + 0x50], si
mov qword [r11 + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r12, rax
cmp rax, rsi
jne 0x11cdf
lea rcx, [0x00017af0]
lea rbx, [0x00017c90]
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
jmp 0x11ec3
mov edx, 0x14
xor ecx, ecx
mov r8d, 0x6c697475
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r13, rax
cmp rax, rsi
jne 0x11d03
lea rcx, [0x00017b30]
jmp 0x11ccb
mov edx, 0xe0
xor ecx, ecx
mov r8d, 0x6c697475
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r14, rax
cmp rax, rsi
jne 0x11d27
lea rcx, [0x00017cb0]
jmp 0x11ccb
mov edx, 0xf0
xor ecx, ecx
mov r8d, 0x6c697475
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r15, rax
cmp rax, rsi
jne 0x11d4b
lea rcx, [0x00017d00]
jmp 0x11ccb
mov edx, 8
xor ecx, ecx
mov r8d, 0x6c697475
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
cmp rax, rsi
jne 0x11d72
lea rcx, [0x00017d50]
jmp 0x11ccb
mov edx, 0x200
mov r8d, 0x6c697475
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x58], rax
cmp rax, rsi
jne 0x11d9b
lea rcx, [0x00017da0]
jmp 0x11ccb
xor edx, edx
mov r8d, 0x200
mov rcx, rax
call fcn.00017320
mov eax, 0x200
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
mov word [rsp + 0x50], si
mov word [rsp + 0x52], ax
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea rbx, [0x00017c90]
cmp eax, esi
mov rdx, rbx
jge 0x11dfa
lea rcx, [0x00017de0]
mov r8d, eax
call sub.ntoskrnl.exe_DbgPrint
jmp 0x11ec3
mov r8, qword [rsp + 0x58]
lea rcx, [0x00017e30]
call sub.ntoskrnl.exe_DbgPrint
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x90], rax
mov eax, 1
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x108]
mov edx, 0x80100000
mov dword [rsp + 0x28], 0x60
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], rsi
mov dword [rsp + 0x98], 0x240
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rsi
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
mov rdx, rbx
mov esi, eax
mov r8d, eax
test eax, eax
jns 0x11f8b
lea rcx, [0x00017e70]
call sub.ntoskrnl.exe_DbgPrint
cmp esi, 0xc0000034
jne 0x11eaa
lea rcx, [0x00017eb0]
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
cmp qword [rsp + 0x68], 5
jne 0x11ec1
lea rcx, [0x00017eb0]
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
xor esi, esi
mov rcx, qword [rsp + 0x108]
cmp rcx, rsi
je 0x11eec
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp eax, esi
jge 0x11eec
lea rcx, [0x00017f90]
mov r8d, eax
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x58]
cmp rcx, rsi
je 0x11f01
mov edx, 0x6c697475
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r12, rsi
je 0x11f14
mov edx, 0x6c697475
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov r12d, 0x6c697475
cmp r13, rsi
je 0x11f2b
mov edx, r12d
mov rcx, r13
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r14, rsi
je 0x11f3c
mov edx, r12d
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp r15, rsi
je 0x11f4d
mov edx, r12d
mov rcx, r15
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp rdi, rsi
je 0x11f5e
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
lea rcx, [0x00017fd0]
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
mov rbx, qword [rsp + 0xf0]
mov al, bpl
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x00017ee0]
call sub.ntoskrnl.exe_DbgPrint
mov rcx, qword [rsp + 0x108]
lea rax, [rsp + 0x100]
xor esi, esi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], 0x40
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x100], rsi
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, esi
jge 0x11ff3
mov rdx, rbx
lea rcx, [0x00017f20]
jmp 0x11ded
mov ecx, 0x5a4d
cmp word [r12], cx
je 0x1200e
mov rdx, rbx
lea rcx, [0x00017b70]
jmp 0x11ded
movsxd rax, dword [r12 + 0x3c]
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x100], rax
lea rax, [rsp + 0x100]
xor r9d, r9d
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xf8]
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, esi
jl 0x11fe4
cmp dword [rsp + 0xf8], 0x4550
je 0x12086
mov rdx, rbx
lea rcx, [0x00017bb0]
jmp 0x11ded
movsxd rax, dword [r12 + 0x3c]
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x40], rsi
add rax, 4
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x100], rax
lea rax, [rsp + 0x100]
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], 0x14
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, esi
mov rdx, rbx
lea rcx, [0x00017f20]
jl 0x11ded
movzx r8d, word [r13]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0x14c
cmp word [r13], ax
jne 0x1216a
movsxd rax, dword [r12 + 0x3c]
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x40], rsi
add rax, 0x18
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x100], rax
lea rax, [rsp + 0x100]
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], 0xe0
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, esi
jge 0x12161
mov rdx, rbx
lea rcx, [0x00017bf0]
jmp 0x11ded
mov rax, qword [r14 + 0x80]
jmp 0x121d5
mov eax, 0x8664
cmp word [r13], ax
jne 0x11ec3
movsxd rax, dword [r12 + 0x3c]
mov rcx, qword [rsp + 0x108]
mov qword [rsp + 0x40], rsi
add rax, 0x18
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x100], rax
lea rax, [rsp + 0x100]
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], 0xf0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
cmp eax, esi
jl 0x12152
mov rax, qword [r15 + 0x90]
mov qword [rdi], rax
mov r8d, dword [rdi + 4]
lea rcx, [0x00017c30]
mov r9d, eax
mov rdx, rbx
call sub.ntoskrnl.exe_DbgPrint
cmp dword [rdi + 4], esi
jbe 0x12201
cmp dword [rdi], esi
movzx ebp, bpl
mov eax, 1
cmova ebp, eax
movzx r8d, bpl
mov rdx, rbx
lea rcx, [0x00017f60]
jmp 0x11df0