Function at 0x180009f80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x90
mov r13, qword [0x18005ab80]
mov qword [rbp - 0x59], r13
mov eax, 0x5a4d
cmp word [0x180056cb0], ax
jne 0x18000a2e4
movsxd rdi, dword [0x180056cec]
lea rsi, [0x180056cb0]
add rdi, rsi
cmp dword [rdi], 0x4550
jne 0x18000a2e4
mov eax, 0x20b
cmp word [rdi + 0x18], ax
je 0x180009ffd
lea rax, str.____Image_is_not_64_bit_n
mov qword [rbp - 0x51], 0x18
jmp 0x18000a2f3
mov ebx, dword [rdi + 0x50]
mov edx, ebx
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x18000a310
movzx eax, word [rdi + 0x14]
mov eax, dword [rax + rdi + 0x24]
mov dword [rbp - 0x39], eax
sub ebx, eax
mov edx, ebx
mov qword [rbp - 0x31], rdx
jne 0x18000a040
xor r14d, r14d
mov r15, r14
jmp 0x18000a175
mov ecx, dword [0x180059cdc]
mov rax, qword gs:[0x58]
mov r8d, 4
mov rcx, qword [rax + rcx*8]
xor r14d, r14d
mov eax, dword [r8 + rcx]
cmp dword [0x18005abbc], eax
jle 0x18000a114
lea rcx, [0x18005abbc]
call fcn.18000fb10
cmp dword [0x18005abbc], 0xffffffff
jne 0x18000a110
mov qword [rbp - 0x21], r14
mov qword [rbp - 0x11], r14
mov qword [rbp - 9], 0xf
mov byte [rbp - 0x21], r14b
lea r8d, [r14 + 0x15]
lea rdx, [0x180046960]
lea rcx, [rbp - 0x21]
call fcn.180007060
nop
lea r8, [rbp - 0x21]
mov rdx, qword [0x18005aa68]
mov rcx, r13
call fcn.1800030a0
mov qword [0x18005ac40], rax
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x18000a104
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a0fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a333
call fcn.18000f980
nop
lea rcx, [0x18005abbc]
call fcn.18000fab0
mov rdx, qword [rbp - 0x31]
cmp qword [0x18005ac40], 0
jne 0x18000a14f
lea rax, str.Failed_to_find_ExAllocatePool
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], 0x1d
movaps xmm0, xmmword [rbp - 0x59]
movdqa xmmword [rbp - 0x59], xmm0
lea rdx, [rbp - 0x59]
lea rcx, [0x18005aa70]
call fcn.1800079a0
mov r15, r14
jmp 0x18000a175
mov qword [rbp - 0x29], r14
mov qword [rsp + 0x20], rdx
lea rdx, [rbp - 0x29]
mov rcx, r13
call fcn.180007d20
test al, al
je 0x18000a038
mov r15, qword [rbp - 0x29]
test r15, r15
jne 0x18000a189
lea rax, str.____Failed_to_allocate_remote_image_in_kernel_
mov qword [rbp - 0x51], 0x2e
jmp 0x18000a293
mov r8d, dword [rdi + 0x54]
mov rdx, rsi
mov rcx, r12
call fcn.180011ba0
movzx ebx, word [rdi + 0x14]
add rbx, 0x28
mov esi, r14d
cmp r14w, word [rdi + 6]
jae 0x18000a1e3
add rbx, rdi
lea r13, [0x180056cb0]
test dword [rbx + 0x14], 0x80
ja 0x18000a1d1
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, r13
mov ecx, dword [rbx - 4]
add rcx, r12
call fcn.180011ba0
inc esi
add rbx, 0x28
movzx eax, word [rdi + 6]
cmp esi, eax
jl 0x18000a1b4
mov r13, qword [rbp - 0x59]
mov eax, dword [rbp - 0x39]
mov rsi, r15
sub rsi, rax
mov rbx, rsi
sub rbx, qword [rdi + 0x30]
mov rdx, r12
lea rcx, [rbp - 0x59]
call fcn.18000ad50
mov rdx, rbx
mov rcx, rax
call fcn.18000a340
mov rdx, r12
lea rcx, [rbp - 0x59]
call fcn.18000aea0
mov rdx, rax
mov rcx, r13
call fcn.18000a440
test al, al
jne 0x18000a236
lea rax, str.____Failed_to_resolve_imports_n
mov qword [rbp - 0x51], 0x1e
jmp 0x18000a293
mov r8d, dword [rbp - 0x39]
add r8, r12
mov r9, qword [rbp - 0x31]
mov rdx, r15
mov rcx, r13
call fcn.180002c60
test al, al
jne 0x18000a261
lea rax, str.____Failed_to_write_local_image_to_remote_image_n
mov qword [rbp - 0x51], 0x30
jmp 0x18000a293
mov r8d, dword [rdi + 0x28]
add r8, rsi
mov dword [rbp - 0x39], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea rdx, [rbp - 0x39]
mov rcx, r13
call fcn.18000a810
test al, al
jne 0x18000a2ce
lea rax, str.____Failed_to_call_driver_entry_n
mov qword [rbp - 0x51], 0x20
mov qword [rbp - 0x59], rax
movaps xmm0, xmmword [rbp - 0x59]
movdqa xmmword [rbp - 0x59], xmm0
lea rdx, [rbp - 0x59]
lea rcx, [0x18005aa70]
call fcn.1800079a0
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, r15
mov rcx, r13
call fcn.180002f50
jmp 0x18000a310
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r15
jmp 0x18000a312
lea rax, str.____Invalid_format_of_PE_image_n
mov qword [rbp - 0x51], 0x1f
mov qword [rbp - 0x59], rax
movaps xmm0, xmmword [rbp - 0x59]
movdqa xmmword [rbp - 0x59], xmm0
lea rdx, [rbp - 0x59]
lea rcx, [0x18005aa70]
call fcn.1800079a0
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18001b3c0
nop
int3