Function at 0x140029360
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov qword [rsp + 0x28], r8
mov r14, rdx
mov r12, rcx
mov rax, qword [0x140062018]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movzx edx, word [rcx]
cmp rdx, 0x20
jae 0x1400293e4
mov ebp, 0x83
xor esi, esi
lea rdi, [0x140054810]
mov rbx, rbp
sub rbx, rsi
shr rbx, 1
add rbx, rsi
mov rdx, rbx
shl rdx, 5
add rdx, rdi
mov rcx, r12
mov r8b, 1
call sub.ntdll.dll_RtlCompareUnicodeString
test eax, eax
je 0x140029452
js 0x1400293da
inc rbx
mov rsi, rbx
jmp 0x1400293dd
mov rbp, rbx
cmp rbp, rsi
jne 0x1400293a7
jmp 0x140029455
mov r10, rdx
shr r10, 1
mov rax, qword [r12 + 8]
movzx r9d, word [rax]
cmp r9w, 0x2e
jne 0x14002961b
xor ebx, ebx
lea edi, [rbx + 1]
cmp r10w, di
jbe 0x140029795
movzx r8d, di
cmp word [rax + r8*2], 0x2e
mov ecx, edi
je 0x14002973e
movzx ebp, r10w
sub ebp, ebx
add ebp, 0xfffffffe
mov rbx, r8
sub bp, 1
jb 0x140029736
lea rcx, [rbx + 1]
cmp word [rax + rbx*2 + 2], 0x2e
mov rbx, rcx
jne 0x14002942b
cmp rcx, r10
jb 0x14002973e
jmp 0x140029795
mov rbp, rbx
mov qword [rsp + 0x40], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x58], 0
test r14, r14
je 0x1400294d8
movzx ecx, word [r14]
cmp ecx, 0x5a4d
jne 0x1400294d8
movsxd rcx, dword [r14 + 0x3c]
lea r15, [r14 + rcx]
mov qword [rsp + 0x48], r15
cmp dword [r14 + rcx], 0x4550
jne 0x1400294db
movzx ecx, word [r15 + 0x18]
cmp ecx, 0x20b
jne 0x1400294db
mov ecx, dword [r15 + 0x50]
cmp ecx, 0x148
jb 0x1400294db
lea esi, [rcx - 1]
add rsi, r14
mov qword [rsp + 0x50], rsi
mov edx, dword [r15 + 0x84]
cmp edx, 0x10
mov ebx, 0x10
cmovb ebx, edx
cmp ebx, 2
jb 0x1400294dd
cmp dword [r15 + 0x90], ecx
setae byte [rsp + 0x58]
jmp 0x1400294dd
xor r15d, r15d
xor esi, esi
test eax, eax
je 0x1400295b0
lea rcx, [0x140062dd0]
lea rdx, [0x14002a480]
xor r8d, r8d
xor r9d, r9d
call fcn.140052730
mov rax, qword [0x140062dc8]
test rax, rax
je 0x14002951b
cmp dword [rax], 2
jl 0x14002951b
xor edi, edi
cmp dword [rax + 0x28], 0
jne 0x140029710
lea rcx, [0x140062dd0]
lea rdx, [0x14002a480]
xor r8d, r8d
xor r9d, r9d
call fcn.140052730
mov r13, qword [0x140062dc8]
test r13, r13
je 0x14002970e
cmp dword [r13], 2
jl 0x14002970e
mov ebp, dword [r13 + 0x30]
mov edi, 0
test rbp, rbp
je 0x140029710
mov qword [rsp + 0x30], rsi
xor ebx, ebx
mov rsi, rbp
sub rsi, rbx
shr rsi, 1
add rsi, rbx
mov rax, rsi
shl rax, 5
lea rdi, [rax + r13]
add rdi, 0x38
mov rcx, r12
mov rdx, rdi
mov r8b, 1
call sub.ntdll.dll_RtlCompareUnicodeString
test eax, eax
je 0x1400296ec
js 0x1400295a3
inc rsi
mov rbx, rsi
jmp 0x1400295a6
mov rbp, rsi
cmp rbp, rbx
jne 0x140029568
jmp 0x14002970e
shl rbp, 5
add rdi, rbp
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x38]
mov rcx, rdi
call fcn.14002a7b0
mov r13d, eax
test eax, eax
je 0x1400294e5
mov rbp, qword [rsp + 0x38]
lea rcx, [0x140062da0]
call sub.ntdll.dll_RtlAcquireSRWLockExclusive
mov rbx, qword [0x140062d98]
test rbx, rbx
je 0x140029647
mov rcx, rbx
mov rdx, rdi
mov r8b, 1
call sub.ntdll.dll_RtlEqualUnicodeString
test al, al
je 0x140029609
cmp qword [rbx + 0x10], rbp
je 0x140029686
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x1400295f1
mov rbx, qword [0x140062d98]
jmp 0x140029649
lea rcx, [r10 - 1]
xor esi, esi
cmp rcx, rsi
je 0x140029795
lea rbx, [rsi + 1]
cmp word [rax + rsi*2 + 2], 0x2e
mov rsi, rbx
jne 0x140029621
cmp rbx, r10
jb 0x140029400
jmp 0x140029795
xor ebx, ebx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x140029686
mov r8d, 0x20
xor edx, edx
call sub.ntdll.dll_RtlAllocateHeap
test rax, rax
je 0x140029686
movups xmm0, xmmword [rdi]
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rbx
mov qword [0x140062d98], rax
lea rcx, [0x140062da0]
call sub.ntdll.dll_RtlReleaseSRWLockExclusive
cmp qword [rsp + 0x28], 0
je 0x1400296e7
mov eax, dword [rdi + 0x18]
and eax, 0x20
je 0x1400296e7
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov rax, qword [rax + 0x10]
lea rdi, [rsp + 0x70]
mov rcx, rdi
call qword [case.0x14002f18e.0]
mov eax, dword [rdi + 4]
mov dword [rsp + 0x68], eax
test rsi, rsi
je 0x1400296e7
mov eax, dword [r15 + 0x28]
add r14, rax
lea rcx, [rsp + 0x60]
mov rdx, r14
call fcn.14002ab00
mov edi, 4
test al, al
jne 0x140029710
mov edi, r13d
jmp 0x140029710
lea rdx, [rsp + 0x40]
lea r8, [rsp + 0x38]
mov rcx, rdi
call fcn.14002a7b0
mov r13d, eax
test eax, eax
mov rsi, qword [rsp + 0x30]
jne 0x1400295d4
xor edi, edi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14002fae0
mov eax, edi
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
inc rbx
cmp rbx, r10
jae 0x140029795
movzx ebp, cx
sub ebp, r8d
cmp ebp, 0xc
jne 0x140029795
sub ecx, edi
mov edi, 3
and ecx, 0x7fff
je 0x140029710
lea rsi, [rax + r8*2]
lea rbx, [rsi + rcx*2]
movabs r8, 0x3f0000003f
movzx ecx, word [rsi]
lea ebp, [rcx - 0x30]
cmp bp, 0xa
jb 0x140029787
movzx ecx, cx
add ecx, 0xffffffbf
cmp ecx, 0x25
ja 0x140029795
bt r8, rcx
jae 0x140029795
add rsi, 2
cmp rsi, rbx
jb 0x14002976a
jmp 0x140029710
cmp dx, 0x28
jb 0x140029399
cmp r9w, 0x2e
je 0x140029399
lea rbx, [r10 - 1]
xor ebp, ebp
mov rcx, rax
cmp rbx, rbp
je 0x140029399
lea rdx, [rcx + 2]
inc rbp
cmp word [rcx + 2], 0x2e
mov rcx, rdx
jne 0x1400297b3
cmp rbp, r10
jae 0x140029399
cmp bp, 0x10
jb 0x140029399
mov edi, 3
test bp, bp
je 0x140029710
movabs rcx, 0x3f0000003f
movzx ebp, word [rax]
lea ebx, [rbp - 0x30]
cmp bx, 0xa
jb 0x14002981d
movzx ebp, bp
add ebp, 0xffffffbf
cmp ebp, 0x25
ja 0x140029399
bt rcx, rbp
jae 0x140029399
add rax, 2
cmp rax, rdx
jb 0x1400297f8
jmp 0x140029710