Function at 0x180060070
Capabilities:
Access pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x100
mov rsi, rdx
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rax + 0x18], r14
lea ebx, [r14 + 6]
mov dword [rsp + 0x40], ebx
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, [rsp + 0x50]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToRelativeNtPathName_U]
nop dword [rax + rax]
test al, al
jne 0x1800600c8
mov ecx, 0xc0000033
call sym.KERNEL32.dll_BaseSetLastNTError
mov edi, r14d
jmp 0x180060338
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
cmp word [rsp + 0x60], r14w
je 0x1800600ec
movups xmm0, xmmword [rsp + 0x60]
movdqu xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x70]
jmp 0x1800600f4
mov rax, r14
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x80], 0x30
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x98], 0x40
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0x28], 0x60
mov dword [rsp + 0x20], 5
lea r9, [rsp + 0xf0]
lea r8, [rsp + 0x80]
mov edx, 0x100020
lea rcx, [rsp + 0x138]
call qword [sym.imp.ntdll.dll_NtOpenFile]
nop dword [rax + rax]
mov edi, eax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlReleaseRelativeName]
nop dword [rax + rax]
test edi, edi
jns 0x180060182
mov ecx, edi
jmp 0x1800600bb
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 0x10
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
lea rcx, [rsp + 0x130]
call qword [sym.imp.ntdll.dll_NtCreateSection]
nop dword [rax + rax]
mov edi, eax
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test edi, edi
jns 0x180060272
mov qword [rsp + 0x130], r14
cmp edi, 0xc000011b
je 0x180060266
cmp edi, 0xc000012f
je 0x180060231
cmp edi, 0xc0000130
je 0x180060266
cmp edi, 0xc0000131
je 0x18006021e
cmp edi, 0xc0000359
je 0x180060219
cmp edi, 0xc000035a
je 0x180060223
jmp 0x18006017b
mov ebx, r14d
jmp 0x180060223
mov ebx, 2
mov dword [rsp + 0x40], ebx
mov edi, 1
jmp 0x180060336
mov edx, 0xc000012f
lea rcx, [rsp + 0x50]
call sym.KERNEL32.dll_BaseIsDosApplication
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x180060252
mov ecx, 0xc000012f
jmp 0x1800600bb
mov edi, 1
mov ebx, edi
lea ecx, [rdi + 2]
cmp eax, ecx
cmove ebx, ecx
jmp 0x180060316
mov edi, 1
mov ebx, edi
jmp 0x180060316
mov qword [rsp + 0x20], r14
mov r9d, 0x40
lea r8, [rsp + 0xb0]
lea edi, [r9 - 0x3f]
mov edx, edi
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.ntdll.dll_NtQuerySection]
nop dword [rax + rax]
test eax, eax
jns 0x1800602aa
mov ecx, eax
jmp 0x1800600bb
mov eax, 0x2000
test word [rsp + 0xdc], ax
je 0x1800602cf
mov ecx, 0xc1
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x1800600c0
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
nop dword [rax + rax]
movzx ecx, word [rsp + 0xe0]
cmp cx, word [rax + 4]
je 0x18006031c
mov eax, 0x14c
cmp cx, ax
jne 0x1800602b9
mov ebx, r14d
mov dword [rsp + 0x40], ebx
cmp dword [rsp + 0xd0], 7
jne 0x180060336
mov ebx, 4
mov dword [rsp + 0x40], ebx
jmp 0x180060336
mov eax, dword [rsp + 0x40]
mov ebx, 4
cmp dword [rsp + 0xd0], 7
cmove eax, ebx
mov ebx, eax
mov dword [rsp + 0x40], eax
mov dword [rsi], ebx
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x180060351
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
cmp qword [rsp + 0x48], r14
je 0x180060378
mov rcx, qword gs:[0x60]
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov eax, edi
mov rbx, qword [rsp + 0x120]
add rsp, 0x100
pop r14
pop rdi
pop rsi
ret