Function at 0x6620ac80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x50
mov r12, r9
movzx r13d, r8b
mov rbx, rdx
mov r14, rcx
test rdx, rdx
je 0x6620af7e
mov eax, 0xffffffff
cmp rdx, rax
je 0x6620af7e
cmp rdx, 0xffffffffffffffff
je 0x6620af7e
cmp qword [rsp + 0x98], 0x40
jae 0x6620acdc
mov eax, 0xc000007b
jmp 0x6620af83
cmp byte [rcx + 0x70], 0
je 0x6620acf6
mov r8d, 2
lea rcx, [rsp + 0x78]
call fcn.6620ec20
xor esi, esi
jmp 0x6620ad6e
xor esi, esi
mov qword [rsp + 0x38], rsi
call fcn.66209d60
test rax, rax
je 0x6620ad36
cmp byte [rax + 0x3c], sil
je 0x6620ad36
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 2
lea r9, [rsp + 0x78]
mov r8, rbx
mov rdx, qword [r14 + 0x58]
mov rcx, rax
call fcn.6620a230
jmp 0x6620ad58
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [rsp + 0x78]
mov rdx, rbx
mov rcx, qword [r14 + 0x58]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x6620ad69
cmp qword [rsp + 0x38], 2
je 0x6620ad6e
mov eax, 0xc0000004
jmp 0x6620af83
mov eax, 0x5a4d
cmp word [rsp + 0x78], ax
je 0x6620ad84
mov eax, 0xc000007b
jmp 0x6620af83
cmp byte [r14 + 0x70], 0
je 0x6620ada1
mov r8d, 4
lea rdx, [rbx + 0x3c]
lea rcx, [rsp + 0x30]
call fcn.6620ec20
jmp 0x6620ae19
mov qword [rsp + 0x40], rsi
call fcn.66209d60
test rax, rax
je 0x6620ade0
cmp byte [rax + 0x3c], 0
je 0x6620ade0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
lea r8, [rbx + 0x3c]
mov rdx, qword [r14 + 0x58]
mov rcx, rax
call fcn.6620a230
jmp 0x6620ae03
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x30]
lea rdx, [rbx + 0x3c]
mov rcx, qword [r14 + 0x58]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x6620ae14
cmp qword [rsp + 0x40], 4
je 0x6620ae19
mov eax, 0xc0000004
jmp 0x6620af83
mov ecx, dword [rsp + 0x30]
cmp rcx, qword [rsp + 0x98]
jae 0x6620af70
lea eax, [rcx + 0x18]
cmp eax, ecx
jb 0x6620af70
cmp rax, qword [rsp + 0x98]
jae 0x6620af70
cmp ecx, 0x10000000
jae 0x6620af70
lea rdi, [rcx + rbx]
cmp byte [r14 + 0x70], 0
je 0x6620ae70
mov r8d, 4
mov rdx, rdi
lea rcx, [rsp + 0x34]
call fcn.6620ec20
jmp 0x6620aee6
mov qword [rsp + 0x48], rsi
call fcn.66209d60
test rax, rax
je 0x6620aeae
cmp byte [rax + 0x3c], 0
je 0x6620aeae
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8, rdi
mov rdx, qword [r14 + 0x58]
mov rcx, rax
call fcn.6620a230
jmp 0x6620aed0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x34]
mov rdx, rdi
mov rcx, qword [r14 + 0x58]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x6620aee1
cmp qword [rsp + 0x48], 4
je 0x6620aee6
mov eax, 0xc0000004
jmp 0x6620af83
cmp dword [rsp + 0x34], 0x4550
je 0x6620aefa
mov eax, 0xc000007b
jmp 0x6620af83
mov esi, dword [rsp + 0x30]
add rsi, rbx
test r12, r12
je 0x6620af0a
mov qword [r12], rsi
mov rdi, qword [rsp + 0x90]
test rdi, rdi
je 0x6620af6c
mov qword [rdi + 0x108], rsi
mov qword [rdi + 0x110], rbx
mov byte [rdi + 0x118], r13b
mov r9d, 0x18
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call fcn.6620a170
test eax, eax
js 0x6620af83
movzx ecx, word [rdi + 0x14]
mov eax, 0xf0
cmp ax, cx
jb 0x6620af55
movzx eax, cx
mov r9d, eax
lea r8, [rdi + 0x18]
lea rdx, [rsi + 0x18]
mov rcx, r14
call fcn.6620a170
test eax, eax
js 0x6620af83
xor eax, eax
jmp 0x6620af83
mov eax, 0xc000007b
jmp 0x6620af83
mov eax, 0xc000000d
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret