Function at 0x140004ba0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r9d, 0x40
mov rcx, rdx
mov rdx, r8
xor r8d, r8d
call fcn.140007970
lea rcx, [0x140025e8c]
mov r8d, 0x24
test rax, rax
je 0x140004cbf
cmp rdx, 0x40
jb 0x140004cbf
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x140004cb2
mov r12, rax
mov r14d, dword [rax + 0x3c]
mov r9d, 0x78
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.140007970
mov ebp, 0x21
lea rcx, str.Invalid_PE_headers_offset_or_sizeInvalid_PE_optional_header_magicPE_optional_header_size_is_too_smallInvalid_PE_optional_header_sizeInvalid_PE_magicInvalid_DOS_header_size_or_alignmentInvalid_DOS_magicInvalid_ELF_symbol_table_dataInvalid_ELF_symtab_shndx_dataInvalid_ELF_string_section_typeInvalid_COFF_section_name_offsetInvalid_COFF_file_header_size_or_alignmentInvalid_COFF_bigobj_file_header_size_or_alignmentInvalid_COFF_bigobj_header_valuesdescription___is_deprecated__use_DisplayError
test rax, rax
je 0x140004cfa
cmp rdx, 0x78
jb 0x140004cfa
cmp dword [rax], 0x4550
jne 0x140004cc9
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
jne 0x140004cd7
movzx r15d, word [rax + 0x14]
cmp r15, 0x60
jb 0x140004ce5
mov r13, rax
add r14, 0x78
add r15, 0xffffffffffffffa0
mov rcx, rbx
mov rdx, rdi
mov r8, r14
mov r9, r15
call fcn.140007970
mov ebp, 0x1f
test rax, rax
je 0x140004cf3
mov r8, rdx
mov r9d, dword [r13 + 0x74]
lea rcx, [rsp + 0x50]
mov rdx, rax
call fcn.140007d90
cmp qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
je 0x140004d1d
mov rbp, rax
jmp 0x140004cfa
lea rcx, [0x140025eb0]
mov r8d, 0x11
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r8
jmp 0x140004d02
mov ebp, 0x10
lea rcx, [0x140025e7c]
jmp 0x140004cfa
mov ebp, 0x20
lea rcx, [0x140025e19]
jmp 0x140004cfa
mov ebp, 0x24
lea rcx, [0x140025e39]
jmp 0x140004cfa
lea rcx, [0x140025e5d]
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rbp
mov qword [rsi], 0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
add r15, r14
movzx eax, word [r13 + 6]
mov qword [rsp + 0x20], rax
lea eax, [rax*8]
lea r14, [rax + rax*4]
mov rcx, rbx
mov rdx, rdi
mov r8, r15
mov r9, r14
call fcn.140007970
lea rcx, [0x1400257e6]
test rax, rax
je 0x140004cfa
cmp r14, rdx
ja 0x140004cfa
mov rdx, r13
mov r15d, dword [r13 + 0xc]
mov ecx, 1
mov qword [rsp + 0x30], rcx
test r15, r15
je 0x140004dc1
mov qword [rsp + 0x28], rax
mov ebp, dword [rdx + 0x10]
lea rax, [rbp*2]
lea r14, [rax + rax*8]
mov rcx, rbx
mov rdx, rdi
mov r8, r15
mov r9, r14
call fcn.140007970
test rax, rax
je 0x140004da6
cmp r14, rdx
jbe 0x140004dd4
xor r8d, r8d
xor r9d, r9d
xor r10d, r10d
xor r11d, r11d
mov rdx, r13
mov rax, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
jmp 0x140004e39
xor r8d, r8d
xor r9d, r9d
xor r10d, r10d
xor r11d, r11d
mov r15, qword [rsp + 0x20]
jmp 0x140004e39
mov qword [rsp + 0x38], rax
add r14, r15
mov r9d, 4
mov rcx, rbx
mov rdx, rdi
mov r8, r14
call fcn.140007970
xor r8d, r8d
test rax, rax
je 0x140004da9
mov rcx, rax
mov r9d, 0
mov r10d, 0
mov r11d, 0
cmp rdx, 4
mov rdx, r13
mov rax, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
jb 0x140004e39
mov r8d, dword [rcx]
add r8, r14
mov r9, r14
mov r10, rbx
mov r11, rbp
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x30], rcx
mov ecx, dword [rdx + 0x34]
mov qword [rsi], r12
mov qword [rsi + 8], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rsi + 0x10], rdx
mov rdx, qword [rsp + 0x48]
mov qword [rsi + 0x18], rdx
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], r15
mov rax, qword [rsp + 0x30]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], r11
mov qword [rsi + 0x40], r10
mov qword [rsi + 0x48], rdi
mov qword [rsi + 0x50], r9
mov qword [rsi + 0x58], r8
mov qword [rsi + 0x60], rcx
mov qword [rsi + 0x68], rbx
mov qword [rsi + 0x70], rdi
jmp 0x140004d09