Function at 0x14006c548
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov byte [rax + 0x20], r9b
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140105640]
mov rsi, rcx
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006c7e7
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
cmp dword [rdi], 0x4550
jne 0x14006c7e7
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14006c7e7
mov ebx, dword [rdi + 0x50]
xor ecx, ecx
mov edx, ebx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r14d, r14d
mov r12, rax
test rax, rax
je 0x14006c7e7
movzx ecx, word [rdi + 0x14]
mov r13d, r14d
mov qword [rbp - 0x30], r14
mov edx, dword [rcx + rdi + 0x24]
mov cl, byte [rbp + 0x60]
neg cl
mov dword [rbp - 0x40], edx
mov rcx, rsi
sbb eax, eax
and eax, edx
sub ebx, eax
mov dword [rbp - 0x38], eax
mov eax, ebx
mov qword [rbp - 0x28], rax
cmp byte [rbp + 0x68], r14b
je 0x14006c60d
lea r8, [rbp - 0x30]
mov edx, eax
call fcn.14006c444
mov r13, qword [rbp - 0x30]
jmp 0x14006c617
mov r8, rax
xor edx, edx
call fcn.140069904
mov qword [rbp - 0x30], rax
mov r15, rax
test rax, rax
je 0x14006c7ca
mov r8d, r14d
mov rdx, qword [0x140105640]
cmp dword [rdi + 0x54], r14d
jbe 0x14006c64e
mov rcx, r12
sub rdx, r12
mov al, byte [rcx + rdx]
inc r8d
mov byte [rcx], al
inc rcx
cmp r8d, dword [rdi + 0x54]
jb 0x14006c63d
movzx edx, word [rdi + 0x14]
mov r9d, r14d
add rdx, 0x28
cmp r14w, word [rdi + 6]
jae 0x14006c6af
add rdx, rdi
test dword [rdx + 0x14], 0x80
ja 0x14006c69f
mov r8d, dword [rdx + 4]
mov r10d, r14d
mov ecx, dword [rdx - 4]
add r8, qword [0x140105640]
add rcx, r12
mov r11d, dword [rdx]
test r11, r11
je 0x14006c69f
sub r8, rcx
mov al, byte [rcx + r8]
inc r10d
mov byte [rcx], al
inc rcx
movsxd rax, r10d
cmp rax, r11
jb 0x14006c68b
movzx eax, word [rdi + 6]
inc r9d
add rdx, 0x28
cmp r9d, eax
jl 0x14006c663
cmp byte [rbp + 0x60], 0
mov r14, r15
je 0x14006c6be
mov eax, dword [rbp - 0x40]
sub r15, rax
mov rbx, r15
lea rcx, [rbp - 0x20]
sub rbx, qword [rdi + 0x30]
mov rdx, r12
call fcn.14006d7f8
mov rdx, rbx
mov rcx, rax
call fcn.14006c804
mov rdx, r12
lea rcx, [rbp - 0x20]
call fcn.14006d528
mov rdx, rax
mov rcx, rsi
call fcn.14006c864
test al, al
je 0x14006c7ca
mov r8d, dword [rbp - 0x38]
mov rdx, r14
mov r9, qword [rbp - 0x28]
add r8, r12
mov rcx, rsi
call fcn.14006bec0
test al, al
je 0x14006c7ca
mov ebx, dword [rdi + 0x28]
xor edi, edi
mov rax, qword [rbp + 0x78]
add rbx, r15
test rax, rax
je 0x14006c748
mov r9, qword [rbp - 0x28]
lea rdx, [rbp + 0x50]
mov r8, r14
mov qword [rsp + 0x20], r13
lea rcx, [rbp + 0x48]
call rax
test al, al
je 0x14006c7ca
mov r9, qword [rbp + 0x48]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x50]
mov r8, rbx
cmp byte [rbp + 0x70], dil
mov rcx, rsi
mov dword [rbp - 0x40], edi
cmovne r9, r14
mov qword [rsp + 0x20], rax
call fcn.14006c018
test al, al
je 0x14006c7ca
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x14006c784
mov eax, dword [rbp - 0x40]
mov dword [rcx], eax
cmp byte [rbp + 0x58], dil
je 0x14006c7b4
mov rdx, r14
mov rcx, rsi
cmp byte [rbp + 0x68], dil
je 0x14006c7af
mov r8, r13
call fcn.14006b854
mov rdx, r13
mov rcx, rsi
call fcn.14006b464
mov rdx, r13
mov rcx, rsi
call fcn.14006a830
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r14
jmp 0x14006c7e9
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp - 0x30]
mov rcx, rsi
call fcn.14006a830
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret