Function at 0x140015eac
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov eax, 0x5a4d
mov r15, rcx
cmp word [0x1401cd3c0], ax
jne 0x140016171
movsxd rdi, dword [0x1401cd3fc]
lea r14, [0x1401cd3c0]
add rdi, r14
cmp dword [rdi], 0x4550
jne 0x140016171
xor ebp, ebp
test rdi, rdi
je 0x140016171
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x140016171
mov ebx, dword [rdi + 0x50]
lea r9d, [rbp + 4]
mov edx, ebx
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x140016171
movzx ecx, word [rdi + 0x14]
mov r13d, dword [rcx + rdi + 0x24]
mov rcx, r15
sub ebx, r13d
mov eax, ebx
mov r8d, ebx
mov qword [rsp + 0xb8], rax
call fcn.140013b78
mov r12, rax
mov rcx, rsi
test rax, rax
jne 0x140015f74
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140016171
mov r8d, dword [rdi + 0x54]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rdi + 0x14]
xor eax, eax
add rbx, 0x28
cmp ax, word [rdi + 6]
jae 0x140015fcd
add rbx, rdi
lea r15, [0x1401cd3c0]
test dword [rbx + 0x14], 0x80
ja 0x140015fb7
mov edx, dword [rbx + 4]
mov ecx, dword [rbx - 4]
add rdx, r15
mov r8d, dword [rbx]
add rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rdi + 6]
inc ebp
add rbx, 0x28
cmp ebp, eax
jl 0x140015f9a
mov r15, qword [rsp + 0xa0]
mov rbp, r12
lea rcx, [rsp + 0x30]
sub r12, r13
mov rdx, rsi
mov rbx, r12
sub rbx, qword [rdi + 0x30]
call fcn.140016854
mov r10, rax
mov r11, qword [rax + 8]
mov rdx, qword [rax]
cmp rdx, r11
je 0x140016044
xor eax, eax
mov r8d, eax
cmp dword [rdx + 0x10], eax
jbe 0x14001603b
mov rax, qword [rdx + 8]
mov ecx, r8d
movzx r9d, word [rax + rcx*2]
mov ecx, 0xf000
movzx eax, r9w
and ax, cx
mov ecx, 0xa000
cmp ax, cx
jne 0x140016030
mov rax, qword [rdx]
and r9d, 0xfff
add qword [r9 + rax], rbx
inc r8d
cmp r8d, dword [rdx + 0x10]
jb 0x140016000
xor eax, eax
add rdx, 0x18
cmp rdx, r11
jne 0x140015ff8
mov rcx, r10
call fcn.1400163cc
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140016171
movsxd rax, dword [rsi + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
jne 0x140016171
xor ebx, ebx
test rax, rax
je 0x140016171
mov ecx, dword [rax + 0xd8]
test ecx, ecx
je 0x1400160de
mov r14, qword [rcx + rsi + 0x58]
test r14, r14
je 0x1400160de
mov rax, rsi
sub rax, r12
add r14, rax
movabs rax, 0x2b992ddfa232
cmp qword [r14], rax
jne 0x140016171
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movabs rdx, 0x2b992ddfa232
xor rcx, rbx
movabs rax, 0x2b992ddfa233
xor rcx, rdx
cmp rcx, rdx
cmove rcx, rax
xor ebx, ebx
mov qword [r14], rcx
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140016984
mov rdx, rax
mov rcx, r15
call fcn.140016184
test al, al
je 0x140016155
mov r9, qword [rsp + 0xb8]
lea r8, [rsi + r13]
mov rdx, rbp
mov rcx, r15
call fcn.140013968
test al, al
je 0x140016155
mov r8d, dword [rdi + 0x28]
lea rdx, [rsp + 0xc0]
add r8, r12
mov dword [rsp + 0xc0], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rcx, r15
call fcn.140016488
test al, al
je 0x140016155
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbp
jmp 0x140016173
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, rbp
mov rcx, r15
call fcn.140013ce4
xor eax, eax
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret