Function at 0x7ff7ec9b8020
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xa0
mov rax, qword [0x7ff7ec9ca040]
xor rax, rsp
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x19], rax
mov rdi, qword [0x7ff7ec9cc600]
mov qword [rbp - 0x49], rdi
mov eax, 0x5a4d
cmp word [0x7ff7ec9ca0c0], ax
jne 0x7ff7ec9b8177
movsxd rsi, dword [0x7ff7ec9ca0fc]
lea rax, [0x7ff7ec9ca0c0]
add rsi, rax
cmp dword [rsi], 0x4550
jne 0x7ff7ec9b8177
mov eax, 0x20b
cmp word [rsi + 0x18], ax
jne 0x7ff7ec9b8177
mov r15d, dword [rsi + 0x50]
mov edx, r15d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x7ff7ec9b8177
movzx ecx, word [rsi + 0x14]
mov eax, dword [rcx + rsi + 0x24]
mov dword [rbp - 0x55], eax
sub r15d, eax
xor r14d, r14d
mov qword [rbp - 0x21], r14
mov eax, dword [rbp + 0x67]
cmp eax, 1
jne 0x7ff7ec9b80fc
mov edx, r15d
lea r8, [rbp - 0x21]
mov rcx, rdi
call fcn.7ff7ec9b7c10
mov r13, rax
jmp 0x7ff7ec9b83c2
cmp eax, 2
jne 0x7ff7ec9b829b
mov qword [rbp - 0x51], r14
lea rax, [0x7ff7ec9bd778]
mov qword [rsp + 0x20], rax
lea r9, [0x7ff7ec9bd7a0]
mov r8, qword [0x7ff7ec9cc5f8]
lea rdx, [0x7ff7ec9bd7c8]
mov rcx, rdi
call fcn.7ff7ec9b3e30
mov rbx, rax
mov qword [0x7ff7ec9cc618], rax
test rax, rax
je 0x7ff7ec9b8166
mov dword [rbp - 0x11], r14d
lea r8, [rax + 1]
mov r9d, 4
lea rdx, [rbp - 0x11]
mov rcx, rdi
call fcn.7ff7ec9b26b0
test al, al
jne 0x7ff7ec9b81a6
mov qword [0x7ff7ec9cc618], r14
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.kernel32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.7ff7ec9bae90
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rcx, dword [rbp - 0x11]
add rcx, 5
add rcx, rbx
mov qword [0x7ff7ec9cc618], rcx
je 0x7ff7ec9b8166
mov r9d, r15d
lea rdx, [rbp - 0x51]
mov rcx, rdi
call fcn.7ff7ec9b5c50
test al, al
je 0x7ff7ec9b8166
mov r13, qword [rbp - 0x51]
test r13, r13
je 0x7ff7ec9b8166
lea rax, [0x7ff7ec9bd800]
mov qword [rsp + 0x20], rax
lea r9, [0x7ff7ec9bd820]
mov r8, qword [0x7ff7ec9cc5f8]
lea rdx, [0x7ff7ec9bd6ec]
mov rcx, rdi
call fcn.7ff7ec9b3e30
mov qword [0x7ff7ec9cc568], rax
test rax, rax
je 0x7ff7ec9b8288
lea rbx, [rax + 0xc]
mov qword [0x7ff7ec9cc568], rbx
mov dword [rbp - 0x11], r14d
lea r8, [rbx + 1]
mov r9d, 4
lea rdx, [rbp - 0x11]
mov rcx, rdi
call fcn.7ff7ec9b26b0
test al, al
jne 0x7ff7ec9b824e
mov qword [0x7ff7ec9cc568], r14
mov r8d, r15d
mov rdx, r13
mov rcx, rdi
call fcn.7ff7ec9b28d0
jmp 0x7ff7ec9b8166
movsxd rcx, dword [rbp - 0x11]
add rcx, 5
add rcx, rbx
mov qword [0x7ff7ec9cc568], rcx
je 0x7ff7ec9b8288
mov byte [rbp - 0x59], r14b
mov dword [rsp + 0x20], r15d
mov r9, r13
lea rdx, [rbp - 0x59]
mov rcx, rdi
call fcn.7ff7ec9b6050
test al, al
je 0x7ff7ec9b8288
cmp byte [rbp - 0x59], r14b
jne 0x7ff7ec9b83c2
mov r8d, r15d
mov rdx, r13
mov rcx, rdi
call fcn.7ff7ec9b28d0
jmp 0x7ff7ec9b8166
mov ebx, r15d
test r15d, r15d
je 0x7ff7ec9b8166
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x7ff7ec9cc660], eax
jle 0x7ff7ec9b8393
lea rcx, [0x7ff7ec9cc660]
call fcn.7ff7ec9baf60
cmp dword [0x7ff7ec9cc660], 0xffffffff
jne 0x7ff7ec9b8393
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], r14
mov qword [rbp - 0x29], r14
mov ecx, 0x20
call fcn.7ff7ec9bafd8
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x31], 0x15
mov qword [rbp - 0x29], 0x1f
movups xmm0, xmmword [0x7ff7ec9bd8c8]
movups xmmword [rax], xmm0
mov ecx, dword [0x7ff7ec9bd8d8]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x7ff7ec9bd8dc]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea r8, [rbp - 0x41]
mov rdx, qword [0x7ff7ec9cc5f8]
mov rcx, rdi
call fcn.7ff7ec9b2d40
mov qword [0x7ff7ec9cc748], rax
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x7ff7ec9b8387
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff7ec9b8381
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff7ec9b8381
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff7ec9baeb0
nop
lea rcx, [0x7ff7ec9cc660]
call fcn.7ff7ec9baef4
cmp qword [0x7ff7ec9cc748], 0
je 0x7ff7ec9b8166
mov qword [rbp - 0x51], r14
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x51]
mov rcx, rdi
call fcn.7ff7ec9b6c50
test al, al
je 0x7ff7ec9b8166
mov r13, qword [rbp - 0x51]
test r13, r13
je 0x7ff7ec9b8166
mov r8d, dword [rsi + 0x54]
lea rdx, [0x7ff7ec9ca0c0]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy_1
movzx ebx, word [rsi + 0x14]
add rbx, 0x28
xor eax, eax
cmp ax, word [rsi + 6]
jae 0x7ff7ec9b8431
add rbx, rsi
lea rdi, [0x7ff7ec9ca0c0]
nop dword [rax + rax]
test dword [rbx + 0x14], 0x80
ja 0x7ff7ec9b841d
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, rdi
mov ecx, dword [rbx - 4]
add rcx, r12
call sub.VCRUNTIME140.dll_memcpy_1
inc r14d
add rbx, 0x28
movzx eax, word [rsi + 6]
cmp r14d, eax
jl 0x7ff7ec9b8400
mov rdi, qword [rbp - 0x49]
mov r14d, r15d
mov rbx, r13
mov eax, dword [rbp - 0x55]
sub r13, rax
mov rdx, r12
lea rcx, [rbp - 0x41]
call fcn.7ff7ec9b9420
mov rdx, r13
sub rdx, qword [rsi + 0x30]
mov rcx, rax
call fcn.7ff7ec9b8560
mov rdx, r13
mov rcx, r12
call fcn.7ff7ec9b8660
test al, al
je 0x7ff7ec9b8177
mov rdx, r12
lea rcx, [rbp - 0x41]
call fcn.7ff7ec9b9570
mov rdx, rax
mov rcx, rdi
call fcn.7ff7ec9b8710
test al, al
je 0x7ff7ec9b84ea
mov r8d, dword [rbp - 0x55]
add r8, r12
mov r9d, r14d
mov rdx, rbx
mov rcx, rdi
call fcn.7ff7ec9b26b0
test al, al
je 0x7ff7ec9b84ea
mov r8d, dword [rsi + 0x28]
add r8, r13
xor eax, eax
mov dword [rbp - 0x55], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea rdx, [rbp - 0x55]
mov rcx, rdi
call fcn.7ff7ec9b8ae0
test al, al
je 0x7ff7ec9b84ea
mov rax, qword [rbp - 0x19]
test rax, rax
je 0x7ff7ec9b84d1
mov ecx, dword [rbp - 0x55]
mov dword [rax], ecx
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.kernel32.dll_VirtualFree]
mov rax, rbx
jmp 0x7ff7ec9b8179
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.kernel32.dll_VirtualFree]
mov eax, dword [rbp + 0x67]
mov rdx, rbx
cmp eax, 1
jne 0x7ff7ec9b8540
mov rsi, qword [rbp - 0x21]
mov r8, rsi
mov rcx, rdi
call fcn.7ff7ec9b29c0
test al, al
je 0x7ff7ec9b8177
mov rdx, rsi
mov rcx, rdi
call fcn.7ff7ec9b2af0
test al, al
je 0x7ff7ec9b8177
mov rdx, rsi
mov rcx, rdi
call fcn.7ff7ec9b2c20
jmp 0x7ff7ec9b8177
cmp eax, 2
jne 0x7ff7ec9b8533
mov r8d, r15d
mov rcx, rdi
call fcn.7ff7ec9b28d0
jmp 0x7ff7ec9b8177