Function at 0x6620ac90
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x50
mov r12, r9
movzx r13d, r8b
mov rbx, rdx
mov r14, rcx
test rdx, rdx
je 0x6620af8e
mov eax, 0xffffffff
cmp rdx, rax
je 0x6620af8e
cmp rdx, 0xffffffffffffffff
je 0x6620af8e
cmp qword [rsp + 0x98], 0x40
jae 0x6620acec
mov eax, 0xc000007b
jmp 0x6620af93
cmp byte [rcx + 0x70], 0
je 0x6620ad06
mov r8d, 2
lea rcx, [rsp + 0x78]
call fcn.6620ec30
xor esi, esi
jmp 0x6620ad7e
xor esi, esi
mov qword [rsp + 0x38], rsi
call fcn.66209d70
test rax, rax
je 0x6620ad46
cmp byte [rax + 0x3c], sil
je 0x6620ad46
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 2
lea r9, [rsp + 0x78]
mov r8, rbx
mov rdx, qword [r14 + 0x58]
mov rcx, rax
call fcn.6620a240
jmp 0x6620ad68
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [rsp + 0x78]
mov rdx, rbx
mov rcx, qword [r14 + 0x58]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x6620ad79
cmp qword [rsp + 0x38], 2
je 0x6620ad7e
mov eax, 0xc0000004
jmp 0x6620af93
mov eax, 0x5a4d
cmp word [rsp + 0x78], ax
je 0x6620ad94
mov eax, 0xc000007b
jmp 0x6620af93
cmp byte [r14 + 0x70], 0
je 0x6620adb1
mov r8d, 4
lea rdx, [rbx + 0x3c]
lea rcx, [rsp + 0x30]
call fcn.6620ec30
jmp 0x6620ae29
mov qword [rsp + 0x40], rsi
call fcn.66209d70
test rax, rax
je 0x6620adf0
cmp byte [rax + 0x3c], 0
je 0x6620adf0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
lea r8, [rbx + 0x3c]
mov rdx, qword [r14 + 0x58]
mov rcx, rax
call fcn.6620a240
jmp 0x6620ae13
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x30]
lea rdx, [rbx + 0x3c]
mov rcx, qword [r14 + 0x58]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x6620ae24
cmp qword [rsp + 0x40], 4
je 0x6620ae29
mov eax, 0xc0000004
jmp 0x6620af93
mov ecx, dword [rsp + 0x30]
cmp rcx, qword [rsp + 0x98]
jae 0x6620af80
lea eax, [rcx + 0x18]
cmp eax, ecx
jb 0x6620af80
cmp rax, qword [rsp + 0x98]
jae 0x6620af80
cmp ecx, 0x10000000
jae 0x6620af80
lea rdi, [rcx + rbx]
cmp byte [r14 + 0x70], 0
je 0x6620ae80
mov r8d, 4
mov rdx, rdi
lea rcx, [rsp + 0x34]
call fcn.6620ec30
jmp 0x6620aef6
mov qword [rsp + 0x48], rsi
call fcn.66209d70
test rax, rax
je 0x6620aebe
cmp byte [rax + 0x3c], 0
je 0x6620aebe
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8, rdi
mov rdx, qword [r14 + 0x58]
mov rcx, rax
call fcn.6620a240
jmp 0x6620aee0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x34]
mov rdx, rdi
mov rcx, qword [r14 + 0x58]
call qword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
js 0x6620aef1
cmp qword [rsp + 0x48], 4
je 0x6620aef6
mov eax, 0xc0000004
jmp 0x6620af93
cmp dword [rsp + 0x34], 0x4550
je 0x6620af0a
mov eax, 0xc000007b
jmp 0x6620af93
mov esi, dword [rsp + 0x30]
add rsi, rbx
test r12, r12
je 0x6620af1a
mov qword [r12], rsi
mov rdi, qword [rsp + 0x90]
test rdi, rdi
je 0x6620af7c
mov qword [rdi + 0x108], rsi
mov qword [rdi + 0x110], rbx
mov byte [rdi + 0x118], r13b
mov r9d, 0x18
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call fcn.6620a180
test eax, eax
js 0x6620af93
movzx ecx, word [rdi + 0x14]
mov eax, 0xf0
cmp ax, cx
jb 0x6620af65
movzx eax, cx
mov r9d, eax
lea r8, [rdi + 0x18]
lea rdx, [rsi + 0x18]
mov rcx, r14
call fcn.6620a180
test eax, eax
js 0x6620af93
xor eax, eax
jmp 0x6620af93
mov eax, 0xc000007b
jmp 0x6620af93
mov eax, 0xc000000d
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret