Function at 0x14004f560
Capabilities:
Parse pe header

Disassembly:
xchg r10, rbx
mov qword [rsp + 0x10], r10
xchg r10, rbx
mov qword [rsp + 0x18], rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r14
sub rsp, 8
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov r15, r8
movsxd rsi, edx
xchg rsi, r14
mov rsi, rcx
xchg rsi, r14
xor r12d, r12d
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
lea rcx, [r14 + 0x108]
call fcn.14007b330
test rax, rax
jne 0x14004f614
test esi, esi
je 0x14004f614
mov ecx, 0x188fb367
sub ecx, 0x3a338c3
add ecx, 0x659296ac
xor ecx, 0x13913a59
sub ecx, 0x683f8f90
add ecx, 0x3cc14579
add ecx, 0x14e66b9d
xor ecx, 0x1e24465b
add ecx, 0x3299f52f
jmp 0x14004fbf1
lea rax, [rsp + 0x40]
mov qword [rbp + 0x67], rax
mov byte [rbp - 0x79], r12b
xor eax, eax
xchg r9, rax
mov qword [rbp - 0x71], r9
xchg r9, rax
xor edx, edx
lea rcx, [rbp - 0x71]
call fcn.140054400
mov byte [rbp - 0x79], 9
xor byte [rbp - 0x79], 0x59
add byte [rbp - 0x79], 9
sub byte [rbp - 0x79], 0x28
add byte [rbp - 0x79], 0x2d
sub byte [rbp - 0x79], 0x11
sub byte [rbp - 0x79], 0x3e
sub byte [rbp - 0x79], 9
mov eax, esi
mov qword [rbp - 0x71], rax
xchg r12, rcx
mov qword [rbp - 0x69], rcx
xchg rcx, r12
mov byte [rbp - 0x61], 0x59
xor byte [rbp - 0x61], 0x60
xor byte [rbp - 0x61], 0x1c
add byte [rbp - 0x61], 0x51
sub byte [rbp - 0x61], 0x4d
add byte [rbp - 0x61], 3
sub byte [rbp - 0x61], 0xa
sub byte [rbp - 0x61], 0x22
xor eax, eax
mov qword [rbp - 0x59], rax
xor edx, edx
lea rcx, [rbp - 0x59]
call fcn.140054400
mov byte [rbp - 0x61], 0x2d
xor byte [rbp - 0x61], 0x4e
sub byte [rbp - 0x61], 0x3a
add byte [rbp - 0x61], 0x1c
add byte [rbp - 0x61], 0x36
sub byte [rbp - 0x61], 0x24
xor byte [rbp - 0x61], 0x52
mov qword [rbp - 0x59], rdi
mov qword [rbp - 0x51], r12
lea rcx, [r14 + 0x108]
call fcn.14007b260
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
nop
movabs rbx, 0xffffffff60bf551d
sub rbx, 0x2a7802b5
add rbx, 0x17bee849
xor rbx, 0x4ce44b02
add rbx, 0x6fdcf822
add rbx, 0x7fffffff
add rbx, 0xd40962b
xchg rbx, r13
mov r8, r13
xchg r13, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004f71e
xchg rdx, r9
mov r9, rax
xchg r9, rdx
lea rcx, [rsp + 0x20]
call fcn.140030e10
nop
lea r8, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae r8, qword [rsp + 0x20]
mov rax, qword [rsp + 0x30]
lea r9, [r8 + rax*2]
lea rdx, [rbp + 0x17]
mov rcx, r14
call fcn.140070a50
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x49]
call fcn.1400305d0
xchg r12, r15
mov qword [rbp - 0x39], r15
xchg r12, r15
mov byte [rbp - 0x31], 0x59
sub byte [rbp - 0x31], 0xe
sub byte [rbp - 0x31], 4
add byte [rbp - 0x31], 0x36
sub byte [rbp - 0x31], 0x57
add byte [rbp - 0x31], 0x43
sub byte [rbp - 0x31], 0x45
sub byte [rbp - 0x31], 0x24
xor eax, eax
xchg r10, rax
mov qword [rbp - 0x29], r10
xchg r10, rax
mov edi, dword [r14 + 0x154]
xor edx, edx
lea rcx, [rbp - 0x29]
call fcn.140054400
mov byte [rbp - 0x31], 0x7e
sub byte [rbp - 0x31], 0x53
add byte [rbp - 0x31], 0x11
add byte [rbp - 0x31], 0x3f
sub byte [rbp - 0x31], 3
xor byte [rbp - 0x31], 0x40
add byte [rbp - 0x31], 2
add byte [rbp - 0x31], 0x19
sub byte [rbp - 0x31], 0x4d
xchg rdi, r14
mov qword [rbp - 0x29], r14
xchg r14, rdi
mov qword [rbp - 0x21], r12
mov byte [rbp - 0x19], 0x51
xor byte [rbp - 0x19], 0x7a
add byte [rbp - 0x19], 0x1e
xor byte [rbp - 0x19], 0x51
xor byte [rbp - 0x19], 0x69
sub byte [rbp - 0x19], 0x39
sub byte [rbp - 0x19], 0x38
xor eax, eax
mov qword [rbp - 0x11], rax
mov edi, dword [r14 + 0x150]
xor edx, edx
lea rcx, [rbp - 0x11]
call fcn.140054400
mov byte [rbp - 0x19], reloc.SHLWAPI.dll_SHCreateMemStream
add byte [rbp - 0x19], 0x23
add byte [rbp - 0x19], 4
xor byte [rbp - 0x19], 8
sub byte [rbp - 0x19], 0x30
add byte [rbp - 0x19], 0x25
xor byte [rbp - 0x19], 0x13
xor byte [rbp - 0x19], 0x2d
sub byte [rbp - 0x19], 8
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], r12
lea rax, [rbp - 0x79]
xchg r15, rax
mov qword [rbp + 7], r15
xchg r15, rax
lea rax, [rbp - 1]
xchg r14, rax
mov qword [rbp + 0xf], r14
xchg r14, rax
mov r9b, 0x79
sub r9b, 0x34
add r9b, 0x20
sub r9b, 0x58
xor r9b, 0x50
sub r9b, 0x3e
add r9b, 0x3c
xor r9b, 0x59
mov r8b, 0x72
sub r8b, 0x6f
xor r8b, 0x5a
add r8b, 0xb
add r8b, 0x14
sub r8b, 6
xor r8b, 0x78
sub r8b, 9
lea rdx, [rbp + 7]
lea rcx, [rsp + 0x40]
call fcn.1400492f0
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
xor edx, edx
xchg r13, rcx
mov r13, r15
xchg rcx, r13
call fcn.14004e250
nop
movzx edx, byte [rax]
movzx ecx, byte [rdi]
mov byte [rax], cl
mov byte [rdi], dl
lea rcx, [rdi + 8]
mov rdx, qword [rax + 8]
mov r8, qword [rcx]
xchg r8, r14
mov qword [rax + 8], r14
xchg r14, r8
xchg rdx, r8
mov qword [rcx], r8
xchg r8, rdx
movzx edx, byte [rdi]
call fcn.140054400
nop
lea r9, [0x14004caf0]
mov edx, 0x1e0f7fd9
add edx, 0x50dd7d62
xor edx, 0x73578c73
add edx, 0x1d277404
xor edx, 0x56f360f4
sub edx, 0x19d7ed7b
xor edx, 0x52399825
lea r8d, [rdx - 0x13]
lea rcx, [rbp - 0x79]
call fcn.1401fcf58
nop
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x14004f989
inc rdx
xchg rcx, r12
mov r12, qword [rbp + 0x17]
xchg r12, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f983
sub rdx, 0xffffffffffffffd9
mov rcx, qword [rcx - 8]
sub rax, rcx
sub rax, 8
cmp rax, 0x1f
jbe 0x14004f983
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fcccc
nop
xchg rdx, r11
mov r11, qword [rsp + 0x38]
xchg r11, rdx
cmp rdx, 8
jb 0x14004f9fe
lea rdx, [rdx*2 + 2]
xchg rcx, r13
mov r13, qword [rsp + 0x20]
xchg rcx, r13
xchg r13, rax
mov r13, rcx
xchg r13, rax
cmp rdx, 0x1000
jb 0x14004f9f9
nop
sub rdx, 0x5f4ab212
add rdx, 0x5f4ab239
mov rcx, qword [rcx - 8]
sub rax, rcx
nop
add rax, 0xffffffff944f2dd9
sub rax, 0xffffffff944f2de1
cmp rax, 0x1f
jbe 0x14004f9f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fcccc
cmp esi, 0x10
ja case.default.0x14004fa20
lea rdx, [0x140000000]
movzx eax, byte [rdx + rsi + 0x4fc58]
mov ecx, dword [rdx + rax*4 + 0x4fc50]
add rcx, rdx
jmp rcx
lea rax, [rsp + 0x40]
mov qword [rbp + 0x67], rax
lea rcx, [r14 + 0x120]
call fcn.14007b2c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004fa48
xchg rbp, rbx
mov r8, rbp
xchg rbx, rbp
xchg rcx, rax
mov rdx, rcx
xchg rcx, rax
lea rcx, [rsp + 0x20]
call fcn.140030c10
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400305d0
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
mov edx, 0x3c72f5d7
add edx, 0x36e8f88a
xor edx, 0x6b2a525a
add edx, 0x1f5a0f80
xor edx, 0x510946d2
add edx, 0x63ce85
xor edx, 0x2333194c
sub edx, 0x441542a1
xchg rcx, r9
mov r9, r15
xchg rcx, r9
call fcn.14004e250
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
mov rdx, rbx
call fcn.14004db80
nop
xchg rdx, rcx
mov rcx, qword [rsp + 0x38]
xchg rdx, rcx
cmp rdx, 0x10
jb 0x14004fb3c
inc rdx
xchg rcx, rbx
mov rbx, qword [rsp + 0x20]
xchg rcx, rbx
xchg rcx, r12
mov rax, r12
xchg r12, rcx
cmp rdx, 0x1000
jb 0x14004fb37
nop
add rdx, 0x3d8a8059
sub rdx, 0x3d8a8032
mov rcx, qword [rcx - 8]
sub rax, rcx
sub rax, 8
cmp rax, 0x1f
jbe 0x14004fb37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fcccc
lea rax, [rsp + 0x40]
mov qword [rbp + 0x67], rax
lea rdx, [r14 + 0x158]
lea rcx, [rsp + 0x40]
call fcn.14002ff40
xchg r15, rbx
mov r15, rax
xchg r15, rbx
mov edx, 0xa0d76f8
xor edx, 0x25f9d9e7
add edx, 0x28bf0e62
add edx, 0x125aacb6
sub edx, 0x1235ed3a
sub edx, 0x409bde87
add edx, 0xa1e10e3
sub edx, 0x225aaf57
xchg r15, rcx
mov r15, rcx
xchg rcx, r15
call fcn.14004e250
xchg r13, rax
mov rcx, r13
xchg r13, rax
xchg r8, rbx
mov rdx, r8
xchg r8, rbx
call fcn.14004db80
mov al, 0x64
sub al, 0x29
sub al, 0x2f
add al, 0x3b
sub al, 0x14
xor al, 0x34
add al, 0x38
sub al, 0x1c
xor al, 0x22
jmp 0x14004fbf9
mov ecx, 0x223c07c
add ecx, 0x6ab97fc5
sub ecx, 0x6afd764b
add ecx, 0x7c596004
sub ecx, 0xd9ee487
sub ecx, 0x59af7087
sub ecx, 0x16eacf67
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
push rax
push rcx
xchg qword [rsp + 0x10], r15
pop rcx
pop rax
add rsp, 8
push rax
push rax
push rbx
push rbx
push rdx
push rcx
push rax
xchg qword [rsp + 0x38], r14
add rsp, 0x40
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rbp
nop
add rsp, 8
jmp qword [rsp - 8]