Function at 0x1400842a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140122080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r8
mov r14, rcx
mov eax, 0x5a4d
cmp word [0x1401220c0], ax
jne 0x14008448b
movsxd rdi, dword [0x1401220fc]
lea rax, [0x1401220c0]
add rdi, rax
cmp dword [rdi], 0x4550
jne 0x14008448b
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14008448b
mov r15d, dword [rdi + 0x50]
mov edx, r15d
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x14008448b
movzx ecx, word [rdi + 0x14]
mov r13d, dword [rcx + rdi + 0x24]
sub r15d, r13d
xor esi, esi
mov qword [rsp + 0x48], rsi
cmp qword [0x140283a60], rsi
jne 0x1400843d3
lea rax, str.x____xxxxxxxx____xxxxxxxxx____xxxxxxxx
mov qword [rsp + 0x20], rax
lea r9, [0x14010d268]
mov r8, qword [0x140282ec8]
lea rdx, str.PAGELK
mov rcx, r14
call fcn.140082270
mov rbx, rax
mov qword [0x140283a60], rax
test rax, rax
je 0x14008447a
mov dword [rsp + 0x78], esi
lea r8, [rax + 1]
lea r9d, [rsi + 4]
lea rdx, [rsp + 0x78]
mov rcx, r14
call fcn.140080fc0
test al, al
jne 0x1400843ba
mov qword [0x140283a60], rsi
jmp 0x14008447a
movsxd rcx, dword [rsp + 0x78]
add rcx, 5
add rcx, rbx
mov qword [0x140283a60], rcx
je 0x14008447a
mov r9d, r15d
lea rdx, [rsp + 0x48]
mov rcx, r14
call fcn.140082e40
test al, al
je 0x14008447a
mov r12, qword [rsp + 0x48]
test r12, r12
je 0x14008447a
cmp qword [0x140283a50], rsi
jne 0x1400844cd
lea rax, str.xx____x___x_x____xxxxxxx____x
mov qword [rsp + 0x20], rax
lea r9, [0x14010d2c0]
mov r8, qword [0x140282ec8]
lea rdx, str.PAGE
mov rcx, r14
call fcn.140082270
mov qword [0x140283a50], rax
test rax, rax
je 0x14008446c
lea rbx, [rax + 0xc]
mov qword [0x140283a50], rbx
mov dword [rsp + 0x78], esi
lea r8, [rbx + 1]
mov r9d, 4
lea rdx, [rsp + 0x78]
mov rcx, r14
call fcn.140080fc0
test al, al
jne 0x1400844b8
mov qword [0x140283a50], rsi
mov r8d, r15d
mov rdx, r12
mov rcx, r14
call fcn.1400811e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400e9540
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movsxd rcx, dword [rsp + 0x78]
add rcx, 5
add rcx, rbx
mov qword [0x140283a50], rcx
je 0x14008446c
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x20], r15d
mov r9, r12
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.140083230
test al, al
je 0x14008446c
cmp byte [rsp + 0x40], sil
je 0x14008446c
mov r8d, dword [rdi + 0x54]
lea rdx, [0x1401220c0]
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rdi + 0x14]
add rbx, 0x28
xor eax, eax
cmp ax, word [rdi + 6]
jae 0x140084553
add rbx, rdi
lea r12, [0x1401220c0]
test dword [rbx + 0x14], 0x80
ja 0x140084540
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, r12
mov ecx, dword [rbx - 4]
add rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
inc esi
add rbx, 0x28
movzx eax, word [rdi + 6]
cmp esi, eax
jl 0x140084523
mov r12, qword [rsp + 0x48]
mov rsi, r12
sub rsi, r13
mov rbx, rsi
sub rbx, qword [rdi + 0x30]
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.140085850
mov rdx, rbx
mov rcx, rax
call fcn.140084630
mov rdx, rsi
mov rcx, rbp
call fcn.140084730
test al, al
je 0x14008448b
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.1400859a0
mov rdx, rax
mov rcx, r14
call fcn.1400847e0
test al, al
je 0x140084605
mov r9d, r15d
mov r8, rbp
add r8, r13
mov rdx, r12
mov rcx, r14
call fcn.140080fc0
test al, al
je 0x140084605
mov r8d, dword [rdi + 0x28]
add r8, rsi
xor eax, eax
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x58]
lea rdx, [rsp + 0x78]
mov rcx, r14
call fcn.140084b40
test al, al
je 0x140084605
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r12
jmp 0x14008448d
xor edx, edx
mov r8d, 0x8000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, r15d
mov rdx, r12
mov rcx, r14
call fcn.1400811e0
jmp 0x14008448b