Function at 0x14006bcd0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov eax, 0x5a4d
mov r15, rcx
cmp word [0x1401990d0], ax
jne 0x14006bf82
movsxd rdi, dword [0x14019910c]
lea r13, [0x1401990d0]
add rdi, r13
cmp dword [rdi], 0x4550
jne 0x14006bf82
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14006bf82
mov ebx, dword [rdi + 0x50]
xor ecx, ecx
mov edx, ebx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x14006bf82
movzx ecx, word [rdi + 0x14]
lea r8, [rsp + 0xa8]
xor ebp, ebp
mov qword [rsp + 0xa8], rbp
mov r14d, dword [rcx + rdi + 0x24]
mov rcx, r15
sub ebx, r14d
mov eax, ebx
mov edx, ebx
mov qword [rsp + 0x30], rax
call fcn.14006b920
mov r12, rax
mov rcx, rsi
test rax, rax
jne 0x14006bda4
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14006bf82
mov r8d, dword [rdi + 0x54]
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rdi + 0x14]
xor eax, eax
add rbx, 0x28
cmp ax, word [rdi + 6]
jae 0x14006bdee
add rbx, rdi
test dword [rbx + 0x14], 0x80
ja 0x14006bde0
mov edx, dword [rbx + 4]
mov ecx, dword [rbx - 4]
add rdx, r13
mov r8d, dword [rbx]
add rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rdi + 6]
inc ebp
add rbx, 0x28
cmp ebp, eax
jl 0x14006bdc3
mov rbp, r12
lea rcx, [rsp + 0x40]
sub r12, r14
mov rdx, rsi
mov rbx, r12
mov r13, r14
sub rbx, qword [rdi + 0x30]
call fcn.14006d020
mov rdx, rbx
mov rcx, rax
call fcn.14006bfa0
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14006bf82
movsxd rax, dword [rsi + 0x3c]
cmp dword [rax + rsi], 0x4550
jne 0x14006bf82
mov ecx, dword [rax + rsi + 0xd8]
test ecx, ecx
je 0x14006be9a
mov r14, qword [rcx + rsi + 0x58]
test r14, r14
je 0x14006be9a
mov rax, rsi
sub rax, r12
add r14, rax
movabs rax, 0x2b992ddfa232
cmp qword [r14], rax
jne 0x14006bf82
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
movabs rdx, 0x2b992ddfa232
xor rax, rbx
movabs rcx, 0x2b992ddfa233
xor rax, rdx
cmp rax, rdx
cmove rax, rcx
mov qword [r14], rax
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.14006d170
mov rdx, rax
mov rcx, r15
call fcn.14006c0a0
mov rbx, qword [rsp + 0xa8]
test al, al
je 0x14006bf45
mov r9, qword [rsp + 0x30]
lea r8, [rsi + r13]
mov rdx, rbp
mov rcx, r15
call fcn.140067ad0
test al, al
je 0x14006bf45
mov r8d, dword [rdi + 0x28]
lea rdx, [rsp + 0xa8]
xor eax, eax
add r8, r12
mov dword [rsp + 0xa8], eax
mov r9, rbx
mov eax, dword [rsp + 0xb8]
mov rcx, r15
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
call fcn.14006c360
test al, al
je 0x14006bf45
mov rdx, qword [rsp + 0xc0]
test rdx, rdx
je 0x14006bf2f
mov ecx, dword [rsp + 0xa8]
mov dword [rdx], ecx
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbp
jmp 0x14006bf84
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8, rbx
mov rdx, rbp
mov rcx, r15
call fcn.140067cf0
test al, al
je 0x14006bf82
mov rdx, rbx
mov rcx, r15
call fcn.140067e10
test al, al
je 0x14006bf82
mov rdx, rbx
mov rcx, r15
call fcn.140067f30
xor eax, eax
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret