Function at 0x14004f400
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14014b0c0]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
mov rax, qword [rbp + 0xe8]
mov qword [rsp + 0x30], rax
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14004fadb
movsxd r15, dword [rdx + 0x3c]
add r15, rdx
mov qword [rsp + 0x50], r15
cmp dword [r15], 0x4550
jne 0x14004fadb
mov eax, 0x20b
cmp word [r15 + 0x18], ax
jne 0x14004fadb
mov ebx, dword [r15 + 0x50]
movabs rax, 0x998f2c943b4948eb
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rbp - 0x70], rax
movabs rax, 0xcb495470030dacb2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rbp - 0x68], rax
movabs rcx, 0xd8e34de14f3b21bd
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x38]
mov qword [rbp + 0x30], rax
movabs rdx, 0xcb4954706062c0de
mov qword [rsp + 0x38], rdx
mov rax, qword [rsp + 0x38]
mov qword [rbp + 0x38], rax
movdqa xmm0, xmmword [rbp - 0x70]
xorps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x70], xmm0
movabs rax, 0xead02184214944d6
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rbp - 0x80], rax
movabs rax, 0xcb4954700c0ea4f0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x38], rcx
mov rax, qword [rsp + 0x38]
mov qword [rbp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov rax, qword [rsp + 0x38]
mov qword [rbp + 0x48], rax
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp - 0x80], xmm0
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14004f56b
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test rax, rax
je 0x14004fadb
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.140046f30
test rax, rax
je 0x14004fadb
mov r9d, 4
mov r8d, 0x3000
mov edx, ebx
xor ecx, ecx
call rax
mov r12, rax
test rax, rax
je 0x14004fadb
movzx ecx, word [r15 + 0x14]
mov r14d, dword [rcx + r15 + 0x24]
sub ebx, r14d
mov eax, ebx
mov qword [rbp - 0x58], rax
mov r8d, ebx
mov rcx, rdi
call fcn.140048530
mov r13, rax
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14004f9bc
mov r8d, dword [r15 + 0x54]
mov rdx, rsi
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r15 + 0x14]
add rbx, 0x24
xor edx, edx
mov edi, edx
cmp dx, word [r15 + 6]
jae 0x14004f624
add rbx, r15
test dword [rbx + 0x18], 0x80
ja 0x14004f613
mov ecx, dword [rbx]
add rcx, r12
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
inc edi
add rbx, 0x28
movzx eax, word [r15 + 6]
cmp edi, eax
jl 0x14004f5f6
xor edx, edx
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x60], r14
sub r13, r14
mov rsi, r13
sub rsi, qword [r15 + 0x30]
mov eax, 0x5a4d
cmp word [r12], ax
jne 0x14004f72a
movsxd rax, dword [r12 + 0x3c]
cmp dword [rax + r12], 0x4550
jne 0x14004f72a
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
mov r11, rdx
mov qword [rbp + 8], rdx
mov ecx, dword [rax + r12 + 0xb0]
test ecx, ecx
jne 0x14004f687
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rdx
jmp 0x14004f73e
lea rbx, [r12 + rcx]
mov edi, dword [rax + r12 + 0xb4]
add rdi, rbx
mov r10, qword [rbp]
cmp rbx, rdi
jae 0x14004f709
nop
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x14004f707
mov eax, dword [rbx]
add rax, r12
mov qword [rbp - 0x40], rax
lea rax, [rbx + 8]
mov qword [rbp - 0x38], rax
lea rax, [rcx - 8]
shr rax, 1
mov dword [rbp - 0x30], eax
cmp r10, r11
je 0x14004f6e4
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [r10], xmm0
movsd xmm1, qword [rbp - 0x30]
movsd qword [r10 + 0x10], xmm1
add r10, 0x18
mov qword [rbp], r10
jmp 0x14004f6fc
lea r8, [rbp - 0x40]
mov rdx, r10
lea rcx, [rbp - 8]
call fcn.140051300
mov r11, qword [rbp + 8]
mov r10, qword [rbp]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rdi
jb 0x14004f6a0
xor edx, edx
mov qword [rbp + 8], rdx
mov qword [rbp], rdx
mov rbx, qword [rbp - 8]
mov qword [rbp - 8], rdx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], r10
mov qword [rsp + 0x70], r11
jmp 0x14004f74d
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r11, rdx
mov qword [rsp + 0x70], rdx
xorps xmm0, xmm0
psrldq xmm0, 8
movq rbx, xmm1
movq r10, xmm0
cmp rbx, r10
je 0x14004f7b4
lea r9, [rbx + 0x10]
mov edi, 0xf000
mov r14d, 0xa000
xor r15d, r15d
mov edx, r15d
cmp dword [r9], r15d
jbe 0x14004f79e
nop dword [rax]
mov ecx, edx
mov rax, qword [r9 - 8]
movzx r8d, word [rax + rcx*2]
movzx eax, r8w
and ax, di
cmp ax, r14w
jne 0x14004f797
and r8d, 0xfff
mov rax, qword [r9 - 0x10]
add qword [r8 + rax], rsi
inc edx
cmp edx, dword [r9]
jb 0x14004f770
add r9, 0x18
lea rax, [r9 - 0x10]
cmp rax, r10
jne 0x14004f764
mov r15, qword [rsp + 0x50]
mov r14, qword [rbp - 0x60]
test rbx, rbx
je 0x14004f821
sub r11, rbx
movabs rax, 0x2aaaaaaaaaaaaaab
imul r11
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x14004f807
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f807
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400f1e50
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
xor esi, esi
mov qword [rsp + 0x70], rsi
jmp 0x14004f823
xor esi, esi
mov rdx, r12
lea rcx, [rbp - 0x28]
call fcn.140050980
mov rdx, rax
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.14004fb10
test al, al
je 0x14004f9b7
lea r8, [r14 + r12]
mov r9, qword [rbp - 0x58]
mov rbx, qword [rbp - 0x50]
mov rdx, rbx
mov rcx, rdi
call fcn.1400482f0
test al, al
je 0x14004f9bc
mov r8d, dword [r15 + 0x28]
add r8, r13
mov dword [rbp - 0x10], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [rbp - 0x10]
mov rcx, rdi
call fcn.14004fe40
test al, al
je 0x14004f9bc
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14004f89b
mov eax, dword [rbp - 0x10]
mov dword [rcx], eax
movabs rax, 0x9e8f2c943b4948eb
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xcb4954706007a5ac
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rcx, 0xd8e34de14f3b21bd
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x10], rax
movabs rdx, 0xcb4954706062c0de
mov qword [rsp + 0x30], rdx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x18], rax
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x50], xmm0
movabs rax, 0xead02184214944d6
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0xcb4954700c0ea4f0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x20], rax
mov qword [rsp + 0x30], rdx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14004f990
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test rax, rax
je 0x14004f9af
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140046f30
test rax, rax
je 0x14004f9af
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call rax
mov rax, rbx
jmp 0x14004fadd
mov rbx, qword [rsp + 0x38]
movabs rax, 0x9e8f2c943b4948eb
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0xcb4954706007a5ac
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rcx, 0xd8e34de14f3b21bd
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x20], rax
movabs rdx, 0xcb4954706062c0de
mov qword [rsp + 0x30], rdx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x50], xmm0
movabs rax, 0xead02184214944d6
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0xcb4954700c0ea4f0
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x10], rax
mov qword [rsp + 0x30], rdx
mov rax, qword [rsp + 0x30]
mov qword [rbp + 0x18], rax
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14004fab1
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
test rax, rax
je 0x14004fad0
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140046f30
test rax, rax
je 0x14004fad0
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call rax
mov rdx, rbx
mov rcx, rdi
call fcn.140048770
xor eax, eax
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1400f1a00
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret