Function at 0x14000a510
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xd0
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rbp - 9], rax
mov qword [rbp - 0x71], rdx
mov rdi, rcx
mov rcx, qword [rbp + 0x8f]
mov qword [rbp - 0x41], rcx
xor ebx, ebx
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x29], rbx
mov ecx, 0x5a4d
cmp word [rdx], cx
jne 0x14000a672
movsxd r14, dword [rdx + 0x3c]
add r14, rdx
cmp dword [r14], 0x4550
jne 0x14000a672
mov eax, 0x20b
cmp word [r14 + 0x18], ax
jne 0x14000a672
mov r15d, dword [r14 + 0x50]
mov edx, r15d
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov qword [rbp - 0x79], rax
test rax, rax
je 0x14000a672
movzx ecx, word [r14 + 0x14]
mov eax, dword [rcx + r14 + 0x24]
mov dword [rsp + 0x44], eax
sub r15d, eax
mov r13d, ebx
mov qword [rbp - 0x69], rbx
mov eax, dword [rbp + 0x77]
cmp eax, 1
jne 0x14000a5f4
mov r12d, r15d
lea r8, [rbp - 0x69]
mov edx, r15d
mov rcx, rdi
call fcn.14000a170
mov rbx, rax
mov qword [rsp + 0x48], rax
mov r13, qword [rbp - 0x69]
jmp 0x14000a893
cmp eax, 2
jne 0x14000a78c
mov qword [rsp + 0x48], rbx
lea rax, str.x____xxxxxxxx____xxxxxxxxx____xxxxxxxx
mov qword [rsp + 0x20], rax
lea r9, [0x1400108f0]
mov r8, qword [0x14001ec08]
lea rdx, str.PAGELK
mov rcx, rdi
call fcn.140003ba0
mov rbx, rax
mov qword [0x14001ec28], rax
test rax, rax
je 0x14000a661
xor r12d, r12d
mov dword [rbp - 0x39], r12d
lea r8, [rax + 1]
lea r9d, [r12 + 4]
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.140002520
test al, al
jne 0x14000a69b
mov qword [0x14001ec28], r12
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14000dba0
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movsxd rcx, dword [rbp - 0x39]
add rcx, 5
add rcx, rbx
mov qword [0x14001ec28], rcx
je 0x14000a661
mov r9d, r15d
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.1400057f0
test al, al
je 0x14000a661
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rbx
test rbx, rbx
je 0x14000a661
lea rax, str.xx____x___x_x____xxxxxxx____x
mov qword [rsp + 0x20], rax
lea r9, [0x140010970]
mov r8, qword [0x14001ec08]
lea rdx, str.PAGE
mov rcx, rdi
call fcn.140003ba0
mov qword [0x14001eb78], rax
test rax, rax
je 0x14000a738
lea r12, [rax + 0xc]
mov qword [0x14001eb78], r12
mov dword [rbp - 0x39], r13d
lea r8, [r12 + 1]
mov r9d, 4
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.140002520
test al, al
jne 0x14000a74b
mov qword [0x14001eb78], r13
mov r8d, r15d
mov rdx, rbx
mov rcx, rdi
call fcn.140002740
jmp 0x14000a661
movsxd rcx, dword [rbp - 0x39]
add rcx, 5
add rcx, r12
mov qword [0x14001eb78], rcx
je 0x14000a738
mov byte [rsp + 0x40], r13b
mov dword [rsp + 0x20], r15d
mov r9, rbx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140005bf0
test al, al
je 0x14000a738
cmp byte [rsp + 0x40], r13b
je 0x14000a738
mov r12d, r15d
jmp 0x14000a893
mov r12d, r15d
test r15d, r15d
je 0x14000a661
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14001ec70], eax
jle 0x14000a85c
lea rcx, [0x14001ec70]
call fcn.14000dc70
cmp dword [0x14001ec70], 0xffffffff
jne 0x14000a85c
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], rbx
mov qword [rbp - 0x49], rbx
mov r8d, 0x15
lea rdx, [0x140010a18]
lea rcx, [rbp - 0x61]
call fcn.140007450
nop
lea r8, [rbp - 0x61]
mov rdx, qword [0x14001ec08]
mov rcx, rdi
call fcn.140002b70
mov qword [0x14001ed58], rax
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x14000a850
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a84a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a84a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000dbc0
nop
lea rcx, [0x14001ec70]
call fcn.14000dc04
cmp qword [0x14001ed58], 0
je 0x14000a661
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x20], r12
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140006800
test al, al
je 0x14000a661
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rbx
test rbx, rbx
je 0x14000a661
mov r8d, dword [r14 + 0x54]
mov rdx, qword [rbp - 0x71]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [r14 + 0x14]
add rax, 0x28
xor ecx, ecx
mov esi, ecx
cmp cx, word [r14 + 6]
jae 0x14000a908
lea rbx, [rax + r14]
mov r12, qword [rbp - 0x79]
mov r13, qword [rbp - 0x71]
nop dword [rax]
test dword [rbx + 0x14], 0x80
ja 0x14000a8ed
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, r13
mov ecx, dword [rbx - 4]
add rcx, r12
call sub.VCRUNTIME140.dll_memcpy
inc esi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp esi, eax
jl 0x14000a8d0
mov r12d, r15d
mov r13, qword [rbp - 0x69]
mov rbx, qword [rsp + 0x48]
mov rsi, rbx
mov eax, dword [rsp + 0x44]
sub rbx, rax
mov qword [rsp + 0x48], rbx
sub rbx, qword [r14 + 0x30]
mov rdx, qword [rbp - 0x79]
lea rcx, [rbp - 0x61]
call fcn.14000b410
mov rdx, rbx
mov rcx, rax
call fcn.14000aac0
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, qword [rbp - 0x79]
call fcn.14000abc0
test al, al
je 0x14000a672
mov rdx, qword [rbp - 0x79]
lea rcx, [rbp - 0x61]
call fcn.14000b560
mov rdx, rax
mov rcx, rdi
call fcn.14000ac70
test al, al
je 0x14000aa55
mov r8d, dword [rsp + 0x44]
add r8, qword [rbp - 0x79]
mov r9, r12
mov rdx, rsi
mov rcx, rdi
call fcn.140002520
test al, al
je 0x14000aa55
mov r14d, dword [r14 + 0x28]
add r14, rbx
mov qword [rsp + 0x20], r13
mov r9, r12
mov r8, rsi
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x29]
call fcn.140008be0
test al, al
je 0x14000aa55
xor eax, eax
mov dword [rsp + 0x44], eax
mov r9, qword [rbp - 0x29]
cmp byte [rbp + 0x7f], al
cmovne r9, rsi
mov rax, qword [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r8, r14
lea rdx, [rsp + 0x44]
mov rcx, rdi
call fcn.14000af90
test al, al
je 0x14000aa55
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14000a9ef
mov eax, dword [rsp + 0x44]
mov dword [rcx], eax
cmp byte [rbp + 0x67], 0
je 0x14000aa29
mov eax, dword [rbp + 0x77]
mov rdx, rsi
cmp eax, 1
jne 0x14000aa43
mov r8, r13
mov rcx, rdi
call fcn.140002830
test al, al
je 0x14000aa29
mov rdx, r13
mov rcx, rdi
call fcn.140002940
test al, al
je 0x14000aa29
mov rdx, r13
mov rcx, rdi
call fcn.140002a50
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rsi
jmp 0x14000a674
cmp eax, 2
jne 0x14000aa21
mov r8d, r15d
mov rcx, rdi
call fcn.140002740
jmp 0x14000aa29
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 0x77]
mov rdx, rsi
cmp eax, 1
jne 0x14000aaa8
mov r8, r13
mov rcx, rdi
call fcn.140002830
test al, al
je 0x14000a672
mov rdx, r13
mov rcx, rdi
call fcn.140002940
test al, al
je 0x14000a672
mov rdx, r13
mov rcx, rdi
call fcn.140002a50
jmp 0x14000a672
cmp eax, 2
jne 0x14000aa9b
mov r8d, r15d
mov rcx, rdi
call fcn.140002740
jmp 0x14000a672