Function at 0x14005b7b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x88
mov rsi, rdx
mov r13, rcx
xor edi, edi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rdi
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14005bbde
movsxd r15, dword [rdx + 0x3c]
add r15, rdx
cmp dword [r15], 0x4550
jne 0x14005bbde
mov eax, 0x20b
cmp word [r15 + 0x18], ax
jne 0x14005bbde
mov ebx, dword [r15 + 0x50]
mov edx, ebx
xor ecx, ecx
lea r9d, [rdi + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x14005bbde
movzx ecx, word [r15 + 0x14]
mov eax, dword [rcx + r15 + 0x24]
mov dword [rbp + 0x6f], eax
sub ebx, eax
mov qword [rbp + 0x5f], rdi
mov eax, ebx
mov qword [rbp + 0x57], rax
lea r8, [rbp + 0x5f]
mov edx, ebx
mov rcx, r13
call fcn.14005b3d0
mov r12, rax
mov qword [rbp - 0x41], rax
mov rcx, r14
test rax, rax
jne 0x14005b886
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14005bbde
mov r8d, dword [r15 + 0x54]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r15 + 0x14]
add rbx, 0x24
xor ecx, ecx
cmp cx, word [r15 + 6]
jae 0x14005b8d5
add rbx, r15
test dword [rbx + 0x18], 0x80
ja 0x14005b8c4
mov ecx, dword [rbx]
add rcx, r14
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
inc edi
add rbx, 0x28
movzx eax, word [r15 + 6]
cmp edi, eax
jl 0x14005b8a7
xor ecx, ecx
mov qword [rbp + 0x8f], r12
mov eax, dword [rbp + 0x6f]
sub r12, rax
mov qword [rbp + 0x67], r12
mov rsi, r12
sub rsi, qword [r15 + 0x30]
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x14005ba6d
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x14005ba6d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x31], xmm0
mov r12, rcx
mov qword [rbp - 0x21], rcx
mov ecx, dword [rax + r14 + 0xb0]
test ecx, ecx
jne 0x14005b92e
jmp 0x14005ba69
lea rbx, [r14 + rcx]
mov edi, dword [rax + r14 + 0xb4]
add rdi, rbx
mov r10, qword [rbp - 0x29]
cmp rbx, rdi
jae 0x14005b9ad
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x14005b9ad
mov eax, dword [rbx]
add rax, r14
mov qword [rbp - 0x19], rax
lea rax, [rbx + 8]
mov qword [rbp - 0x11], rax
lea rax, [rcx - 8]
shr rax, 1
mov dword [rbp - 9], eax
cmp r10, r12
je 0x14005b98a
movups xmm0, xmmword [rbp - 0x19]
movups xmmword [r10], xmm0
movsd xmm1, qword [rbp - 9]
movsd qword [r10 + 0x10], xmm1
add r10, 0x18
mov qword [rbp - 0x29], r10
jmp 0x14005b9a2
lea r8, [rbp - 0x19]
mov rdx, r10
lea rcx, [rbp - 0x31]
call fcn.14005cd60
mov r12, qword [rbp - 0x21]
mov r10, qword [rbp - 0x29]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rdi
jb 0x14005b946
mov r11, qword [rbp - 0x31]
cmp r11, r10
je 0x14005ba0e
lea r8, [r11 + 0x10]
mov ebx, 0xf000
mov edi, 0xa000
xor r13d, r13d
mov edx, r13d
cmp dword [r8], edx
jbe 0x14005b9fd
nop
mov ecx, edx
mov rax, qword [r8 - 8]
movzx r9d, word [rax + rcx*2]
movzx eax, r9w
and ax, bx
cmp ax, di
jne 0x14005b9f6
and r9d, 0xfff
mov rax, qword [r8 - 0x10]
add qword [r9 + rax], rsi
inc edx
cmp edx, dword [r8]
jb 0x14005b9d0
add r8, 0x18
lea rax, [r8 - 0x10]
cmp rax, r10
jne 0x14005b9c7
mov r13, qword [rbp + 0x4f]
test r11, r11
je 0x14005ba69
sub r12, r11
movabs rax, 0x2aaaaaaaaaaaaaab
imul r12
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r11
cmp rdx, 0x1000
jb 0x14005ba61
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ba61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r11
call fcn.14016c298
mov r12, qword [rbp + 0x67]
mov ecx, 0x5a4d
cmp word [r14], cx
jne 0x14005bbde
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x14005bbde
mov ecx, dword [rax + r14 + 0xd8]
test ecx, ecx
je 0x14005baea
mov rdi, qword [rcx + r14 + 0x58]
test rdi, rdi
je 0x14005baea
mov rax, r14
sub rax, r12
add rdi, rax
movabs rsi, 0x2b992ddfa232
cmp qword [rdi], rsi
jne 0x14005bbde
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
xor rax, rbx
xor rax, rsi
movabs rcx, 0x2b992ddfa233
cmp rax, rsi
cmove rax, rcx
mov qword [rdi], rax
mov rdx, r14
lea rcx, [rbp - 0x19]
call fcn.14005c8a0
mov rdx, rax
mov rcx, r13
call fcn.14005bc00
mov rbx, qword [rbp + 0x5f]
test al, al
je 0x14005bba0
mov r8d, dword [rbp + 0x6f]
add r8, r14
mov r9, qword [rbp + 0x57]
mov rsi, qword [rbp + 0x8f]
mov rdx, rsi
mov rcx, r13
call fcn.1400557e0
test al, al
je 0x14005bba0
mov edi, dword [r15 + 0x28]
add rdi, r12
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp + 0x57]
mov r8, rsi
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x49]
call fcn.1400646b0
test al, al
je 0x14005bba0
mov dword [rbp + 0x6f], 0
mov rax, qword [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x49]
mov r8, rdi
lea rdx, [rbp + 0x6f]
mov rcx, r13
call fcn.14005bfb0
test al, al
je 0x14005bba0
mov rdx, qword [rbp + 0x97]
test rdx, rdx
je 0x14005bb8a
mov ecx, dword [rbp + 0x6f]
mov dword [rdx], ecx
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rsi
jmp 0x14005bbe0
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8, rbx
mov rdx, qword [rbp - 0x41]
mov rcx, r13
call fcn.140055a10
test al, al
je 0x14005bbde
mov rdx, rbx
mov rcx, r13
call fcn.140055b40
test al, al
je 0x14005bbde
mov rdx, rbx
mov rcx, r13
call fcn.140055c60
xor eax, eax
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret