Function at 0x140138680
Capabilities:
Parse pe header

Disassembly:
push rbp
push rdi
push r14
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xf8
mov r8, qword [0x14051e318]
lea rax, str.xxxxxx____xxxxx____xxx____xxxxx____x____xx_x
lea r9, [0x140492650]
mov qword [rsp + 0x20], rax
lea rdx, str.PAGE
mov rdi, rcx
call fcn.140138d70
mov r8, qword [0x14051e318]
lea r9, [0x140492688]
mov qword [0x14051e2a0], rax
lea rdx, str.PAGE
lea rax, str.xxxxxx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140138d70
mov rdx, qword [0x14051e2a0]
mov qword [0x14051e2a8], rax
test rdx, rdx
jne 0x140138745
mov r8, qword [0x14051e318]
lea rax, str.xxx____xxxxx____xxx____x____x
lea r9, [0x1404926b0]
mov qword [rsp + 0x20], rax
lea rdx, str.PAGE
mov rcx, rdi
call fcn.140138d70
mov qword [0x14051e2a0], rax
test rax, rax
je 0x140138b76
lea rdx, [rax + 0x10]
mov rax, qword [0x14051e2a8]
jmp 0x140138749
add rdx, 0x1c
mov qword [0x14051e2a0], rdx
test rax, rax
je 0x140138b76
mov r9d, 7
mov rcx, rdi
lea r8d, [r9 - 4]
call fcn.140138360
mov rdx, qword [0x14051e2a8]
mov r9d, 0xa
mov rcx, rdi
mov r15, rax
lea r8d, [r9 - 4]
call fcn.140138360
mov rdx, r15
mov rcx, rdi
mov r14, rax
call fcn.1401383f0
test al, al
je 0x140138b76
lea rcx, [rbp - 0x31]
mov qword [rsp + 0xf0], rbx
call fcn.140136980
cmp qword [rbp - 0x19], 7
lea rcx, [rbp - 0x31]
mov eax, 0x5a4d
cmova rcx, qword [rbp - 0x31]
xor ebx, ebx
cmp word [0x1404c3e30], ax
je 0x1401387d0
mov eax, ebx
jmp 0x1401387eb
movsxd rax, dword [0x1404c3e6c]
lea rdx, [0x1404c3e30]
add rax, rdx
cmp dword [rax], 0x4550
cmovne rax, rbx
mov eax, dword [rax + 8]
xorps xmm0, xmm0
mov dword [rbp + 0xf], eax
mov rax, 0xffffffffffffffff
movdqu xmmword [rbp + 0x13], xmm0
mov qword [rbp - 0x11], rbx
mov qword [rbp - 9], rbx
mov dword [rbp + 3], ebx
mov dword [rbp + 0x23], ebx
mov qword [rbp + 7], rcx
inc rax
cmp word [rcx + rax*2], 0
jne 0x140138812
add ax, ax
mov qword [rsp + 0xe8], rsi
mov word [rbp - 1], ax
add ax, 2
mov qword [rsp + 0xe0], r12
mov word [rbp + 1], ax
test r14, r14
je 0x140138afd
mov rax, qword gs:[0x58]
mov r12d, 8
mov rax, qword [rax]
mov eax, dword [r12 + rax]
cmp dword [0x14051e594], eax
jg 0x140138ba8
cmp qword [0x14051e588], 0
je 0x140138afd
lea rax, [rbp - 0x11]
mov r9, r14
lea rdx, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.14013c150
test al, al
je 0x140138afd
mov rsi, qword [rbp + 0x6f]
test rsi, rsi
je 0x140138afd
lea rax, [rsi + 8]
test rax, rax
je 0x140138afd
mov qword [rbp - 0x79], rax
lea r8, [rbp - 0x79]
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x59]
mov qword [rbp - 0x69], rax
mov r9d, 0x18
lea rax, [rbp + 0x6f]
mov qword [rbp - 0x71], 8
mov qword [rsp + 0x30], rax
mov edx, 0x30394004
mov dword [rsp + 0x28], ebx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x6f], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140138afd
mov qword [rsp + 0x38], rbx
lea rax, [rbp + 0x7f]
mov qword [rbp - 0x69], rax
lea r8, [rbp - 0x79]
lea rax, [rbp + 0x6f]
mov qword [rbp - 0x71], 8
mov qword [rsp + 0x30], rax
mov r9d, 0x18
mov dword [rsp + 0x28], ebx
mov edx, 0x30394004
mov rcx, rdi
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x79], rsi
mov dword [rbp + 0x6f], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140138afd
mov rax, qword [rbp - 0x59]
test rax, rax
je 0x140138afd
mov qword [rsp + 0x38], rbx
lea rcx, [rbp + 0x7f]
mov qword [rbp - 0x69], rax
lea r8, [rbp - 0x79]
lea rax, [rbp + 0x6f]
mov qword [rbp - 0x79], rcx
mov qword [rsp + 0x30], rax
mov r9d, 0x18
mov dword [rsp + 0x28], ebx
mov edx, 0x30394004
mov rcx, rdi
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x71], 8
mov dword [rbp + 0x6f], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140138afd
mov rax, qword [rbp + 0x7f]
add rax, 8
je 0x140138afd
mov qword [rsp + 0x38], rbx
lea rcx, [rbp - 0x59]
mov qword [rbp - 0x69], rax
lea r8, [rbp - 0x79]
lea rax, [rbp + 0x6f]
mov qword [rbp - 0x79], rcx
mov qword [rsp + 0x30], rax
mov r9d, 0x18
mov dword [rsp + 0x28], ebx
mov edx, 0x30394004
mov rcx, rdi
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x71], 8
mov dword [rbp + 0x6f], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140138afd
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [r12 + rax]
cmp dword [0x14051e578], eax
jg 0x140138c96
cmp qword [0x14051e508], 0
je 0x140138afd
mov r9, r14
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0x6f]
mov rcx, rdi
call fcn.14013be80
test al, al
je 0x140138afd
cmp byte [rbp + 0x6f], 0
je 0x140138afd
lea rsi, [r14 + 0x40]
mov dword [rbp + 0x77], ebx
test rsi, rsi
je 0x140138af9
mov qword [rsp + 0x38], rbx
lea rax, [rbp + 0x77]
mov qword [rbp - 0x69], rax
lea r8, [rbp - 0x79]
lea rax, [rbp + 0x6f]
mov qword [rbp - 0x71], 4
mov qword [rsp + 0x30], rax
mov r9d, 0x18
mov dword [rsp + 0x28], ebx
mov edx, 0x30394004
mov rcx, rdi
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x79], rsi
mov dword [rbp + 0x6f], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp + 0x77]
test eax, eax
je 0x140138af9
dec eax
mov qword [rsp + 0x38], rbx
mov dword [rbp + 0x77], eax
lea r8, [rbp - 0x79]
lea rax, [rbp + 0x77]
mov qword [rbp - 0x71], 4
mov qword [rbp - 0x79], rax
mov r9d, 0x18
lea rax, [rbp + 0x6f]
mov qword [rbp - 0x69], rsi
mov qword [rsp + 0x30], rax
mov edx, 0x30394004
mov dword [rsp + 0x28], ebx
mov rcx, rdi
mov qword [rsp + 0x20], rbx
mov dword [rbp + 0x6f], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov bl, 1
jmp 0x140138aff
xor bl, bl
mov rdx, r15
mov rcx, rdi
call fcn.140138550
mov rdx, qword [rbp - 0x19]
cmp rdx, 7
jbe 0x140138b4d
mov rcx, qword [rbp - 0x31]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140138b48
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140138b48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401c7f18
mov rsi, qword [rsp + 0xe8]
movzx eax, bl
mov rbx, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe0]
add rsp, 0xf8
pop r15
pop r14
pop rdi
pop rbp
ret
xor al, al
add rsp, 0xf8
pop r15
pop r14
pop rdi
pop rbp
ret
movdqa xmm0, xmmword [0x140495320]
lea rcx, [0x14051e578]
movdqu xmmword [rbp - 0x69], xmm0
mov byte [rbp - 0x79], 0
call fcn.1401c7f4c
jmp 0x140138a1d
lea rcx, [0x14051e594]
call fcn.1401c7fb8
cmp dword [0x14051e594], 0xffffffff
jne 0x140138866
mov ecx, 0x20
mov qword [rbp - 0x49], rbx
call fcn.1401c7ed4
movups xmm1, xmmword [str.RtlLookupElementGenericTableAvl]
lea r8, [rbp - 0x51]
mov qword [rbp - 0x51], rax
movdqa xmm0, xmmword [0x140495410]
mov rdx, rax
movdqu xmmword [rbp - 0x41], xmm0
movups xmmword [rax], xmm1
movsd xmm0, qword [0x140492608]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140492610]
mov dword [rax + 0x18], ecx
mov rcx, rdi
movzx eax, word [0x140492614]
mov word [rdx + 0x1c], ax
movzx eax, byte [0x140492616]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], 0
mov rdx, qword [0x14051e318]
call fcn.1401376b0
mov rdx, qword [rbp - 0x39]
mov qword [0x14051e588], rax
cmp rdx, 0xf
jbe 0x140138c74
mov rcx, qword [rbp - 0x51]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140138c6f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140138c6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401c7f18
movdqa xmm0, xmmword [0x140495320]
lea rcx, [0x14051e594]
movdqu xmmword [rbp - 0x41], xmm0
mov byte [rbp - 0x51], 0
call fcn.1401c7f4c
jmp 0x140138866
lea rcx, [0x14051e578]
call fcn.1401c7fb8
cmp dword [0x14051e578], 0xffffffff
jne 0x140138a1d
mov ecx, 0x20
mov qword [rbp - 0x71], rbx
call fcn.1401c7ed4
movups xmm1, xmmword [str.RtlDeleteElementGenericTableAvl]
lea r8, [rbp - 0x79]
mov qword [rbp - 0x79], rax
movdqa xmm0, xmmword [0x140495410]
mov rdx, rax
movdqu xmmword [rbp - 0x69], xmm0
movups xmmword [rax], xmm1
movsd xmm0, qword [0x1404925e8]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1404925f0]
mov dword [rax + 0x18], ecx
mov rcx, rdi
movzx eax, word [0x1404925f4]
mov word [rdx + 0x1c], ax
movzx eax, byte [0x1404925f6]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], 0
mov rdx, qword [0x14051e318]
call fcn.1401376b0
mov rdx, qword [rbp - 0x61]
mov qword [0x14051e508], rax
cmp rdx, 0xf
jbe 0x140138b86
mov rcx, qword [rbp - 0x79]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140138d61
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140138d61
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401c7f18
jmp 0x140138b86