Function at 0x140009f64
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov eax, 0x5a4d
mov r15, rcx
cmp word [0x1406371d0], ax
jne 0x14000a229
movsxd rdi, dword [0x14063720c]
lea r14, [0x1406371d0]
add rdi, r14
cmp dword [rdi], 0x4550
jne 0x14000a229
xor ebp, ebp
test rdi, rdi
je 0x14000a229
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14000a229
mov ebx, dword [rdi + 0x50]
lea r9d, [rbp + 4]
mov edx, ebx
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x14000a229
movzx ecx, word [rdi + 0x14]
mov r13d, dword [rcx + rdi + 0x24]
mov rcx, r15
sub ebx, r13d
mov eax, ebx
mov r8d, ebx
mov qword [rsp + 0xb8], rax
call fcn.140007db0
mov r12, rax
mov rcx, rsi
test rax, rax
jne 0x14000a02c
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000a229
mov r8d, dword [rdi + 0x54]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rdi + 0x14]
xor eax, eax
add rbx, 0x28
cmp ax, word [rdi + 6]
jae 0x14000a085
add rbx, rdi
lea r15, [0x1406371d0]
test dword [rbx + 0x14], 0x80
ja 0x14000a06f
mov edx, dword [rbx + 4]
mov ecx, dword [rbx - 4]
add rdx, r15
mov r8d, dword [rbx]
add rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rdi + 6]
inc ebp
add rbx, 0x28
cmp ebp, eax
jl 0x14000a052
mov r15, qword [rsp + 0xa0]
mov rbp, r12
lea rcx, [rsp + 0x30]
sub r12, r13
mov rdx, rsi
mov rbx, r12
sub rbx, qword [rdi + 0x30]
call fcn.14000ace0
mov r10, rax
mov r11, qword [rax + 8]
mov rdx, qword [rax]
cmp rdx, r11
je 0x14000a0fc
xor eax, eax
mov r8d, eax
cmp dword [rdx + 0x10], eax
jbe 0x14000a0f3
mov rax, qword [rdx + 8]
mov ecx, r8d
movzx r9d, word [rax + rcx*2]
mov ecx, 0xf000
movzx eax, r9w
and ax, cx
mov ecx, 0xa000
cmp ax, cx
jne 0x14000a0e8
mov rax, qword [rdx]
and r9d, 0xfff
add qword [r9 + rax], rbx
inc r8d
cmp r8d, dword [rdx + 0x10]
jb 0x14000a0b8
xor eax, eax
add rdx, 0x18
cmp rdx, r11
jne 0x14000a0b0
mov rcx, r10
call fcn.14000a484
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14000a229
movsxd rax, dword [rsi + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
jne 0x14000a229
xor ebx, ebx
test rax, rax
je 0x14000a229
mov ecx, dword [rax + 0xd8]
test ecx, ecx
je 0x14000a196
mov r14, qword [rcx + rsi + 0x58]
test r14, r14
je 0x14000a196
mov rax, rsi
sub rax, r12
add r14, rax
movabs rax, 0x2b992ddfa232
cmp qword [r14], rax
jne 0x14000a229
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movabs rdx, 0x2b992ddfa232
xor rcx, rbx
movabs rax, 0x2b992ddfa233
xor rcx, rdx
cmp rcx, rdx
cmove rcx, rax
xor ebx, ebx
mov qword [r14], rcx
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14000ae10
mov rdx, rax
mov rcx, r15
call fcn.14000a23c
test al, al
je 0x14000a20d
mov r9, qword [rsp + 0xb8]
lea r8, [rsi + r13]
mov rdx, rbp
mov rcx, r15
call fcn.140007ba0
test al, al
je 0x14000a20d
mov r8d, dword [rdi + 0x28]
lea rdx, [rsp + 0xc0]
add r8, r12
mov dword [rsp + 0xc0], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rcx, r15
call fcn.14000a540
test al, al
je 0x14000a20d
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbp
jmp 0x14000a22b
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, rbp
mov rcx, r15
call fcn.140007f1c
xor eax, eax
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret