Function at 0x1403adf00
Capabilities:
Parse pe header

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [0x14051d038]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rax, qword [rcx + 0x38]
mov rcx, qword [rax + 0x20]
mov esi, 0xffffffff
cmp byte [rcx], 0x3c
jne 0x1403adf90
cmp byte [rcx + 1], 0x21
jne 0x1403adf90
add rcx, 2
mov qword [rax + 0x20], rcx
mov rax, qword [rdi + 0x38]
add dword [rax + 0x38], 2
mov rax, qword [rdi + 0x38]
mov rcx, qword [rax + 0x20]
mov dl, byte [rcx]
test dl, dl
jne 0x1403adf6d
mov rcx, rdi
call fcn.1401baba0
mov rax, qword [rdi + 0x38]
mov rcx, qword [rax + 0x20]
mov dl, byte [rcx]
cmp dl, 0x45
jne 0x1403adf90
cmp byte [rcx + 1], 0x4c
jne 0x1403adf90
cmp byte [rcx + 2], 0x45
jne 0x1403adf90
cmp byte [rcx + 3], 0x4d
jne 0x1403adf90
cmp byte [rcx + 4], 0x45
jne 0x1403adf90
cmp byte [rcx + 5], 0x4e
je 0x1403adfc0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402ddd70
mov eax, esi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
lea r8, str.xmlParseElementDecl:_EMPTY__ANY_or___expected_n
mov rcx, rdi
mov edx, 0x36
call fcn.1403aa720
jmp 0x1403adf90
cmp byte [rcx + 6], 0x54
jne 0x1403adf90
mov ebp, dword [rax + 0x5c]
add rcx, 7
mov qword [rax + 0x20], rcx
mov rax, qword [rdi + 0x38]
add dword [rax + 0x38], 7
mov rax, qword [rdi + 0x38]
mov rax, qword [rax + 0x20]
cmp byte [rax], 0
jne 0x1403adfee
mov rcx, rdi
call fcn.1401baba0
mov rcx, rdi
call fcn.14027e7f0
test eax, eax
je 0x1403ae180
mov rcx, rdi
call fcn.14017b830
test rax, rax
je 0x1403ae194
mov rbx, rax
mov rcx, rdi
call fcn.14027e7f0
test eax, eax
je 0x1403ae1a8
mov rax, qword [rdi + 0x38]
mov rcx, qword [rax + 0x20]
movzx edx, byte [rcx]
cmp edx, 0x44
jg 0x1403ae12d
cmp edx, 0x41
jne 0x1403ae1da
cmp byte [rcx + 1], 0x4e
jne 0x1403adfaa
cmp byte [rcx + 2], 0x59
jne 0x1403adfaa
add rcx, 3
mov qword [rax + 0x20], rcx
mov rax, qword [rdi + 0x38]
add dword [rax + 0x38], 3
mov rax, qword [rdi + 0x38]
mov rax, qword [rax + 0x20]
mov esi, 2
cmp byte [rax], 0
jne 0x1403ae07d
mov rcx, rdi
call fcn.1401baba0
mov rcx, rdi
call fcn.14027e7f0
mov rax, qword [rdi + 0x38]
mov rcx, qword [rax + 0x20]
cmp byte [rcx], 0x3e
je 0x1403ae0be
mov rcx, rdi
mov edx, VarR8FromUI1
xor r8d, r8d
call fcn.1403f5fb0
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x1403adf90
mov rcx, qword [rdi + 0x10]
call fcn.1403f3eb0
jmp 0x1403adf90
cmp ebp, dword [rax + 0x5c]
jne 0x1403ae1c1
mov rcx, rdi
call fcn.1401bad10
mov rax, qword [rdi]
test rax, rax
je 0x1403ae0a2
cmp dword [rdi + 0x13c], 0
jne 0x1403ae0a2
mov rax, qword [rax + 0x48]
test rax, rax
je 0x1403ae0a2
mov r14, qword [rsp + 0x20]
test r14, r14
je 0x1403ae22a
mov qword [r14 + 0x20], 0
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
mov rax, qword [rax + 0x48]
mov rdx, rbx
mov r8d, esi
mov r9, r14
call qword [case.0x14012d181.0]
cmp qword [r14 + 0x20], 0
jne 0x1403adf90
mov rcx, qword [rdi + 0x10]
mov rdx, r14
jmp 0x1403ae0b4
cmp edx, 0x45
jne 0x1403adfaa
cmp byte [rcx + 1], 0x4d
jne 0x1403adfaa
cmp byte [rcx + 2], 0x50
jne 0x1403adfaa
cmp byte [rcx + 3], 0x54
jne 0x1403adfaa
cmp byte [rcx + 4], 0x59
jne 0x1403adfaa
add rcx, 5
mov qword [rax + 0x20], rcx
mov rax, qword [rdi + 0x38]
add dword [rax + 0x38], 5
mov rax, qword [rdi + 0x38]
mov rax, qword [rax + 0x20]
mov esi, 1
jmp 0x1403ae070
lea r8, str.Space_required_after_ELEMENT_n
mov rcx, rdi
mov edx, 0x41
jmp 0x1403adfb9
lea r8, str.xmlParseElementDecl:_no_name_for_Element_n
mov rcx, rdi
mov edx, 0x44
jmp 0x1403adfb9
lea r8, str.Space_required_after_the_element_name_n
mov rcx, rdi
mov edx, 0x41
call fcn.1403aa720
jmp 0x1403ae022
lea r8, str.Element_declaration_doesnt_start_and_stop_in_the_same_entity_n
mov rcx, rdi
mov edx, 0x5a
call fcn.1403aa720
jmp 0x1403ae0c7
cmp edx, 0x25
je 0x1403ae1ff
cmp edx, 0x28
jne 0x1403adfaa
lea r8, [rsp + 0x20]
mov rcx, rdi
mov rdx, rbx
call fcn.1403addf0
mov esi, eax
jmp 0x1403ae07d
cmp dword [rdi + 0x8c], 0
jne 0x1403adfaa
cmp dword [rdi + 0x40], 1
jne 0x1403adfaa
lea r8, str.PEReference:_forbidden_within_markup_decl_in_internal_subset_n
mov rcx, rdi
mov edx, reloc.WS2_32.dll_setsockopt
jmp 0x1403adfb9
mov rcx, qword [rdi + 8]
mov rdx, rbx
mov r8d, esi
xor r9d, r9d
call qword [case.0x14012d181.0]
jmp 0x1403adf90