Function at 0x14006b7f8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov byte [rax + 0x20], r9b
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140103610]
mov rsi, rcx
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006ba97
movsxd rdi, dword [rax + 0x3c]
add rdi, rax
cmp dword [rdi], 0x4550
jne 0x14006ba97
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14006ba97
mov ebx, dword [rdi + 0x50]
xor ecx, ecx
mov edx, ebx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r14d, r14d
mov r12, rax
test rax, rax
je 0x14006ba97
movzx ecx, word [rdi + 0x14]
mov r13d, r14d
mov qword [rbp - 0x30], r14
mov edx, dword [rcx + rdi + 0x24]
mov cl, byte [rbp + 0x60]
neg cl
mov dword [rbp - 0x40], edx
mov rcx, rsi
sbb eax, eax
and eax, edx
sub ebx, eax
mov dword [rbp - 0x38], eax
mov eax, ebx
mov qword [rbp - 0x28], rax
cmp byte [rbp + 0x68], r14b
je 0x14006b8bd
lea r8, [rbp - 0x30]
mov edx, eax
call fcn.14006b6f4
mov r13, qword [rbp - 0x30]
jmp 0x14006b8c7
mov r8, rax
xor edx, edx
call fcn.140068bb0
mov qword [rbp - 0x30], rax
mov r15, rax
test rax, rax
je 0x14006ba7a
mov r8d, r14d
mov rdx, qword [0x140103610]
cmp dword [rdi + 0x54], r14d
jbe 0x14006b8fe
mov rcx, r12
sub rdx, r12
mov al, byte [rcx + rdx]
inc r8d
mov byte [rcx], al
inc rcx
cmp r8d, dword [rdi + 0x54]
jb 0x14006b8ed
movzx edx, word [rdi + 0x14]
mov r9d, r14d
add rdx, 0x28
cmp r14w, word [rdi + 6]
jae 0x14006b95f
add rdx, rdi
test dword [rdx + 0x14], 0x80
ja 0x14006b94f
mov r8d, dword [rdx + 4]
mov r10d, r14d
mov ecx, dword [rdx - 4]
add r8, qword [0x140103610]
add rcx, r12
mov r11d, dword [rdx]
test r11, r11
je 0x14006b94f
sub r8, rcx
mov al, byte [rcx + r8]
inc r10d
mov byte [rcx], al
inc rcx
movsxd rax, r10d
cmp rax, r11
jb 0x14006b93b
movzx eax, word [rdi + 6]
inc r9d
add rdx, 0x28
cmp r9d, eax
jl 0x14006b913
cmp byte [rbp + 0x60], 0
mov r14, r15
je 0x14006b96e
mov eax, dword [rbp - 0x40]
sub r15, rax
mov rbx, r15
lea rcx, [rbp - 0x20]
sub rbx, qword [rdi + 0x30]
mov rdx, r12
call fcn.14006caa8
mov rdx, rbx
mov rcx, rax
call fcn.14006bab4
mov rdx, r12
lea rcx, [rbp - 0x20]
call fcn.14006c7d8
mov rdx, rax
mov rcx, rsi
call fcn.14006bb14
test al, al
je 0x14006ba7a
mov r8d, dword [rbp - 0x38]
mov rdx, r14
mov r9, qword [rbp - 0x28]
add r8, r12
mov rcx, rsi
call fcn.14006b16c
test al, al
je 0x14006ba7a
mov ebx, dword [rdi + 0x28]
xor edi, edi
mov rax, qword [rbp + 0x78]
add rbx, r15
test rax, rax
je 0x14006b9f8
mov r9, qword [rbp - 0x28]
lea rdx, [rbp + 0x50]
mov r8, r14
mov qword [rsp + 0x20], r13
lea rcx, [rbp + 0x48]
call rax
test al, al
je 0x14006ba7a
mov r9, qword [rbp + 0x48]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x50]
mov r8, rbx
cmp byte [rbp + 0x70], dil
mov rcx, rsi
mov dword [rbp - 0x40], edi
cmovne r9, r14
mov qword [rsp + 0x20], rax
call fcn.14006b2c4
test al, al
je 0x14006ba7a
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x14006ba34
mov eax, dword [rbp - 0x40]
mov dword [rcx], eax
cmp byte [rbp + 0x58], dil
je 0x14006ba64
mov rdx, r14
mov rcx, rsi
cmp byte [rbp + 0x68], dil
je 0x14006ba5f
mov r8, r13
call fcn.14006ab00
mov rdx, r13
mov rcx, rsi
call fcn.14006a710
mov rdx, r13
mov rcx, rsi
call fcn.140069adc
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r14
jmp 0x14006ba99
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp - 0x30]
mov rcx, rsi
call fcn.140069adc
xor eax, eax
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret