Function at 0x1400035f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x14000381e
mov ebx, 0x40
lea rcx, [rsp + 0x60]
mov r8d, ebx
xor edx, edx
call fcn.140016a70
mov r14d, 0x108
lea rcx, [rbp - 0x60]
mov r8d, r14d
xor edx, edx
call fcn.140016a70
mov r9d, ebx
lea rdx, [rsp + 0x60]
mov r8, rsi
mov rcx, rdi
call fcn.140003114
test al, al
je 0x14000381e
mov eax, 0x5a4d
cmp word [rsp + 0x60], ax
jne 0x14000381e
movsxd r8, dword [rbp - 0x64]
lea rdx, [rbp - 0x60]
add r8, rsi
mov r9d, r14d
mov rcx, rdi
call fcn.140003114
test al, al
je 0x14000381e
cmp dword [rbp - 0x60], 0x4550
jne 0x14000381e
mov r14d, dword [rbp + 0x28]
test r14d, r14d
je 0x14000381e
mov eax, dword [rbp + 0x2c]
test eax, eax
je 0x14000381e
lea r9d, [rbx - 0x3c]
mov qword [rsp + 0x50], rax
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, r12d
mov qword [rsp + 0x48], r14
mov rbx, rax
mov rcx, rdi
lea rax, [r14 + rsi]
mov rdx, rbx
mov r8, rax
mov qword [rsp + 0x40], rax
mov r15d, r14d
call fcn.140003114
test al, al
je 0x14000380d
mov eax, dword [rbx + 0x20]
mov r14, rbx
mov r12d, dword [rbx + 0x24]
sub r14, r15
mov r13d, dword [rbx + 0x1c]
add rax, r14
add r12, r14
mov qword [rbp + 0xf8], rax
add r13, r14
xor r15d, r15d
cmp dword [rbx + 0x18], r15d
jbe 0x14000380d
mov r9d, dword [rax + r15*4]
and qword [rsp + 0x20], 0
add r9, r14
and qword [rsp + 0x30], 0
mov ecx, r15d
or rdi, 0xffffffffffffffff
mov qword [rbp + 0x108], rcx
mov qword [rsp + 0x38], 0xf
inc rdi
cmp byte [r9 + rdi], 0
jne 0x14000375a
lea rcx, [rsp + 0x20]
cmp rdi, 0xf
ja 0x140003786
mov r8, rdi
mov qword [rsp + 0x30], rdi
mov rdx, r9
call fcn.1400163a0
mov byte [rsp + rdi + 0x20], 0
jmp 0x14000378e
mov rdx, rdi
call fcn.14000ac04
mov rax, qword [rbp + 0x100]
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400037a2
mov rdx, qword [rax]
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call fcn.14001db6c
test eax, eax
je 0x14000383b
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400037f9
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037f4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038d8
call fcn.140014298
mov rax, qword [rbp + 0xf8]
inc r15d
cmp r15d, dword [rbx + 0x18]
jb 0x140003730
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rbp + 0x108]
mov r14d, 0x1000
movzx eax, word [r12 + rax*2]
cmp dword [r13 + rax*4], r14d
jbe 0x140003886
mov edi, dword [r13 + rax*4]
add rdi, rsi
cmp rdi, qword [rsp + 0x40]
jb 0x1400038c5
mov rax, qword [rsp + 0x48]
add rax, qword [rsp + 0x50]
add rax, rsi
cmp rdi, rax
ja 0x1400038c5
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edi, edi
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1400038bd
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x1400038b8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400038d8
call fcn.140014298
mov rax, rdi
jmp 0x140003820
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140003888
call fcn.14001e6e4
int3