Function at 0x14000a1a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xd0
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rbp - 9], rax
mov qword [rbp - 0x71], rdx
mov rdi, rcx
mov rcx, qword [rbp + 0x8f]
mov qword [rbp - 0x41], rcx
xor ebx, ebx
mov qword [rbp - 0x19], rbx
mov qword [rbp - 0x29], rbx
mov ecx, 0x5a4d
cmp word [rdx], cx
jne 0x14000a302
movsxd r14, dword [rdx + 0x3c]
add r14, rdx
cmp dword [r14], 0x4550
jne 0x14000a302
mov eax, 0x20b
cmp word [r14 + 0x18], ax
jne 0x14000a302
mov r15d, dword [r14 + 0x50]
mov edx, r15d
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov qword [rbp - 0x79], rax
test rax, rax
je 0x14000a302
movzx ecx, word [r14 + 0x14]
mov eax, dword [rcx + r14 + 0x24]
mov dword [rsp + 0x44], eax
sub r15d, eax
mov r13d, ebx
mov qword [rbp - 0x69], rbx
mov eax, dword [rbp + 0x77]
cmp eax, 1
jne 0x14000a284
mov r12d, r15d
lea r8, [rbp - 0x69]
mov edx, r15d
mov rcx, rdi
call fcn.140009e00
mov rbx, rax
mov qword [rsp + 0x48], rax
mov r13, qword [rbp - 0x69]
jmp 0x14000a523
cmp eax, 2
jne 0x14000a41c
mov qword [rsp + 0x48], rbx
lea rax, str.x____xxxxxxxx____xxxxxxxxx____xxxxxxxx
mov qword [rsp + 0x20], rax
lea r9, [0x140010890]
mov r8, qword [0x14001ec08]
lea rdx, str.PAGELK
mov rcx, rdi
call fcn.140003ba0
mov rbx, rax
mov qword [0x14001ec28], rax
test rax, rax
je 0x14000a2f1
xor r12d, r12d
mov dword [rbp - 0x39], r12d
lea r8, [rax + 1]
lea r9d, [r12 + 4]
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.140002520
test al, al
jne 0x14000a32b
mov qword [0x14001ec28], r12
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14000d830
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movsxd rcx, dword [rbp - 0x39]
add rcx, 5
add rcx, rbx
mov qword [0x14001ec28], rcx
je 0x14000a2f1
mov r9d, r15d
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.1400057f0
test al, al
je 0x14000a2f1
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rbx
test rbx, rbx
je 0x14000a2f1
lea rax, str.xx____x___x_x____xxxxxxx____x
mov qword [rsp + 0x20], rax
lea r9, [0x140010910]
mov r8, qword [0x14001ec08]
lea rdx, str.PAGE
mov rcx, rdi
call fcn.140003ba0
mov qword [0x14001eb78], rax
test rax, rax
je 0x14000a3c8
lea r12, [rax + 0xc]
mov qword [0x14001eb78], r12
mov dword [rbp - 0x39], r13d
lea r8, [r12 + 1]
mov r9d, 4
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.140002520
test al, al
jne 0x14000a3db
mov qword [0x14001eb78], r13
mov r8d, r15d
mov rdx, rbx
mov rcx, rdi
call fcn.140002740
jmp 0x14000a2f1
movsxd rcx, dword [rbp - 0x39]
add rcx, 5
add rcx, r12
mov qword [0x14001eb78], rcx
je 0x14000a3c8
mov byte [rsp + 0x40], r13b
mov dword [rsp + 0x20], r15d
mov r9, rbx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140005bf0
test al, al
je 0x14000a3c8
cmp byte [rsp + 0x40], r13b
je 0x14000a3c8
mov r12d, r15d
jmp 0x14000a523
mov r12d, r15d
test r15d, r15d
je 0x14000a2f1
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14001ec70], eax
jle 0x14000a4ec
lea rcx, [0x14001ec70]
call fcn.14000d900
cmp dword [0x14001ec70], 0xffffffff
jne 0x14000a4ec
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], rbx
mov qword [rbp - 0x49], rbx
mov r8d, 0x15
lea rdx, [0x1400109b8]
lea rcx, [rbp - 0x61]
call fcn.140007450
nop
lea r8, [rbp - 0x61]
mov rdx, qword [0x14001ec08]
mov rcx, rdi
call fcn.140002b70
mov qword [0x14001ed58], rax
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x14000a4e0
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a4da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a4da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000d850
nop
lea rcx, [0x14001ec70]
call fcn.14000d894
cmp qword [0x14001ed58], 0
je 0x14000a2f1
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x20], r12
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140006800
test al, al
je 0x14000a2f1
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rbx
test rbx, rbx
je 0x14000a2f1
mov r8d, dword [r14 + 0x54]
mov rdx, qword [rbp - 0x71]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [r14 + 0x14]
add rax, 0x28
xor ecx, ecx
mov esi, ecx
cmp cx, word [r14 + 6]
jae 0x14000a598
lea rbx, [rax + r14]
mov r12, qword [rbp - 0x79]
mov r13, qword [rbp - 0x71]
nop dword [rax]
test dword [rbx + 0x14], 0x80
ja 0x14000a57d
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, r13
mov ecx, dword [rbx - 4]
add rcx, r12
call sub.VCRUNTIME140.dll_memcpy
inc esi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp esi, eax
jl 0x14000a560
mov r12d, r15d
mov r13, qword [rbp - 0x69]
mov rbx, qword [rsp + 0x48]
mov rsi, rbx
mov eax, dword [rsp + 0x44]
sub rbx, rax
mov qword [rsp + 0x48], rbx
sub rbx, qword [r14 + 0x30]
mov rdx, qword [rbp - 0x79]
lea rcx, [rbp - 0x61]
call fcn.14000b0a0
mov rdx, rbx
mov rcx, rax
call fcn.14000a750
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, qword [rbp - 0x79]
call fcn.14000a850
test al, al
je 0x14000a302
mov rdx, qword [rbp - 0x79]
lea rcx, [rbp - 0x61]
call fcn.14000b1f0
mov rdx, rax
mov rcx, rdi
call fcn.14000a900
test al, al
je 0x14000a6e5
mov r8d, dword [rsp + 0x44]
add r8, qword [rbp - 0x79]
mov r9, r12
mov rdx, rsi
mov rcx, rdi
call fcn.140002520
test al, al
je 0x14000a6e5
mov r14d, dword [r14 + 0x28]
add r14, rbx
mov qword [rsp + 0x20], r13
mov r9, r12
mov r8, rsi
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x29]
call fcn.140008b30
test al, al
je 0x14000a6e5
xor eax, eax
mov dword [rsp + 0x44], eax
mov r9, qword [rbp - 0x29]
cmp byte [rbp + 0x7f], al
cmovne r9, rsi
mov rax, qword [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r8, r14
lea rdx, [rsp + 0x44]
mov rcx, rdi
call fcn.14000ac20
test al, al
je 0x14000a6e5
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14000a67f
mov eax, dword [rsp + 0x44]
mov dword [rcx], eax
cmp byte [rbp + 0x67], 0
je 0x14000a6b9
mov eax, dword [rbp + 0x77]
mov rdx, rsi
cmp eax, 1
jne 0x14000a6d3
mov r8, r13
mov rcx, rdi
call fcn.140002830
test al, al
je 0x14000a6b9
mov rdx, r13
mov rcx, rdi
call fcn.140002940
test al, al
je 0x14000a6b9
mov rdx, r13
mov rcx, rdi
call fcn.140002a50
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rsi
jmp 0x14000a304
cmp eax, 2
jne 0x14000a6b1
mov r8d, r15d
mov rcx, rdi
call fcn.140002740
jmp 0x14000a6b9
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 0x77]
mov rdx, rsi
cmp eax, 1
jne 0x14000a738
mov r8, r13
mov rcx, rdi
call fcn.140002830
test al, al
je 0x14000a302
mov rdx, r13
mov rcx, rdi
call fcn.140002940
test al, al
je 0x14000a302
mov rdx, r13
mov rcx, rdi
call fcn.140002a50
jmp 0x14000a302
cmp eax, 2
jne 0x14000a72b
mov r8d, r15d
mov rcx, rdi
call fcn.140002740
jmp 0x14000a302