Function at 0x140049192
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov r12, rcx
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov r9, rsp
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov r10, rsp
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov r11, rsp
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov qword [rbp - 0x78], rsp
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov qword [rbp - 0x50], rsp
mov eax, 0x20
call fcn.140074a70
sub rsp, rax
mov qword [rbp - 0x58], rsp
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov r14, rsp
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov rbx, rsp
mov eax, 0x20
call fcn.140074a70
sub rsp, rax
mov r15, rsp
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov qword [rbp - 0x60], rsp
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov qword [rbp - 0x68], rsp
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov r13, rsp
mov eax, 0x10
call fcn.140074a70
sub rsp, rax
mov r8, rsp
movzx eax, word [rcx]
cmp eax, 0x5a4d
sete al
movsxd rsi, dword [rcx + 0x3c]
test rsi, rsi
setne cl
and cl, al
cmp cl, 1
jne 0x1400498ee
cmp esi, 0x40
jb 0x140049ab5
cmp rsi, rdx
ja 0x140049ab5
movabs rax, 0x184afba7f9b36ba6
lea rcx, [rax + 0x18]
xor rcx, rax
add rcx, rsi
movzx eax, word [r12 + rcx]
cmp eax, 0x20b
je 0x14004931a
cmp eax, 0x10b
jne 0x1400498ee
cmp dword [r12 + rsi], 0x4550
jne 0x1400498ee
lea rcx, [r12 + rsi]
movzx eax, word [rcx + 4]
cmp eax, 0x14c
jne 0x1400498ee
test byte [rcx + 0x16], 2
je 0x1400498ee
mov qword [rbp + 8], rcx
mov eax, 0x138
xor edi, edi
jmp 0x140049353
cmp dword [r12 + rsi], 0x4550
jne 0x1400498ee
lea rcx, [r12 + rsi]
movzx eax, word [rcx + 4]
cmp eax, 0x8664
jne 0x1400498ee
test byte [rcx + 0x16], 2
je 0x1400498ee
mov qword [rbp + 8], rcx
mov eax, 0x148
mov edi, 1
mov qword [rbp + 0x20], r8
lea rcx, [rsi - 0x40]
mov qword [rbp - 0x48], rax
add rcx, rax
sub rdx, rcx
jb 0x140049ab5
mov rcx, qword [rbp + 8]
movzx eax, word [rcx + 6]
movabs rcx, 0xad14f8f6f3a1e89a
lea r8, [rcx + 0x18]
xor r8, rcx
imul r8, rax
cmp r8, rdx
ja 0x140049ab5
test rdi, rdi
mov rcx, qword [rbp + 0x20]
mov r8, qword [rbp + 8]
je 0x1400498ee
test byte [r8 + 0x17], 0x20
jne 0x1400498ee
cmp dword [r8 + 0xfc], 0
mov qword [rbp + 0x10], rax
setne al
cmp dword [r8 + 0xf8], 0
setne dl
test al, dl
jne 0x1400498ee
mov eax, dword [r8 + 0x28]
mov qword [rbp], rax
test rax, rax
je 0x1400498ee
mov rax, qword [r8 + 0x30]
mov qword [rcx], rax
mov eax, dword [r8 + 0x50]
mov qword [r13], rax
sub rsp, 0x20
mov rdx, r13
mov qword [rbp + 0x28], r9
mov qword [rbp + 0x18], r10
mov qword [rbp - 0x30], r11
call fcn.140049078
mov rdi, qword [rbp + 0x20]
add rsp, 0x20
cmp eax, 0xb
mov rax, qword [rbp + 0x10]
je 0x140049443
mov qword [rdi], 0
sub rsp, 0x20
mov rcx, rdi
mov rdx, r13
call fcn.140049078
mov rdi, qword [rbp + 0x20]
add rsp, 0x20
cmp eax, 0xb
mov rax, qword [rbp + 0x10]
jne 0x1400498ee
mov edx, eax
and edx, 0xff00
movzx r8d, al
mov rax, rdx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], r8
lea rax, [rdx + r8]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1400494d1
mov rax, qword [rbp - 0x48]
mov rcx, 0xffffffffffffffc0
add rax, rcx
add rax, rsi
add rax, r12
add rax, 0x14
mov qword [rbp + 0x10], rax
mov rax, qword [rbp - 0x20]
lea rax, [rax + rax*4]
mov rcx, qword [rbp - 0x18]
lea rcx, [rcx + rcx*4]
shl rcx, 3
lea rax, [rcx + rax*8]
mov qword [rbp + 0x30], rax
xor r13d, r13d
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + r13]
add rdx, r12
mov ecx, dword [rax + r13 - 8]
mov r8d, dword [rax + r13 - 4]
add rcx, qword [rdi]
sub rsp, 0x20
call fcn.140084cc0
add rsp, 0x20
add r13, 0x28
cmp qword [rbp + 0x30], r13
jne 0x1400494a2
mov rax, qword [rdi]
mov qword [rbp + 0x30], rax
mov r13, qword [rbp + 8]
sub rax, qword [r13 + 0x30]
mov qword [rbp - 0x10], rax
je 0x14004961b
mov r9d, dword [r13 + 0xb0]
test r9, r9
sete al
cmp dword [r13 + 0xb4], 0
sete cl
or cl, al
jne 0x14004961b
movabs r10, 0xdd358a126536e432
movabs rax, 0xdcbf79653a52eedd
movabs r11, 0x58478c19ea162ce2
movabs r13, 0x417d8562d207e198
add r9, qword [rbp + 0x30]
lea rcx, [rax + 2]
xor rcx, rax
mov qword [rbp - 8], rcx
mov eax, dword [r9 + 4]
test rax, rax
jne 0x14004955b
cmp dword [r9], 0
je 0x140049610
xor eax, eax
jmp 0x140049608
cmp eax, 0xa
jb 0x140049608
add rax, 0xfffffffffffffff8
cqo
idiv qword [rbp - 8]
mov rcx, rax
cmp rax, 2
mov eax, 1
cmovl rcx, rax
mov rax, rcx
xor r8d, r8d
mov qword [rbp + 0x10], rcx
lea ecx, [r10 + 1]
xor ecx, r10d
mov rdx, r8
shl rdx, cl
lea rcx, [r11 + 8]
xor rcx, r11
add rcx, rdx
movzx ecx, word [r9 + rcx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0xa000
jne 0x1400495f1
mov edx, dword [r9]
and ecx, 0xfff
add rcx, rdx
mov rdx, qword [rbp + 0x30]
mov rax, rsi
mov rsi, r12
mov r12, r9
mov r9, r13
mov r13, r11
mov r11, r10
mov rdi, qword [rbp - 0x10]
add qword [rdx + rcx], rdi
mov r11, r13
mov r13, r9
mov r9, r12
mov r12, rsi
mov rsi, rax
mov rax, qword [rbp + 0x10]
lea rcx, [r13 + 1]
xor rcx, r13
add r8, rcx
cmp r8, rax
jne 0x140049588
mov eax, dword [r9 + 4]
mov rdi, qword [rbp + 0x20]
add r9, rax
jmp 0x140049541
mov rax, qword [rdi]
mov qword [rbp + 0x30], rax
mov r13, qword [rbp + 8]
cmp dword [r13 + 0x94], 0
jne 0x14004962f
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x18]
jmp 0x140049647
mov r8d, dword [r13 + 0x90]
test r8, r8
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x18]
jne 0x1400498ff
cmp dword [r13 + 0xa4], 0
mov rbx, qword [rbp - 0x48]
je 0x140049700
movabs rax, 0xc9b42d1a66006545
lea r8, [rax + 4]
xor r8, rax
sub rsp, 0x20
lea rdx, str.kernel32.dllRtlAddFunctionTable
mov rdi, qword [rbp - 0x50]
mov rcx, rdi
call fcn.140048dad
mov rcx, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x28]
add rsp, 0x20
cmp dword [rdi], 0
jne 0x140049700
mov rax, qword [rbp - 0x50]
mov rdx, qword [rax + 8]
movabs rax, 0xa0defaea82745ccd
lea r9, [rax + 0x11]
xor r9, rax
sub rsp, 0x20
lea r8, [0x14009404b]
mov rdi, qword [rbp - 0x78]
mov rcx, rdi
call fcn.140048ebe
add rsp, 0x20
cmp dword [rdi], 0
jne 0x1400496f8
mov ecx, dword [r13 + 0xa0]
mov eax, dword [r13 + 0xa4]
mov r8, qword [rbp + 0x30]
add rcx, r8
mov edx, 0xaaaaaaab
imul rdx, rax
shr rdx, 0x23
sub rsp, 0x20
call qword [rdi + 8]
add rsp, 0x20
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x18]
cmp qword [rbp - 0x70], 0
mov r8, qword [rbp + 0x20]
je 0x140049889
movabs r14, 0x5d4922837bd37ae2
mov rax, 0xffffffffffffffc0
add rbx, rax
add rbx, rsi
add r12, rbx
add r12, 0xc
mov rax, qword [rbp - 0x20]
lea rax, [rax + rax*4]
mov r8, qword [rbp - 0x18]
lea r8, [r8 + r8*4]
shl r8, 3
lea r13, [r8 + rax*8]
mov r8, qword [rbp + 0x20]
xor edi, edi
movabs rsi, 0xefe35804213eba6f
mov eax, dword [r12 + rdi + 4]
mov r9, qword [rbp - 0x68]
mov qword [r9], rax
test rax, rax
je 0x14004987c
mov eax, dword [r12 + rdi]
add rax, qword [r8]
mov r8, qword [rbp - 0x60]
mov qword [r8], rax
mov eax, dword [r12 + rdi + 0x18]
mov r8d, eax
and r8d, 0x40000000
bt eax, 0x1d
jb 0x1400497a3
mov ebx, 1
test r8d, r8d
je 0x1400497b8
shr eax, 0x1f
lea ebx, [rax*2 + 2]
jmp 0x1400497b8
mov ebx, 0x10
test r8d, r8d
je 0x1400497b8
shr eax, 0x1a
and eax, 0xffffffe0
add eax, 0x20
mov ebx, eax
mov r15, qword [0x1400a5020]
xor r15, rsi
jne 0x14004983b
lea r8, [r14 + 9]
xor r8, r14
sub rsp, 0x20
lea rdx, str.ntdll.dllNtAllocateVirtualMemoryNtProtectVirtualMemory
call fcn.140048dad
mov rax, qword [rbp + 0x18]
add rsp, 0x20
cmp dword [rax], 0
mov rcx, qword [rbp - 0x30]
jne 0x1400498ee
mov rdx, qword [rax + 8]
movabs rax, 0x45d9824ab21abfe4
lea r9, [rax + 0xe]
xor r9, rax
sub rsp, 0x20
lea r8, [0x1400940a0]
call fcn.140048ebe
mov rax, qword [rbp - 0x30]
mov rdx, qword [rbp + 0x28]
add rsp, 0x20
cmp dword [rax], 0
jne 0x1400498ee
mov r15, qword [rax + 8]
mov rax, r15
xor rax, rsi
mov qword [0x1400a5020], rax
mov dword [rdx], 0
sub rsp, 0x20
call sub.kernel32.dll_GetCurrentProcess
sub rsp, 0x10
mov rcx, qword [rbp + 0x28]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9d, ebx
call r15
mov rcx, qword [rbp + 0x18]
mov rdx, qword [rbp + 0x28]
add rsp, 0x30
test eax, eax
mov r8, qword [rbp + 0x20]
jne 0x1400498ee
add rdi, 0x28
cmp r13, rdi
jne 0x140049755
mov rsi, qword [r8]
mov rax, qword [rbp + 8]
cmp dword [rax + 0xd4], 0
je 0x1400498dd
mov eax, dword [rax + 0xd0]
test rax, rax
je 0x1400498dd
mov rdi, qword [rsi + rax + 0x18]
mov rax, qword [rdi]
test rax, rax
je 0x1400498dd
add rdi, 8
sub rsp, 0x20
mov rcx, rsi
mov edx, 2
xor r8d, r8d
call rax
add rsp, 0x20
mov rax, qword [rdi]
add rdi, 8
test rax, rax
jne 0x1400498b5
mov rax, qword [rbp + 0x20]
mov rsi, qword [rax]
mov rax, qword [rbp]
add rsi, rax
sub rsp, 0x20
call rsi
add rsp, 0x20
lea rsp, [rbp + 0x38]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rax, qword [rbp + 0x30]
add r8, rax
add rax, 2
mov qword [rbp - 0x38], rax
mov rax, r8
mov rdi, qword [rbp - 0x58]
mov r13d, dword [rax + 0xc]
test r13, r13
jne 0x140049939
cmp dword [rax + 0x10], 0
jne 0x140049939
cmp dword [rax], 0
jne 0x140049939
cmp dword [rax + 4], 0
jne 0x140049939
cmp dword [rax + 8], 0
je 0x140049a99
mov qword [rbp - 0x28], rax
add r13, qword [rbp + 0x30]
sub rsp, 0x20
mov rcx, r13
call fcn.140078b20
mov rcx, r15
mov rdx, r13
mov r8, rax
call fcn.14004599b
add rsp, 0x20
cmp qword [r15], 0
jne 0x1400498ee
mov rdx, qword [r15 + 8]
mov r8, qword [r15 + 0x10]
sub rsp, 0x20
mov rcx, rbx
call fcn.140048dad
add rsp, 0x20
cmp dword [rbx], 0
jne 0x1400498ee
mov rcx, qword [rbp - 0x28]
mov eax, dword [rcx]
mov edx, dword [rcx + 0x10]
mov rcx, qword [rbp + 0x30]
add rdx, rcx
add rcx, rax
test rax, rax
mov qword [rbp - 0x10], rdx
cmove rcx, rdx
mov qword [rbp - 8], rcx
mov r13, qword [rcx]
test r13, r13
je 0x140049a8c
mov rax, qword [rbx + 8]
mov qword [rbp - 0x40], rax
xor ecx, ecx
test r13, r13
mov qword [rbp + 0x10], rcx
js 0x140049a32
mov rax, qword [rbp - 0x38]
cmp byte [rax + r13], 0
je 0x140049a8c
add r13, qword [rbp - 0x38]
sub rsp, 0x20
mov rcx, r13
call fcn.140078b20
mov rcx, rdi
mov rdx, r13
mov r8, rax
call fcn.14004599b
add rsp, 0x20
cmp qword [rdi], 0
jne 0x1400498ee
mov rax, qword [rbp - 0x58]
mov r8, qword [rax + 8]
mov r9, qword [rax + 0x10]
sub rsp, 0x20
mov rcx, r14
mov rdx, qword [rbp - 0x40]
call fcn.140048ebe
add rsp, 0x20
cmp dword [r14], 0
jne 0x1400498ee
mov rax, qword [r14 + 8]
jmp 0x140049a67
movabs rcx, 0x6f6af63728c653d7
lea rax, [rcx + 0x5851]
xor rax, rcx
and r13, rax
sub rsp, 0x20
mov rcx, qword [rbp - 0x40]
mov rdx, r13
call qword [sym.imp.kernel32.dll_GetProcAddress]
add rsp, 0x20
test rax, rax
je 0x1400498ee
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp + 0x10]
mov qword [rcx + rdx], rax
mov rcx, rdx
mov rax, qword [rbp - 8]
mov r13, qword [rax + rdx + 8]
add rcx, 8
test r13, r13
jne 0x1400499be
mov rax, qword [rbp - 0x28]
add rax, 0x14
jmp 0x140049915
mov rax, qword [rbp + 0x20]
mov rax, qword [rax]
mov qword [rbp + 0x30], rax
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x18]
mov r13, qword [rbp + 8]
jmp 0x140049647
ud2