Function at 0x14000c060
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xe0
mov rax, qword [0x140021040]
xor rax, rsp
mov qword [rbp - 9], rax
mov rsi, rdx
mov qword [rbp - 0x69], rdx
mov rdi, rcx
mov qword [rbp - 0x71], rcx
mov rax, qword [rbp + 0x8f]
mov qword [rbp - 0x41], rax
xor r15d, r15d
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x29], r15
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14000c5ef
movsxd r14, dword [rdx + 0x3c]
add r14, rdx
cmp dword [r14], 0x4550
jne 0x14000c5ef
test r14, r14
je 0x14000c5ef
mov eax, 0x20b
cmp word [r14 + 0x18], ax
jne 0x14000c5ef
mov r12d, dword [r14 + 0x50]
mov edx, r12d
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000c5ef
movzx ecx, word [r14 + 0x14]
mov eax, dword [rcx + r14 + 0x24]
mov dword [rsp + 0x44], eax
sub r12d, eax
mov dword [rbp - 0x79], r12d
mov qword [rsp + 0x58], r15
mov eax, dword [rbp + 0x77]
cmp eax, 1
jne 0x14000c152
mov r13d, r12d
lea r8, [rsp + 0x58]
mov edx, r12d
mov rcx, rdi
call fcn.14000bcc0
mov r15, rax
jmp 0x14000c3d8
cmp eax, 2
jne 0x14000c2d7
mov qword [rsp + 0x48], r15
lea rax, str.x____xxxxxxxx____xxxxxxxxx____xxxxxxxx
mov qword [rsp + 0x20], rax
lea r9, [0x1400129d0]
mov r8, qword [0x140021d18]
lea rdx, str.PAGELK
mov rcx, rdi
call fcn.140003b60
mov rsi, rax
mov qword [0x140021d38], rax
test rax, rax
je 0x14000c2cb
mov dword [rbp - 0x39], r15d
lea r8, [rax + 1]
mov r9d, 4
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.140002560
test al, al
jne 0x14000c1cd
mov qword [0x140021d38], r15
mov r13d, r12d
mov rsi, qword [rbp - 0x69]
jmp 0x14000c3d8
movsxd rcx, dword [rbp - 0x39]
add rcx, 5
add rcx, rsi
mov qword [0x140021d38], rcx
je 0x14000c2cb
mov r9d, r12d
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140005810
test al, al
je 0x14000c2cb
mov r15, qword [rsp + 0x48]
test r15, r15
je 0x14000c2cb
lea rax, str.xx____x___x_x____xxxxxxx____x
mov qword [rsp + 0x20], rax
lea r9, [0x140012a50]
mov r8, qword [0x140021d18]
lea rdx, str.PAGE
mov rcx, rdi
call fcn.140003b60
mov qword [0x140021c88], rax
xor r13d, r13d
test rax, rax
je 0x14000c2ae
lea rsi, [rax + 0xc]
mov qword [0x140021c88], rsi
mov dword [rbp - 0x39], r13d
lea r8, [rsi + 1]
mov r9d, 4
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.140002560
test al, al
jne 0x14000c275
mov qword [0x140021c88], r13
jmp 0x14000c2ae
movsxd rcx, dword [rbp - 0x39]
add rcx, 5
add rcx, rsi
mov qword [0x140021c88], rcx
je 0x14000c2ae
mov byte [rsp + 0x40], r13b
mov dword [rsp + 0x20], r12d
mov r9, r15
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140005c10
test al, al
je 0x14000c2ae
cmp byte [rsp + 0x40], r13b
jne 0x14000c2cb
mov r8d, r12d
mov rdx, r15
mov rcx, rdi
call fcn.1400027a0
mov r15, r13
mov r13d, r12d
mov rsi, qword [rbp - 0x69]
jmp 0x14000c3d8
mov r13d, r12d
mov rsi, qword [rbp - 0x69]
jmp 0x14000c3d8
mov r13d, r12d
test r12d, r12d
je 0x14000c3d8
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140021d88], eax
jle 0x14000c3a7
lea rcx, [0x140021d88]
call fcn.14000f5c0
cmp dword [0x140021d88], 0xffffffff
jne 0x14000c3a7
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], r15
mov r8d, 0x15
lea rdx, [0x140012af8]
lea rcx, [rbp - 0x61]
call fcn.140007460
nop
lea r8, [rbp - 0x61]
mov rdx, qword [0x140021d18]
mov rcx, rdi
call fcn.140002bd0
mov qword [0x140021e70], rax
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x14000c39b
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c395
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c395
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000f510
nop
lea rcx, [0x140021d88]
call fcn.14000f554
cmp qword [0x140021e70], 0
je 0x14000c3d8
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x20], r13
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140006820
mov r15, qword [rsp + 0x48]
test al, al
mov eax, 0
cmove r15, rax
mov rcx, rbx
test r15, r15
jne 0x14000c3f3
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000c5ef
mov r8d, dword [r14 + 0x54]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r14 + 0x14]
add rbx, 0x28
xor ecx, ecx
mov esi, ecx
cmp cx, word [r14 + 6]
jae 0x14000c457
add rbx, r14
mov r13, qword [rsp + 0x50]
mov r12, qword [rbp - 0x69]
nop
test dword [rbx + 0x14], 0x80
ja 0x14000c43d
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, r12
mov ecx, dword [rbx - 4]
add rcx, r13
call sub.VCRUNTIME140.dll_memcpy
inc esi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp esi, eax
jl 0x14000c420
mov r12d, dword [rbp - 0x79]
mov r13d, r12d
mov rdi, qword [rbp - 0x71]
mov rsi, r15
mov eax, dword [rsp + 0x44]
sub r15, rax
mov rbx, r15
sub rbx, qword [r14 + 0x30]
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x61]
call fcn.14000cf90
mov rdx, rbx
mov rcx, rax
call fcn.14000c630
mov rdx, r15
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.14000c730
test al, al
je 0x14000c5ef
mov rdx, rbx
lea rcx, [rbp - 0x61]
call fcn.14000d0f0
mov rdx, rax
mov rcx, rdi
call fcn.14000c7f0
test al, al
je 0x14000c5a3
mov r8d, dword [rsp + 0x44]
add r8, rbx
mov r9, r13
mov rdx, rsi
mov rcx, rdi
call fcn.140002560
mov rbx, qword [rsp + 0x58]
test al, al
je 0x14000c5a8
mov r14d, dword [r14 + 0x28]
add r14, r15
mov qword [rsp + 0x20], rbx
mov r9, r13
mov r8, rsi
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x29]
call fcn.140009010
test al, al
je 0x14000c5a8
xor eax, eax
mov dword [rsp + 0x44], eax
mov r9, qword [rbp - 0x29]
cmp byte [rbp + 0x7f], al
cmovne r9, rsi
mov rax, qword [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r8, r14
lea rdx, [rsp + 0x44]
mov rcx, rdi
call fcn.14000cb10
test al, al
je 0x14000c5a8
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14000c53f
mov eax, dword [rsp + 0x44]
mov dword [rcx], eax
cmp byte [rbp + 0x67], 0
je 0x14000c579
mov eax, dword [rbp + 0x77]
mov rdx, rsi
cmp eax, 1
jne 0x14000c591
mov r8, rbx
mov rcx, rdi
call fcn.140002890
test al, al
je 0x14000c579
mov rdx, rbx
mov rcx, rdi
call fcn.1400029a0
test al, al
je 0x14000c579
mov rdx, rbx
mov rcx, rdi
call fcn.140002ab0
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rsi
jmp 0x14000c5f1
cmp eax, 2
jne 0x14000c571
mov r8d, r12d
mov rcx, rdi
call fcn.1400027a0
jmp 0x14000c579
mov rbx, qword [rsp + 0x58]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 0x77]
mov rdx, rsi
cmp eax, 1
jne 0x14000c618
mov r8, rbx
mov rcx, rdi
call fcn.140002890
test al, al
je 0x14000c5ef
mov rdx, rbx
mov rcx, rdi
call fcn.1400029a0
test al, al
je 0x14000c5ef
mov rdx, rbx
mov rcx, rdi
call fcn.140002ab0
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14000f4f0
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp eax, 2
jne 0x14000c5e7
mov r8d, r12d
mov rcx, rdi
call fcn.1400027a0
jmp 0x14000c5ef