Function at 0x1404b0cc0
Capabilities:
Parse pe header

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbp, rbx
mov qword [rsp + 0x10], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
lea rbp, [rsp - 0x57]
mov dword [rsp - 0x20], 0x95d1c22
sub rsp, 0xc0
movzx eax, byte [r8 + 0x80]
xchg rbx, r12
mov r12, r8
xchg r12, rbx
xchg rdi, rdx
mov rdx, rdi
xchg rdi, rdx
cmp eax, 6
ja case.default.0x1404b0d2d
mov dword [rsp - 0x44], 0x25f2eefc
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0x4b139a]
add rax, rdx
xchg rdx, rdx
jmp rax
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.14002c550
xchg rbx, rbx
mov rax, qword [rbp + 0x4f]
mov rcx, qword [rdi]
cmp rax, 0x20
jae 0x1404b0d85
xchg rsi, rsi
or al, 0xa0
lea rdx, [rbp + 0x77]
mov r8d, 0x1747d3fc
add r8d, 0x3e5b71d6
sub r8d, 0x249d4964
sub r8d, 0xc52de87
xor r8d, 0x24b31de6
mov byte [rbp + 0x77], al
call qword [rdi + 8]
jmp 0x1404b0e76
mov r9, qword [rdi + 8]
cmp rax, 0x100
mov rsp, rsp
jae 0x1404b0dd9
mov byte [rbp + 0x77], 0x11
xor byte [rbp + 0x77], 0x46
sub byte [rbp + 0x77], 0x28
xor byte [rbp + 0x77], 0xf6
lea rdx, [rbp + 0x77]
mov byte [rbp + 0x78], al
mov r9, r9
mov r8d, 0x101214db
xor r8d, 0x62075cfe
sub r8d, 0x1338cdea
sub r8d, 0x5479ce8d
sub r8d, 0xa62abac
jmp 0x1404b0e73
cmp rax, 0x10000
jae 0x1404b0e37
ror ax, 2
ror ax, 3
ror ax, 2
ror ax, 1
lea rdx, [rbp + 0x77]
mov word [rbp + 0x78], ax
mov r8d, 0x6186ed26
sub r8d, 0x17ff91e0
xor r8d, 0x4f900892
add r8d, 0x220e9cd
sub r8d, 0x8383d9e
mov byte [rbp + 0x77], 0x48
sub byte [rbp + 0x77], 0x19
xor byte [rbp + 0x77], 0x78
add byte [rbp + 0x77], 0x14
add byte [rbp + 0x77], 0x6f
jmp 0x1404b0e73
bswap eax
mov dword [rsp - 0xc], 0x2036572a
mov dword [rbp + 0x78], eax
lea rdx, [rbp + 0x77]
mov byte [rbp + 0x77], 0x32
add byte [rbp + 0x77], 0x14
xor byte [rbp + 0x77], 0x68
xor byte [rbp + 0x77], 0xf5
mov r8d, 0x62c69643
sub r8d, 0x5dc47534
add r8d, 0x21fe658d
sub r8d, 0x27008697
call r9
mov r8, qword [rbp + 0x4f]
mov dword [rsp - 0x1c], edi
xchg r15, rdx
mov r15, qword [rbp - 0x39]
xchg r15, rdx
xchg rdx, rcx
mov rdx, qword [rdi]
xchg rdx, rcx
call qword [rdi + 8]
mov dword [rsp - 0x1c], 0x6badab26
mov rcx, qword [rbp - 0x39]
lea rax, [rbp - 0x31]
cmp rcx, rax
jne 0x1404b0ed5
mov dword [rsp - 0x1c], esi
lea rdi, [rbp - 0x31]
xor eax, eax
mov ecx, 0x6393f8b9
xor ecx, 0x4f817992
xor ecx, 0x1ff5cf18
xor ecx, 0x33e74eb3
rep stosb byte [rdi], al
jmp case.default.0x1404b0d2d
call fcn.1400b6f90
jmp case.default.0x1404b0d2d
mov eax, dword [r8 + 0x48]
mov rcx, qword [rdi]
mov dword [rsp - 0x14], ebp
mov r9, qword [rdi + 8]
cmp eax, 0x100
jae 0x1404b0f43
mov dword [rsp - 0x30], 0x3fb42874
mov byte [rbp + 0x77], 0x28
xor byte [rbp + 0x77], 0x7f
xor byte [rbp + 0x77], 4
sub byte [rbp + 0x77], 0x49
add byte [rbp + 0x77], 0xba
lea rdx, [rbp + 0x77]
mov byte [rbp + 0x78], al
mov r8d, 0x650f047a
sub r8d, 0x28c9892a
sub r8d, 0x1f430e11
add r8d, 0x61306acd
xor r8d, 0x7e32d80e
jmp 0x1404b0fde
cmp eax, 0x10000
mov r14, r14
jae 0x1404b0fa2
ror ax, 6
ror ax, 1
ror ax, 1
lea rdx, [rbp + 0x77]
mov word [rbp + 0x78], ax
mov dword [rsp - 0x18], 0x1e38462a
mov r8d, 0x689158dd
sub r8d, 0x2a2b7afe
add r8d, 0x3840ef64
add r8d, 0x65bc46f
sub r8d, 0x7d0291af
mov byte [rbp + 0x77], 0xb
add byte [rbp + 0x77], 0x1f
sub byte [rbp + 0x77], 0x12
add byte [rbp + 0x77], 0xad
jmp 0x1404b0fde
bswap eax
mov dword [rsp - 0x44], 0x6e2b3a2a
mov dword [rbp + 0x78], eax
lea rdx, [rbp + 0x77]
mov byte [rbp + 0x77], 0x52
xor byte [rbp + 0x77], 0x28
sub byte [rbp + 0x77], 0x24
xor byte [rbp + 0x77], 0x90
mov r8d, 0x40bea5d7
add r8d, 0x1f2f0ea
add r8d, 0x6ca1e35
xor r8d, 0x497bb4f3
call r9
xchg r8, r8
mov r8d, dword [rbx + 0x48]
xchg r14, rdx
mov r14, qword [rbx + 0x40]
xchg r14, rdx
mov rcx, qword [rdi]
xchg rsp, rsp
call qword [rdi + 8]
jmp case.default.0x1404b0d2d
cmp byte [r8 + 0x50], 0
mov rsp, rsp
pushf
mov r8d, 0x3268693b
xor r8d, 0x630d50a6
sub r8d, 0x278dddbc
sub r8d, 0x29d75be0
popf
mov rcx, qword [rdi]
mov dword [rsp - 0x3c], ebx
mov rax, qword [rdi + 8]
je 0x1404b1049
lea rdx, [0x14000c7a0]
mov r15, r15
call rax
jmp case.default.0x1404b0d2d
lea rdx, [0x14000c7a1]
call rax
jmp case.default.0x1404b0d2d
mov eax, dword [r8 + 0x54]
xchg rcx, r15
mov r15, qword [rdi]
xchg r15, rcx
mov dword [rbp + 0x7f], eax
mov dword [rsp - 0x38], 0x6b6bbcf
cmp eax, 0xffffffe0
jge 0x1404b114b
mov rdi, qword [rdi + 8]
mov dword [rsp - 0x34], 0x48e8ee06
cmp eax, 0xffff8000
jge 0x1404b10a8
mov byte [rbp + 0x77], 0x4d
add byte [rbp + 0x77], 0x21
xor byte [rbp + 0x77], 0x5a
xor byte [rbp + 0x77], 0xb
add byte [rbp + 0x77], 0x93
jmp 0x1404b1208
cmp eax, 0xffffff80
jge 0x1404b1106
mov byte [rbp + 0x77], 0x50
sub byte [rbp + 0x77], 2
xor byte [rbp + 0x77], 0x13
add byte [rbp + 0x77], 0x74
ror ax, 1
ror ax, 2
ror ax, 4
ror ax, 1
lea rdx, [rbp + 0x77]
xchg rsp, rsp
mov r8d, 0x66cea088
sub r8d, 0x493aaef5
add r8d, 0xa6bcebe
add r8d, 0x6fcd59
sub r8d, 0x286f8da7
mov word [rbp + 0x78], ax
mov r15, r15
call rdi
jmp case.default.0x1404b0d2d
mov byte [rbp + 0x77], 5
add byte [rbp + 0x77], 0x78
xor byte [rbp + 0x77], 9
sub byte [rbp + 0x77], 0x4a
xor byte [rbp + 0x77], 0xfa
mov r8d, 0x3be01363
add r8d, 0x1e2014ec
sub r8d, 0x26791d5b
sub r8d, 0x33870af2
mov byte [rbp + 0x78], al
lea rdx, [rbp + 0x77]
mov dword [rsp - 0x38], 0x54288dc7
call rdi
jmp case.default.0x1404b0d2d
cmp eax, 0x80
jge 0x1404b1180
mov r8d, 0x2f037a52
xor r8d, 0x2d19a8ad
add r8d, 0x62eb0f9c
xor r8d, 0x6505e29a
lea rdx, [rbp + 0x7f]
call qword [rdi + 8]
mov rsi, rsi
jmp case.default.0x1404b0d2d
cmp eax, 0x100
jge 0x1404b11cc
mov dword [rsp - 0x18], edx
mov r8d, 0x3323a4c7
xor r8d, 0x25b439d5
add r8d, 0x655cf2d2
sub r8d, 0x7bf48fe2
mov byte [rbp + 0x77], 0x2a
xor byte [rbp + 0x77], 0x26
add byte [rbp + 0x77], 0x55
add byte [rbp + 0x77], 0x6b
lea rdx, [rbp + 0x77]
xchg rcx, rcx
mov byte [rbp + 0x78], al
call qword [rdi + 8]
jmp case.default.0x1404b0d2d
mov rdi, qword [rdi + 8]
cmp eax, 0x10000
mov dword [rsp - 0x34], ecx
jge 0x1404b11f4
mov byte [rbp + 0x77], 0x60
xor byte [rbp + 0x77], 0xd
sub byte [rbp + 0x77], 0x45
add byte [rbp + 0x77], 0xa5
jmp 0x1404b10c1
mov byte [rbp + 0x77], 7
xor byte [rbp + 0x77], 5
add byte [rbp + 0x77], 0x38
xor byte [rbp + 0x77], 0xe
xor byte [rbp + 0x77], 0xfa
bswap eax
mov r8d, 0x45550acd
xor r8d, 0x38aef9a9
sub r8d, 0x73f2ee6f
xor r8d, 0xa0904f0
mov dword [rbp + 0x78], eax
mov dword [rsp - 0x2c], 0x39e5ee0f
lea rdx, [rbp + 0x77]
call rdi
jmp case.default.0x1404b0d2d
mov rax, qword [r8 + 0x58]
mov rcx, qword [rdi]
mov rdi, qword [rdi + 8]
mov dword [rsp - 0x38], 0x75c477eb
mov qword [rbp + 0x7f], rax
cmp rax, 0x100
jae 0x1404b12d9
cmp rax, 0x80
mov r11, r11
jae 0x1404b1296
mov r8d, 0x33ba0b88
sub r8d, 0x2549c381
sub r8d, 0x4ed8753
sub r8d, 0x982c0b3
lea rdx, [rbp + 0x7f]
mov r13, r13
call rdi
jmp case.default.0x1404b0d2d
mov byte [rbp + 0x77], 0x56
sub byte [rbp + 0x77], 0x4b
sub byte [rbp + 0x77], 1
xor byte [rbp + 0x77], 0xc6
mov r8d, 0x33ffb141
sub r8d, 0x14836707
add r8d, 0x4df46e11
xor r8d, 0x72fbabba
xor r8d, 0x1f8b13f3
mov byte [rbp + 0x78], al
xchg r11, r11
lea rdx, [rbp + 0x77]
call rdi
jmp case.default.0x1404b0d2d
cmp rax, 0x10000
jb 0x1404b11df
movabs rdx, 0x10e959746
sub rdx, 0x16507b2
add rdx, 0x6edd2243
sub rdx, 0x7c0db1d7
cmp rax, rdx
jb 0x1404b11f4
mov dword [rsp - 0x18], 0x45e9f5ec
bswap rax
mov r8d, 0x5cd51a30
sub r8d, 0x5a40fb3d
xor r8d, 0x7df36013
sub r8d, 0x7f677ed7
xchg r11, rax
mov qword [rbp - 0x48], r11
xchg r11, rax
lea rdx, [rbp - 0x49]
mov dword [rsp - 0x18], ebx
mov byte [rbp - 0x49], 0x3a
xor byte [rbp - 0x49], 0x66
add byte [rbp - 0x49], 0x10
xor byte [rbp - 0x49], 0x45
add byte [rbp - 0x49], 0xa6
call rdi
jmp case.default.0x1404b0d2d
sub r8, 0xffffffffffffffa0
xchg rdx, rdx
xchg rdi, rdx
mov rdi, rdx
xchg rdx, rdi
call fcn.1404b0ae0
lea r11, [rsp + 0xc0]
mov r13, r13
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
xchg rsp, rdi
mov rdi, r11
xchg rdi, rsp
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret