Function at 0x1400096f0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x218
movaps xmmword [rsp + 0x200], xmm6
test rdx, rdx
je 0x140009afc
mov r15, r8
mov r12, rdx
mov rbp, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
xor ebx, ebx
lea rsi, [rsp + 0xf8]
mov r8d, 0x108
mov rcx, rsi
xor edx, edx
call fcn.1401d5110
movaps xmm6, xmmword [0x140210de0]
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x60], r12
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 0x40
mov dword [rsp + 0x4c], 0
lea rdi, [rsp + 0x4c]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x50]
mov rcx, rbp
mov edx, 0x80862007
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140009afe
movzx eax, word [rsp + 0xb0]
cmp eax, 0x5a4d
jne 0x140009afc
movsxd rax, dword [rsp + 0xec]
add rax, r12
je 0x140009afc
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 0x108
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdi, [rsp + 0x50]
mov rcx, rbp
mov edx, 0x80862007
mov r8, rdi
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140009afc
cmp dword [rsp + 0xf8], 0x4550
jne 0x140009afc
mov r14d, dword [rsp + 0x180]
xor ebx, ebx
test r14, r14
je 0x140009afe
mov esi, dword [rsp + 0x184]
test esi, esi
je 0x140009afe
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
lea rdx, [r14 + r12]
mov rcx, rbp
mov qword [rsp + 0x80], rdx
mov r8, rax
mov r9, rsi
call fcn.140008350
test al, al
je 0x140009ae7
mov qword [rsp + 0x78], rsi
cmp dword [r13 + 0x18], 0
je 0x140009ae7
mov rax, r13
sub rax, r14
mov ecx, dword [r13 + 0x1c]
mov edx, dword [r13 + 0x20]
add rdx, rax
mov qword [rsp + 0xa0], rdx
mov edx, dword [r13 + 0x24]
add rdx, rax
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0xa8], rax
add rcx, rax
mov qword [rsp + 0x90], rcx
mov rax, qword [rsp + 0x80]
add qword [rsp + 0x78], rax
xor r14d, r14d
movaps xmm6, xmmword [section..rdata]
mov qword [rsp + 0x98], r13
mov rax, qword [rsp + 0xa0]
mov ebp, dword [rax + r14*4]
add rbp, qword [rsp + 0xa8]
mov qword [rsp + 0x50], 0
movups xmmword [rsp + 0x60], xmm6
mov byte [rsp + 0x50], 0
mov rcx, rbp
call fcn.1401ed780
mov r13, rax
cmp rax, 0xf
jbe 0x1400099c1
test r13, r13
js 0x140009b1d
mov rax, r13
or rax, 0xf
movabs rdi, 0x7fffffffffffffff
movabs rcx, 0x8000000000000000
js 0x1400099aa
mov rdi, rax
cmp rax, 0x17
jae 0x14000999a
mov edi, reloc.WS2_32.dll_shutdown
lea rcx, [rdi + 1]
cmp rdi, 0xfff
jb 0x1400099e1
mov rdi, rax
add rcx, 0x27
call fcn.1400ad850
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400099e9
mov qword [rsp + 0x60], r13
mov rcx, rdi
mov rdx, rbp
mov r8, r13
call fcn.1401d4a60
mov byte [rsp + r13 + 0x50], 0
mov rsi, qword [rsp + 0x50]
jmp 0x140009a10
call fcn.1400ad850
mov rsi, rax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rdi
mov rcx, rsi
mov rdx, rbp
mov r8, r13
call fcn.1401d4a60
mov byte [rsi + r13], 0
mov qword [rsp + 0x50], rsi
lea rdi, [rsp + 0x50]
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
mov r13, qword [rsp + 0x98]
jb 0x140009a25
mov rdx, qword [r15]
cmp qword [rsp + 0x68], 0x10
cmovb rsi, rdi
mov rcx, rsi
call fcn.1401e65bc
mov ebp, eax
test eax, eax
jne 0x140009a90
mov rax, qword [rsp + 0x88]
movzx eax, word [rax + r14*2]
mov rcx, qword [rsp + 0x90]
mov esi, dword [rcx + rax*4]
cmp rsi, 0x1001
jae 0x140009a62
xor ebx, ebx
jmp 0x140009a90
add rsi, r12
mov rcx, r13
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp rsi, qword [rsp + 0x78]
mov ebx, 0
cmova rbx, rsi
cmp rsi, qword [rsp + 0x80]
cmovb rbx, rsi
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x140009ad2
mov rcx, qword [rsp + 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140009acd
mov rdi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rdi
cmp rcx, 0x20
jae 0x140009b22
add rax, 0x28
mov rdx, rax
mov rcx, rdi
lea rdi, [rsp + 0x50]
call fcn.1400ad894
test ebp, ebp
je 0x140009afe
add r14, 1
mov eax, dword [r13 + 0x18]
cmp r14, rax
jb 0x14000992e
xor ebx, ebx
mov rcx, r13
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140009afe
xor ebx, ebx
mov rax, rbx
movaps xmm6, xmmword [rsp + 0x200]
add rsp, 0x218
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400035c0
call fcn.1401e54b4
int3