Function at 0x14005c4e0
Capabilities:
Access pe header

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r13, r9
mov rbp, r8
mov r15d, edx
mov rbx, rcx
call fcn.14005dbe0
mov r8, rax
xor edx, edx
mov rcx, rbx
call fcn.14011d670
mov rcx, rbp
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rdi, rax
test rax, rax
je case.default.0x14005c582
xor r12b, r12b
xor r14b, r14b
xor esi, esi
lea ecx, [rsi + 1]
cmp dword [rax + 0xfc], esi
je 0x14005c55f
mov eax, dword [rax + 0xf8]
test eax, eax
je 0x14005c55f
movzx r14d, cl
test byte [rax + rbp + 0x10], cl
cmovne esi, ecx
call fcn.14005e010
dec eax
cmp eax, 7
ja case.default.0x14005c582
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x5c7e8]
add rcx, rdx
jmp rcx
mov r12d, 1
mov dword [rbx + 0x114], r12d
jmp 0x14005c599
mov r12d, 1
mov ecx, dword [0x1406f5db0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1406f4c30], eax
jle 0x14005c608
lea rcx, [0x1406f4c30]
call fcn.1400ebf7c
cmp dword [0x1406f4c30], 0xffffffff
jne 0x14005c608
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 3
mov r9d, 6
xor r8d, r8d
lea edx, [r9 - 4]
mov ecx, r9d
call fcn.14005dfd0
mov byte [0x1406f4c2c], al
lea rcx, [0x1406f4c30]
call fcn.1400ebf1c
lea rcx, [rbx + 0x100]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
mov rax, qword [rdi + 0x30]
mov qword [rbx + 0xf8], rax
xor edx, edx
mov rcx, r13
call fcn.14005d9f0
mov dword [rbx + 0x108], eax
mov dword [rbx + 0x10c], 4
mov rdx, rbp
mov rcx, rbx
call fcn.14005c8d0
test eax, eax
js case.default.0x14005c582
mov ecx, 0x50
call fcn.14005db80
mov qword [rbx + 0x98], rax
test rax, rax
je case.default.0x14005c582
lea rcx, [rbx + 0xa0]
mov qword [rcx], rax
mov qword [rbx + 0xa8], rax
mov qword [rax], rcx
mov rax, qword [rbx + 0x98]
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x98]
mov dword [rax + 0x38], 9
mov rax, qword [rbx + 0x98]
mov dword [rax + 0x18], r12d
cmp byte [0x1406f4c2c], 0
je 0x14005c6b3
mov rax, qword [rbx + 0x98]
mov dword [rax + 0x1c], r12d
movzx ecx, r14b
shl ecx, 0x16
mov eax, dword [rbx + 0x68]
and eax, 0xffbffdff
or ecx, eax
btr ecx, 0x18
shl r15d, 9
not r15d
and r15d, 0x200
or ecx, r15d
shl esi, 0x18
or ecx, esi
or ecx, 0x840cc
mov dword [rbx + 0x68], ecx
mov r12b, 1
call fcn.14005dbe0
cmp rax, 0xe0
jne case.0x14005c582.2
mov rax, qword [rdi + 0x30]
mov qword [rbx + 0xd0], rax
lea rcx, [rbx + 0xd8]
call qword [sym.imp.ntdll.dll_NtQuerySystemTime]
call fcn.14005dbe0
cmp rax, 0xc8
je 0x14005c729
call fcn.14005dbe0
cmp rax, 0xe0
jne case.0x14005c582.1
lea rax, [rbx + 0x98]
mov qword [rax], rax
mov qword [rbx + 0xa0], rax
lea rax, [rbx + 0xb8]
mov qword [rax], rax
mov qword [rbx + 0xc0], rax
lea rax, [rbx + 0xa8]
mov qword [rax], rax
mov qword [rbx + 0xb0], rax
mov qword [rbx + 0x30], rbp
mov eax, dword [rdi + 0x50]
mov dword [rbx + 0x40], eax
mov eax, dword [rdi + 8]
mov dword [rbx + 0x80], eax
movups xmm0, xmmword [r13]
movups xmmword [rbx + 0x58], xmm0
mov rax, qword [rsp + 0x90]
movups xmm0, xmmword [rax]
movups xmmword [rbx + 0x48], xmm0
mov eax, dword [rdi + 0x28]
add rax, rbp
mov qword [rbx + 0x38], rax
mov eax, 1
mov word [rbx + 0x6c], ax
test r12b, r12b
jne 0x14005c7b7
mov dword [rbx + 0x68], 0x8c004
mov eax, dword [rbx + 0x68]
mov ecx, 0x48c004
test r14b, r14b
cmovne eax, ecx
mov dword [rbx + 0x68], eax
lea rax, [rbx + 0x70]
mov qword [rax], rax
mov qword [rbx + 0x78], rax
mov al, 1
jmp 0x14005c7c8
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret