Function at 0x14001ccce
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push r15
push r14
mov rax, 0x5d
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14001ccee
sub rsp, 0x28
call fcn.140040160
mov rdx, qword [rsp + 0x338]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400401d0
add rsp, 0x10
mov rdx, qword [rsp + 0x340]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.1400401d0
add rsp, 0x10
mov dword [0x1400f7001], 0x40000ac
mov dword [0x1400f7001], 0x40000ad
mov qword [rsp + 0x48], 0
mov dword [0x1400f7001], 0x40000b7
sub rsp, 0x18
mov rdx, 1
lea rax, [rsp + 0x2f0]
push rax
xor r9, r9
mov r8, 5
mov rcx, 4
sub rsp, 0x20
call fcn.140036dc4
add rsp, 0x40
mov qword [rsp + 0x2d8], rax
mov dword [0x1400f7001], 0x40000b8
sub rsp, 0x18
mov rdx, 1
lea rax, [rsp + 0x300]
push rax
xor r9, r9
mov r8, 5
mov rcx, 4
sub rsp, 0x20
call fcn.140036dc4
add rsp, 0x40
mov qword [rsp + 0x2e8], rax
mov dword [0x1400f7001], 0x40000b9
sub rsp, 0x18
mov rdx, 1
lea rax, [rsp + 0x310]
push rax
xor r9, r9
mov r8, 3
mov rcx, 2
sub rsp, 0x20
call fcn.140036dc4
add rsp, 0x40
mov qword [rsp + 0x2f8], rax
mov dword [0x1400f7001], 0x40000bb
push qword [rsp + 0x330]
push 0
push 0x10
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_OpenProcess
mov qword [rsp + 0x38], rax
mov dword [0x1400f7001], 0x40000bc
cmp qword [rsp + 0x38], 0
je 0x14001d933
mov dword [0x1400f7001], 0x40000bd
cmp qword [rsp + 0x348], 0
je 0x14001ce9c
mov dword [0x1400f7001], 0x40000be
push qword [rsp + 0x348]
pop rax
mov qword [rsp + 0x40], rax
mov dword [0x1400f7001], 0x40000bf
jmp 0x14001cec7
mov dword [0x1400f7001], 0x40000bf
mov dword [0x1400f7001], 0x40000c0
push qword [rsp + 0x28]
push qword [rsp + 0x338]
pop rcx
pop rdx
call fcn.14001ca7e
mov qword [rsp + 0x40], rax
mov dword [0x1400f7001], 0x40000c1
mov dword [0x1400f7001], 0x40000c3
cmp qword [rsp + 0x40], 0
je 0x14001cee8
xor rax, rax
jmp 0x14001ceef
mov rax, 1
and rax, rax
je 0x14001cf03
mov dword [0x1400f7001], 0x40000c4
jmp 0x14001d8da
mov dword [0x1400f7001], 0x40000c5
mov dword [0x1400f7001], 0x40000c7
sub rsp, 8
push 0
push 0x40
lea rax, [rsp + 0x88]
mov rax, rax
push rax
push qword [rsp + 0x60]
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
and rax, rax
je 0x14001cf6d
lea rbp, [rsp + 0x70]
movsx r15, word [rbp]
cmp r15, 0x5a4d
je 0x14001cf6d
mov rax, 1
jmp 0x14001cf70
xor rax, rax
and rax, rax
je 0x14001cf84
mov dword [0x1400f7001], 0x40000c8
jmp 0x14001d8da
mov dword [0x1400f7001], 0x40000c9
mov dword [0x1400f7001], 0x40000cb
sub rsp, 8
push 0
push 4
lea rax, [rsp + 0xc8]
mov rax, rax
push rax
mov r15, qword [rsp + 0x60]
lea rbp, [rsp + 0x90]
movsxd rax, dword [rbp + 0x3c]
add r15, rax
mov rax, r15
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
and rax, rax
je 0x14001d000
movsxd r15, dword [rsp + 0xb0]
cmp r15, 0x4550
je 0x14001d000
mov rax, 1
jmp 0x14001d003
xor rax, rax
and rax, rax
je 0x14001d017
mov dword [0x1400f7001], 0x40000cc
jmp 0x14001d8da
mov dword [0x1400f7001], 0x40000cd
mov dword [0x1400f7001], 0x40000cf
sub rsp, 8
push 0
push 0x14
lea rax, [rsp + 0xd0]
mov rax, rax
push rax
mov r15, qword [rsp + 0x60]
lea rbp, [rsp + 0x90]
movsxd rax, dword [rbp + 0x3c]
add r15, rax
add r15, 4
mov rax, r15
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
and rax, rax
je 0x14001d082
xor rax, rax
jmp 0x14001d089
mov rax, 1
and rax, rax
je 0x14001d09d
mov dword [0x1400f7001], 0x40000d0
jmp 0x14001d8da
mov dword [0x1400f7001], 0x40000d1
mov dword [0x1400f7001], 0x40000d3
lea rbp, [rsp + 0xb8]
movsx r15, word [rbp + 0x10]
cmp r15, 0xf0
jne 0x14001d0e5
mov dword [0x1400f7001], 0x40000d4
mov byte [rsp + 0xd0], 1
mov dword [0x1400f7001], 0x40000d5
jmp 0x14001d13c
mov dword [0x1400f7001], 0x40000d5
lea rbp, [rsp + 0xb8]
movsx r15, word [rbp + 0x10]
cmp r15, 0xe0
jne 0x14001d123
mov dword [0x1400f7001], 0x40000d6
mov byte [rsp + 0xd0], 0
mov dword [0x1400f7001], 0x40000d7
jmp 0x14001d13c
mov dword [0x1400f7001], 0x40000d7
mov dword [0x1400f7001], 0x40000d8
jmp 0x14001d8da
mov dword [0x1400f7001], 0x40000d9
mov dword [0x1400f7001], 0x40000db
cmp byte [rsp + 0xd0], 0
je 0x14001d215
mov dword [0x1400f7001], 0x40000dc
sub rsp, 8
push 0
lea rbp, [rsp + 0xc8]
movsx rax, word [rbp + 0x10]
mov rax, rax
push rax
lea rax, [rsp + 0xf0]
mov rax, rax
push rax
mov r15, qword [rsp + 0x60]
lea rbp, [rsp + 0x90]
movsxd rax, dword [rbp + 0x3c]
add r15, rax
add r15, 0x18
mov rax, r15
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
and rax, rax
je 0x14001d1e5
lea rbp, [rsp + 0xd8]
movsx r15, word [rbp]
cmp r15, 0x20b
je 0x14001d1e5
mov rax, 1
jmp 0x14001d1e8
xor rax, rax
and rax, rax
je 0x14001d1fc
mov dword [0x1400f7001], 0x40000dd
jmp 0x14001d8da
mov dword [0x1400f7001], 0x40000de
mov dword [0x1400f7001], 0x40000df
jmp 0x14001d2c7
mov dword [0x1400f7001], 0x40000df
mov dword [0x1400f7001], 0x40000e0
sub rsp, 8
push 0
lea rbp, [rsp + 0xc8]
movsx rax, word [rbp + 0x10]
mov rax, rax
push rax
lea rax, [rsp + 0x1e0]
mov rax, rax
push rax
mov r15, qword [rsp + 0x60]
lea rbp, [rsp + 0x90]
movsxd rax, dword [rbp + 0x3c]
add r15, rax
add r15, 0x18
mov rax, r15
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
and rax, rax
je 0x14001d2a6
lea rbp, [rsp + 0x1c8]
movsx r15, word [rbp]
cmp r15, 0x10b
je 0x14001d2a6
mov rax, 1
jmp 0x14001d2a9
xor rax, rax
and rax, rax
je 0x14001d2bd
mov dword [0x1400f7001], 0x40000e1
jmp 0x14001d8da
mov dword [0x1400f7001], 0x40000e2
mov dword [0x1400f7001], 0x40000e3
mov dword [0x1400f7001], 0x40000e5
cmp byte [rsp + 0xd0], 0
je 0x14001d300
lea rbp, [rsp + 0xd8]
movsxd r15, dword [rbp + 0x6c]
cmp r15, 1
jl 0x14001d300
mov rax, 1
jmp 0x14001d303
xor rax, rax
and rax, rax
je 0x14001d361
mov dword [0x1400f7001], 0x40000e6
lea rbp, [rsp + 0xd8]
push rbp
pop rbp
movsxd rax, dword [rbp + 0x70]
push rax
lea rbp, [rsp + 0x2b0]
pop rax
mov dword [rbp], eax
mov dword [0x1400f7001], 0x40000e7
lea rbp, [rsp + 0xd8]
push rbp
pop rbp
movsxd rax, dword [rbp + 0x74]
push rax
lea rbp, [rsp + 0x2b0]
pop rax
mov dword [rbp + 4], eax
mov dword [0x1400f7001], 0x40000e8
jmp 0x14001d3ec
mov dword [0x1400f7001], 0x40000e8
lea rbp, [rsp + 0x1c8]
movsxd r15, dword [rbp + 0x5c]
cmp r15, 1
jl 0x14001d3d3
mov dword [0x1400f7001], 0x40000e9
lea rbp, [rsp + 0x1c8]
push rbp
pop rbp
movsxd rax, dword [rbp + 0x60]
push rax
lea rbp, [rsp + 0x2b0]
pop rax
mov dword [rbp], eax
mov dword [0x1400f7001], 0x40000ea
lea rbp, [rsp + 0x1c8]
push rbp
pop rbp
movsxd rax, dword [rbp + 0x64]
push rax
lea rbp, [rsp + 0x2b0]
pop rax
mov dword [rbp + 4], eax
mov dword [0x1400f7001], 0x40000eb
jmp 0x14001d3ec
mov dword [0x1400f7001], 0x40000eb
mov dword [0x1400f7001], 0x40000ec
jmp 0x14001d8da
mov dword [0x1400f7001], 0x40000ed
mov dword [0x1400f7001], 0x40000ef
sub rsp, 8
push 0
push 0x28
lea rax, [rsp + 0x2c8]
mov rax, rax
push rax
mov r15, qword [rsp + 0x60]
lea rbp, [rsp + 0x2c8]
movsxd rax, dword [rbp]
add r15, rax
mov rax, r15
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
and rax, rax
je 0x14001d453
xor rax, rax
jmp 0x14001d45a
mov rax, 1
and rax, rax
je 0x14001d46e
mov dword [0x1400f7001], 0x40000f0
jmp 0x14001d8da
mov dword [0x1400f7001], 0x40000f1
mov dword [0x1400f7001], 0x40000f3
lea rbp, [rsp + 0x2b0]
movsxd rax, dword [rbp + 0x14]
inc rax
lea rdx, [rsp + 0x2d8]
mov rcx, rax
call fcn.140036f5c
mov dword [0x1400f7001], 0x40000f4
lea rbp, [rsp + 0x2b0]
movsxd rax, dword [rbp + 0x18]
inc rax
lea rdx, [rsp + 0x2e8]
mov rcx, rax
call fcn.140036f5c
mov dword [0x1400f7001], 0x40000f5
lea rbp, [rsp + 0x2b0]
movsxd rax, dword [rbp + 0x18]
inc rax
lea rdx, [rsp + 0x2f8]
mov rcx, rax
call fcn.140036f5c
mov dword [0x1400f7001], 0x40000f7
sub rsp, 8
push 0
movsxd r15, dword [rbp + 0x14]
shl r15, 2
mov rax, r15
push rax
push qword [rsp + 0x2f0]
mov r15, qword [rsp + 0x60]
movsxd rax, dword [rbp + 0x1c]
add r15, rax
mov rax, r15
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
and rax, rax
je 0x14001d54a
xor rax, rax
jmp 0x14001d551
mov rax, 1
and rax, rax
je 0x14001d565
mov dword [0x1400f7001], 0x40000f8
jmp 0x14001d8da
mov dword [0x1400f7001], 0x40000f9
mov dword [0x1400f7001], 0x40000fb
sub rsp, 8
push 0
lea rbp, [rsp + 0x2c0]
movsxd r15, dword [rbp + 0x18]
shl r15, 2
mov rax, r15
push rax
push qword [rsp + 0x300]
mov r15, qword [rsp + 0x60]
movsxd rax, dword [rbp + 0x20]
add r15, rax
mov rax, r15
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
and rax, rax
je 0x14001d5ce
xor rax, rax
jmp 0x14001d5d5
mov rax, 1
and rax, rax
je 0x14001d5e9
mov dword [0x1400f7001], 0x40000fc
jmp 0x14001d8da
mov dword [0x1400f7001], 0x40000fd
mov dword [0x1400f7001], 0x40000ff
sub rsp, 8
push 0
lea rbp, [rsp + 0x2c0]
movsxd r15, dword [rbp + 0x18]
add r15, r15
mov rax, r15
push rax
push qword [rsp + 0x310]
mov r15, qword [rsp + 0x60]
movsxd rax, dword [rbp + 0x24]
add r15, rax
mov rax, r15
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
and rax, rax
je 0x14001d651
xor rax, rax
jmp 0x14001d658
mov rax, 1
and rax, rax
je 0x14001d66c
mov dword [0x1400f7001], 0x4000100
jmp 0x14001d8da
mov dword [0x1400f7001], 0x4000101
mov dword [0x1400f7001], 0x4000103
mov qword [rsp + 0x50], 0
jmp 0x14001d695
mov dword [0x1400f7001], 0x4000103
lea rbp, [rsp + 0x2b0]
movsxd r15, dword [rbp + 0x18]
dec r15
cmp r15, qword [rsp + 0x50]
jl 0x14001d8da
mov dword [0x1400f7001], 0x4000104
movabs rdx, 0x1400f71e6
lea rcx, [rsp + 0x68]
call fcn.14003ffa0
mov dword [0x1400f7001], 0x4000105
mov qword [rsp + 0x58], 0
mov dword [0x1400f7001], 0x4000107
mov dword [0x1400f7001], 0x4000108
sub rsp, 8
push 0
push 1
lea rax, [rsp + 0x78]
mov rax, rax
push rax
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x308]
shl r14, 2
movsxd rax, dword [r14 + rbp]
add r15, rax
add r15, qword [rsp + 0x78]
mov rax, r15
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.KERNEL32.dll_ReadProcessMemory
add rsp, 0x30
and rax, rax
je 0x14001d752
xor rax, rax
jmp 0x14001d759
mov rax, 1
and rax, rax
je 0x14001d76d
mov dword [0x1400f7001], 0x4000109
jmp 0x14001d8da
mov dword [0x1400f7001], 0x400010a
mov dword [0x1400f7001], 0x400010c
movzx r15, byte [rsp + 0x60]
xor rax, rax
cmp r15, rax
jne 0x14001d7aa
mov dword [0x1400f7001], 0x400010d
jmp 0x14001d855
mov dword [0x1400f7001], 0x400010e
mov dword [0x1400f7001], 0x400010f
mov rcx, qword [rsp + 0x68]
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14003fd90
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.14003fd40
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14003fd40
add rsp, 0x28
pop rcx
push rax
movzx rax, byte [rsp + 0x78]
mov rax, rax
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14003dcd0
add rsp, 0x20
pop rax
lea rcx, [rsp + 0x70]
pop rdx
call fcn.14003fe00
mov dword [0x1400f7001], 0x4000110
mov dword [0x1400f7001], 0x4000112
mov r15, qword [rsp + 0x58]
inc r15
mov qword [rsp + 0x58], r15
mov dword [0x1400f7001], 0x4000113
jmp 0x14001d6e0
mov dword [0x1400f7001], 0x4000115
push qword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
pop rdx
call fcn.14003fee0
or rax, rax
je 0x14001d8bb
mov dword [0x1400f7001], 0x4000116
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x2f8]
add r14, r14
movsx r14, word [r14 + rbp]
mov rbp, qword [rsp + 0x2d8]
shl r14, 2
movsxd rax, dword [r14 + rbp]
add r15, rax
mov qword [rsp + 0x48], r15
mov dword [0x1400f7001], 0x4000117
jmp 0x14001d8da
mov dword [0x1400f7001], 0x4000118
mov dword [0x1400f7001], 0x4000119
inc qword [rsp + 0x50]
jno 0x14001d68b
mov dword [0x1400f7001], 0x400011c
push qword [rsp + 0x38]
pop rcx
call sub.KERNEL32.dll_CloseHandle
mov dword [0x1400f7001], 0x400011d
push qword [rsp + 0x2d8]
pop rcx
call fcn.14003707c
mov dword [0x1400f7001], 0x400011e
push qword [rsp + 0x2e8]
pop rcx
call fcn.14003707c
mov dword [0x1400f7001], 0x400011f
push qword [rsp + 0x2f8]
pop rcx
call fcn.14003707c
mov dword [0x1400f7001], 0x4000120
mov dword [0x1400f7001], 0x4000122
mov rax, qword [rsp + 0x48]
jmp 0x14001d95b
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140040240
add rsp, 0x28
mov rcx, qword [rsp + 0x70]
sub rsp, 0x28
call fcn.140040240
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.140040240
add rsp, 0x28
mov rcx, qword [rsp + 0x2e0]
sub rsp, 0x28
call fcn.140037084
add rsp, 0x28
mov rcx, qword [rsp + 0x2f0]
sub rsp, 0x28
call fcn.140037084
add rsp, 0x28
mov rcx, qword [rsp + 0x300]
sub rsp, 0x28
call fcn.140037084
add rsp, 0x28
pop rax
add rsp, 0x310
pop r14
pop r15
pop rbp
ret