Function at 0x14004b940
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xd0
mov rax, qword [0x14013f0c0]
xor rax, rsp
mov qword [rbp - 9], rax
mov rbx, rdx
mov qword [rbp - 0x69], rdx
mov rdi, rcx
mov qword [rbp - 0x79], rcx
mov rax, qword [rbp + 0x8f]
mov qword [rbp - 0x41], rax
xor r12d, r12d
mov qword [rbp - 0x19], r12
mov qword [rbp - 0x29], r12
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14004ba9f
movsxd rsi, dword [rdx + 0x3c]
add rsi, rdx
cmp dword [rsi], 0x4550
jne 0x14004ba9f
mov eax, 0x20b
cmp word [rsi + 0x18], ax
jne 0x14004ba9f
mov r15d, dword [rsi + 0x50]
mov edx, r15d
xor ecx, ecx
lea r9d, [r12 + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
test rax, rax
je 0x14004ba9f
movzx ecx, word [rsi + 0x14]
mov eax, dword [rcx + rsi + 0x24]
mov dword [rsp + 0x44], eax
sub r15d, eax
mov qword [rbp - 0x71], r12
mov eax, dword [rbp + 0x77]
cmp eax, 1
jne 0x14004ba16
mov edx, r15d
lea r8, [rbp - 0x71]
mov rcx, rdi
call fcn.14004b510
mov r12, rax
jmp 0x14004bd0d
cmp eax, 2
jne 0x14004bbdb
mov qword [rsp + 0x48], r12
cmp qword [0x140146cd0], r12
jne 0x14004badc
lea rax, str.x____xxxxxxxx____xxxxxxxxx____xxxxxxxx
mov qword [rsp + 0x20], rax
lea r9, [0x140128d08]
mov r8, qword [0x140146bd8]
lea rdx, str.PAGELK
mov rcx, rdi
call fcn.140047720
mov r14, rax
mov qword [0x140146cd0], rax
test rax, rax
je 0x14004ba8e
mov dword [rbp - 0x39], r12d
lea r8, [rax + 1]
mov r9d, 4
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.140045f70
test al, al
jne 0x14004bac8
mov qword [0x140146cd0], r12
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.140113790
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
movsxd rcx, dword [rbp - 0x39]
add rcx, 5
add rcx, r14
mov qword [0x140146cd0], rcx
je 0x14004ba8e
mov r9d, r15d
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.1400495c0
test al, al
je 0x14004ba8e
mov r12, qword [rsp + 0x48]
test r12, r12
je 0x14004ba8e
cmp qword [0x140146cb0], 0
jne 0x14004bb9f
lea rax, str.xx____x___x_x____xxxxxxx____x
mov qword [rsp + 0x20], rax
lea r9, [0x140128d88]
mov r8, qword [0x140146bd8]
lea rdx, str.PAGE
mov rcx, rdi
call fcn.140047720
mov qword [0x140146cb0], rax
test rax, rax
je 0x14004bbc8
lea r14, [rax + 0xc]
mov qword [0x140146cb0], r14
mov dword [rbp - 0x39], 0
lea r8, [r14 + 1]
mov r9d, 4
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.140045f70
test al, al
jne 0x14004bb8b
mov qword [0x140146cb0], 0
mov r8d, r15d
mov rdx, r12
mov rcx, rdi
call fcn.140046190
jmp 0x14004ba8e
movsxd rcx, dword [rbp - 0x39]
add rcx, 5
add rcx, r14
mov qword [0x140146cb0], rcx
je 0x14004bbc8
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], r15d
mov r9, r12
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400499c0
test al, al
je 0x14004bbc8
cmp byte [rsp + 0x40], 0
jne 0x14004bd0d
mov r8d, r15d
mov rdx, r12
mov rcx, rdi
call fcn.140046190
jmp 0x14004ba8e
mov ebx, r15d
test r15d, r15d
je 0x14004ba8e
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140146d20], eax
jle 0x14004bcd7
lea rcx, [0x140146d20]
call fcn.140113bd8
cmp dword [0x140146d20], 0xffffffff
jne 0x14004bcd7
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], reloc.WS2_32.dll_ntohs
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1401137b0
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x51], reloc.WS2_32.dll_setsockopt
mov qword [rbp - 0x49], Ordinal_33
movups xmm0, xmmword [0x140128e30]
movups xmmword [rax], xmm0
mov ecx, dword [0x140128e40]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x140128e44]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea r8, [rbp - 0x61]
mov rdx, qword [0x140146bd8]
mov rcx, rdi
call fcn.140046630
mov qword [0x140146e08], rax
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x14004bccb
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bcc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bcc5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140113afc
nop
lea rcx, [0x140146d20]
call fcn.140113b6c
cmp qword [0x140146e08], 0
je 0x14004ba8e
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.14004a5e0
test al, al
je 0x14004ba8e
mov r12, qword [rsp + 0x48]
mov rbx, qword [rbp - 0x69]
test r12, r12
je 0x14004ba8e
mov r8d, dword [rsi + 0x54]
mov rdx, rbx
mov rcx, r13
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rsi + 0x14]
add rbx, 0x28
xor eax, eax
mov r14d, eax
cmp ax, word [rsi + 6]
jae 0x14004bd71
add rbx, rsi
mov rdi, qword [rbp - 0x69]
nop
test dword [rbx + 0x14], 0x80
ja 0x14004bd5d
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, rdi
mov ecx, dword [rbx - 4]
add rcx, r13
call sub.VCRUNTIME140.dll_memcpy
inc r14d
add rbx, 0x28
movzx eax, word [rsi + 6]
cmp r14d, eax
jl 0x14004bd40
mov rdi, qword [rbp - 0x79]
mov r14, r12
mov eax, dword [rsp + 0x44]
sub r12, rax
mov rbx, r12
sub rbx, qword [rsi + 0x30]
mov rdx, r13
lea rcx, [rbp - 0x61]
call fcn.14004c950
mov rdx, rbx
mov rcx, rax
call fcn.14004bf30
mov rdx, r12
mov rcx, r13
call fcn.14004c030
test al, al
je 0x14004ba9f
mov rdx, r13
lea rcx, [rbp - 0x61]
call fcn.14004caa0
mov rdx, rax
mov rcx, rdi
call fcn.14004c0e0
test al, al
je 0x14004bebd
mov r8d, dword [rsp + 0x44]
add r8, r13
mov ebx, r15d
mov r9d, r15d
mov rdx, r14
mov rcx, rdi
call fcn.140045f70
test al, al
je 0x14004bebd
mov eax, dword [rsi + 0x28]
add rax, r12
mov qword [rbp - 0x79], rax
mov rsi, qword [rbp - 0x71]
mov qword [rsp + 0x20], rsi
mov r9d, ebx
mov r8, r14
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x29]
call fcn.1400413a0
test al, al
je 0x14004bec1
xor eax, eax
mov dword [rsp + 0x44], eax
mov r9, qword [rbp - 0x29]
cmp byte [rbp + 0x7f], al
cmovne r9, r14
mov rax, qword [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r8, qword [rbp - 0x79]
lea rdx, [rsp + 0x44]
mov rcx, rdi
call fcn.14004c4d0
test al, al
je 0x14004bec1
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x14004be58
mov eax, dword [rsp + 0x44]
mov dword [rcx], eax
cmp byte [rbp + 0x67], 0
je 0x14004be92
mov eax, dword [rbp + 0x77]
mov rdx, r14
cmp eax, 1
jne 0x14004beab
mov r8, rsi
mov rcx, rdi
call fcn.140046280
test al, al
je 0x14004be92
mov rdx, rsi
mov rcx, rdi
call fcn.1400463c0
test al, al
je 0x14004be92
mov rdx, rsi
mov rcx, rdi
call fcn.140046500
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r14
jmp 0x14004baa1
cmp eax, 2
jne 0x14004be8a
mov r8d, r15d
mov rcx, rdi
call fcn.140046190
jmp 0x14004be92
mov rsi, qword [rbp - 0x71]
xor edx, edx
mov r8d, 0x8000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 0x77]
mov rdx, r14
cmp eax, 1
jne 0x14004bf13
mov r8, rsi
mov rcx, rdi
call fcn.140046280
test al, al
je 0x14004ba9f
mov rdx, rsi
mov rcx, rdi
call fcn.1400463c0
test al, al
je 0x14004ba9f
mov rdx, rsi
mov rcx, rdi
call fcn.140046500
jmp 0x14004ba9f
cmp eax, 2
jne 0x14004bf06
mov r8d, r15d
mov rcx, rdi
call fcn.140046190
jmp 0x14004ba9f