Function at 0x140001660
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
xor ebx, ebx
mov dword [rbp + 0x58], 4
mov dword [rbp - 8], ebx
mov dword [rbp + 0xb8], ebx
mov dword [rbp + 0x108], 4
mov rax, qword gs:[0x30]
mov qword [rbp + 8], rax
test rax, rax
je 0x140002265
mov rcx, qword [rax + 0x60]
mov qword [rbp + 0x168], rcx
test rcx, rcx
je 0x140002265
mov rax, qword [rcx + 0x18]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140002265
lea rdx, [rax + 0x20]
mov qword [rbp - 0x40], rdx
test rdx, rdx
je 0x140002265
mov rdx, qword [rdx]
lea r8d, [rbx + 0x11]
mov ecx, 0x8813575b
mov rdx, qword [rdx + 0x50]
call section..text
or eax, 1
lea r8d, [rbx + 0x11]
mov dword [rbp + 0x10], eax
mov ecx, 0xfcacc145
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x50]
call section..text
mov dword [rbp + 0xd8], eax
lea r8d, [rbx + 0x11]
mov rax, qword [rbp - 0x40]
mov ecx, 0x27271182
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x50]
call section..text
mov edx, 0xd374da73
mov dword [rbp - 0x68], eax
mov r8d, 0x3c0275f
lea rcx, [rsp + 0x40]
call fcn.140001040
mov qword [rbp + 0x88], rax
test rax, rax
je 0x140002265
mov edx, 0xf78e2a
mov r8d, 0x3db8ba08
mov rcx, rax
call fcn.1400010d0
mov qword [rbp - 0x50], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0xaca9803e
mov r8d, 0xb6a0a961
call fcn.1400010d0
mov qword [rbp + 0x80], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0x48355a85
mov r8d, 0xeefe57cd
call fcn.1400010d0
mov qword [rbp - 0x48], rax
test rax, rax
je 0x140002272
mov edx, 0xb760b600
mov dword [rsp + 0x20], 0xb3d60cc1
mov r9d, 0x8708a693
lea rcx, [rsp + 0x40]
mov r8d, 0xc3a02312
call fcn.140001470
lea rcx, [rsp + 0x40]
call fcn.140001620
test eax, eax
je 0x140002265
lea rcx, [rbp + 0x70]
call qword [rbp - 0x50]
mov qword [rbp + 0xf0], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0x5a34b58
mov r8d, 0xd629d30
call fcn.1400010d0
mov qword [rbp - 0x30], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0xd42d1a00
mov r8d, 0x6d298557
call fcn.1400010d0
mov qword [rbp + 0xa8], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0x1dce794f
mov r8d, 0x674af22d
call fcn.1400010d0
mov qword [rbp + 0x60], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0x859a2128
mov r8d, 0xcba7daa2
call fcn.1400010d0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0xbe72d0a1
mov r8d, 0x73fa520c
call fcn.1400010d0
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0x97cda4b4
mov r8d, 0x956ef119
call fcn.1400010d0
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xf0]
mov edx, 0xea9438e1
mov r8d, 0x65aa2392
call fcn.1400010d0
mov qword [rbp + 0x38], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0x7dfb7ce7
mov r8d, 0x8ebcc719
call fcn.1400010d0
mov qword [rbp + 0x180], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xf0]
mov edx, 0x7b7e5fc5
mov r8d, 0xb9a6d4da
call fcn.1400010d0
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xf0]
mov edx, 0x3ee327fb
mov r8d, 0x88edf061
call fcn.1400010d0
mov qword [rbp + 0x158], rax
test rax, rax
je 0x140002265
mov edx, 0x9606c98f
mov dword [rsp + 0x20], 0xab4a1636
mov r9d, 0x706d02fd
lea rcx, [rsp + 0x40]
mov r8d, 0xc057229d
call fcn.140001470
lea rcx, [rbp + 0x70]
call qword [rbp - 0x50]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140002265
mov edx, 0x237f1431
mov dword [rsp + 0x20], 0xf815b2e0
mov r9d, 0x82c46550
lea rcx, [rsp + 0x40]
mov r8d, 0x83be6c9
call fcn.140001470
lea rcx, [rbp + 0x70]
call qword [rbp - 0x50]
mov qword [rbp + 0x28], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0x4fc648ef
mov r8d, 0x19c6a2c2
call fcn.1400010d0
mov qword [rbp + 0xe8], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0xb3e5c121
mov r8d, 0x7d70337d
call fcn.1400010d0
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0x59d9c5a2
mov r8d, 0x76164780
call fcn.1400010d0
mov qword [rbp + 0xb0], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp - 0x60]
mov edx, 0xbcf227aa
mov r8d, 0x56738b3
call fcn.1400010d0
mov qword [rbp + 0x128], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xf0]
mov edx, 0xa147228d
mov r8d, 0x3d6e99df
call fcn.1400010d0
mov qword [rbp - 0x58], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xf0]
mov edx, 0x4ba81c96
mov r8d, 0x9f7e90c4
call fcn.1400010d0
mov qword [rbp + 0x138], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xf0]
mov edx, 0x13c248bd
mov r8d, 0xf96d5024
call fcn.1400010d0
mov qword [rbp - 0x28], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xf0]
mov edx, 0xf48b53d2
mov r8d, 0x9fbce564
call fcn.1400010d0
mov qword [rbp + 0x118], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0x88]
mov edx, 0xa19a43f3
mov r8d, 0xa0ea080e
call fcn.1400010d0
mov qword [rbp + 0x100], rax
test rax, rax
je 0x140002265
lea edx, [rbx + 0x20]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp + 0x18], rax
test rax, rax
je 0x140002265
lea edx, [rbx + 0x13]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp - 0x38], rax
test rax, rax
je 0x140002265
mov qword [rsp + 0x4b0], rsi
lea rcx, [rsp + 0x40]
mov edx, 0x43e93d01
mov qword [rsp + 0x4b8], rdi
mov r9d, 0x56f15ac0
mov dword [rsp + 0x20], 0xcf797566
mov r8d, 0xfa1159af
call fcn.140001470
mov rdi, qword [rbp + 0x18]
lea rsi, [rbp + 0x70]
add rdi, 0x10
mov dword [rsp + 0x20], 0x30d50c76
mov ecx, 0x10
mov edx, 0x633150f3
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
mov r9d, 0x5611ac11
mov r8d, 0x62d1e648
call fcn.140001470
mov rdi, qword [rbp - 0x38]
lea rsi, [rbp + 0x70]
mov ecx, 0x10
mov edx, 0x8fce9057
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp + 0x88]
mov r8d, 0x2fae9f4d
call fcn.1400010d0
mov qword [rbp + 0x160], rax
test rax, rax
je 0x140002255
mov rcx, qword [rbp + 0x28]
mov edx, 0xaff72798
mov r8d, 0x540a6ee5
call fcn.1400010d0
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140002255
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea edx, [rbx + 1]
xor ecx, ecx
call qword [rbp - 0x58]
mov qword [rbp + 0x90], rax
test rax, rax
je 0x140002255
mov edx, 0xf71f0730
mov dword [rsp + 0x20], 0x2663495d
mov r9d, 0x49100cd
lea rcx, [rsp + 0x40]
mov r8d, 0xeb4f404e
call fcn.140001470
mov rdi, qword [rbp + 0x18]
lea rsi, [rbp + 0x70]
mov ecx, 0x10
lea edx, [rbx + 0x27]
rep movsb byte [rdi], byte [rsi]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp + 0xa0], rax
test rax, rax
je 0x140002255
mov edx, 0x3f782678
mov dword [rsp + 0x20], 0xef656c2f
mov r9d, 0x95f064d0
lea rcx, [rsp + 0x40]
mov r8d, 0x648ba1a5
call fcn.140001470
lea rcx, [rbp + 0x70]
call qword [rbp - 0x50]
mov qword [rbp + 0x178], rax
test rax, rax
je 0x140002255
xor ecx, ecx
call qword [rbp + 0x128]
mov dword [rbp + 0xc8], eax
test eax, eax
js 0x140002255
mov edx, 0xdb17dfcb
mov dword [rsp + 0x20], 0x886178e2
mov r9d, 0x84e2554e
lea rcx, [rsp + 0x40]
mov r8d, 0x80384632
call fcn.140001470
mov rdi, qword [rbp + 0xa0]
lea rsi, [rbp + 0x70]
add rdi, 0x20
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp + 0x178]
mov edx, 0xa94d0bba
mov r8d, 0xd57b6803
call fcn.1400010d0
mov qword [rbp + 0x68], rax
test rax, rax
je 0x140002255
lea rdx, [rbp + 0x190]
mov ecx, 0x104
call qword [rbp + 0xe8]
test eax, eax
je 0x140002255
lea rcx, [rbp + 0x190]
call qword [rbp + 0x100]
test eax, eax
je 0x140002255
mov edx, 0x5acb1dac
mov dword [rsp + 0x20], 0x704217fa
mov r9d, 0xbe1cf41a
lea rcx, [rsp + 0x40]
mov r8d, 0xf042105b
call fcn.140001470
mov rdi, qword [rbp + 0xa0]
lea rsi, [rbp + 0x70]
add rdi, 0x10
mov dword [rsp + 0x20], 0x68f1d79d
mov ecx, 0x10
mov edx, 0xce9c6cb1
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
mov r9d, 0x919e53b3
mov r8d, 0x6d510107
call fcn.140001470
mov rcx, qword [rbp + 0x90]
lea rdx, [rbp + 0x70]
mov qword [rsp + 0x38], rbx
mov r8d, 0x1bb
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call qword [rbp - 0x28]
mov qword [rbp + 0x148], rax
test rax, rax
je 0x140002255
lea rcx, [rsp + 0x40]
call fcn.140001500
mov rax, qword [rbp - 0x10]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140002255
mov edx, 0x994e3fe8
mov dword [rsp + 0x20], 0xdfd8580
mov r9d, 0x23a519e6
lea rcx, [rsp + 0x40]
mov r8d, 0xc802b913
call fcn.140001470
mov rcx, qword [rbp + 0x148]
lea r8, [rbp + 0x74]
mov qword [rsp + 0x38], rbx
lea rdx, [rbp + 0x70]
mov dword [rsp + 0x30], 0x80800000
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [rbp + 0x38]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140002255
mov edx, 0xe6f7cfb5
mov dword [rsp + 0x20], 0x1cea6f92
mov r9d, 0x81426eac
lea rcx, [rsp + 0x40]
mov r8d, 0x9b419a89
call fcn.140001470
mov rdi, qword [rbp + 0xa0]
lea rsi, [rbp + 0x70]
mov ecx, 0x10
mov dword [rsp + 0x20], 0xfc554f2c
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
mov edx, 0x53fe5ef0
mov r9d, 0xab4680df
mov r8d, 0x4384c887
call fcn.140001470
mov rdi, qword [rbp - 0x38]
lea rsi, [rbp + 0x70]
add rdi, 0x10
mov dword [rsp + 0x20], ebx
mov ecx, 0x10
xor r9d, r9d
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp - 0x78]
xor r8d, r8d
xor edx, edx
call qword [rsp + 0x48]
test eax, eax
je 0x140002255
mov rcx, qword [rbp - 0x78]
lea rax, [rbp - 8]
lea r9, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x140]
mov edx, 0x20000005
call qword [rbp + 0x138]
test eax, eax
je 0x140002255
mov edx, dword [rbp + 0x140]
lea r9d, [rbx + 4]
xor ecx, ecx
mov r8d, 0x3000
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp + 0x170], rax
test rax, rax
je 0x140002255
mov r8d, dword [rbp + 0x140]
lea r9, [rbp + 0x130]
mov rcx, qword [rbp - 0x78]
mov rdx, rax
call qword [rbp + 0x158]
test eax, eax
je 0x140002255
mov r8d, dword [rbp + 0x140]
cmp dword [rbp + 0x130], r8d
jne 0x140002255
mov rdx, qword [rbp + 0x170]
lea r9, [rbp + 0xd0]
mov rcx, qword [rbp - 0x10]
mov qword [rsp + 0x20], rbx
call qword [rsp + 0x50]
test eax, eax
je 0x140002255
mov rcx, qword [rbp - 0x78]
call qword [rbp + 0x118]
mov rcx, qword [rbp - 0x10]
call qword [rsp + 0x78]
mov rdx, qword [rbp + 0x18]
lea r8d, [rbx + 1]
xor ecx, ecx
call qword [rbp + 0x68]
mov dword [rsp + 0x68], eax
test eax, eax
js 0x140002255
mov rcx, qword [rbp + 0x148]
call qword [rbp + 0x118]
mov edx, 0x69943ec6
mov dword [rsp + 0x20], 0x6bc1c210
mov r9d, 0x81f3799b
lea rcx, [rsp + 0x40]
mov r8d, 0x898e9306
call fcn.140001470
mov rcx, qword [rbp + 0x90]
lea rdx, [rbp + 0x70]
mov qword [rsp + 0x38], rbx
mov r8d, 0x1bb
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call qword [rbp - 0x28]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x140002255
mov edx, 0xf4f3c9c0
mov dword [rsp + 0x20], 0x3505ae7c
mov r9d, 0xa4e652ad
lea rcx, [rsp + 0x40]
mov r8d, 0x702de10b
call fcn.140001470
mov rcx, qword [rbp - 0x18]
lea r8, [rbp + 0x74]
mov qword [rsp + 0x38], rbx
lea rdx, [rbp + 0x70]
mov dword [rsp + 0x30], 0x80800000
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [rbp + 0x38]
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140002255
mov r8, qword [rbp - 0x38]
mov r9d, 0x1040
mov rdx, qword [rbp + 0xa0]
xor ecx, ecx
call qword [rsp + 0x58]
mov rcx, qword [rbp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [rsp + 0x48]
test eax, eax
je 0x140002255
mov rcx, qword [rbp + 0x48]
lea rax, [rbp + 0xb8]
lea r9, [rbp + 0x108]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x70]
mov edx, 0x20000005
call qword [rbp + 0x138]
test eax, eax
je 0x140002255
mov edx, dword [rsp + 0x70]
lea r9d, [rbx + 4]
xor ecx, ecx
mov r8d, 0x3000
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp], rax
test rax, rax
je 0x140002255
mov r8d, dword [rsp + 0x70]
lea r9, [rbp + 0x20]
mov rcx, qword [rbp + 0x48]
mov rdx, rax
call qword [rbp + 0x158]
test eax, eax
je 0x140002255
mov eax, dword [rsp + 0x70]
cmp dword [rbp + 0x20], eax
jne 0x140002255
mov rcx, qword [rbp - 0x18]
call qword [rbp + 0x118]
mov rcx, qword [rbp + 0x48]
call qword [rbp + 0x118]
mov rcx, qword [rbp]
mov eax, 0x5a4d
mov qword [rbp - 0x20], rcx
cmp word [rcx], ax
jne 0x140002255
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
mov qword [rsp + 0x40], rcx
cmp dword [rcx], 0x4550
jne 0x140002255
mov eax, 0x8664
cmp word [rcx + 4], ax
jne 0x140002255
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002255
mov rcx, qword [rbp + 0x90]
call qword [rbp + 0x118]
mov rdx, qword [rsp + 0x40]
lea r9d, [rbx + 0x40]
mov r8d, 0x3000
movzx eax, word [rdx + 0x14]
lea rcx, [rdx + 0x18]
add rcx, rax
mov qword [rbp + 0x30], rcx
xor ecx, ecx
mov edx, dword [rdx + 0x50]
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp + 0x50], rax
test rax, rax
je 0x140002255
mov rcx, qword [rsp + 0x40]
mov rdi, rax
mov rsi, qword [rbp]
mov ecx, dword [rcx + 0x54]
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
call fcn.140001200
lea rcx, [rsp + 0x40]
call fcn.140001270
lea rcx, [rsp + 0x40]
call fcn.140001360
lea rcx, [rsp + 0x40]
call fcn.140001400
mov rsi, qword [rsp + 0x4b0]
mov rdi, qword [rsp + 0x4b8]
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x140002272
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x4c0]
xor eax, eax
add rsp, 0x4a0
pop rbp
ret