Function at 0x1400081b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xd0
mov rax, qword [0x14001a010]
xor rax, rsp
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x41], rax
xor r12d, r12d
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x19], r12
mov rdi, qword [0x14001c7d0]
mov qword [rbp - 0x69], rdi
mov eax, 0x5a4d
cmp word [0x14001a050], ax
jne 0x140008326
movsxd rsi, dword [0x14001a08c]
lea r14, [0x14001a050]
add rsi, r14
cmp dword [rsi], 0x4550
jne 0x140008326
mov eax, 0x20b
cmp word [rsi + 0x18], ax
jne 0x140008326
mov r15d, dword [rsi + 0x50]
mov edx, r15d
xor ecx, ecx
lea r9d, [r12 + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140008326
movzx ecx, word [rsi + 0x14]
mov eax, dword [rcx + rsi + 0x24]
mov dword [rsp + 0x44], eax
sub r15d, eax
mov qword [rbp - 0x71], r12
mov eax, dword [rbp + 0x67]
cmp eax, 1
jne 0x14000829e
mov r13d, r15d
lea r8, [rbp - 0x71]
mov edx, r15d
mov rcx, rdi
call fcn.140007d80
mov r12, rax
jmp 0x14000857f
cmp eax, 2
jne 0x140008454
mov qword [rbp - 0x79], r12
cmp qword [0x14001c7e8], r12
jne 0x140008369
lea rax, str.x____xxxxxxxx____xxxxxxxxx____xxxxxxxx
mov qword [rsp + 0x20], rax
lea r9, [0x14000d810]
mov r8, qword [0x14001c7c8]
lea rdx, str.PAGELK
mov rcx, rdi
call fcn.140003d80
mov r14, rax
mov qword [0x14001c7e8], rax
test rax, rax
je 0x140008315
mov dword [rbp - 0x39], r12d
lea r8, [rax + 1]
mov r9d, 4
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.1400025d0
test al, al
jne 0x140008355
mov qword [0x14001c7e8], r12
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14000b0a0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rcx, dword [rbp - 0x39]
add rcx, 5
add rcx, r14
mov qword [0x14001c7e8], rcx
je 0x140008315
mov r9d, r15d
lea rdx, [rbp - 0x79]
mov rcx, rdi
call fcn.140005b70
test al, al
je 0x140008315
mov r12, qword [rbp - 0x79]
test r12, r12
je 0x140008315
cmp qword [0x14001c738], 0
jne 0x140008420
lea rax, str.xx____x___x_x____xxxxxxx____x
mov qword [rsp + 0x20], rax
lea r9, [0x14000d890]
mov r8, qword [0x14001c7c8]
lea rdx, str.PAGE
mov rcx, rdi
call fcn.140003d80
mov qword [0x14001c738], rax
test rax, rax
je 0x1400083f9
lea r14, [rax + 0xc]
mov qword [0x14001c738], r14
xor r13d, r13d
mov dword [rbp - 0x39], r13d
lea r8, [r14 + 1]
lea r9d, [r13 + 4]
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.1400025d0
test al, al
jne 0x14000840c
mov qword [0x14001c738], r13
mov r8d, r15d
mov rdx, r12
mov rcx, rdi
call fcn.1400027f0
jmp 0x140008315
movsxd rcx, dword [rbp - 0x39]
add rcx, 5
add rcx, r14
mov qword [0x14001c738], rcx
je 0x1400083f9
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], r15d
mov r9, r12
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140005f70
test al, al
je 0x1400083f9
cmp byte [rsp + 0x40], 0
je 0x1400083f9
mov r13d, r15d
lea r14, [0x14001a050]
jmp 0x14000857f
mov r13d, r15d
test r15d, r15d
je 0x140008315
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14001c830], eax
jle 0x140008550
lea rcx, [0x14001c830]
call fcn.14000b250
cmp dword [0x14001c830], 0xffffffff
jne 0x140008550
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], 0xf
mov ecx, 0x20
call fcn.14000b360
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x51], 0x15
mov qword [rbp - 0x49], 0x1f
movups xmm0, xmmword [0x14000d938]
movups xmmword [rax], xmm0
mov ecx, dword [0x14000d948]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x14000d94c]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
lea r8, [rbp - 0x61]
mov rdx, qword [0x14001c7c8]
mov rcx, rdi
call fcn.140002c90
mov qword [0x14001c918], rax
mov rdx, qword [rbp - 0x49]
cmp rdx, 0x10
jb 0x140008544
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000853e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000853e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b0c0
nop
lea rcx, [0x14001c830]
call fcn.14000b1f0
cmp qword [0x14001c918], 0
je 0x140008315
mov qword [rbp - 0x79], r12
mov qword [rsp + 0x20], r13
lea rdx, [rbp - 0x79]
mov rcx, rdi
call fcn.140006b90
test al, al
je 0x140008315
mov r12, qword [rbp - 0x79]
test r12, r12
je 0x140008315
mov r8d, dword [rsi + 0x54]
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rsi + 0x14]
add rbx, 0x28
xor eax, eax
mov r14d, eax
cmp ax, word [rsi + 6]
jae 0x1400085f4
add rbx, rsi
mov r13, qword [rsp + 0x48]
lea rdi, [0x14001a050]
nop dword [rax]
test dword [rbx + 0x14], 0x80
ja 0x1400085dd
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, rdi
mov ecx, dword [rbx - 4]
add rcx, r13
call sub.VCRUNTIME140.dll_memcpy
inc r14d
add rbx, 0x28
movzx eax, word [rsi + 6]
cmp r14d, eax
jl 0x1400085c0
mov r13d, r15d
mov rdi, qword [rbp - 0x69]
mov r14, r12
mov eax, dword [rsp + 0x44]
sub r12, rax
mov rbx, r12
sub rbx, qword [rsi + 0x30]
mov rdx, qword [rsp + 0x48]
lea rcx, [rbp - 0x61]
call fcn.140009600
mov rdx, rbx
mov rcx, rax
call fcn.1400087b0
mov rdx, r12
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1400088b0
test al, al
je 0x140008326
mov rdx, rbx
lea rcx, [rbp - 0x61]
call fcn.140009750
mov rdx, rax
mov rcx, rdi
call fcn.140008960
test al, al
je 0x140008736
mov r8d, dword [rsp + 0x44]
add r8, rbx
mov r9, r13
mov rdx, r14
mov rcx, rdi
call fcn.1400025d0
mov rbx, qword [rbp - 0x71]
test al, al
je 0x14000873a
mov esi, dword [rsi + 0x28]
add rsi, r12
mov qword [rsp + 0x20], rbx
mov r9, r13
mov r8, r14
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.140007ba0
test al, al
je 0x14000873a
xor r13d, r13d
mov dword [rsp + 0x44], r13d
mov rax, qword [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x19]
mov r8, rsi
lea rdx, [rsp + 0x44]
mov rcx, rdi
call fcn.140008d40
test al, al
je 0x14000873a
mov rcx, qword [rbp - 0x41]
test rcx, rcx
je 0x1400086d5
mov eax, dword [rsp + 0x44]
mov dword [rcx], eax
mov eax, dword [rbp + 0x67]
mov rdx, r14
cmp eax, 1
jne 0x140008724
mov r8, rbx
mov rcx, rdi
call fcn.1400028e0
test al, al
je 0x140008709
mov rdx, rbx
mov rcx, rdi
call fcn.140002a20
test al, al
je 0x140008709
mov rdx, rbx
mov rcx, rdi
call fcn.140002b60
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r14
jmp 0x140008328
cmp eax, 2
jne 0x140008701
mov r8d, r15d
mov rcx, rdi
call fcn.1400027f0
jmp 0x140008709
mov rbx, qword [rbp - 0x71]
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 0x67]
mov rdx, r14
cmp eax, 1
jne 0x14000878e
mov r8, rbx
mov rcx, rdi
call fcn.1400028e0
test al, al
je 0x140008326
mov rdx, rbx
mov rcx, rdi
call fcn.140002a20
test al, al
je 0x140008326
mov rdx, rbx
mov rcx, rdi
call fcn.140002b60
jmp 0x140008326
cmp eax, 2
jne 0x140008781
mov r8d, r15d
mov rcx, rdi
call fcn.1400027f0
jmp 0x140008326