Function at 0x140005cf2
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1e8
movaps xmmword [rsp + 0x1d0], xmm6
test rdx, rdx
je 0x14000601d
mov r14, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm0, xmm0
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
xor ebx, ebx
lea rcx, [rsp + 0xc8]
mov r8d, 0x108
xor edx, edx
call fcn.14001b800
mov r9d, 0x40
mov rcx, rsi
mov rdx, rbp
mov r8, rdi
call fcn.140004984
test al, al
je 0x14000601f
movzx eax, word [rsp + 0x80]
cmp eax, 0x5a4d
jne 0x14000601d
movsxd r8, dword [rsp + 0xbc]
add r8, rdi
lea rdx, [rsp + 0xc8]
mov r9d, 0x108
mov rcx, rsi
call fcn.140004984
test al, al
je 0x14000601d
cmp dword [rsp + 0xc8], 0x4550
jne 0x14000601d
mov ebp, dword [rsp + 0x150]
xor ebx, ebx
test rbp, rbp
je 0x14000601f
mov eax, dword [rsp + 0x154]
test eax, eax
je 0x14000601f
xor ecx, ecx
mov rbx, rax
mov rdx, rax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
lea r8, [rdi + rbp]
mov rcx, rsi
mov rdx, rax
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], rbx
mov r9, rbx
call fcn.140004984
test al, al
je 0x140006008
cmp dword [r12 + 0x18], 0
je 0x140006008
mov rax, r12
sub rax, rbp
mov ecx, dword [r12 + 0x1c]
mov edx, dword [r12 + 0x20]
add rdx, rax
mov qword [rsp + 0x70], rdx
mov edx, dword [r12 + 0x24]
add rdx, rax
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x78], rax
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rsp + 0x48]
add qword [rsp + 0x50], rax
xor ebp, ebp
movaps xmm6, xmmword [0x140046780]
mov qword [rsp + 0x68], r12
mov rax, qword [rsp + 0x70]
mov esi, dword [rax + rbp*4]
add rsi, qword [rsp + 0x78]
mov qword [rsp + 0x28], 0
movups xmmword [rsp + 0x38], xmm6
mov byte [rsp + 0x28], 0
mov rcx, rsi
call fcn.140026a30
mov r12, rax
cmp rax, 0xf
jbe 0x140005eef
test r12, r12
js 0x14000603e
mov rax, r12
or rax, 0xf
movabs rcx, 0x8000000000000000
movabs r15, 0x7fffffffffffffff
js 0x140005ee8
mov r15, rax
cmp rax, 0x16
ja 0x140005ed8
mov r15d, 0x16
lea rcx, [r15 + 1]
cmp r15, 0xfff
jb 0x140005f11
mov r15, rax
call fcn.140008be5
jmp 0x140005f16
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x28]
mov rdx, rsi
mov r8, r12
call fcn.14001b150
mov byte [rsp + r12 + 0x28], 0
mov r13, qword [rsp + 0x28]
jmp 0x140005f3c
call fcn.14001570c
mov r13, rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r15
mov rcx, rax
mov rdx, rsi
mov r8, r12
call fcn.14001b150
mov byte [r13 + r12], 0
mov qword [rsp + 0x28], r13
cmp qword [r14 + 0x18], 0xf
mov rdx, r14
jbe 0x140005f49
mov rdx, qword [r14]
cmp qword [rsp + 0x40], 0xf
lea rax, [rsp + 0x28]
cmovbe r13, rax
mov rcx, r13
call fcn.140021de0
mov r15d, eax
test eax, eax
mov r12, qword [rsp + 0x68]
jne 0x140005fb5
mov rax, qword [rsp + 0x58]
movzx eax, word [rax + rbp*2]
mov rcx, qword [rsp + 0x60]
mov esi, dword [rcx + rax*4]
cmp rsi, 0x1001
jae 0x140005f8a
xor ebx, ebx
jmp 0x140005fb5
add rsi, rdi
mov rcx, r12
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
cmp rsi, qword [rsp + 0x50]
mov ebx, 0
cmova rbx, rsi
cmp rsi, qword [rsp + 0x48]
cmovb rbx, rsi
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x140005ff2
mov rcx, qword [rsp + 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140005fed
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x140006043
add rax, 0x28
mov rdx, rax
mov rcx, rsi
call fcn.140015750
test r15d, r15d
je 0x14000601f
inc rbp
mov eax, dword [r12 + 0x18]
cmp rbp, rax
jb 0x140005e72
xor ebx, ebx
mov rcx, r12
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14000601f
xor ebx, ebx
mov rax, rbx
movaps xmm6, xmmword [rsp + 0x1d0]
add rsp, 0x1e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140008bd4
call fcn.1400215e4
int3