Function at 0x14001cde8
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov eax, 0x5a4d
mov r15, rcx
cmp word [0x1400b4cd0], ax
jne 0x14001d0ad
movsxd rdi, dword [0x1400b4d0c]
lea r14, [0x1400b4cd0]
add rdi, r14
cmp dword [rdi], 0x4550
jne 0x14001d0ad
xor ebp, ebp
test rdi, rdi
je 0x14001d0ad
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x14001d0ad
mov ebx, dword [rdi + 0x50]
lea r9d, [rbp + 4]
mov edx, ebx
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
je 0x14001d0ad
movzx ecx, word [rdi + 0x14]
mov r13d, dword [rcx + rdi + 0x24]
mov rcx, r15
sub ebx, r13d
mov eax, ebx
mov r8d, ebx
mov qword [rsp + 0xb8], rax
call fcn.14001ac70
mov r12, rax
mov rcx, rsi
test rax, rax
jne 0x14001ceb0
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14001d0ad
mov r8d, dword [rdi + 0x54]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rdi + 0x14]
xor eax, eax
add rbx, 0x28
cmp ax, word [rdi + 6]
jae 0x14001cf09
add rbx, rdi
lea r15, [0x1400b4cd0]
test dword [rbx + 0x14], 0x80
ja 0x14001cef3
mov edx, dword [rbx + 4]
mov ecx, dword [rbx - 4]
add rdx, r15
mov r8d, dword [rbx]
add rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rdi + 6]
inc ebp
add rbx, 0x28
cmp ebp, eax
jl 0x14001ced6
mov r15, qword [rsp + 0xa0]
mov rbp, r12
lea rcx, [rsp + 0x30]
sub r12, r13
mov rdx, rsi
mov rbx, r12
sub rbx, qword [rdi + 0x30]
call fcn.14001d790
mov r10, rax
mov r11, qword [rax + 8]
mov rdx, qword [rax]
cmp rdx, r11
je 0x14001cf80
xor eax, eax
mov r8d, eax
cmp dword [rdx + 0x10], eax
jbe 0x14001cf77
mov rax, qword [rdx + 8]
mov ecx, r8d
movzx r9d, word [rax + rcx*2]
mov ecx, 0xf000
movzx eax, r9w
and ax, cx
mov ecx, 0xa000
cmp ax, cx
jne 0x14001cf6c
mov rax, qword [rdx]
and r9d, 0xfff
add qword [r9 + rax], rbx
inc r8d
cmp r8d, dword [rdx + 0x10]
jb 0x14001cf3c
xor eax, eax
add rdx, 0x18
cmp rdx, r11
jne 0x14001cf34
mov rcx, r10
call fcn.14001d308
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14001d0ad
movsxd rax, dword [rsi + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
jne 0x14001d0ad
xor ebx, ebx
test rax, rax
je 0x14001d0ad
mov ecx, dword [rax + 0xd8]
test ecx, ecx
je 0x14001d01a
mov r14, qword [rcx + rsi + 0x58]
test r14, r14
je 0x14001d01a
mov rax, rsi
sub rax, r12
add r14, rax
movabs rax, 0x2b992ddfa232
cmp qword [r14], rax
jne 0x14001d0ad
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
movabs rdx, 0x2b992ddfa232
xor rcx, rbx
movabs rax, 0x2b992ddfa233
xor rcx, rdx
cmp rcx, rdx
cmove rcx, rax
xor ebx, ebx
mov qword [r14], rcx
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14001d8c0
mov rdx, rax
mov rcx, r15
call fcn.14001d0c0
test al, al
je 0x14001d091
mov r9, qword [rsp + 0xb8]
lea r8, [rsi + r13]
mov rdx, rbp
mov rcx, r15
call fcn.14001aa60
test al, al
je 0x14001d091
mov r8d, dword [rdi + 0x28]
lea rdx, [rsp + 0xc0]
add r8, r12
mov dword [rsp + 0xc0], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rcx, r15
call fcn.14001d3c4
test al, al
je 0x14001d091
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbp
jmp 0x14001d0af
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, rbp
mov rcx, r15
call fcn.14001addc
xor eax, eax
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret