Function at 0x140001680
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
xor ebx, ebx
mov dword [rsp + 0x50], 4
mov dword [rbp + 0x128], ebx
mov dword [rbp + 0x148], ebx
mov rax, qword gs:[0x30]
mov qword [rbp + 0x170], rax
test rax, rax
je 0x1400022b6
mov dword [rbp - 0x68], 4
mov rcx, qword [rax + 0x60]
mov qword [rbp + 0x98], rcx
test rcx, rcx
je 0x1400022b6
mov rax, qword [rcx + 0x18]
mov qword [rbp + 0x60], rax
test rax, rax
je 0x1400022b6
lea rdx, [rax + 0x20]
mov qword [rbp + 0x40], rdx
test rdx, rdx
je 0x1400022b6
mov rdx, qword [rdx]
lea r8d, [rbx + 0x11]
mov ecx, 0x9f7798d1
mov rdx, qword [rdx + 0x50]
call section..text
mov dword [rbp - 0x28], eax
lea r8d, [rbx + 0x11]
mov rax, qword [rbp + 0x40]
mov ecx, 0xceaf6249
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x50]
call section..text
or eax, 1
lea r8d, [rbx + 0x11]
mov dword [rbp - 0x60], eax
mov ecx, 0x8013a906
mov rax, qword [rbp + 0x40]
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x50]
call section..text
mov edx, 0xccbea895
mov dword [rbp - 0x80], eax
mov r8d, 0xbf6b0146
lea rcx, [rsp + 0x40]
call fcn.140001040
mov qword [rbp + 0x158], rax
test rax, rax
je 0x1400022b6
mov edx, 0x7aae9e73
mov r8d, 0xc0a8a18c
mov rcx, rax
call fcn.1400010d0
mov qword [rbp + 0x80], rax
test rax, rax
je 0x1400022b6
mov rcx, qword [rbp + 0x158]
mov edx, 0x3e720626
mov r8d, 0xfd2be28c
call fcn.1400010d0
mov qword [rbp + 0x108], rax
test rax, rax
je 0x1400022b6
mov rcx, qword [rbp + 0x158]
mov edx, 0x3501c76b
mov r8d, 0x362d2450
call fcn.1400010d0
mov qword [rbp + 0x48], rax
test rax, rax
je 0x1400022c3
mov edx, 0x703539e4
mov dword [rsp + 0x20], 0x43b5fb3a
mov r9d, 0xc58546eb
lea rcx, [rsp + 0x40]
mov r8d, 0x6efe3a0b
call fcn.140001490
lea rcx, [rsp + 0x40]
call fcn.140001640
test eax, eax
je 0x1400022b6
lea rcx, [rbp + 0x110]
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp + 0x90], rax
test rax, rax
je 0x1400022b6
mov edx, 0x40b85025
mov r8d, 0x68f16485
mov rcx, rax
call fcn.1400010d0
mov qword [rbp - 8], rax
test rax, rax
je 0x1400022b6
mov edx, 0x89befa2a
mov dword [rsp + 0x20], 0xc84cb085
mov r9d, 0xc1fef54a
lea rcx, [rsp + 0x40]
mov r8d, 0xea0b347b
call fcn.140001490
lea rcx, [rbp + 0x110]
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp + 0x120], rax
test rax, rax
je 0x1400022b6
mov edx, 0x529cd893
mov r8d, 0x5e181a8b
mov rcx, rax
call fcn.1400010d0
mov qword [rbp + 8], rax
test rax, rax
je 0x1400022b6
mov rcx, qword [rbp + 0x158]
mov edx, 0x9b5a374c
mov r8d, 0xd59082b7
call fcn.1400010d0
mov qword [rbp + 0x18], rax
test rax, rax
je 0x1400022b6
mov rcx, qword [rbp + 0x158]
mov edx, 0x77452a13
mov r8d, 0x3d6ced6d
call fcn.1400010d0
mov qword [rbp + 0x30], rax
test rax, rax
je 0x1400022b6
xor ecx, ecx
call qword [rbp + 8]
mov dword [rbp + 0x70], eax
test eax, eax
js 0x1400022b6
mov edx, 0x54d26cd1
mov dword [rsp + 0x20], 0x91bd0175
mov r9d, 0x29ea122d
lea rcx, [rsp + 0x40]
mov r8d, 0xa76aa59
call fcn.140001490
lea rcx, [rbp + 0x110]
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400022b6
mov edx, 0x2d6df58e
mov dword [rsp + 0x20], 0xd391224b
mov r9d, 0x1f4e2949
lea rcx, [rsp + 0x40]
mov r8d, 0x3636350
call fcn.140001490
lea rcx, [rbp + 0x110]
call qword [rbp + pe_nt_image_headers64]
mov qword [rbp + 0x140], rax
test rax, rax
je 0x1400022b6
mov rcx, qword [rbp + 0x158]
mov edx, 0x7708524
mov r8d, 0x36820768
call fcn.1400010d0
mov qword [rbp + 0xc0], rax
test rax, rax
je 0x1400022b6
mov rcx, qword [rbp + 0x158]
mov edx, 0xfd43f251
mov r8d, 0x113284d5
call fcn.1400010d0
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400022b6
mov rcx, qword [rbp - 0x50]
mov edx, 0xbd9c9286
mov r8d, 0x5aec34f4
call fcn.1400010d0
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400022b6
lea edx, [rbx + 0x27]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [rbp + 0x108]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400022b6
lea edx, [rbx + 0x20]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [rbp + 0x108]
mov qword [rbp + 0x160], rax
test rax, rax
je 0x1400022b6
mov rcx, qword [rbp - 0x50]
mov edx, 0x26e077da
mov r8d, 0x829f1a98
call fcn.1400010d0
mov qword [rbp - 0x70], rax
test rax, rax
je 0x1400022b6
mov qword [rsp + 0x4c0], rsi
lea rcx, [rsp + 0x40]
mov edx, 0x48185344
mov qword [rsp + 0x4c8], rdi
mov r9d, 0x7f42d99e
mov dword [rsp + 0x20], 0x35a7fa
mov r8d, 0x92211ab4
call fcn.140001490
mov rdi, qword [rsp + 0x58]
lea rsi, [rbp + 0x110]
mov ecx, 0x10
mov edx, 0x2448a807
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp + 0x158]
mov r8d, 0x535c7065
call fcn.1400010d0
mov qword [rbp], rax
test rax, rax
je 0x1400022a6
mov rcx, qword [rbp - 0x50]
mov edx, 0x8a64a52f
mov r8d, 0x16ba6db2
call fcn.1400010d0
mov qword [rbp + 0x78], rax
test rax, rax
je 0x1400022a6
mov rcx, qword [rbp + 0x158]
mov edx, 0xe5d605a1
mov r8d, 0x946e72f5
call fcn.1400010d0
mov qword [rbp + 0xb8], rax
test rax, rax
je 0x1400022a6
mov rcx, qword [rbp + 0x158]
mov edx, 0x781a862e
mov r8d, 0xf3847ab7
call fcn.1400010d0
mov qword [rbp - 0x48], rax
test rax, rax
je 0x1400022a6
lea edx, [rbx + 0x13]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [rbp + 0x108]
mov qword [rbp + 0x58], rax
test rax, rax
je 0x1400022a6
mov edx, 0x99cbc3bf
mov dword [rsp + 0x20], 0xec7ff1ac
mov r9d, 0x86be534f
lea rcx, [rsp + 0x40]
mov r8d, 0xdb13afc7
call fcn.140001490
mov rdi, qword [rsp + 0x58]
lea rsi, [rbp + 0x110]
add rdi, 0x20
mov dword [rsp + 0x20], ebx
mov ecx, 0x10
lea edx, [rbx + 1]
rep movsb byte [rdi], byte [rsi]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
call qword [rbp - 0x70]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x1400022a6
mov rcx, qword [rbp + 0x158]
mov edx, 0x95a67e1
mov r8d, 0xe1360b96
call fcn.1400010d0
mov qword [rbp + 0x50], rax
test rax, rax
je 0x1400022a6
mov rcx, qword [rbp + 0x158]
mov edx, 0x3f3c0e39
mov r8d, 0x8d7e4cc3
call fcn.1400010d0
mov qword [rbp + 0xf0], rax
test rax, rax
je 0x1400022a6
mov edx, 0xf0441ecc
mov dword [rsp + 0x20], 0x77e08326
mov r9d, 0x9cd5cb1
lea rcx, [rsp + 0x40]
mov r8d, 0x82479add
call fcn.140001490
mov rdi, qword [rbp + 0x58]
lea rsi, [rbp + 0x110]
add rdi, 0x10
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp - 0x50]
mov edx, 0x9d874e24
mov r8d, 0x50174049
call fcn.1400010d0
mov qword [rbp + 0x168], rax
test rax, rax
je 0x1400022a6
mov edx, 0xd9842311
mov dword [rsp + 0x20], 0x1a620f49
mov r9d, 0x667380f1
lea rcx, [rsp + 0x40]
mov r8d, 0xe79ee09b
call fcn.140001490
mov rdi, qword [rsp + 0x58]
lea rsi, [rbp + 0x110]
add rdi, 0x10
mov dword [rsp + 0x20], 0xc079bef
mov ecx, 0x10
mov edx, 0xb3607a53
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
mov r9d, 0x131133aa
mov r8d, 0x2a6cec09
call fcn.140001490
mov rdi, qword [rbp + 0x58]
lea rsi, [rbp + 0x110]
mov ecx, 0x10
mov dword [rsp + 0x20], 0xac77145d
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
mov edx, 0x9787e2f5
mov r9d, 0x686215b8
mov r8d, 0x9a4f0d80
call fcn.140001490
mov rdi, qword [rbp + 0x160]
lea rsi, [rbp + 0x110]
mov ecx, 0x10
mov edx, 0x9d706217
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp + 0x158]
mov r8d, 0xe4e3b055
call fcn.1400010d0
mov qword [rbp + 0xe8], rax
test rax, rax
je 0x1400022a6
mov rcx, qword [rbp + 0x140]
mov edx, 0x4be1ca45
mov r8d, 0x121213
call fcn.1400010d0
mov qword [rbp + 0x20], rax
test rax, rax
je 0x1400022a6
mov edx, 0xbe700160
mov dword [rsp + 0x20], 0x33ad1c27
mov r9d, 0x5e4e897f
lea rcx, [rsp + 0x40]
mov r8d, 0x6c2134d9
call fcn.140001490
mov rdi, qword [rbp + 0x160]
lea rsi, [rbp + 0x110]
add rdi, 0x10
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp - 0x50]
mov edx, 0x35cc5faf
mov r8d, 0x695cd990
call fcn.1400010d0
mov qword [rbp + 0xa0], rax
test rax, rax
je 0x1400022a6
mov rcx, qword [rbp - 0x50]
mov edx, 0x9e354bec
mov r8d, 0x7d512adb
call fcn.1400010d0
mov qword [rbp + 0xf8], rax
test rax, rax
je 0x1400022a6
mov rcx, qword [rbp + 0x158]
mov edx, 0x73b2877c
mov r8d, 0xf841ce62
call fcn.1400010d0
mov qword [rbp - 0x38], rax
test rax, rax
je 0x1400022a6
mov rcx, qword [rbp - 0x50]
mov edx, 0x85c0ecbd
mov r8d, 0xec3950b6
call fcn.1400010d0
mov qword [rbp + 0x138], rax
test rax, rax
je 0x1400022a6
lea rdx, [rbp + 0x1a0]
mov ecx, 0x104
call qword [rbp + 0x18]
test eax, eax
je 0x1400022a6
lea rcx, [rbp + 0x1a0]
call qword [rbp + 0x50]
test eax, eax
je 0x1400022a6
mov rcx, qword [rbp + 0x158]
mov edx, 0x400844f0
mov r8d, 0x63a5876b
call fcn.1400010d0
mov qword [rbp + 0x178], rax
test rax, rax
je 0x1400022a6
mov edx, 0xd81f5559
mov dword [rsp + 0x20], 0x3d24a36b
mov r9d, 0x9d07512d
lea rcx, [rsp + 0x40]
mov r8d, 0x85cc3227
call fcn.140001490
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0x110]
mov qword [rsp + 0x38], rbx
mov r8d, 0x1bb
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call qword [rbp + 0x138]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x1400022a6
lea rcx, [rsp + 0x40]
call fcn.140001520
mov rax, qword [rbp + 0xc8]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400022a6
mov edx, 0xdbfcd24
mov dword [rsp + 0x20], 0xb3ff4186
mov r9d, 0x680cf240
lea rcx, [rsp + 0x40]
mov r8d, 0x87913444
call fcn.140001490
mov rcx, qword [rbp - 0x40]
lea r8, [rbp + 0x114]
mov qword [rsp + 0x38], rbx
lea rdx, [rbp + 0x110]
mov dword [rsp + 0x30], 0x80800000
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [rbp + 0x78]
mov qword [rbp + 0xd0], rax
test rax, rax
je 0x1400022a6
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [rbp + 0x168]
test eax, eax
je 0x1400022a6
mov rcx, qword [rbp + 0xd0]
lea rax, [rbp + 0x128]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x190]
mov edx, 0x20000005
call qword [rbp + 0xa0]
test eax, eax
je 0x1400022a6
mov edx, dword [rbp + 0x190]
lea r9d, [rbx + 4]
xor ecx, ecx
mov r8d, 0x3000
call qword [rbp + 0x108]
mov qword [rbp + 0x150], rax
test rax, rax
je 0x1400022a6
mov r8d, dword [rbp + 0x190]
lea r9, [rbp - 0x20]
mov rcx, qword [rbp + 0xd0]
mov rdx, rax
call qword [rbp + 0xf8]
test eax, eax
je 0x1400022a6
mov r8d, dword [rbp + 0x190]
cmp dword [rbp - 0x20], r8d
jne 0x1400022a6
mov rdx, qword [rbp + 0x150]
lea r9, [rsp + 0x40]
mov rcx, qword [rbp + 0xc8]
mov qword [rsp + 0x20], rbx
call qword [rbp + 0x30]
test eax, eax
je 0x1400022a6
mov rcx, qword [rbp + 0xc8]
call qword [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
call qword [rsp + 0x78]
mov edx, 0x6f24374c
mov dword [rsp + 0x20], 0x5089216
mov r9d, 0xe00f548b
lea rcx, [rsp + 0x40]
mov r8d, 0x4dbd2643
call fcn.140001490
mov rcx, qword [rbp - 0x30]
lea rdx, [rbp + 0x110]
mov qword [rsp + 0x38], rbx
mov r8d, 0x1bb
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call qword [rbp + 0x138]
mov qword [rbp + 0xd8], rax
test rax, rax
je 0x1400022a6
mov rcx, qword [rbp + 0xd0]
call qword [rsp + 0x78]
mov rdx, qword [rbp + 0x160]
lea r8d, [rbx + 1]
xor ecx, ecx
call qword [rbp - 8]
mov dword [rbp + 0xe0], eax
test eax, eax
js 0x1400022a6
mov r8, qword [rbp + 0x58]
mov r9d, 0x1040
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
call qword [rbp + 0x20]
mov edx, 0x32b0c93c
mov dword [rsp + 0x20], 0xbf5c4aa4
mov r9d, 0xfa0f6dae
lea rcx, [rsp + 0x40]
mov r8d, 0xefc9a114
call fcn.140001490
mov rcx, qword [rbp + 0xd8]
lea r8, [rbp + 0x114]
mov qword [rsp + 0x38], rbx
lea rdx, [rbp + 0x110]
mov dword [rsp + 0x30], 0x80800000
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [rbp + 0x78]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x1400022a6
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [rbp + 0x168]
test eax, eax
je 0x1400022a6
mov rcx, qword [rbp - 0x78]
lea rax, [rbp + 0x148]
lea r9, [rbp - 0x68]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x180]
mov edx, 0x20000005
call qword [rbp + 0xa0]
test eax, eax
je 0x1400022a6
mov edx, dword [rbp + 0x180]
lea r9d, [rbx + 4]
xor ecx, ecx
mov r8d, 0x3000
call qword [rbp + 0x108]
mov qword [rbp + 0xb0], rax
test rax, rax
je 0x1400022a6
mov r8d, dword [rbp + 0x180]
lea r9, [rbp + 0x28]
mov rcx, qword [rbp - 0x78]
mov rdx, rax
call qword [rbp + 0xf8]
test eax, eax
je 0x1400022a6
mov eax, dword [rbp + 0x180]
cmp dword [rbp + 0x28], eax
jne 0x1400022a6
mov rcx, qword [rbp - 0x30]
call qword [rsp + 0x78]
mov rcx, qword [rbp + 0xd8]
call qword [rsp + 0x78]
mov rax, qword [rbp + 0xb0]
mov ecx, 0x5a4d
mov qword [rsp + 0x68], rax
cmp word [rax], cx
jne 0x1400022a6
mov rcx, qword [rbp - 0x78]
call qword [rsp + 0x78]
mov rax, qword [rsp + 0x68]
movsxd rdx, dword [rax + 0x3c]
add rdx, qword [rbp + 0xb0]
mov qword [rbp + 0x68], rdx
cmp dword [rdx], 0x4550
jne 0x1400022a6
mov eax, 0x8664
cmp word [rdx + 4], ax
jne 0x1400022a6
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x1400022a6
movzx ecx, word [rdx + 0x14]
lea r9d, [rbx + 0x40]
add rcx, 0x18
mov r8d, 0x3000
add rcx, rdx
mov qword [rbp - 0x18], rcx
xor ecx, ecx
mov edx, dword [rdx + 0x50]
call qword [rbp + 0x108]
mov qword [rbp + 0x130], rax
test rax, rax
je 0x1400022a6
mov rcx, qword [rbp + 0x68]
mov rdi, rax
mov rsi, qword [rbp + 0xb0]
mov ecx, dword [rcx + 0x54]
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
call fcn.140001200
lea rcx, [rsp + 0x40]
call fcn.140001280
lea rcx, [rsp + 0x40]
call fcn.140001370
lea rcx, [rsp + 0x40]
call fcn.140001420
mov rsi, qword [rsp + 0x4c0]
mov rdi, qword [rsp + 0x4c8]
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x1400022c3
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x4d0]
xor eax, eax
add rsp, 0x4b0
pop rbp
ret