Function at 0x140034480
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400ac2c0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rbx, rcx
xor r14d, r14d
mov rsi, qword [0x1400afe18]
mov rdi, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, rdi
xorps xmm0, xmm0
xorps xmm1, xmm1
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x30], xmm1
cmp rax, 0x40
jae 0x140034558
mov r8d, gethostbyname
lea rdx, str._r_nInvalid_EXE:_Too_small_to_contain_a_DOS_header._r_n
call fcn.140005560
nop
mov r8d, 0xff
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140035a2e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003454e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035a76
call fcn.1400626b0
jmp 0x140035a2e
mov eax, 0x5a4d
cmp word [rdi], ax
je 0x1400345c7
mov r8d, 0x1a
lea rdx, str._r_nInvalid_DOS_signature._r_n
call fcn.140005560
nop
mov r8d, 0xff
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140035a2e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003454e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035a64
jmp 0x14003454e
mov r8d, 0x1b
lea rdx, str._r_nValid_DOS_header_found._r_n
call fcn.140005560
nop
mov r8d, 0xff00
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14003462b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034626
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035a7c
call fcn.1400626b0
movsxd rdx, dword [rdi + 0x3c]
mov r8, qword [rbx]
mov rcx, qword [rbx + 8]
sub rcx, r8
lea rax, [rdx + 0x108]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x30], xmm1
cmp rcx, rax
lea rcx, [rsp + 0x20]
jae 0x1400346c7
mov r8d, 0x1d
lea rdx, str._r_nInvalid_PE_header_offset._r_n
call fcn.140005560
nop
mov r8d, 0xff
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140035a2e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003454e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035a6a
jmp 0x14003454e
lea r12, [r8 + rdx]
cmp dword [r12], 0x4550
je 0x140034741
mov r8d, 0x19
lea rdx, str._r_nInvalid_PE_signature._r_n
call fcn.140005560
nop
mov r8d, 0xff
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140035a2e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003454e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035a70
jmp 0x14003454e
mov r8d, 0x1a
lea rdx, str._r_nValid_PE_header_found._r_n
call fcn.140005560
nop
mov r8d, 0xff00
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400347a5
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400347a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035a82
call fcn.1400626b0
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp - 0x80]
call fcn.140088570
lea rcx, [rbp - 0x80]
call fcn.14004df20
nop
lea rdx, str.___Machine:
lea rcx, [rbp - 0x70]
call fcn.140057bd0
movzx edx, word [r12 + 4]
mov rcx, rax
call fcn.140051c10
mov rcx, rax
lea rdx, [0x14009aad4]
call fcn.140057bd0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140055890
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140034825
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
mov r8d, 0xff00
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14003488b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034886
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035a88
call fcn.1400626b0
movdqa xmm0, xmmword [0x14009e340]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400348db
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400348d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035a8e
call fcn.1400626b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
xor r8d, r8d
lea rdx, [0x14009a1e9]
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
lea rcx, [rbp - 0x68]
call fcn.1400557e0
mov ebx, dword [rbp + 8]
mov eax, ebx
and eax, 6
cmp al, 6
jne 0x140034927
mov qword [rbp], r14
or ebx, 0x20
mov r9, qword [rsp + 0x38]
jmp 0x1400349c4
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jbe 0x14003493c
mov r8, qword [rsp + 0x20]
inc rax
jmp 0x140034956
mov ecx, 0x11
call fcn.1400626b8
mov r8, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
mov eax, 0x11
mov r9d, 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x30]
add rdx, r8
mov qword [rbp], rdx
test bl, 0x18
cmove rdx, r8
lea rcx, [r8 + rax]
mov rax, qword [rbp - 0x48]
mov qword [rax], r8
mov rax, qword [rbp - 0x28]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbp - 0x10]
mov dword [rax], ecx
mov rax, qword [rbp - 0x50]
test bl, 4
je 0x1400349aa
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
mov rax, qword [rbp - 0x18]
mov dword [rax], r14d
jmp 0x1400349c1
mov rcx, qword [rbp]
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
sub ecx, r8d
mov rax, qword [rbp - 0x18]
mov dword [rax], ecx
or ebx, 0x21
mov dword [rbp + 8], ebx
cmp r9, 0xf
jbe 0x140034a00
lea rdx, [r9 + 1]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400349fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ae8
call fcn.1400626b0
lea rdx, str.___Number_of_Sections:
lea rcx, [rbp - 0x70]
call fcn.140057bd0
movzx edx, word [r12 + 6]
mov rcx, rax
call fcn.140051c10
mov rcx, rax
lea rdx, [0x14009aad4]
call fcn.140057bd0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140055890
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140034a65
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
mov r8d, 0xff00
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140034acb
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034ac6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035a94
call fcn.1400626b0
movdqa xmm0, xmmword [0x14009e340]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140034b1b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034b16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035a9a
call fcn.1400626b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
xor r8d, r8d
lea rdx, [0x14009a1e9]
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
lea rcx, [rbp - 0x68]
call fcn.1400557e0
mov ebx, dword [rbp + 8]
mov eax, ebx
and eax, 6
cmp al, 6
jne 0x140034b67
mov qword [rbp], r14
or ebx, 0x20
mov r9, qword [rsp + 0x38]
jmp 0x140034c04
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jbe 0x140034b7c
mov r8, qword [rsp + 0x20]
inc rax
jmp 0x140034b96
mov ecx, 0x11
call fcn.1400626b8
mov r8, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
mov eax, 0x11
mov r9d, 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x30]
add rdx, r8
mov qword [rbp], rdx
test bl, 0x18
cmove rdx, r8
lea rcx, [r8 + rax]
mov rax, qword [rbp - 0x48]
mov qword [rax], r8
mov rax, qword [rbp - 0x28]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbp - 0x10]
mov dword [rax], ecx
mov rax, qword [rbp - 0x50]
test bl, 4
je 0x140034bea
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
mov rax, qword [rbp - 0x18]
mov dword [rax], r14d
jmp 0x140034c01
mov rcx, qword [rbp]
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
sub ecx, r8d
mov rax, qword [rbp - 0x18]
mov dword [rax], ecx
or ebx, 0x21
mov dword [rbp + 8], ebx
cmp r9, 0xf
jbe 0x140034c40
lea rdx, [r9 + 1]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034c3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ae8
call fcn.1400626b0
lea rdx, str.___Time_Date_Stamp:
lea rcx, [rbp - 0x70]
call fcn.140057bd0
mov edx, dword [r12 + 8]
mov rcx, rax
call fcn.140051810
mov rcx, rax
lea rdx, [0x14009aad4]
call fcn.140057bd0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140055890
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140034ca4
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
mov r8d, 0xff00
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140034d0a
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034d05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035aa0
call fcn.1400626b0
movdqa xmm0, xmmword [0x14009e340]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140034d5a
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034d55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035aa6
call fcn.1400626b0
movzx r13d, word [r12 + 0x14]
add r13, r12
xor ebx, ebx
mov r15d, ebx
cmp bx, word [r12 + 6]
jae 0x1400359aa
mov r14d, ebx
mov byte [rsp + 0x68], 0
lea rax, [r14 + r14*4]
lea rdi, [rax*8]
mov rax, qword [rdi + r13 + 0x18]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
xor r8d, r8d
lea rdx, [0x14009a1e9]
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
lea rcx, [rbp - 0x68]
call fcn.1400557e0
mov ebx, dword [rbp + 8]
mov eax, ebx
and eax, 6
cmp al, 6
jne 0x140034de3
mov qword [rbp], 0
or ebx, 0x20
mov r9, qword [rsp + 0x38]
jmp 0x140034e83
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jbe 0x140034df8
mov r8, qword [rsp + 0x20]
inc rax
jmp 0x140034e12
mov ecx, 0x11
call fcn.1400626b8
mov r8, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
mov eax, 0x11
mov r9d, 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x30]
add rdx, r8
mov qword [rbp], rdx
test bl, 0x18
cmove rdx, r8
lea rcx, [r8 + rax]
mov rax, qword [rbp - 0x48]
mov qword [rax], r8
mov rax, qword [rbp - 0x28]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbp - 0x10]
mov dword [rax], ecx
mov rax, qword [rbp - 0x50]
test bl, 4
je 0x140034e69
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
mov rax, qword [rbp - 0x18]
mov dword [rax], 0
jmp 0x140034e80
mov rcx, qword [rbp]
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
sub ecx, r8d
mov rax, qword [rbp - 0x18]
mov dword [rax], ecx
or ebx, 0x21
mov dword [rbp + 8], ebx
cmp r9, 0xf
jbe 0x140034ebf
lea rdx, [r9 + 1]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034eba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ae8
call fcn.1400626b0
lea rdx, str.___Section:
lea rcx, [rbp - 0x70]
call fcn.140057bd0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov r8d, 8
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rcx, rbx
call fcn.14005d490
lea rdx, [0x14009aad4]
mov rcx, rax
call fcn.140057bd0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140034f67
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034f62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ab2
call fcn.1400626b0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140055890
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], bl
jne 0x140034fa2
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
mov r8d, 0xff00
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140035007
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035002
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ab8
call fcn.1400626b0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140035057
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035052
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035abe
call fcn.1400626b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
xor r8d, r8d
lea rdx, [0x14009a1e9]
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
lea rcx, [rbp - 0x68]
call fcn.1400557e0
mov ebx, dword [rbp + 8]
mov eax, ebx
and eax, 6
cmp al, 6
jne 0x1400350a8
mov qword [rbp], 0
or ebx, 0x20
mov r9, qword [rsp + 0x38]
jmp 0x140035148
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jbe 0x1400350bd
mov r8, qword [rsp + 0x20]
inc rax
jmp 0x1400350d7
mov ecx, 0x11
call fcn.1400626b8
mov r8, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
mov eax, 0x11
mov r9d, 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x30]
add rdx, r8
mov qword [rbp], rdx
test bl, 0x18
cmove rdx, r8
lea rcx, [r8 + rax]
mov rax, qword [rbp - 0x48]
mov qword [rax], r8
mov rax, qword [rbp - 0x28]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbp - 0x10]
mov dword [rax], ecx
mov rax, qword [rbp - 0x50]
test bl, 4
je 0x14003512e
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
mov rax, qword [rbp - 0x18]
mov dword [rax], 0
jmp 0x140035145
mov rcx, qword [rbp]
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
sub ecx, r8d
mov rax, qword [rbp - 0x18]
mov dword [rax], ecx
or ebx, 0x21
mov dword [rbp + 8], ebx
cmp r9, 0xf
jbe 0x140035184
lea rdx, [r9 + 1]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003517f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ae8
call fcn.1400626b0
lea rdx, str.______Virtual_Size:
lea rcx, [rbp - 0x70]
call fcn.140057bd0
mov edx, dword [rdi + r13 + 0x20]
mov rcx, rax
call fcn.140051810
mov rcx, rax
lea rdx, [0x14009aad4]
call fcn.140057bd0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140055890
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], bl
jne 0x1400351f0
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
mov r8d, 0xff00
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140035255
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035250
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ac4
call fcn.1400626b0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400352a5
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400352a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035aca
call fcn.1400626b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
xor r8d, r8d
lea rdx, [0x14009a1e9]
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
lea rcx, [rbp - 0x68]
call fcn.1400557e0
mov ebx, dword [rbp + 8]
mov eax, ebx
and eax, 6
cmp al, 6
jne 0x1400352f6
mov qword [rbp], 0
or ebx, 0x20
mov r9, qword [rsp + 0x38]
jmp 0x140035396
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jbe 0x14003530b
mov r8, qword [rsp + 0x20]
inc rax
jmp 0x140035325
mov ecx, 0x11
call fcn.1400626b8
mov r8, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
mov eax, 0x11
mov r9d, 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x30]
add rdx, r8
mov qword [rbp], rdx
test bl, 0x18
cmove rdx, r8
lea rcx, [r8 + rax]
mov rax, qword [rbp - 0x48]
mov qword [rax], r8
mov rax, qword [rbp - 0x28]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbp - 0x10]
mov dword [rax], ecx
mov rax, qword [rbp - 0x50]
test bl, 4
je 0x14003537c
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
mov rax, qword [rbp - 0x18]
mov dword [rax], 0
jmp 0x140035393
mov rcx, qword [rbp]
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
sub ecx, r8d
mov rax, qword [rbp - 0x18]
mov dword [rax], ecx
or ebx, 0x21
mov dword [rbp + 8], ebx
cmp r9, 0xf
jbe 0x1400353d2
lea rdx, [r9 + 1]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400353cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ae8
call fcn.1400626b0
lea rdx, str.______Virtual_Address:
lea rcx, [rbp - 0x70]
call fcn.140057bd0
mov edx, dword [rdi + r13 + 0x24]
mov rcx, rax
call fcn.140051810
mov rcx, rax
lea rdx, [0x14009aad4]
call fcn.140057bd0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140055890
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], bl
jne 0x140035440
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
mov r8d, 0xff00
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400354a5
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400354a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ad0
call fcn.1400626b0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400354f5
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400354f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ad6
call fcn.1400626b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
xor r8d, r8d
lea rdx, [0x14009a1e9]
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
lea rcx, [rbp - 0x68]
call fcn.1400557e0
mov ebx, dword [rbp + 8]
mov eax, ebx
and eax, 6
cmp al, 6
jne 0x140035546
mov qword [rbp], 0
or ebx, 0x20
mov r9, qword [rsp + 0x38]
jmp 0x1400355e6
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jbe 0x14003555b
mov r8, qword [rsp + 0x20]
inc rax
jmp 0x140035575
mov ecx, 0x11
call fcn.1400626b8
mov r8, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
mov eax, 0x11
mov r9d, 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x30]
add rdx, r8
mov qword [rbp], rdx
test bl, 0x18
cmove rdx, r8
lea rcx, [r8 + rax]
mov rax, qword [rbp - 0x48]
mov qword [rax], r8
mov rax, qword [rbp - 0x28]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbp - 0x10]
mov dword [rax], ecx
mov rax, qword [rbp - 0x50]
test bl, 4
je 0x1400355cc
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
mov rax, qword [rbp - 0x18]
mov dword [rax], 0
jmp 0x1400355e3
mov rcx, qword [rbp]
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
sub ecx, r8d
mov rax, qword [rbp - 0x18]
mov dword [rax], ecx
or ebx, 0x21
mov dword [rbp + 8], ebx
cmp r9, 0xf
jbe 0x140035622
lea rdx, [r9 + 1]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003561d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ae8
call fcn.1400626b0
lea rdx, str.______Size_of_Raw_Data:
lea rcx, [rbp - 0x70]
call fcn.140057bd0
mov edx, dword [rdi + r13 + 0x28]
mov rcx, rax
call fcn.140051810
mov rcx, rax
lea rdx, [0x14009aad4]
call fcn.140057bd0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140055890
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], bl
jne 0x140035690
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
mov r8d, 0xff00
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1400356f5
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400356f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035adc
call fcn.1400626b0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140035745
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035740
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ae2
call fcn.1400626b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
xor r8d, r8d
lea rdx, [0x14009a1e9]
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
lea rcx, [rbp - 0x68]
call fcn.1400557e0
mov ebx, dword [rbp + 8]
mov eax, ebx
and eax, 6
cmp al, 6
jne 0x140035796
mov qword [rbp], 0
or ebx, 0x20
mov r9, qword [rsp + 0x38]
jmp 0x140035836
mov rax, qword [rsp + 0x38]
cmp rax, 0xf
jbe 0x1400357ab
mov r8, qword [rsp + 0x20]
inc rax
jmp 0x1400357c5
mov ecx, 0x11
call fcn.1400626b8
mov r8, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
mov eax, 0x11
mov r9d, 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x30]
add rdx, r8
mov qword [rbp], rdx
test bl, 0x18
cmove rdx, r8
lea rcx, [r8 + rax]
mov rax, qword [rbp - 0x48]
mov qword [rax], r8
mov rax, qword [rbp - 0x28]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbp - 0x10]
mov dword [rax], ecx
mov rax, qword [rbp - 0x50]
test bl, 4
je 0x14003581c
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
mov rax, qword [rbp - 0x18]
mov dword [rax], 0
jmp 0x140035833
mov rcx, qword [rbp]
mov qword [rax], r8
mov rax, qword [rbp - 0x30]
mov qword [rax], r8
sub ecx, r8d
mov rax, qword [rbp - 0x18]
mov dword [rax], ecx
or ebx, 0x21
mov dword [rbp + 8], ebx
cmp r9, 0xf
jbe 0x140035872
lea rdx, [r9 + 1]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003586d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035ae8
call fcn.1400626b0
lea rdx, str.______Pointer_to_Raw_Data:
lea rcx, [rbp - 0x70]
call fcn.140057bd0
mov edx, dword [rdi + r13 + 0x2c]
mov rcx, rax
call fcn.140051810
mov rcx, rax
lea rdx, [0x14009aad4]
call fcn.140057bd0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x68]
call fcn.140055890
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rdx, qword [rsp + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], bl
jne 0x1400358e0
lea rcx, [rsp + 0x20]
call fcn.140005560
nop
mov r8d, 0xff00
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140035945
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035940
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035aee
call fcn.1400626b0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140035995
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035990
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035a5e
call fcn.1400626b0
inc r15d
inc r14
movzx eax, word [r12 + 6]
cmp r15d, eax
jl 0x140034d77
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
mov r8d, 0x2a
lea rdx, str._r_nPE_Information_extracted_successfully._r_n
lea rcx, [rsp + 0x40]
call fcn.140005560
nop
mov r8d, 0xff00
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140005a90
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140035a25
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035a1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140035aac
call fcn.1400626b0
nop
lea rcx, [rbp - 0x80]
call fcn.140032770
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140062690
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14007025c
nop
call fcn.14007025c
int3
call fcn.14007025c
int3
call fcn.14007025c
int3
call fcn.14007025c
int3
call fcn.14007025c
int3
call fcn.14007025c
nop
call fcn.14007025c
nop
call fcn.14007025c
nop
call fcn.14007025c
nop
call fcn.14007025c
nop
call fcn.14007025c
nop
call fcn.14007025c
int3
call fcn.14007025c
int3
call fcn.14007025c
nop
call fcn.14007025c
nop
call fcn.14007025c
nop
call fcn.14007025c
nop
call fcn.14007025c
nop
call fcn.14007025c
nop
call fcn.14007025c
nop
call fcn.14007025c
nop
call fcn.14007025c
int3
call fcn.14007025c
nop
call fcn.14007025c
int3