Function at 0x140001000
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, qword [0x1400056c0]
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x14000147d
movsxd rsi, dword [r14 + 0x3c]
add rsi, r14
cmp dword [rsi], 0x4550
jne 0x14000147d
mov edx, dword [rsi + 0x50]
mov r9d, 4
mov rcx, qword [rsi + 0x30]
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x140001082
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
xor ecx, ecx
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
je 0x14000147d
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r13d, r13d
mov r8d, 0x1000
mov rcx, rdi
mov r15, rax
mov qword [rax + 8], rdi
mov qword [rax + 0x18], r13
lea r9d, [r13 + 4]
mov qword [rax + 0x10], r13
mov edx, dword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsi + 0x54]
mov rdx, r14
add r8d, dword [r14 + 0x3c]
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
movsxd rcx, dword [r14 + 0x3c]
mov ebp, r13d
add rcx, qword [rsp + 0x50]
mov qword [r15], rcx
mov qword [rcx + 0x30], rdi
mov rcx, qword [r15]
mov r12, qword [r15 + 8]
movzx edi, word [rcx + 0x14]
add rdi, 0x28
cmp r13w, word [rcx + 6]
jae 0x1400011a9
add rdi, rcx
nop dword [rax]
mov eax, dword [rdi]
test eax, eax
jne 0x14000115e
movsxd rax, dword [rsi + 0x38]
test eax, eax
jle 0x140001190
mov ecx, dword [rdi - 4]
mov r9d, 4
add rcx, r12
mov r8d, 0x1000
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov dword [rdi - 8], eax
call sub.VCRUNTIME140.dll_memset
jmp 0x140001190
mov ecx, dword [rdi - 4]
mov rdx, rax
add rcx, r12
mov r9d, 4
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [rdi + 4]
mov rcx, rax
mov r8d, dword [rdi]
add rdx, r14
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi - 8], ebx
mov rcx, qword [r15]
inc ebp
add rdi, 0x28
movzx eax, word [rcx + 6]
cmp ebp, eax
jl 0x140001120
mov r12, qword [r15 + 8]
mov r14, qword [rsp + 0x50]
mov rbp, r12
mov rbx, r14
mov rdx, rcx
sub rbx, qword [rsi + 0x30]
je 0x140001250
cmp dword [rcx + 0xb4], r13d
jbe 0x140001250
mov r11d, dword [rcx + 0xb0]
add r11, r12
mov eax, dword [r11]
test eax, eax
je 0x140001250
nop
mov r10d, dword [r11 + 4]
lea rdx, [r11 + 8]
mov r9d, eax
mov r8d, r13d
add r9, r12
lea rax, [r10 - 8]
test rax, 0xfffffffffffffffe
jbe 0x14000123c
nop dword [rax]
movzx eax, word [rdx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x14000121e
cmp eax, 0xa
jne 0x140001222
add qword [rcx + r9], rbx
jmp 0x140001222
add dword [rcx + r9], ebx
mov r10d, dword [r11 + 4]
inc r8d
add rdx, 2
mov eax, r8d
lea rcx, [r10 - 8]
shr rcx, 1
cmp rax, rcx
jb 0x140001200
mov eax, r10d
add r11, rax
mov eax, dword [r11]
test eax, eax
jne 0x1400011e0
mov rbp, qword [r15 + 8]
mov rdx, qword [r15]
mov r12, qword [rsp + 0x68]
cmp dword [rdx + 0x94], r13d
jbe 0x14000134e
mov r14d, dword [rdx + 0x90]
mov edx, socket
add r14, rbp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x140001349
mov eax, dword [r14 + 0xc]
test eax, eax
je 0x140001349
lea rcx, [rax + rbp]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140001471
movsxd rdx, dword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
lea rdx, [rdx*8 + 8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov qword [r15 + 0x10], rax
test rax, rax
je 0x140001471
movsxd rcx, dword [r15 + 0x18]
mov qword [rax + rcx*8], rsi
inc dword [r15 + 0x18]
mov ecx, dword [r14]
test ecx, ecx
je 0x1400012e0
mov eax, dword [r14 + 0x10]
jmp 0x1400012e6
mov ecx, dword [r14 + 0x10]
mov eax, ecx
mov edi, eax
mov ebx, ecx
add rdi, rbp
add rbx, rbp
mov rax, qword [rbx]
test rax, rax
je 0x14000132f
mov rcx, rsi
test rax, rax
jns 0x140001305
movzx edx, ax
jmp 0x14000130c
lea rdx, [rax + 2]
add rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi], rax
test rax, rax
je 0x140001471
mov rax, qword [rbx + 8]
add rbx, 8
add rdi, 8
test rax, rax
jne 0x1400012f8
add r14, 0x14
mov edx, socket
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x140001282
mov r14, qword [rsp + 0x50]
mov r10, qword [r15]
movabs rax, 0xffffffff00000000
movzx ebx, word [r10 + 0x14]
mov rdi, qword [r10 + 0x30]
add rbx, 0x28
and rdi, rax
cmp r13w, word [r10 + 6]
jae 0x14000142c
add rbx, r10
lea rsi, [0x1400033c8]
mov r9d, dword [rbx + 0x14]
mov r8d, dword [rbx]
bt r9d, 0x19
jae 0x1400013a5
mov ecx, dword [rbx - 8]
mov edx, r8d
or rcx, rdi
mov r8d, 0x4000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140001414
mov rcx, r9
mov rax, r9
shr rax, 0x1e
and eax, 1
shr rcx, 0x1d
and ecx, 1
lea rcx, [rax + rcx*2]
mov rax, r9
shr rax, 0x1f
lea rcx, [rax + rcx*2]
mov eax, r9d
mov r11d, dword [rsi + rcx*4]
bts r11d, 9
and eax, 0x4000000
cmove r11d, dword [rsi + rcx*4]
test r8d, r8d
jne 0x1400013fd
test r9b, 0x40
je 0x1400013ef
mov r8d, dword [r10 + 0x20]
jmp 0x1400013f8
test r9b, r9b
jns 0x140001414
mov r8d, dword [r10 + 0x24]
test r8d, r8d
je 0x140001414
mov ecx, dword [rbx - 8]
lea r9, [rsp + 0x50]
mov edx, r8d
or rcx, rdi
mov r8d, r11d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r10, qword [r15]
inc r13d
add rbx, 0x28
movzx eax, word [r10 + 6]
cmp r13d, eax
jl 0x140001380
mov eax, dword [r10 + 0x28]
test eax, eax
je 0x140001451
add rax, r14
je 0x140001471
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 1]
call rax
test eax, eax
je 0x140001471
mov dword [r15 + 0x1c], 1
mov rax, r15
mov r13, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov rcx, r15
call fcn.140001490
xor eax, eax
jmp 0x140001454
xor eax, eax
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret