Function at 0x140016ff0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x508
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
mov r13, qword [0x1400f74a8]
mov rax, qword [r13]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov rdx, qword [rdx]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x70]
xor r8d, r8d
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
js 0x14001754e
test byte [rsp + 0x9b], 1
je 0x14001755e
mov r8, qword [rbx]
mov rax, qword [case.0x140018f2e.0]
lea rdx, case.0x140018f2e.0
lea rcx, [rsp + 0xb0]
call qword [rax + 0x58]
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x14001754e
movzx ecx, word [rsp + 0xb0]
test cx, cx
je 0x14001754e
movzx r8d, cx
mov ecx, r8d
and ecx, 0xfffffffe
add rcx, rax
add rcx, 0xfffffffffffffffe
mov rdx, rcx
cmp r8w, 2
jb 0x1400170cf
mov rdx, rcx
nop word cs:[rax + rax]
cmp word [rdx], 0x5c
je 0x1400170cf
add rdx, 0xfffffffffffffffe
cmp rdx, rax
jae 0x1400170c0
add rdx, 2
mov qword [rsp + 0x68], rdx
sub ecx, edx
add ecx, 2
mov word [rsp + 0x60], cx
mov word [rsp + 0x62], cx
movups xmm0, xmmword [0x1400f8238]
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov r12b, 1
mov r8b, 1
call sub.ntdll.dll_RtlCompareUnicodeString
xor r15d, r15d
test eax, eax
je 0x14001714e
lea rcx, [0x140137030]
call sub.ntdll.dll_RtlAcquireSRWLockShared
lea rcx, [0x140137018]
lea rdx, [0x140019c50]
xor r14d, r14d
xor r8d, r8d
xor r9d, r9d
call fcn.1400f41f0
mov rbp, qword [0x140137028]
test rbp, rbp
je 0x14001719f
cmp dword [rbp], 3
jge 0x140017158
xor r14d, r14d
jmp 0x14001719f
xor ebp, ebp
xor r14d, r14d
jmp 0x1400174cd
mov eax, dword [0x14013703c]
mov rcx, qword gs:[0x30]
cmp eax, dword [rcx + 0x48]
je 0x140017191
cmp byte [0x140137039], 0
je 0x140017191
mov eax, dword [0x140134660]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 8]
jmp 0x140017196
call fcn.14001b5d0
lea r14, [rbp + 8]
test rax, rax
je 0x1400171fb
mov rdx, qword [rbx]
lea rcx, [rsp + 0x60]
mov r8, r14
call fcn.1400178a0
mov r15d, eax
xor ebp, ebp
lea rcx, [0x140137030]
call sub.ntdll.dll_RtlReleaseSRWLockShared
cmp r15d, 4
je 0x1400174c1
cmp r15d, 1
je 0x1400171e0
test r15d, r15d
jne 0x1400171ea
xor r15d, r15d
xor r14d, r14d
jmp 0x1400174cd
lea rcx, [rsp + 0x60]
call fcn.140017f00
xor r12d, r12d
xor r14d, r14d
mov r15d, 1
jmp 0x1400174cd
xor ecx, ecx
call qword [rbp + 0x10]
mov r15, rax
and r15, 0xfffffffffffffffc
je 0x14001719f
movzx eax, word [r15]
cmp eax, 0x5a4d
jne 0x14001719f
movsxd rax, dword [r15 + 0x3c]
cmp dword [r15 + rax], 0x4550
jne 0x14001719f
movzx ecx, word [r15 + rax + 0x18]
cmp ecx, 0x20b
jne 0x14001719f
mov r8d, dword [r15 + rax + 0x50]
cmp r8d, 0x148
jb 0x14001719f
mov ecx, dword [r15 + rax + 0x84]
cmp ecx, 0x10
mov edx, 0x10
cmovb edx, ecx
cmp edx, 2
jb 0x14001719f
mov eax, dword [r15 + rax + 0x90]
cmp eax, r8d
jb 0x14001719f
cmp dword [r15 + rax], 0
je 0x14001719f
dec r8d
add rax, r15
xor ecx, ecx
mov dword [rsp + 0x4c], r8d
jmp 0x1400172a9
mov r8d, dword [rsp + 0x4c]
mov rax, qword [rsp + 0x40]
cmp dword [rax + 0x14], 0
lea rax, [rax + 0x14]
je 0x1400173bb
test cl, cl
jne 0x14001729b
mov edx, dword [rax + 0xc]
cmp r8d, edx
jae 0x14001730d
mov qword [rsp + 0x40], rax
add rdx, r15
lea rcx, [rsp + 0x4d0]
call sub.ntdll.dll_RtlInitAnsiString
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x4d0]
mov r8b, 1
call sub.ntdll.dll_RtlAnsiStringToUnicodeString
test eax, eax
js 0x14001731e
movzx ecx, word [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
mov eax, ecx
and eax, 0xfffffffe
add rax, rdx
add rax, 0xfffffffffffffffe
cmp cx, 2
jae 0x140017345
mov rcx, rax
jmp 0x140017357
xor ecx, ecx
cmp dword [rax + 0x14], 0
lea rax, [rax + 0x14]
jne 0x1400172a9
jmp 0x14001719f
mov dword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov rax, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffe
jmp 0x140017357
mov rcx, rax
cmp word [rcx], 0x5c
je 0x140017357
add rcx, 0xfffffffffffffffe
cmp rcx, rdx
jae 0x140017348
add rcx, 2
mov qword [rsp + 0x4d8], rcx
sub eax, ecx
add eax, 2
mov word [rsp + 0x4d0], ax
mov word [rsp + 0x4d2], ax
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x4d0]
mov r8b, 1
call sub.ntdll.dll_RtlCompareUnicodeString
test eax, eax
sete cl
cmp qword [rsp + 0xa8], 0
je 0x140017291
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0xa0]
call sub.ntdll.dll_RtlFreeUnicodeString
mov ecx, dword [rsp + 0x38]
jmp 0x140017291
test cl, cl
je 0x14001719f
lea rcx, [rsp + 0x4d0]
lea rdx, [rsp + 0xb0]
call fcn.140017650
mov rdx, qword [rbx]
lea rcx, [rsp + 0x60]
mov r8, r14
call fcn.1400178a0
mov r15d, eax
and eax, 0xfffffffe
cmp eax, 2
jne 0x140017445
mov r15, qword [rbx]
mov byte [rsp + 0x40], 1
test r15, r15
je 0x14001744d
movzx eax, word [r15]
cmp eax, 0x5a4d
jne 0x14001744d
movsxd rax, dword [r15 + 0x3c]
lea rcx, [r15 + rax]
mov qword [rsp + 0x38], rcx
cmp dword [r15 + rax], 0x4550
jne 0x140017454
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x140017454
mov rax, qword [rsp + 0x38]
cmp dword [rax + 0x50], 0x148
setb byte [rsp + 0x40]
jmp 0x140017454
mov bpl, 1
jmp 0x1400171b4
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0xa0], r14
lea rcx, [rsp + 0x4d0]
call qword [rbp + 0x18]
mov eax, dword [rsp + 0x4d4]
mov dword [rsp + 0xa8], eax
cmp byte [rsp + 0x40], 0
jne 0x140017588
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x28]
add r15, rax
lea r9, [0x14001a780]
lea rcx, [rsp + 0x4d0]
lea rdx, [rsp + 0xa0]
mov r8, r15
call fcn.14001a790
test al, al
je 0x140017588
lea rcx, [0x140137030]
call sub.ntdll.dll_RtlReleaseSRWLockShared
mov bpl, 1
mov r15d, 2
mov r14b, 1
xor r12d, r12d
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
cmp qword [rax + 0x30], 0
je 0x140017549
lea rdx, [rsp + 0xb0]
lea r8, [rsp + 0x4d0]
mov ecx, 1
call sub.ntdll.dll_RtlDuplicateUnicodeString
test eax, eax
jns 0x140017516
mov dword [rsp + 0x4d0], 0
mov qword [rsp + 0x4d8], 0
mov rdx, qword [rbx]
mov byte [rsp + 0x20], bpl
lea rcx, [rsp + 0x4d0]
mov r8d, esi
mov r9d, r15d
call fcn.140017fb0
cmp qword [rsp + 0x4d8], 0
je 0x140017549
lea rcx, [rsp + 0x4d0]
call sub.ntdll.dll_RtlFreeUnicodeString
or r12b, r14b
jne 0x14001755e
mov rdx, qword [rbx]
mov rcx, rdi
call sub.ntdll.dll_NtUnmapViewOfSection
mov esi, 0xc0000022
mov rax, qword [rsp + 0x500]
xor rax, rsp
mov rcx, qword [r13]
cmp rcx, rax
jne 0x14001759c
mov eax, esi
add rsp, 0x508
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x140137030]
call sub.ntdll.dll_RtlReleaseSRWLockShared
mov bpl, 1
jmp 0x1400171d5
call fcn.1400c8850
int3