Function at 0x7ffbf1cc391c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x170
mov rax, qword [0x7ffbf1d68270]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r12, qword [rsp + 0x1c0]
mov r13, qword [rsp + 0x1c8]
and dword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
or qword [rsp + 0x60], 0xffffffffffffffff
and qword [rsp + 0x48], 0
mov rbx, rdx
xor edx, edx
mov edi, r8d
mov esi, ecx
lea r8d, [rdx + 0x50]
lea rcx, [rsp + 0x70]
mov rbp, r9
call fcn.7ffbf1cc1ab4
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0xc0]
call fcn.7ffbf1cc1ab4
xor edx, edx
lea rcx, [rsp + 0x120]
lea r8d, [rdx + 0x40]
call fcn.7ffbf1cc1ab4
and dword [rsp + 0x40], 0
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x50]
mov rdx, rbx
mov ecx, esi
call fcn.7ffbf1cc69ac
mov ebx, eax
test eax, eax
jne 0x7ffbf1cc3bd2
mov r8d, dword [rsp + 0x50]
cmp r8d, 4
jb 0x7ffbf1cc3c2f
mov rdx, qword [rsp + 0x58]
mov ax, word [rdx]
cmp ax, word [0x7ffbf1cb72dc]
jne 0x7ffbf1cc3c2f
cmp r8d, 0x40
jb 0x7ffbf1cc3c2f
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x7ffbf1cc3c2f
movsxd r9, dword [rdx + 0x3c]
lea rcx, [r9 + 0x40]
cmp r8, rcx
jb 0x7ffbf1cc3c2f
cmp dword [r9 + rdx], 0x4550
jne 0x7ffbf1cc3c2f
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.7ffbf1cc6cb4
test eax, eax
je 0x7ffbf1cc3bcd
mov rcx, qword [rsp + 0x48]
mov eax, 0x200
cmp ax, word [rcx + 4]
jne 0x7ffbf1cc3bcd
lea eax, [rbx + 2]
cmp ax, word [rcx + 6]
jne 0x7ffbf1cc3bcd
mov edx, dword [rcx]
cmp edx, 8
jb 0x7ffbf1cc3bcd
lea rax, [rsp + 0x70]
add edx, 0xfffffff8
add rcx, 8
mov qword [rsp + 0x30], rax
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
call fcn.7ffbf1cc4afc
mov ebx, eax
test eax, eax
jne 0x7ffbf1cc3bd2
cmp dword [rsp + 0x70], 0xa
jne 0x7ffbf1cc3bc6
mov rcx, qword [rsp + 0x78]
lea rax, [0x7ffbf1cb72d0]
mov rdx, qword [rax]
cmp rdx, qword [rcx]
jne 0x7ffbf1cc3acb
mov dx, word [rax + 8]
cmp dx, word [rcx + 8]
jne 0x7ffbf1cc3acb
xor eax, eax
jmp 0x7ffbf1cc3ad0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x7ffbf1cc3bc6
mov edx, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea r9, [0x7ffbf1cb5c80]
lea r8, [rsp + 0x48]
mov dword [rsp + 0x20], 6
mov dword [rsp + 0x48], 8
call fcn.7ffbf1cc6e54
test eax, eax
jle 0x7ffbf1cc3bc6
cmp dword [rsp + 0xd0], 0
jle 0x7ffbf1cc3bc6
lea rcx, [rsp + 0x100]
call fcn.7ffbf1cc4e08
test eax, eax
jne 0x7ffbf1cc3b46
mov ebx, 0x80091002
jmp 0x7ffbf1cc3bdd
lea rcx, [rsp + 0x40]
lea r9, [rsp + 0x120]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov ecx, 3
mov r8d, eax
call fcn.7ffbf1cc310c
mov ebx, eax
test eax, eax
jne 0x7ffbf1cc3bd2
mov eax, dword [rsp + 0x40]
cmp eax, dword [rsp + 0x110]
jne 0x7ffbf1cc3bbf
mov rdx, qword [rsp + 0x118]
lea rcx, [rsp + 0x120]
mov r8, rax
call fcn.7ffbf1cd520c
test eax, eax
jne 0x7ffbf1cc3bbf
test edi, edi
je 0x7ffbf1cc3bbb
lea rcx, [rsp + 0xa0]
mov r9, r12
mov r8, rbp
mov edx, edi
mov qword [rsp + 0x20], r13
call fcn.7ffbf1cc3204
mov ebx, eax
jmp 0x7ffbf1cc3bdd
xor ebx, ebx
jmp 0x7ffbf1cc3bdd
mov ebx, 0x80091007
jmp 0x7ffbf1cc3bdd
mov ebx, 0x8009200d
jmp 0x7ffbf1cc3bdd
mov ebx, 0x800b0100
mov eax, 0x8000ffff
cmp ebx, 0x7a
cmove ebx, eax
cmp esi, 3
je 0x7ffbf1cc3bf5
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x7ffbf1cc3bf5
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x60]
cmp rcx, 0xffffffffffffffff
je 0x7ffbf1cc3c06
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.7ffbf1d2cc34
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x170
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0x32
jmp 0x7ffbf1cc3bdd