Function at 0x14005a770
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
mov rbp, rsp
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
xchg rdx, rbx
mov rdx, rbx
xchg rdx, rbx
sub eax, 0x1362bfc2
add eax, 0x1362befe
mov rdi, rcx
cmp eax, 0x14
ja case.0x14005a7c1.325238520
lea rcx, [0x140000000]
cdqe
mov r8d, dword [rcx + rax*4 + 0x5b2c8]
add r8, rcx
jmp r8
lea r8, [rbp + 0x10]
mov byte [rbp + 0x10], 0x68
xor byte [rbp + 0x10], 0x60
add byte [rbp + 0x10], 0x4c
sub byte [rbp + 0x10], 7
sub byte [rbp + 0x10], 0x3b
add byte [rbp + 0x10], 0x58
sub byte [rbp + 0x10], 0x5c
sub byte [rbp + 0x10], 0xe
mov edx, 0x36bf9d3f
xor edx, 0x71a95e7a
xor edx, 0x57028ebb
add edx, 0x3f79076c
add edx, 0x4181532
xor edx, 0x75035def
add edx, 0x566fa0b8
sub edx, 0x7d15d829
xchg r9, rcx
mov r9, rdi
xchg r9, rcx
call fcn.14003f130
test al, al
je case.0x14005a7c1.325238520
movzx r8d, byte [rbp + 0x10]
mov r9, rbx
mov edx, 0x5c101c24
xor edx, 0x117a3719
add edx, 0x2a239320
xor edx, 0xf51e68f
xor edx, 0x613c74b7
xor edx, 0x33d89a72
add edx, 0x9d71571
sub edx, 0x1f2d9678
xor edx, 0x14e23512
xchg rcx, rdi
mov rdi, rcx
xchg rcx, rdi
call fcn.14003a9b0
test al, al
je case.0x14005a7c1.325238520
mov al, 0x28
add al, 0x4f
xor al, 0x48
add al, 0x2f
sub al, 0x6e
add al, 0x2d
xor al, 0x41
sub al, 0x6b
xchg r12, rbx
mov r12, qword [rsp + 0x40]
xchg r12, rbx
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
push rbx
push rdx
push rdx
xchg qword [rsp + 0x18], rbp
add rsp, 0x20
nop
add rsp, 8
jmp qword [rsp - 8]
xor eax, eax
lea r8, [rbp + 0x10]
xchg r11, rcx
mov r11, rdi
xchg rcx, r11
mov word [rbp + 0x10], ax
lea edx, [rax + 2]
call fcn.14003fe60
test al, al
je case.0x14005a7c1.325238520
movzx r8d, word [rbp + 0x10]
xchg r9, rbx
mov rbx, r9
xchg rbx, r9
mov edx, 0x63f61a70
xor edx, 0x41a1db70
xor edx, 0x2894f37b
xor edx, 0x119bfd19
sub edx, 0x12893722
add edx, 0x4f8ae4a2
add edx, 0x26a917d2
sub edx, 0x7f0394b2
mov rcx, rdi
call fcn.14003b030
test al, al
je case.0x14005a7c1.325238520
mov al, 0x73
xor al, 0x7c
add al, 0xe
add al, 0x53
sub al, 0x36
xor al, 0x70
sub al, 0x49
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
push rbx
push rcx
push rdx
xchg qword [rsp + 0x18], rbp
add rsp, 0x20
nop
add rsp, 8
jmp qword [rsp - 8]
xor eax, eax
lea r8, [rbp + 0x10]
xchg r9, rcx
mov r9, rdi
xchg r9, rcx
mov dword [rbp + 0x10], eax
lea edx, [rax + 2]
call fcn.1400411f0
test al, al
je case.0x14005a7c1.325238520
mov r8d, dword [rbp + 0x10]
xchg r9, rbx
mov rbx, r9
xchg r9, rbx
mov edx, 0x1e1ae0d9
sub edx, 0x1a501cad
add edx, 0x218290e1
sub edx, 0x13159d7a
add edx, 0x54e447c0
sub edx, 0x2f5c3170
xor edx, 0x111d4781
sub edx, 0x1d262b60
sub edx, 0x97c5f00
mov rcx, rdi
call fcn.14003bd70
test al, al
je case.0x14005a7c1.325238520
mov al, 0x54
sub al, 0x3d
xor al, 0x72
sub al, 0x10
xor al, 0x78
xor al, 0xf
add al, 0x13
xor al, 0x34
xchg rbx, rsi
mov rsi, qword [rsp + 0x40]
xchg rbx, rsi
xchg rbp, rdi
mov rbp, qword [rsp + 0x48]
xchg rbp, rdi
add rsp, 0x20
nop
add rsp, 8
mov rbp, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
lea r8, [rbp + 0x10]
mov byte [rbp + 0x10], 0x34
xor byte [rbp + 0x10], 0x14
xor byte [rbp + 0x10], 0x44
sub byte [rbp + 0x10], 0x2e
sub byte [rbp + 0x10], 0xf
xor byte [rbp + 0x10], 0x5e
sub byte [rbp + 0x10], 0x72
xor byte [rbp + 0x10], 7
mov edx, 0x18b9ce16
add edx, 0xa0a9bba
add edx, 0x324b2de7
sub edx, 0x254cf10a
sub edx, 0x28ba9569
add edx, 0x274c320a
sub edx, 0x1e316cc9
sub edx, 0x1022d683
mov byte [rbp + 0x18], 0x15
xor byte [rbp + 0x18], 0x6e
xor byte [rbp + 0x18], 0x64
sub byte [rbp + 0x18], 0x1a
xor byte [rbp + 0x18], 0x71
sub byte [rbp + 0x18], 0x57
sub byte [rbp + 0x18], 0xe
sub byte [rbp + 0x18], 0xf
mov rcx, rdi
call fcn.14003f130
test al, al
je case.0x14005a7c1.325238520
lea r8, [rbp + 0x18]
mov edx, 0x3269d307
sub edx, 0x2f835f2e
add edx, 0x61a1e965
add edx, 0x64064bd
xor edx, 0x61c0f0d9
add edx, 0x2b8b6b18
sub edx, 0x2396ae9
sub edx, 0x11f5f2ef
xor edx, 0x22643e60
xchg rcx, rbx
mov rbx, rdi
xchg rcx, rbx
call fcn.14003ea80
test al, al
je case.0x14005a7c1.325238520
movzx r8d, byte [rbp + 0x10]
mov r9, rbx
mov edx, 0x2cb6e0f3
add edx, 0x1763e849
add edx, 0x16540047
sub edx, 0x20dd97b1
sub edx, 0x12985b02
xor edx, 0x55bf8e9c
sub edx, 0x24e2f829
xor edx, 0x4e646021
xchg rcx, r8
mov r8, rdi
xchg r8, rcx
call fcn.14003a9b0
test al, al
je case.0x14005a7c1.325238520
movzx eax, byte [rbp + 0x18]
xchg r15, rax
mov qword [rbx + 0x18], r15
xchg r15, rax
mov al, 0x71
xor al, 0x26
sub al, 0x3a
xor al, 0x11
add al, 0x2a
sub al, 0x35
mov byte [rbx + 0x20], 0x72
xor byte [rbx + 0x20], 0x62
add byte [rbx + 0x20], 0x2a
add byte [rbx + 0x20], 0x1a
sub byte [rbx + 0x20], 0x4b
add byte [rbx + 0x20], 0x49
add byte [rbx + 0x20], 0xf
sub byte [rbx + 0x20], 0x60
xchg r8, rbx
mov r8, qword [rsp + 0x40]
xchg r8, rbx
xchg rdi, r14
mov r14, qword [rsp + 0x48]
xchg rdi, r14
add rsp, 0x20
push rdx
push rbx
push rdx
push rcx
push rcx
push rdx
xchg qword [rsp + 0x30], rbp
add rsp, 0x38
ret
xor eax, eax
lea r8, [rbp + 0x18]
xchg rcx, rdi
mov rdi, rcx
xchg rcx, rdi
mov word [rbp + 0x18], ax
mov byte [rbp + 0x10], al
lea edx, [rax + 2]
call fcn.14003fe60
test al, al
je case.0x14005a7c1.325238520
lea r8, [rbp + 0x10]
mov edx, 0x3f56f40
add edx, 0x2e55523d
add edx, 0x41ac96cc
add edx, 0x9fd73d7
sub edx, 0x62838a22
add edx, 0x10ef1ea0
xor edx, 0x2c60609c
xchg r11, rdi
mov rcx, r11
xchg r11, rdi
call fcn.14003ea80
test al, al
je case.0x14005a7c1.325238520
movzx r8d, word [rbp + 0x18]
xchg r9, rbx
mov rbx, r9
xchg rbx, r9
mov edx, 0x7e81e6a9
sub edx, 0x27521b32
sub edx, 0x39a772dc
xor edx, 0x1deb52db
add edx, 0x524dafca
sub edx, 0x4502e301
add edx, 0x667af094
sub edx, 0x7428c79b
xchg rsi, rcx
mov rsi, rdi
xchg rcx, rsi
call fcn.14003b030
test al, al
je case.0x14005a7c1.325238520
movzx eax, byte [rbp + 0x10]
mov qword [rbx + 0x18], rax
mov al, 0x22
add al, 0x5c
sub al, 0x7a
add al, 3
add al, 0x40
sub al, 0x46
mov byte [rbx + 0x20], 0x59
xor byte [rbx + 0x20], 0x5d
xor byte [rbx + 0x20], 0x70
xor byte [rbx + 0x20], 0x27
xor byte [rbx + 0x20], 0x51
add byte [rbx + 0x20], 0x7b
sub byte [rbx + 0x20], 0x7c
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
nop
add rsp, 8
mov rbp, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
xor eax, eax
lea r8, [rbp + 0x18]
xchg r15, rcx
mov r15, rdi
xchg r15, rcx
mov dword [rbp + 0x18], eax
mov byte [rbp + 0x10], al
lea edx, [rax + 2]
call fcn.1400411f0
test al, al
je case.0x14005a7c1.325238520
lea r8, [rbp + 0x10]
mov edx, 0x2f71b81d
add edx, 0x2da924ba
add edx, 0x157e0ca5
sub edx, 0x5215595d
add edx, 0x24e3cc85
sub edx, 0x45675ca2
xchg rdi, r8
mov rcx, r8
xchg r8, rdi
call fcn.14003ea80
test al, al
je case.0x14005a7c1.325238520
mov r8d, dword [rbp + 0x18]
xchg rbx, r11
mov r9, r11
xchg r11, rbx
mov edx, 0x551f2495
sub edx, 0x38fe8915
xor edx, 0x60715002
sub edx, 0x597f94db
xor edx, 0x2a275365
sub edx, 0x2e16f26
add edx, 0x26021ff9
sub edx, 0x2c161693
xchg rcx, rdi
mov rdi, rcx
xchg rcx, rdi
call fcn.14003bd70
test al, al
je case.0x14005a7c1.325238520
movzx eax, byte [rbp + 0x10]
xchg r8, rax
mov qword [rbx + 0x18], r8
xchg r8, rax
mov al, 0x41
add al, 0x12
sub al, 0x27
add al, 0x16
add al, 0x1f
add al, 8
xor al, 0x1d
xor al, 0x75
mov byte [rbx + 0x20], 0x48
xor byte [rbx + 0x20], 0x43
add byte [rbx + 0x20], 0x1e
xor byte [rbx + 0x20], 0x3e
xor byte [rbx + 0x20], 0x3d
xor byte [rbx + 0x20], 0xf
add byte [rbx + 0x20], 0x11
sub byte [rbx + 0x20], 0x35
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
push rdx
push rax
push rax
push rdx
push rcx
xchg qword [rsp + 0x28], rbp
pop rcx
pop rdx
pop rax
pop rax
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
lea r8, [rbp + 0x10]
mov byte [rbp + 0x10], 0x7d
sub byte [rbp + 0x10], 0x64
add byte [rbp + 0x10], 0x50
xor byte [rbp + 0x10], 0x4d
add byte [rbp + 0x10], 1
add byte [rbp + 0x10], 0x38
xor byte [rbp + 0x10], 0x7c
sub byte [rbp + 0x10], 0x21
mov edx, 0x89d129e
xor edx, 0x1420f169
xor edx, 0x52958471
add edx, 0x2f1e473a
sub edx, 0x7ce7e029
add edx, 0x48f445ea
sub edx, 0x1deeb869
sub edx, 0x2b645c16
xchg rdi, rcx
mov rdi, rcx
xchg rcx, rdi
call fcn.14003ea80
test al, al
je case.0x14005a7c1.325238520
mov edx, 0x37ecf1bf
xor edx, 0x4def0104
xor edx, 0x42364e72
sub edx, 0x1db31b4d
add edx, 0x5e6d53b5
xor edx, 0x78eff733
xchg r9, rbx
mov rbx, r9
xchg r9, rbx
mov rcx, rdi
lea r8d, [rdx - 1]
call fcn.14003b6d0
test al, al
je case.0x14005a7c1.325238520
movzx eax, byte [rbp + 0x10]
xchg r13, rax
mov qword [rbx + 0x18], r13
xchg r13, rax
mov al, 0x62
sub al, 0xd
xor al, 0x55
add al, 0x64
xor al, 0x41
sub al, 5
sub al, 0x1f
mov byte [rbx + 0x20], 0x10
add byte [rbx + 0x20], 0x11
add byte [rbx + 0x20], 0x18
sub byte [rbx + 0x20], 0x15
add byte [rbx + 0x20], 0x3e
sub byte [rbx + 0x20], 0x55
sub byte [rbx + 0x20], 3
sub byte [rbx + 0x20], 9
mov rbx, qword [rsp + 0x40]
xchg rdi, r15
mov r15, qword [rsp + 0x48]
xchg r15, rdi
add rsp, 0x20
push rax
push rcx
xchg qword [rsp + 0x10], rbp
add rsp, 0x18
ret
lea r8, [rbp + 0x10]
mov byte [rbp + 0x10], 0x49
add byte [rbp + 0x10], 0x24
sub byte [rbp + 0x10], 0x40
xor byte [rbp + 0x10], 0xf
xor byte [rbp + 0x10], 0x72
sub byte [rbp + 0x10], 0x50
mov edx, 0x4dad745f
sub edx, 0xb2e2892
xor edx, 0x320ac32c
xor edx, 0x434899c5
add edx, 0x37b28b2e
sub edx, 0x4ec4a3cd
sub edx, 0x3563c16
sub edx, 0x18d4bc6d
xchg rdi, r10
mov rcx, r10
xchg rdi, r10
call fcn.14003ea80
test al, al
je case.0x14005a7c1.325238520
mov edx, 0x6b61feac
sub edx, 0x38865686
xor edx, 0x74725d3a
sub edx, 0x235b8fbb
sub edx, 0xf8bd28c
add edx, 0x33927c2d
sub edx, 0x47550f00
xchg rbx, r9
mov rbx, r9
xchg rbx, r9
mov r8d, edx
xchg rcx, rbx
mov rbx, rdi
xchg rbx, rcx
call fcn.14003b6d0
test al, al
je case.0x14005a7c1.325238520
movzx eax, byte [rbp + 0x10]
mov qword [rbx + 0x18], rax
mov al, 0x58
sub al, 0x39
xor al, 0x14
xor al, 0x17
add al, 0x27
add al, 4
add al, 0x13
add al, 8
xor al, 0x63
mov byte [rbx + 0x20], 1
xor byte [rbx + 0x20], 0x2f
add byte [rbx + 0x20], 1
sub byte [rbx + 0x20], 0xf
add byte [rbx + 0x20], 0x2a
xor byte [rbx + 0x20], 0x6c
sub byte [rbx + 0x20], 0x25
xchg rbx, r14
mov r14, qword [rsp + 0x40]
xchg r14, rbx
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
nop
xchg qword [rsp], rbp
add rsp, 8
ret
lea r8, [rbp + 0x10]
mov byte [rbp + 0x10], 0x29
sub byte [rbp + 0x10], 0x22
add byte [rbp + 0x10], 0x21
sub byte [rbp + 0x10], 0x17
add byte [rbp + 0x10], 0x16
xor byte [rbp + 0x10], 0x76
sub byte [rbp + 0x10], 0x51
xor byte [rbp + 0x10], 0x53
sub byte [rbp + 0x10], 0x53
mov edx, 0xa1268d4
xor edx, 0xbda62c2
xor edx, 0x712003e0
sub edx, 0x30bf760a
add edx, 0x14247074
sub edx, 0x4ced85d7
sub edx, 0x75f7e87
xchg rcx, r12
mov r12, rdi
xchg rcx, r12
call fcn.14003ea80
test al, al
je case.0x14005a7c1.325238520
mov edx, 0x5ff7d652
sub edx, 0x14c9798a
xor edx, 0x8623017
sub edx, 0x11d97a62
add edx, 0x28a1ddd9
sub edx, 0x40c2fe2e
sub edx, 0x1951d226
mov r9, rbx
xchg rcx, r13
mov r13, rdi
xchg rcx, r13
lea r8d, [rdx + 2]
call fcn.14003b6d0
test al, al
je case.0x14005a7c1.325238520
movzx eax, byte [rbp + 0x10]
xchg r15, rax
mov qword [rbx + 0x18], r15
xchg r15, rax
mov al, 0x46
sub al, 0x35
add al, 0x19
xor al, 0x13
xor al, 0x68
xor al, 0x50
mov byte [rbx + 0x20], 0xe
xor byte [rbx + 0x20], 0x18
xor byte [rbx + 0x20], 2
xor byte [rbx + 0x20], 0x20
sub byte [rbx + 0x20], 0xe
add byte [rbx + 0x20], 0x22
sub byte [rbx + 0x20], 0x47
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
nop
add rsp, 8
mov rbp, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
lea r8, [rbp + 0x10]
mov byte [rbp + 0x10], 0x75
sub byte [rbp + 0x10], 0x6a
add byte [rbp + 0x10], 0x3d
sub byte [rbp + 0x10], 7
add byte [rbp + 0x10], 0xe
sub byte [rbp + 0x10], 0xa
xor byte [rbp + 0x10], 0x45
mov edx, 0x29cbedba
add edx, 0xe464ba7
add edx, 0x1a688e31
xor edx, 0x5d15285b
add edx, 0x4d102d3
xor edx, 0x1440f29e
xchg rsi, rdi
mov rcx, rsi
xchg rdi, rsi
call fcn.14003ea80
test al, al
je case.0x14005a7c1.325238520
mov edx, 0x47b560db
sub edx, 0x38abaec1
add edx, 0x55dd7598
sub edx, 0x2497be7a
xor edx, 0x54186e35
xor edx, 0x1457070f
mov r9, rbx
xchg r14, rcx
mov r14, rdi
xchg r14, rcx
lea r8d, [rdx + 6]
call fcn.14003b6d0
test al, al
je case.0x14005a7c1.325238520
movzx eax, byte [rbp + 0x10]
xchg r11, rax
mov qword [rbx + 0x18], r11
xchg r11, rax
mov al, 0x51
add al, 0x21
sub al, 0x12
sub al, 0xe
xor al, 4
xor al, 4
sub al, 0x51
mov byte [rbx + 0x20], 0x6f
xor byte [rbx + 0x20], 0x5a
sub byte [rbx + 0x20], 0x12
add byte [rbx + 0x20], 0x23
xor byte [rbx + 0x20], 0x77
add byte [rbx + 0x20], 0x1d
xor byte [rbx + 0x20], 0x4f
xchg r9, rbx
mov r9, qword [rsp + 0x40]
xchg rbx, r9
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
push rcx
push rdx
push rcx
push rbx
xchg qword [rsp + 0x20], rbp
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]
lea r8, [rbp + 0x10]
mov byte [rbp + 0x10], SHCreateMemStream
xor byte [rbp + 0x10], 0xa
xor byte [rbp + 0x10], 0x56
sub byte [rbp + 0x10], 0x33
add byte [rbp + 0x10], 0x17
sub byte [rbp + 0x10], 0x25
xor byte [rbp + 0x10], 0x16
mov edx, 0x28374376
add edx, 0xee2c8ec
sub edx, 0x1840fc90
xor edx, 0x3ddd2729
add edx, 0x4395fd12
xor edx, 0x63ab2efc
sub edx, 0x53108ef
mov rcx, rdi
call fcn.14003ea80
test al, al
je case.0x14005a7c1.325238520
mov edx, 0x13319ec7
add edx, 0x652060b4
sub edx, 0x71804d0e
add edx, 0x71844a84
sub edx, 0x5eddcb8d
add edx, 0x2a3b8c41
add edx, 0x287e2479
sub edx, 0x6c31e21c
mov r9, rbx
mov rcx, rdi
lea r8d, [rdx + 0xe]
call fcn.14003b6d0
test al, al
je case.0x14005a7c1.325238520
movzx eax, byte [rbp + 0x10]
xchg r9, rax
mov qword [rbx + 0x18], r9
xchg r9, rax
mov al, 0x30
add al, 0x2e
sub al, 0x23
add al, 7
xor al, 0x76
sub al, 0x34
add al, 0x5d
xor al, 0x5c
mov byte [rbx + 0x20], 0x19
xor byte [rbx + 0x20], 0x2f
xor byte [rbx + 0x20], 0x50
sub byte [rbx + 0x20], 0x38
xor byte [rbx + 0x20], 0x24
sub byte [rbx + 0x20], 9
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
nop
add rsp, 8
mov rbp, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
mov rbx, qword [rsp + 0x40]
xor al, al
xchg rdi, r11
mov r11, qword [rsp + 0x48]
xchg rdi, r11
add rsp, 0x20
nop
mov rbp, qword [rsp]
add rsp, 8
ret