Function at 0x1400721d0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x88
mov rsi, rdx
mov r13, rcx
xor edi, edi
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rdi
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400725fe
movsxd r15, dword [rdx + 0x3c]
add r15, rdx
cmp dword [r15], 0x4550
jne 0x1400725fe
mov eax, 0x20b
cmp word [r15 + 0x18], ax
jne 0x1400725fe
mov ebx, dword [r15 + 0x50]
mov edx, ebx
xor ecx, ecx
lea r9d, [rdi + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r14, rax
test rax, rax
je 0x1400725fe
movzx ecx, word [r15 + 0x14]
mov eax, dword [rcx + r15 + 0x24]
mov dword [rbp + 0x6f], eax
sub ebx, eax
mov qword [rbp + 0x5f], rdi
mov eax, ebx
mov qword [rbp + 0x57], rax
lea r8, [rbp + 0x5f]
mov edx, ebx
mov rcx, r13
call fcn.140071df0
mov r12, rax
mov qword [rbp - 0x41], rax
mov rcx, r14
test rax, rax
jne 0x1400722a6
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400725fe
mov r8d, dword [r15 + 0x54]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r15 + 0x14]
add rbx, 0x24
xor ecx, ecx
cmp cx, word [r15 + 6]
jae 0x1400722f5
add rbx, r15
test dword [rbx + 0x18], 0x80
ja 0x1400722e4
mov ecx, dword [rbx]
add rcx, r14
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
inc edi
add rbx, 0x28
movzx eax, word [r15 + 6]
cmp edi, eax
jl 0x1400722c7
xor ecx, ecx
mov qword [rbp + 0x8f], r12
mov eax, dword [rbp + 0x6f]
sub r12, rax
mov qword [rbp + 0x67], r12
mov rsi, r12
sub rsi, qword [r15 + 0x30]
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x14007248d
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x14007248d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x31], xmm0
mov r12, rcx
mov qword [rbp - 0x21], rcx
mov ecx, dword [rax + r14 + 0xb0]
test ecx, ecx
jne 0x14007234e
jmp 0x140072489
lea rbx, [r14 + rcx]
mov edi, dword [rax + r14 + 0xb4]
add rdi, rbx
mov r10, qword [rbp - 0x29]
cmp rbx, rdi
jae 0x1400723cd
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x1400723cd
mov eax, dword [rbx]
add rax, r14
mov qword [rbp - 0x19], rax
lea rax, [rbx + 8]
mov qword [rbp - 0x11], rax
lea rax, [rcx - 8]
shr rax, 1
mov dword [rbp - 9], eax
cmp r10, r12
je 0x1400723aa
movups xmm0, xmmword [rbp - 0x19]
movups xmmword [r10], xmm0
movsd xmm1, qword [rbp - 9]
movsd qword [r10 + 0x10], xmm1
add r10, 0x18
mov qword [rbp - 0x29], r10
jmp 0x1400723c2
lea r8, [rbp - 0x19]
mov rdx, r10
lea rcx, [rbp - 0x31]
call fcn.140073850
mov r12, qword [rbp - 0x21]
mov r10, qword [rbp - 0x29]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rdi
jb 0x140072366
mov r11, qword [rbp - 0x31]
cmp r11, r10
je 0x14007242e
lea r8, [r11 + 0x10]
mov ebx, 0xf000
mov edi, 0xa000
xor r13d, r13d
mov edx, r13d
cmp dword [r8], edx
jbe 0x14007241d
nop
mov ecx, edx
mov rax, qword [r8 - 8]
movzx r9d, word [rax + rcx*2]
movzx eax, r9w
and ax, bx
cmp ax, di
jne 0x140072416
and r9d, 0xfff
mov rax, qword [r8 - 0x10]
add qword [r9 + rax], rsi
inc edx
cmp edx, dword [r8]
jb 0x1400723f0
add r8, 0x18
lea rax, [r8 - 0x10]
cmp rax, r10
jne 0x1400723e7
mov r13, qword [rbp + 0x4f]
test r11, r11
je 0x140072489
sub r12, r11
movabs rax, 0x2aaaaaaaaaaaaaab
imul r12
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r11
cmp rdx, 0x1000
jb 0x140072481
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140072481
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r11
call fcn.140139edc
mov r12, qword [rbp + 0x67]
mov ecx, 0x5a4d
cmp word [r14], cx
jne 0x1400725fe
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x1400725fe
mov ecx, dword [rax + r14 + 0xd8]
test ecx, ecx
je 0x14007250a
mov rdi, qword [rcx + r14 + 0x58]
test rdi, rdi
je 0x14007250a
mov rax, r14
sub rax, r12
add rdi, rax
movabs rsi, 0x2b992ddfa232
cmp qword [rdi], rsi
jne 0x1400725fe
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
xor rax, rbx
xor rax, rsi
movabs rcx, 0x2b992ddfa233
cmp rax, rsi
cmove rax, rcx
mov qword [rdi], rax
mov rdx, r14
lea rcx, [rbp - 0x19]
call fcn.1400732c0
mov rdx, rax
mov rcx, r13
call fcn.140072620
mov rbx, qword [rbp + 0x5f]
test al, al
je 0x1400725c0
mov r8d, dword [rbp + 0x6f]
add r8, r14
mov r9, qword [rbp + 0x57]
mov rsi, qword [rbp + 0x8f]
mov rdx, rsi
mov rcx, r13
call fcn.14006be00
test al, al
je 0x1400725c0
mov edi, dword [r15 + 0x28]
add rdi, r12
mov qword [rsp + 0x20], rbx
mov r9, qword [rbp + 0x57]
mov r8, rsi
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x49]
call fcn.14002e280
test al, al
je 0x1400725c0
mov dword [rbp + 0x6f], 0
mov rax, qword [rbp - 0x51]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x49]
mov r8, rdi
lea rdx, [rbp + 0x6f]
mov rcx, r13
call fcn.1400729d0
test al, al
je 0x1400725c0
mov rdx, qword [rbp + 0x97]
test rdx, rdx
je 0x1400725aa
mov ecx, dword [rbp + 0x6f]
mov dword [rdx], ecx
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rsi
jmp 0x140072600
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8, rbx
mov rdx, qword [rbp - 0x41]
mov rcx, r13
call fcn.14006c030
test al, al
je 0x1400725fe
mov rdx, rbx
mov rcx, r13
call fcn.14006c160
test al, al
je 0x1400725fe
mov rdx, rbx
mov rcx, r13
call fcn.14006c280
xor eax, eax
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret