Function at 0x140036cc0
Capabilities:
Parse pe header

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x60], 0xfffffffffffffffe
mov dword [rbp + 0x1c], edx
mov ebx, ecx
lea rax, [0x140302168]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 0xc
lea rax, [0x140302174]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 0xc
lea rax, [0x140302180]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 0xa
lea rax, [0x14030218a]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 9
xor r12d, r12d
lea rdi, [rbp - 0x18]
mov r13, qword [sym.imp.kernel32.dll_LoadLibraryA]
xor esi, esi
nop word cs:[rax + rax]
cmp rsi, 0x40
je 0x140036e7e
mov r14, qword [rbp + rsi - 0x58]
mov r15, qword [rbp + rsi - 0x50]
mov rcx, rdi
mov rdx, r14
mov r8, r15
call fcn.1402dac10
cmp r12, qword [rbp - 0x18]
jno 0x140036f85
mov rcx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rcx
call r13
test rax, rax
jne 0x140036daa
call fcn.14027f3b0
test edx, edx
jne 0x140036fbf
test rax, rax
je 0x140036e56
test r15, r15
je 0x140036e50
add r15, r14
xor ecx, ecx
jmp 0x140036dd1
inc r14
rol ecx, 0x13
add ecx, edx
cmp r14, r15
je 0x140036e52
movzx r9d, byte [r14]
movzx edx, r9b
test dl, dl
jns 0x140036dc0
mov r8d, edx
and r8d, 0x1f
movzx r10d, byte [r14 + 1]
and r10d, 0x3f
cmp dl, 0xdf
jbe 0x140036e2a
movzx edx, byte [r14 + 2]
shl r10d, 6
and edx, 0x3f
or edx, r10d
cmp r9b, 0xf0
jb 0x140036e3a
movzx r9d, byte [r14 + 3]
add r14, 4
and r8d, 7
shl r8d, 0x12
shl edx, 6
and r9d, 0x3f
or r9d, edx
or r9d, r8d
mov edx, r9d
jmp 0x140036dc3
add r14, 2
shl r8d, 6
or r8d, r10d
mov edx, r8d
jmp 0x140036dc3
add r14, 3
shl r8d, 0xc
or edx, r8d
jmp 0x140036dc3
xor ecx, ecx
cmp ecx, ebx
je 0x140036e8a
add rsi, 0x10
mov rcx, qword [rbp + 0x10]
mov byte [rcx], 0
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x140036d50
mov r8d, 1
call fcn.140061f30
jmp 0x140036d50
lea rax, str.Error_loading_the_module._n
jmp 0x140036f0f
mov rcx, qword [rbp + 0x10]
mov byte [rcx], 0
mov rdx, qword [rbp + 8]
test rdx, rdx
je 0x140036eab
mov r8d, 1
mov rsi, rax
call fcn.140061f30
mov rax, rsi
cmp word [rax], 0x5a4d
jne 0x140036ee1
movsxd rcx, dword [rax + 0x3c]
movzx edx, word [rax + rcx + 0x18]
mov word [rbp + 0x5e], dx
cmp edx, 0x10b
je 0x140036eea
cmp edx, 0x20b
jne 0x140036f49
cmp dword [rax + rcx], 0x4550
jne 0x140036f08
mov edx, dword [rax + rcx + 0x88]
jmp 0x140036ef7
lea rax, str.x_0_
jmp 0x140036f0f
cmp dword [rax + rcx], 0x4550
jne 0x140036f08
mov edx, dword [rax + rcx + 0x78]
add rdx, rax
mov rcx, rax
mov r8d, dword [rbp + 0x1c]
call fcn.1400370d0
jmp 0x140036f35
lea rax, str.Invalid_NT_header._n
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 1
mov qword [rbp + 0x30], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
lea rcx, [rbp + 0x20]
call fcn.1402bbef0
xor eax, eax
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rax, [rbp + 0x5e]
mov qword [rbp - 0x18], rax
lea rax, [fcn.1402e85f0]
mov qword [rbp - 0x10], rax
lea rax, str.Unknown_Optional_Header_magic:__n8_0_
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 2
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], 1
jmp 0x140036f2a
movups xmm0, xmmword [rbp - 0x18]
movups xmm1, xmmword [rbp - 8]
movaps xmmword [rbp + 0x30], xmm1
movaps xmmword [rbp + 0x20], xmm0
lea rax, [0x140302198]
mov qword [rsp + 0x20], rax
lea rcx, [0x140301f48]
lea r9, [0x140301f98]
lea r8, [rbp + 0x20]
mov edx, 0x2b
call fcn.1402fb720
jmp 0x140036fee
mov qword [rbp + 0x20], rax
mov dword [rbp + 0x28], edx
lea rax, [0x1403021c8]
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to_load_library
lea r9, [0x140301f08]
lea r8, [rbp + 0x20]
mov edx, 0x16
call fcn.1402fb720
ud2