Function at 0x6e0770
Capabilities:
Parse pe header

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x2e0
mov rbp, rsp
mov rbx, rcx
mov qword [rbp + 0x38], rdx
mov rsi, r8
xor rax, rax
mov qword [rbp + 0x30], rax
mov rcx, rbx
mov rdx, qword [rbp + 0x38]
lea r8, [rbp + 0x290]
mov r9d, 0x40
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
call qword [0x009bae38]
test eax, eax
setne al
test al, al
je 0x6e0aa3
cmp word [rbp + 0x290], 0x5a4d
jne 0x6e0aa3
cmp qword [0x009bae18], 0
je 0x6e0804
mov rcx, rbx
lea rdx, [rbp + 0x44]
call sub.kernel32.dll_IsWow64Process
test eax, eax
setne al
test al, al
jne 0x6e07fc
mov dword [rbp + 0x44], 0
jmp 0x6e080b
mov eax, dword [rbp + 0x44]
mov dword [rbp + 0x44], eax
jmp 0x6e080b
mov dword [rbp + 0x44], 0
cmp dword [rbp + 0x44], 0
setne al
cmp al, 1
jne 0x6e0884
mov rcx, rbx
movsxd rax, dword [rbp + 0x2cc]
mov rdx, qword [rbp + 0x38]
add rdx, rax
lea r8, [rbp + 0x198]
mov r9d, 0xf8
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
call qword [0x009bae38]
test eax, eax
setne al
test al, al
je 0x6e0aa3
cmp dword [rbp + 0x198], 0x4550
jne 0x6e0aa3
cmp word [rbp + 0x19c], 0x14c
jne 0x6e0aa3
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0x2d8], rax
jmp 0x6e08ee
mov rcx, rbx
movsxd rax, dword [rbp + 0x2cc]
mov rdx, qword [rbp + 0x38]
add rdx, rax
lea r8, [rbp + 0x48]
mov r9d, 0x108
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
call qword [0x009bae38]
test eax, eax
setne al
test al, al
je 0x6e0aa3
cmp dword [rbp + 0x48], 0x4550
jne 0x6e0aa3
cmp word [rbp + 0x4c], 0x8664
je 0x6e08e0
cmp word [rbp + 0x4c], 0x200
jne 0x6e0aa3
mov rax, qword [rbp + 0xd0]
mov qword [rbp + 0x2d8], rax
cmp dword [rbp + 0x2d8], 0
je 0x6e0aa3
cmp dword [rbp + 0x2dc], 0
je 0x6e0aa3
mov rcx, rbx
mov eax, dword [rbp + 0x2d8]
mov rdx, qword [rbp + 0x38]
add rdx, rax
lea r8, [rbp + 0x170]
mov r9d, 0x28
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
call qword [0x009bae38]
test eax, eax
setne al
test al, al
je 0x6e0aa3
xor rdi, rdi
mov r13d, dword [rbp + 0x188]
cmp edi, r13d
jg 0x6e0aa2
add r13d, 1
mov rcx, rbx
mov eax, dword [rbp + 0x190]
mov rdx, qword [rbp + 0x38]
add rdx, rax
mov eax, edi
add eax, eax
add eax, eax
movsxd rax, eax
add rdx, rax
lea r8, [rbp + 0x154]
mov r9d, 4
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
call qword [0x009bae38]
test eax, eax
setne al
test al, al
je 0x6e0aa3
mov rcx, rbx
mov eax, dword [rbp + 0x154]
mov rdx, qword [rbp + 0x38]
add rdx, rax
lea r8, [rbp + 0x15b]
mov r9d, 0x15
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
call qword [0x009bae38]
test eax, eax
setne al
test al, al
je 0x6e0aa3
lea rcx, [rbp + 0x15b]
mov rdx, rsi
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x6e0a96
mov rcx, rbx
mov eax, dword [rbp + 0x194]
mov rdx, qword [rbp + 0x38]
add rdx, rax
add edi, edi
movsxd rdi, edi
add rdx, rdi
lea r8, [rbp + 0x158]
mov r9d, 2
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
call qword [0x009bae38]
test eax, eax
setne al
test al, al
je 0x6e0aa3
mov rcx, rbx
mov eax, dword [rbp + 0x18c]
mov rdx, qword [rbp + 0x38]
add rdx, rax
movzx eax, word [rbp + 0x158]
add eax, eax
add eax, eax
mov eax, eax
add rdx, rax
lea r8, [rbp + 0x150]
mov r9d, 4
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
call qword [0x009bae38]
test eax, eax
setne al
test al, al
je 0x6e0aa3
mov eax, dword [rbp + 0x150]
mov rcx, qword [rbp + 0x38]
add rcx, rax
mov qword [rbp + 0x30], rcx
jmp 0x6e0aa3
add edi, 1
cmp edi, r13d
jne 0x6e095c
nop
mov rax, qword [rbp + 0x30]
lea rsp, [rbp + 0x2e0]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret