Function at 0x140001310
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r13
sub rsp, 0x30
mov eax, 0x5a4d
cmp word [0x140066350], ax
jne 0x1400016b8
movsxd rsi, dword [0x14006638c]
lea rdi, [0x140066350]
add rsi, rdi
cmp dword [rsi], 0x4550
jne 0x1400016b8
mov edx, dword [rsi + 0x50]
mov r9d, 4
mov rcx, qword [rsi + 0x30]
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
test rax, rax
jne 0x14000138e
mov edx, dword [rsi + 0x50]
lea r9d, [rax + 4]
xor ecx, ecx
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
test rax, rax
je 0x1400016b8
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x20]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r14d, r14d
mov r8d, 0x1000
mov rcx, r13
mov r15, rax
mov qword [rax + 8], r13
mov qword [rax + 0x18], r14
lea r9d, [r14 + 4]
mov qword [rax + 0x10], r14
mov edx, dword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [rsi + 0x54]
lea r9d, [r14 + 4]
mov r8d, 0x1000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsi + 0x54]
mov rdx, rdi
add r8d, dword [0x14006638c]
mov rcx, rax
mov rbx, rax
call fcn.140004660
movsxd rax, dword [0x14006638c]
mov ebp, r14d
add rax, rbx
mov qword [r15], rax
mov qword [rax + 0x30], r13
mov rcx, qword [r15]
mov r12, qword [r15 + 8]
movzx edi, word [rcx + 0x14]
add rdi, 0x28
cmp r14w, word [rcx + 6]
jae 0x1400014d8
add rdi, rcx
lea r14, [0x140066350]
nop dword [rax + rax]
mov eax, dword [rdi]
test eax, eax
jne 0x14000148e
movsxd rax, dword [rsi + 0x38]
test eax, eax
jle 0x1400014c0
mov ecx, dword [rdi - 4]
mov r9d, 4
add rcx, r12
mov r8d, 0x1000
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov dword [rdi - 8], eax
call fcn.140008260
jmp 0x1400014c0
mov ecx, dword [rdi - 4]
mov rdx, rax
add rcx, r12
mov r9d, 4
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [rdi + 4]
mov rcx, rax
mov r8d, dword [rdi]
add rdx, r14
mov rbx, rax
call fcn.140004660
mov dword [rdi - 8], ebx
mov rcx, qword [r15]
inc ebp
add rdi, 0x28
movzx eax, word [rcx + 6]
cmp ebp, eax
jl 0x140001450
xor r14d, r14d
mov r12, qword [rsp + 0x68]
mov rbx, r13
mov rbp, qword [rsp + 0x60]
sub rbx, qword [rsi + 0x30]
je 0x140001579
cmp dword [rcx + 0xb4], 0
jbe 0x140001579
mov rdi, qword [r15 + 8]
mov r10d, dword [rcx + 0xb0]
add r10, rdi
mov eax, dword [r10]
test eax, eax
je 0x140001579
mov r11d, dword [r10 + 4]
lea rdx, [r10 + 8]
mov r9d, eax
mov r8d, r14d
add r9, rdi
lea rax, [r11 - 8]
test rax, 0xfffffffffffffffe
jbe 0x14000156c
nop
movzx eax, word [rdx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x14000154e
cmp eax, 0xa
jne 0x140001552
add qword [rcx + r9], rbx
jmp 0x140001552
add dword [rcx + r9], ebx
mov r11d, dword [r10 + 4]
inc r8d
add rdx, 2
mov eax, r8d
lea rcx, [r11 - 8]
shr rcx, 1
cmp rax, rcx
jb 0x140001530
mov eax, r11d
add r10, rax
mov eax, dword [r10]
test eax, eax
jne 0x140001511
mov rcx, r15
call fcn.140001180
test eax, eax
je 0x1400016ac
mov r10, qword [r15]
movabs rax, 0xffffffff00000000
movzx ebx, word [r10 + 0x14]
mov rdi, qword [r10 + 0x30]
add rbx, 0x28
and rdi, rax
cmp r14w, word [r10 + 6]
jae 0x14000166c
add rbx, r10
lea rsi, [0x14004ee18]
nop dword [rax + rax]
mov r9d, dword [rbx + 0x14]
mov r8d, dword [rbx]
bt r9d, 0x19
jae 0x1400015e5
mov ecx, dword [rbx - 8]
mov edx, r8d
or rcx, rdi
mov r8d, 0x4000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140001654
mov rcx, r9
mov rax, r9
shr rax, 0x1e
and eax, 1
shr rcx, 0x1d
and ecx, 1
lea rcx, [rax + rcx*2]
mov rax, r9
shr rax, 0x1f
lea rcx, [rax + rcx*2]
mov eax, r9d
mov r11d, dword [rsi + rcx*4]
bts r11d, 9
and eax, 0x4000000
cmove r11d, dword [rsi + rcx*4]
test r8d, r8d
jne 0x14000163d
test r9b, 0x40
je 0x14000162f
mov r8d, dword [r10 + 0x20]
jmp 0x140001638
test r9b, r9b
jns 0x140001654
mov r8d, dword [r10 + 0x24]
test r8d, r8d
je 0x140001654
mov ecx, dword [rbx - 8]
lea r9, [rsp + 0x50]
mov edx, r8d
or rcx, rdi
mov r8d, r11d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r10, qword [r15]
inc r14d
add rbx, 0x28
movzx eax, word [r10 + 6]
cmp r14d, eax
jl 0x1400015c0
mov eax, dword [r10 + 0x28]
test eax, eax
je 0x140001691
add rax, r13
je 0x1400016ac
xor r8d, r8d
mov rcx, r13
lea edx, [r8 + 1]
call rax
test eax, eax
je 0x1400016ac
mov dword [r15 + 0x1c], 1
mov rax, r15
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret
mov rcx, r15
call fcn.1400016d0
xor eax, eax
jmp 0x140001694
xor eax, eax
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret