Function at 0x140002d90
Capabilities:
Parse pe header

Disassembly:
push rbp
push rbx
push rsi
push r12
push r14
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov r14, r8
mov r12, rdx
mov rsi, rcx
test rdx, rdx
je 0x140003117
xor eax, eax
lea rcx, [rbp - 0x40]
xor edx, edx
mov qword [rbp - 0x80], rax
mov r8d, 0x108
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
call fcn.140012f60
xor ebx, ebx
mov qword [rsp + 0x40], 0x33
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x40]
lea rax, [rbp + 0x118]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x30], rax
lea r9d, [rbx + 0x28]
mov dword [rsp + 0x28], ebx
mov edx, 0x80862007
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], 0x40
mov dword [rbp + 0x118], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140003117
mov eax, 0x5a4d
cmp word [rbp - 0x80], ax
jne 0x140003117
movsxd rax, dword [rbp - 0x44]
add rax, r12
je 0x140003117
mov qword [rsp + 0x50], rax
lea r9d, [rbx + 0x28]
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x40]
lea rax, [rbp + 0x118]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x30], rax
mov edx, 0x80862007
mov dword [rsp + 0x28], ebx
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x40], 0x33
mov qword [rsp + 0x60], 0x108
mov dword [rbp + 0x118], ebx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140003117
cmp dword [rbp - 0x40], 0x4550
jne 0x140003117
mov ebx, dword [rbp + 0x48]
test ebx, ebx
je 0x140003117
mov eax, dword [rbp + 0x4c]
test eax, eax
je 0x140003117
mov qword [rsp + 0x210], rdi
mov r9d, 4
mov qword [rsp + 0x1d0], r15
mov r8d, 0x3000
mov edx, eax
mov qword [rsp + 0x78], rax
xor ecx, ecx
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r9d, r15d
mov qword [rsp + 0x70], rbx
mov rdi, rax
mov rcx, rsi
lea rax, [rbx + r12]
mov r8, rdi
mov rdx, rax
mov qword [rsp + 0x68], rax
call fcn.1400027d0
test al, al
jne 0x140002f61
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140003057
mov eax, dword [rdi + 0x24]
mov r15, rdi
sub r15, rbx
mov qword [rsp + 0x1d8], r13
mov r13d, dword [rdi + 0x20]
add rax, r15
mov qword [rbp + 0x118], rax
add r13, r15
mov eax, dword [rdi + 0x1c]
xor ebx, ebx
add rax, r15
mov qword [rbp + 0x128], rax
cmp dword [rdi + 0x18], ebx
jbe 0x14000303c
nop dword [rax + rax]
mov edx, dword [r13 + rbx*4]
lea rcx, [rsp + 0x40]
add rdx, r15
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
call fcn.140006d70
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x140002fd6
mov rdx, qword [r14]
cmp qword [rsp + 0x58], 0x10
lea rcx, [rsp + 0x40]
cmovae rcx, qword [rsp + 0x40]
call fcn.14001608c
test eax, eax
je 0x140003076
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140003031
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000302c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003128
call fcn.140010d2c
inc ebx
cmp ebx, dword [rdi + 0x18]
jb 0x140002fa0
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov r13, qword [rsp + 0x1d8]
mov rdi, qword [rsp + 0x210]
mov r15, qword [rsp + 0x1d0]
add rsp, 0x1e0
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rbp + 0x118]
mov rcx, qword [rbp + 0x128]
movzx eax, word [rax + rbx*2]
mov ecx, dword [rcx + rax*4]
cmp ecx, 0x1000
jbe 0x1400030c1
lea rbx, [r12 + rcx]
cmp rbx, qword [rsp + 0x68]
jb 0x140003104
mov rax, qword [rsp + 0x70]
add rax, qword [rsp + 0x78]
add rax, r12
cmp rbx, rax
ja 0x140003104
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ebx, ebx
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400030fc
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030f7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003128
call fcn.140010d2c
mov rax, rbx
jmp 0x14000304f
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1400030c3
xor eax, eax
add rsp, 0x1e0
pop r14
pop r12
pop rsi
pop rbx
pop rbp
ret
call fcn.140016bd0
int3