Function at 0x14013f472
Capabilities:
Parse pe header

Disassembly:
push rax
pushf
mov eax, 0xc35ab0d8
pushf
not eax
add eax, 0xcec6fd08
xor eax, 0xc3314836
rol eax, 0x15
popf
pushf
not eax
add eax, 0xaa10a8db
xor eax, 0xa9d663fc
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xb56708d6
xor eax, 0xd5273004
rol eax, 0x1e
popf
cmp eax, 4
jne 0x14013f4c2
popf
pop rax
jmp 0x14013f84a
cmp eax, 0
jne 0x14013f4d1
popf
pop rax
jmp 0x14013f60c
cmp eax, 3
jne 0x14013f4e0
popf
pop rax
jmp 0x14013f810
cmp eax, 1
jne 0x14013f4ef
popf
pop rax
jmp 0x14013f6f7
cmp eax, 0xd
jne 0x14013f4fe
popf
pop rax
jmp 0x14013fd20
cmp eax, 7
jne 0x14013f50d
popf
pop rax
jmp 0x14013fa2c
cmp eax, 0xe
jne 0x14013f51c
popf
pop rax
jmp 0x14013fdb1
cmp eax, 0xb
jne 0x14013f52b
popf
pop rax
jmp 0x14013fc77
cmp eax, 0xc
jne 0x14013f53a
popf
pop rax
jmp 0x14013fcd6
cmp eax, 8
jne 0x14013f549
popf
pop rax
jmp 0x14013faeb
cmp eax, 0x10
jne 0x14013f558
popf
pop rax
jmp 0x14013fef8
cmp eax, 2
jne 0x14013f567
popf
pop rax
jmp 0x14013f731
cmp eax, 9
jne 0x14013f576
popf
pop rax
jmp 0x14013fb8d
cmp eax, 0x12
jne 0x14013f585
popf
pop rax
jmp 0x14013fff9
cmp eax, 6
jne 0x14013f594
popf
pop rax
jmp 0x14013f9bd
cmp eax, 0x11
jne 0x14013f5a3
popf
pop rax
jmp 0x14013ff53
cmp eax, 5
jne 0x14013f5b2
popf
pop rax
jmp 0x14013f902
cmp eax, 0x16
jne 0x14013f5c1
popf
pop rax
jmp 0x140140166
cmp eax, 0xa
jne 0x14013f5d0
popf
pop rax
jmp 0x14013fbf1
cmp eax, 0x14
jne 0x14013f5df
popf
pop rax
jmp 0x1401400b6
cmp eax, 0xf
jne 0x14013f5ee
popf
pop rax
jmp 0x14013fe94
cmp eax, 0x13
jne 0x14013f5fd
popf
pop rax
jmp 0x14014006b
cmp eax, 0x15
jne 0x14013f60c
popf
pop rax
jmp 0x14014015b
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], rdi
mov rax, qword [0x140030040]
xor rax, rbp
mov qword [rbp + 0x28], rax
mov r13d, edx
mov r15d, r9d
mov rdx, rcx
mov r12, r8
lea rcx, [rbp + 8]
call fcn.14018669f
mov edi, dword [rbp + 0x88]
test edi, edi
jne 0x14013f6b1
push rax
pushf
mov eax, 0x271b5240
pushf
not eax
add eax, 0xae0b2827
xor eax, 0xa31fc560
rol eax, 0x37
popf
pushf
not eax
add eax, 0xaa6e198d
xor eax, 0xf6cbbf6e
rol eax, 0x82
popf
pushf
not eax
add eax, 0xfaed399c
xor eax, 0x9dfd4c50
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xde72019b
xor eax, 0xb51a0f79
rol eax, 0xf9
popf
jmp 0x14013f4b3
push rax
pushf
mov eax, 0xbb7a9912
pushf
not eax
add eax, 0x9bc32e2a
xor eax, 0x877da7da
rol eax, 8
popf
pushf
not eax
add eax, 0x9eb03180
xor eax, 0xcbaa2a39
rol eax, 0x71
popf
pushf
not eax
add eax, 0x99b08a92
xor eax, 0xfd4d44e3
rol eax, 0x8c
popf
jmp 0x14013f4b3
mov rax, qword [rbp + 0x10]
mov edi, dword [rax + 0xc]
push rax
pushf
mov eax, 0xc4acbbd5
pushf
not eax
add eax, 0x8cb5d4f4
xor eax, 0xa6e6575e
rol eax, 0xf4
popf
pushf
not eax
add eax, 0xaa8c9617
xor eax, 0xc684a722
rol eax, 0x91
popf
jmp 0x14013f4b3
neg dword [rbp + 0x90]
mov r9d, r15d
mov r8, r12
mov ecx, edi
sbb edx, edx
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
and edx, 8
jmp 0x14013f750
inc edx
call fcn.14011a19e
movsxd r14, eax
test eax, eax
jne 0x14013f7b7
push rax
pushf
mov eax, 0x529c8df3
pushf
not eax
add eax, 0xa249a68b
xor eax, 0xa915186a
rol eax, 0x25
popf
pushf
not eax
add eax, 0x996769d6
xor eax, 0xd14736e2
rol eax, 0x5b
popf
pushf
not eax
add eax, 0x8fae27cd
xor eax, 0xcb5f9705
rol eax, 0x87
popf
pushf
not eax
add eax, 0xae0d2cce
xor eax, 0x88b2a48f
rol eax, 0xf5
popf
jmp 0x14013f4b3
push rax
pushf
mov eax, 0x552b6ac3
pushf
not eax
add eax, 0xfcebea58
xor eax, 0xafde1c8e
rol eax, 0x90
popf
pushf
not eax
add eax, 0xfa4ef94f
xor eax, 0xf3e42645
rol eax, 0x15
popf
pushf
not eax
add eax, 0x8547eedc
xor eax, 0xece6f366
rol eax, 0x92
popf
pushf
not eax
add eax, 0x9da82524
xor eax, 0xf70a3b2d
rol eax, 7
popf
jmp 0x14013f4b3
xor edi, edi
jmp 0x1401400b6
mov rsi, r14
add rsi, rsi
lea rax, [rsi + 0x10]
cmp rsi, rax
sbb rcx, rcx
and rcx, rax
je 0x14013f8a9
push rax
pushf
mov eax, 0x95417d61
pushf
not eax
add eax, 0x8ddb4eba
xor eax, 0xaf4c0905
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xff74eb98
xor eax, 0xeaaed843
rol eax, 0x2c
popf
pushf
not eax
add eax, 0x92975fcd
xor eax, 0xddf809c1
rol eax, 0x6d
popf
jmp 0x14013f4b3
push rax
pushf
mov eax, 0x8fea7508
pushf
not eax
add eax, 0xdbb8f76e
xor eax, 0xa92e1807
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xa5ca9f39
xor eax, 0xf1f37e1f
rol eax, 8
popf
pushf
not eax
add eax, 0x96d91c0d
xor eax, 0x8f1ec0c6
rol eax, 0x14
popf
pushf
not eax
add eax, 0xc0e8fdf7
xor eax, 0xbdcb4e33
rol eax, 0xaf
popf
jmp 0x14013f4b3
cmp rcx, 0x400
ja 0x14013f964
push rax
pushf
mov eax, 0x2fbc0785
pushf
not eax
add eax, 0x86f8c8fc
xor eax, 0xa24ff4ed
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xd81526f2
xor eax, 0xbc061a1c
rol eax, 0xfb
popf
pushf
not eax
add eax, 0xe53a646f
xor eax, 0xfd446069
rol eax, 0x84
popf
pushf
not eax
add eax, 0xbe744cf4
xor eax, 0xf7309fb6
rol eax, 0x80
popf
jmp 0x14013f4b3
push rax
pushf
mov eax, 0xf9e9dd77
pushf
not eax
add eax, 0x92cb3fbb
xor eax, 0x90f13740
rol eax, 0xd9
popf
pushf
not eax
add eax, 0x9c0410c3
xor eax, 0xd4f873d9
rol eax, 0x75
popf
pushf
not eax
add eax, 0x821744f3
xor eax, 0x8b7b7d83
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xe27f23d8
xor eax, 0xca557df7
rol eax, 0xb4
popf
jmp 0x14013f4b3
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x14013f9f9
push rax
pushf
mov eax, 0xdcb8ecf4
pushf
not eax
add eax, 0xbbfe7f2e
xor eax, 0xf4fad143
rol eax, 0xb3
popf
pushf
not eax
add eax, 0xc31ab995
xor eax, 0xbb495b9a
rol eax, 0xc6
popf
jmp 0x14013f4b3
push rax
pushf
mov eax, 0x3a0cd834
pushf
not eax
add eax, 0xe395aba3
xor eax, 0x88e8afb7
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xe0ae65bd
xor eax, 0xd5aafef3
rol eax, 0x34
popf
jmp 0x14013f4b3
movabs rax, 0x737ffae57e2eb352
pushf
not rax
add rax, 0x7172c510
xor rax, 0x41546eab
rol rax, 0x43
popf
pushf
not rax
add rax, 0x565d50a0
xor rax, 0x78f58d15
rol rax, 0x6f
popf
pushf
not rax
add rax, 0x5b95f547
xor rax, 0x70076eec
rol rax, 0x99
popf
pushf
not rax
add rax, 0x73fcaf1b
xor rax, 0x45285249
rol rax, 0x98
popf
push rax
pushf
mov eax, 0xa7a08a54
pushf
not eax
add eax, 0xb69b19db
xor eax, 0xce4d1a82
rol eax, 0x3e
popf
pushf
not eax
add eax, 0x8568d079
xor eax, 0xd58d7346
rol eax, 0xb4
popf
pushf
not eax
add eax, 0xa3e535d0
xor eax, 0x890c8262
rol eax, 0x98
popf
pushf
not eax
add eax, 0xc2b2b7e1
xor eax, 0x8e1cf238
rol eax, 0xf9
popf
jmp 0x14013f4b3
and rax, 0xfffffffffffffff0
call fcn.140181e18
sub rsp, rax
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x14013fb47
push rax
pushf
mov eax, 0x83843ac7
pushf
not eax
add eax, 0x9fc6a6cb
xor eax, 0xbf7e7b14
rol eax, 0xe0
popf
pushf
not eax
add eax, 0xee097258
xor eax, 0xfb5eee72
rol eax, 0x4e
popf
pushf
not eax
add eax, 0xddda1c0b
xor eax, 0xb88d6fa6
rol eax, 0x25
popf
jmp 0x14013f4b3
push rax
pushf
mov eax, 0xd5879556
pushf
not eax
add eax, 0xa26990b2
xor eax, 0xc1e7ee6a
rol eax, 0x45
popf
pushf
not eax
add eax, 0xcd7a4717
xor eax, 0xb43e2a73
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xd46d03b7
xor eax, 0xaa56e190
rol eax, 0x52
popf
jmp 0x14013f4b3
mov dword [rbx], 0xcccc
jmp 0x14013fcd6
call fcn.14018cea1
mov rbx, rax
test rax, rax
je 0x14013fc44
push rax
pushf
mov eax, 0x8ac31754
pushf
not eax
add eax, 0xb660a614
xor eax, 0x8ad31d10
rol eax, 0x92
popf
pushf
not eax
add eax, 0xed10a7fc
xor eax, 0xda1fcc88
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xdcf52cec
xor eax, 0x8be1b152
rol eax, 0x60
popf
jmp 0x14013f4b3
push rax
pushf
mov eax, 0x2ef33cba
pushf
not eax
add eax, 0xdc3aef54
xor eax, 0xa3ae13b1
rol eax, 0x20
popf
pushf
not eax
add eax, 0xbbd214fa
xor eax, 0xace873cb
rol eax, 0x3f
popf
jmp 0x14013f4b3
mov dword [rax], 0xdddd
push rax
pushf
mov eax, 0xb60ff7b2
pushf
not eax
add eax, 0x80e32241
xor eax, 0x8e15281b
rol eax, 0x38
popf
pushf
not eax
add eax, 0xb6453b30
xor eax, 0xa90f86fc
rol eax, 0x93
popf
pushf
not eax
add eax, 0xa2eca9a1
xor eax, 0xa0c25dfc
rol eax, 0x38
popf
pushf
not eax
add eax, 0xaf35c91e
xor eax, 0xd1f126e9
rol eax, 0x2d
popf
jmp 0x14013f4b3
add rbx, 0x10
push rax
pushf
mov eax, 0x915a916c
pushf
not eax
add eax, 0xa160dc6e
xor eax, 0xacc2bc46
rol eax, 0x14
popf
pushf
not eax
add eax, 0xd8563603
xor eax, 0x967f0ed9
rol eax, 0x38
popf
pushf
not eax
add eax, 0xf01367b6
xor eax, 0x8575c24e
rol eax, 0xed
popf
jmp 0x14013f4b3
test rbx, rbx
je 0x14013fd7e
push rax
pushf
mov eax, 0x5e58420b
pushf
not eax
add eax, 0xbd41c047
xor eax, 0xd9a8d973
rol eax, 0x21
popf
pushf
not eax
add eax, 0x8fd0e103
xor eax, 0xce0c299b
rol eax, 0xad
popf
pushf
not eax
add eax, 0xc748a881
xor eax, 0xdfd91427
rol eax, 0x87
popf
pushf
not eax
add eax, 0xd221b977
xor eax, 0xc8fc59c0
rol eax, 0xc0
popf
jmp 0x14013f4b3
push rax
pushf
mov eax, 0xe1be853e
pushf
not eax
add eax, 0xcc9b2473
xor eax, 0xa7d65e8b
rol eax, 0xee
popf
pushf
not eax
add eax, 0xab14d5d9
xor eax, 0xfaa502d2
rol eax, 0xfe
popf
jmp 0x14013f4b3
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.14001f640
mov r9d, r15d
mov dword [rsp + 0x28], r14d
mov r8, r12
mov qword [rsp + 0x20], rbx
mov edx, 0x7b1acfc6
pushf
not edx
add edx, 0xd1f16ee6
xor edx, 0xaea51171
rol edx, 0x39
popf
pushf
not edx
add edx, 0xda463995
xor edx, 0xfc5d5278
rol edx, 0xad
popf
mov ecx, edi
call fcn.14011a19e
test eax, eax
je 0x14013fe61
push rax
pushf
mov eax, 0x6a8f927b
pushf
not eax
add eax, 0xe3b6d2d6
xor eax, 0xde7fe2ee
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xeef75a11
xor eax, 0xed4dbb97
rol eax, 0x7c
popf
pushf
not eax
add eax, 0xe08524ec
xor eax, 0x8547f104
rol eax, 0x50
popf
pushf
not eax
add eax, 0x949b38ee
xor eax, 0x9d6cf4b9
rol eax, 0x87
popf
jmp 0x14013f4b3
push rax
pushf
mov eax, 0x851753c5
pushf
not eax
add eax, 0xc4685589
xor eax, 0xa0bc2fcf
rol eax, 0x37
popf
pushf
not eax
add eax, 0xfaea2f10
xor eax, 0xf49a7c78
rol eax, 0xd6
popf
jmp 0x14013f4b3
mov r9, qword [rbp + 0x80]
mov r8d, eax
mov rdx, rbx
mov ecx, r13d
jmp 0x14013fea5
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov edi, eax
jmp 0x14013fff9
xor ebx, ebx
push rax
pushf
mov eax, 0xe4e7d79e
pushf
not eax
add eax, 0xd0733a17
xor eax, 0xd1c76943
rol eax, 0xad
popf
pushf
not eax
add eax, 0x9204486f
xor eax, 0xd11dc67e
rol eax, 0x3a
popf
pushf
not eax
add eax, 0x964068ac
xor eax, 0xed351193
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x911869cb
xor eax, 0xc2336232
rol eax, 0x3f
popf
jmp 0x14013f4b3
xor edi, edi
test rbx, rbx
je 0x14013ffb3
push rax
pushf
mov eax, 0xcde59052
pushf
not eax
add eax, 0x99c68f5e
xor eax, 0xe0fe1cc6
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xf976995b
xor eax, 0x84668478
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xa6726c7e
xor eax, 0x984aa442
rol eax, 0xfa
popf
pushf
not eax
add eax, 0xd7a4db3d
xor eax, 0xcd56292b
rol eax, 0x2c
popf
jmp 0x14013f4b3
push rax
pushf
mov eax, 0x4607a045
pushf
not eax
add eax, 0xb8615b89
xor eax, 0xb1645fe9
rol eax, 0xaa
popf
pushf
not eax
add eax, 0x95a9ceb9
xor eax, 0x9117fd32
rol eax, 0x4d
popf
pushf
not eax
add eax, 0xed3727c8
xor eax, 0xd16365b7
rol eax, 0x3e
popf
jmp 0x14013f4b3
lea rcx, [rbx - 0x10]
cmp dword [rcx], 0xdddd
jne 0x140140038
push rax
pushf
mov eax, 0x6dd73f90
pushf
not eax
add eax, 0x81fb5bde
xor eax, 0xb03d004e
rol eax, 0x43
popf
pushf
not eax
add eax, 0xd3789187
xor eax, 0xd2afb16b
rol eax, 0xe3
popf
jmp 0x14013f4b3
push rax
pushf
mov eax, 0x5bde4c0f
pushf
not eax
add eax, 0xe5ff54cd
xor eax, 0xb16b193a
rol eax, 0x64
popf
pushf
not eax
add eax, 0x8977079d
xor eax, 0xd4d5eda9
rol eax, 0x9b
popf
jmp 0x14013f4b3
call fcn.1401b1d03
push rax
pushf
mov eax, 0x25d2137d
pushf
not eax
add eax, 0xafcec3c4
xor eax, 0x96e99102
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xdacaedcb
xor eax, 0xbb6de772
rol eax, 0x17
popf
pushf
not eax
add eax, 0xd09bcfba
xor eax, 0xe8250ce0
rol eax, 0x63
popf
jmp 0x14013f4b3
cmp byte [rbp + 0x20], 0
je 0x140140115
push rax
pushf
mov eax, 0x7022fa54
pushf
not eax
add eax, 0xbd9d265b
xor eax, 0xbc2a7df1
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xe60746cf
xor eax, 0xfc89e802
rol eax, 0x86
popf
pushf
not eax
add eax, 0x84f6df0a
xor eax, 0xf4326836
rol eax, 0xce
popf
pushf
not eax
add eax, 0xf392ebf7
xor eax, 0x989dcf9c
rol eax, 0xcb
popf
jmp 0x14013f4b3
push rax
pushf
mov eax, 0x6af83267
pushf
not eax
add eax, 0xe16e6a0b
xor eax, 0xa636fb10
rol eax, 0x66
popf
pushf
not eax
add eax, 0xe643d79f
xor eax, 0xe87ec8f0
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xa716dd73
xor eax, 0xea3a18bc
rol eax, 0xa3
popf
jmp 0x14013f4b3
mov rax, qword [rbp + 8]
and dword [rax + 0x3a8], 0xfffffffd
mov eax, edi
mov rcx, qword [rbp + 0x28]
xor rcx, rbp
call fcn.140178dd1
mov rbx, qword [rbp + 0x60]
mov rsi, qword [rbp + 0x68]
mov rdi, qword [rbp + 0x70]
lea rsp, [rbp + 0x30]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret