Function at 0x140001660
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
xor ebx, ebx
mov dword [rbp + 0xb8], 4
mov dword [rbp + 0x140], ebx
mov dword [rbp - 8], ebx
mov rax, qword gs:[0x30]
mov qword [rbp + 0x150], rax
test rax, rax
je 0x140002265
mov dword [rbp + 0x158], 4
mov rcx, qword [rax + 0x60]
mov qword [rbp - 0x68], rcx
test rcx, rcx
je 0x140002265
mov rax, qword [rcx + 0x18]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x140002265
lea rdx, [rax + 0x20]
mov qword [rsp + 0x48], rdx
test rdx, rdx
je 0x140002265
mov rdx, qword [rdx]
lea r8d, [rbx + 0x11]
mov ecx, 0xad7a554b
mov rdx, qword [rdx + 0x50]
call section..text
mov edx, 0xeab4adb3
mov dword [rbp + 0x178], eax
mov r8d, 0x456f6764
lea rcx, [rsp + 0x40]
call fcn.140001040
mov qword [rbp + 0xd8], rax
test rax, rax
je 0x140002265
mov edx, 0x2091e4a4
mov r8d, 0xa30f3435
mov rcx, rax
call fcn.1400010d0
mov qword [rbp + 0x68], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xd8]
mov edx, 0xeb566d96
mov r8d, 0xc08c1025
call fcn.1400010d0
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xd8]
mov edx, 0x3db08a78
mov r8d, 0xee7ce940
call fcn.1400010d0
mov qword [rbp - 0x48], rax
test rax, rax
je 0x140002272
mov rcx, qword [rbp + 0xd8]
mov edx, 0xf672850e
mov r8d, 0x2beecf6c
call fcn.1400010d0
mov qword [rbp + 0x120], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xd8]
mov edx, 0x35262772
mov r8d, 0x782fb421
call fcn.1400010d0
mov qword [rbp], rax
test rax, rax
je 0x140002265
mov rax, qword [rsp + 0x48]
lea r8d, [rbx + 0x11]
mov ecx, 0xfe87df67
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x50]
call section..text
mov rcx, qword [rbp + 0xd8]
mov edx, 0x83f88322
mov r8d, 0xb87bcd14
mov dword [rbp + 0xf0], eax
call fcn.1400010d0
mov qword [rbp + 0x60], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xd8]
mov edx, 0x2fcccf93
mov r8d, 0x6d6c28fb
call fcn.1400010d0
mov qword [rbp + 0x188], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xd8]
mov edx, 0xe6f817d8
mov r8d, 0xbc937025
call fcn.1400010d0
mov qword [rbp - 0x50], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xd8]
mov edx, 0x2b2c7a62
mov r8d, 0x3fcfda3b
call fcn.1400010d0
mov qword [rbp + 0x180], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xd8]
mov edx, 0xbab92a7f
mov r8d, 0x3cc214c1
call fcn.1400010d0
mov qword [rbp + 0x90], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xd8]
mov edx, 0xd61c01cd
mov r8d, 0x19757281
call fcn.1400010d0
mov qword [rbp + 0x128], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xd8]
mov edx, 0x79cac8ac
mov r8d, 0xf6f6709
call fcn.1400010d0
mov qword [rbp + 0xc8], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xd8]
mov edx, 0xf2b16571
mov r8d, 0x144cf26
call fcn.1400010d0
mov qword [rbp + 0x108], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xd8]
mov edx, 0x2160ba2c
mov r8d, 0xb786e1d1
call fcn.1400010d0
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x140002265
mov rcx, qword [rbp + 0xd8]
mov edx, 0x19484ff5
mov r8d, 0x49e0358e
call fcn.1400010d0
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140002265
mov rax, qword [rsp + 0x48]
lea r8d, [rbx + 0x11]
mov ecx, 0x262739c5
mov rdx, qword [rax]
mov rdx, qword [rdx + 0x50]
call section..text
or eax, 1
mov dword [rsp + 0x20], 0xab9e34a4
mov edx, 0x818b2e98
mov dword [rbp + 0x18], eax
mov r9d, 0x9900bab6
lea rcx, [rsp + 0x40]
mov r8d, 0x8d6c5fbe
call fcn.140001480
lea rcx, [rsp + 0x40]
call fcn.140001630
test eax, eax
je 0x140002265
lea rcx, [rsp + 0x58]
call qword [rbp + 0x68]
mov qword [rbp - 0x38], rax
test rax, rax
je 0x140002265
mov edx, 0x3bb813b5
mov dword [rsp + 0x20], 0xc21fd371
mov r9d, 0xf65c93c5
lea rcx, [rsp + 0x40]
mov r8d, 0x5f6024a0
call fcn.140001480
lea rcx, [rsp + 0x58]
call qword [rbp + 0x68]
mov qword [rbp - 0x58], rax
test rax, rax
je 0x140002265
mov edx, 0xc19f9bfb
mov dword [rsp + 0x20], 0x4f96a285
mov r9d, 0xec5019f2
lea rcx, [rsp + 0x40]
mov r8d, 0xf73c3f25
call fcn.140001480
lea rcx, [rsp + 0x58]
call qword [rbp + 0x68]
mov qword [rbp + 0x58], rax
test rax, rax
je 0x140002265
mov edx, 0x85302de9
mov r8d, 0x5760039a
mov rcx, rax
call fcn.1400010d0
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140002265
lea edx, [rbx + 0x20]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [rbp - 0x80]
mov qword [rbp + 0xb0], rax
test rax, rax
je 0x140002265
mov edx, 0x271025c5
mov dword [rsp + 0x20], 0x4847e6ad
mov r9d, 0xb04cf7b3
lea rcx, [rsp + 0x40]
mov r8d, 0x6fc8e98f
call fcn.140001480
lea rcx, [rsp + 0x58]
call qword [rbp + 0x68]
mov qword [rbp + 0x20], rax
test rax, rax
je 0x140002265
xor ecx, ecx
call qword [rbp - 0x60]
mov dword [rbp + 0xc0], eax
test eax, eax
js 0x140002265
mov rcx, qword [rbp - 0x58]
mov edx, 0x1a4f3e3b
mov r8d, 0x2ce58685
call fcn.1400010d0
mov qword [rbp + 0x148], rax
test rax, rax
je 0x140002265
mov qword [rsp + 0x4c0], rsi
lea rcx, [rsp + 0x40]
mov edx, 0x40c6fbbf
mov qword [rsp + 0x4c8], rdi
mov r9d, 0x64943944
mov dword [rsp + 0x20], 0xdb0df27a
mov r8d, 0x26012c2e
call fcn.140001480
mov rdi, qword [rbp + 0xb0]
lea rsi, [rsp + 0x58]
mov ecx, 0x10
mov edx, 0xb68b8bc
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp + 0x20]
mov r8d, 0x27a13a21
call fcn.1400010d0
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140002255
mov rcx, qword [rbp + 0x20]
mov edx, 0x1030f32
mov r8d, 0x3056033c
call fcn.1400010d0
mov qword [rbp + 0x50], rax
test rax, rax
je 0x140002255
lea edx, [rbx + 0x27]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [rbp - 0x80]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140002255
mov rcx, qword [rbp + 0x20]
mov edx, 0x2655f355
mov r8d, 0x23da4f0
call fcn.1400010d0
mov qword [rbp + 0x170], rax
test rax, rax
je 0x140002255
mov edx, 0x18ba5cfe
mov dword [rsp + 0x20], 0x4b7fb76e
mov r9d, 0x55036180
lea rcx, [rsp + 0x40]
mov r8d, 0x937fc011
call fcn.140001480
mov rdi, qword [rsp + 0x68]
lea rsi, [rsp + 0x58]
mov ecx, 0x10
lea edx, [rbx + 0x13]
rep movsb byte [rdi], byte [rsi]
xor ecx, ecx
lea r9d, [rbx + 4]
mov r8d, 0x3000
call qword [rbp - 0x80]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140002255
mov rcx, qword [rbp + 0x20]
mov edx, 0xb53f617
mov r8d, 0x3c5c1a
call fcn.1400010d0
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140002255
mov edx, 0x35366967
mov dword [rsp + 0x20], 0x6738864d
mov r9d, 0xc1f39767
lea rcx, [rsp + 0x40]
mov r8d, 0xbbc63c6f
call fcn.140001480
mov rdi, qword [rbp - 0x78]
lea rsi, [rsp + 0x58]
mov ecx, 0x10
mov dword [rsp + 0x20], 0x8f86db08
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
mov edx, 0x5e2566d5
mov r9d, 0x16534d0b
mov r8d, 0xd4ec7889
call fcn.140001480
mov rdi, qword [rbp - 0x78]
lea rsi, [rsp + 0x58]
add rdi, 0x10
mov dword [rsp + 0x20], 0x404d9af1
mov ecx, 0x10
mov edx, 0x28863a0c
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
mov r9d, 0x475d5bc6
mov r8d, 0x149d9d03
call fcn.140001480
mov rdi, qword [rsp + 0x68]
lea rsi, [rsp + 0x58]
add rdi, 0x10
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp - 0x38]
mov edx, 0x98957a6
mov r8d, 0x3c4e6c04
call fcn.1400010d0
mov qword [rbp + 0x80], rax
test rax, rax
je 0x140002255
mov edx, 0x42129a62
mov dword [rsp + 0x20], 0x47a7dc75
mov r9d, 0xcc58f215
lea rcx, [rsp + 0x40]
mov r8d, 0xde17cddd
call fcn.140001480
mov rdi, qword [rbp + 0xb0]
lea rsi, [rsp + 0x58]
add rdi, 0x10
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp + 0x20]
mov edx, 0x17e554f2
mov r8d, 0x96a8940d
call fcn.1400010d0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140002255
lea rdx, [rbp + 0x1a0]
mov ecx, 0x104
call qword [rbp]
test eax, eax
je 0x140002255
lea rcx, [rbp + 0x1a0]
call qword [rbp + 0x188]
test eax, eax
je 0x140002255
mov rcx, qword [rbp + 0x20]
mov edx, 0xb2929141
mov r8d, 0xb8c90ad2
call fcn.1400010d0
mov qword [rbp + 0x88], rax
test rax, rax
je 0x140002255
lea rcx, [rsp + 0x40]
call fcn.140001510
mov rax, qword [rbp + 0x38]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140002255
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea edx, [rbx + 1]
xor ecx, ecx
call qword [rbp + 0x88]
mov qword [rbp + 0x100], rax
test rax, rax
je 0x140002255
mov rcx, qword [rbp + 0x20]
mov edx, 0xc65b2255
mov r8d, 0x2c894f0
call fcn.1400010d0
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140002255
mov edx, 0x918df456
mov dword [rsp + 0x20], 0xdc36022d
mov r9d, 0xceee1c51
lea rcx, [rsp + 0x40]
mov r8d, 0xd7ebf278
call fcn.140001480
mov rcx, qword [rbp + 0x100]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov r8d, 0x1bb
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call qword [rbp + 0x48]
mov qword [rbp + 0xd0], rax
test rax, rax
je 0x140002255
mov edx, 0xb8a539eb
mov dword [rsp + 0x20], 0xa86106e5
mov r9d, 0xa5d34d8f
lea rcx, [rsp + 0x40]
mov r8d, 0x1c0192d6
call fcn.140001480
mov rdi, qword [rsp + 0x68]
lea rsi, [rsp + 0x58]
add rdi, 0x20
mov dword [rsp + 0x20], 0xb7b76573
mov ecx, 0x10
mov edx, 0xb345a3bb
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
mov r9d, 0x1b41f012
mov r8d, 0x49fd2b32
call fcn.140001480
mov rcx, qword [rbp + 0xd0]
lea r8, [rsp + 0x5c]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x30], 0x80800000
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [rsp + 0x40]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x140002255
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [rbp + 0x170]
test eax, eax
je 0x140002255
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 8]
lea r9, [rbp + 0x158]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x10]
mov edx, 0x20000005
call qword [rsp + 0x70]
test eax, eax
je 0x140002255
mov edx, dword [rbp - 0x10]
lea r9d, [rbx + 4]
xor ecx, ecx
mov r8d, 0x3000
call qword [rbp - 0x80]
mov qword [rbp + 0x138], rax
test rax, rax
je 0x140002255
mov r8d, dword [rbp - 0x10]
lea r9, [rbp + 0x70]
mov rcx, qword [rbp - 0x20]
mov rdx, rax
call qword [rbp + 0x50]
test eax, eax
je 0x140002255
mov eax, dword [rbp - 0x10]
cmp dword [rbp + 0x70], eax
jne 0x140002255
mov rcx, qword [rbp - 0x20]
call qword [rsp + 0x78]
mov rcx, qword [rbp + 0xd0]
call qword [rsp + 0x78]
mov r8d, dword [rbp - 0x10]
lea r9, [rbp + 0x40]
mov rdx, qword [rbp + 0x138]
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x20], rbx
call qword [rbp + 0x90]
test eax, eax
je 0x140002255
mov edx, 0x34d92175
mov dword [rsp + 0x20], 0xa4566194
mov r9d, 0xfdba5e57
lea rcx, [rsp + 0x40]
mov r8d, 0xa66b9fe
call fcn.140001480
mov rcx, qword [rbp + 0x100]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov r8d, 0x1bb
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbx
call qword [rbp + 0x48]
mov qword [rbp + 0x130], rax
test rax, rax
je 0x140002255
mov edx, 0xb496f4ad
mov dword [rsp + 0x20], 0xce929f31
mov r9d, 0x33db4870
lea rcx, [rsp + 0x40]
mov r8d, 0x17778196
call fcn.140001480
mov rcx, qword [rbp + 0x130]
lea r8, [rsp + 0x5c]
mov qword [rsp + 0x38], rbx
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x30], 0x80800000
xor r9d, r9d
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140002255
mov rcx, qword [rbp + 0x38]
call qword [rbp + 0x180]
mov rdx, qword [rbp + 0xb0]
lea r8d, [rbx + 1]
xor ecx, ecx
call qword [rbp + pe_nt_image_headers64]
mov dword [rbp + 8], eax
test eax, eax
js 0x140002255
mov r8, qword [rbp - 0x78]
mov r9d, 0x1040
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [rbp + 0x148]
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [rbp + 0x170]
test eax, eax
je 0x140002255
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x140]
lea r9, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x168]
mov edx, 0x20000005
call qword [rsp + 0x70]
test eax, eax
je 0x140002255
mov edx, dword [rbp + 0x168]
lea r9d, [rbx + 4]
xor ecx, ecx
mov r8d, 0x3000
call qword [rbp - 0x80]
mov qword [rbp + 0x110], rax
test rax, rax
je 0x140002255
mov r8d, dword [rbp + 0x168]
lea r9, [rbp + 0x28]
mov rcx, qword [rsp + 0x50]
mov rdx, rax
call qword [rbp + 0x50]
test eax, eax
je 0x140002255
mov eax, dword [rbp + 0x168]
cmp dword [rbp + 0x28], eax
jne 0x140002255
mov rax, qword [rbp + 0x110]
mov ecx, 0x5a4d
mov qword [rbp + 0x98], rax
cmp word [rax], cx
jne 0x140002255
mov rcx, qword [rbp + 0x100]
call qword [rsp + 0x78]
mov rcx, qword [rbp + 0x130]
call qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x78]
mov rax, qword [rbp + 0x98]
movsxd rdx, dword [rax + 0x3c]
add rdx, qword [rbp + 0x110]
mov qword [rbp + 0xa8], rdx
cmp dword [rdx], 0x4550
jne 0x140002255
mov eax, 0x8664
cmp word [rdx + 4], ax
jne 0x140002255
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x140002255
movzx ecx, word [rdx + 0x14]
lea r9d, [rbx + 0x40]
add rcx, 0x18
mov r8d, 0x3000
add rcx, rdx
mov qword [rbp + 0xf8], rcx
xor ecx, ecx
mov edx, dword [rdx + 0x50]
call qword [rbp - 0x80]
mov qword [rbp + 0xa0], rax
test rax, rax
je 0x140002255
mov rcx, qword [rbp + 0xa8]
mov rdi, rax
mov rsi, qword [rbp + 0x110]
mov ecx, dword [rcx + 0x54]
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x40]
call fcn.140001200
lea rcx, [rsp + 0x40]
call fcn.140001280
lea rcx, [rsp + 0x40]
call fcn.140001360
lea rcx, [rsp + 0x40]
call fcn.140001410
mov rsi, qword [rsp + 0x4c0]
mov rdi, qword [rsp + 0x4c8]
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x140002272
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x4d0]
xor eax, eax
add rsp, 0x4b0
pop rbp
ret