Function at 0x140001570
Capabilities:
Access peb ldr_data
Enumerate pe sections
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
call fcn.140001560
mov rsi, rax
jmp 0x140001593
dec rsi
movzx eax, word [rsi]
cmp eax, 0x5a4d
jne 0x140001590
mov ecx, dword [rsi + 0x3c]
lea eax, [rcx - 0x40]
cmp eax, 0x3bf
ja 0x140001590
cmp dword [rsi + rcx], 0x4550
jne 0x140001590
add rcx, rsi
mov qword [rsp + 0x20], rcx
mov ecx, 0xffffffe0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x20]
xor r14d, r14d
xor eax, eax
xor r15d, r15d
xor r8d, r8d
mov qword [rsp + 0x28], r8
jmp 0x1400015fc
mov rdx, qword [rdx]
test rdx, rdx
je 0x140001827
mov r8, qword [rdx + 0x50]
movzx r10d, word [rdx + 0x48]
cmp r10w, 1
jne 0x140001620
xor r9d, r9d
jmp 0x140001665
mov r11d, r10d
and r11d, 0xfffe
xor r9d, r9d
nop dword [rax]
rol r9d, 0x13
movzx edi, byte [r8]
lea ebx, [rdi + rcx]
cmp edi, 0x61
cmovb ebx, edi
add ebx, r9d
rol ebx, 0x13
movzx edi, byte [r8 + 1]
lea r9d, [rdi + rcx]
cmp edi, 0x61
cmovb r9, rdi
add r9, rbx
add r8, 2
add r11w, 0xfffe
jne 0x140001630
test r10b, 1
je 0x140001682
rol r9d, 0x13
movzx r8d, byte [r8]
lea r10d, [rcx + r8]
cmp r8d, 0x61
cmovb r10, r8
add r9, r10
cmp r9d, 0x3cfa685d
je 0x140001770
cmp r9d, 0x6a4abc5b
jne 0x140001800
mov r8, qword [rdx + 0x20]
movsxd r9, dword [r8 + 0x3c]
mov r9d, dword [r9 + r8 + 0x88]
mov r10d, dword [r9 + r8 + 0x20]
mov r11d, dword [r9 + r8 + 0x24]
add r10, r8
add r11, r8
mov di, 3
jmp 0x1400016dc
mov eax, dword [r12 + r13*4]
add rax, r8
dec edi
add r10, 4
add r11, 2
test di, di
je 0x140001800
mov ebx, dword [r10]
movzx ebp, byte [rbx + r8]
lea r12, [rbx + r8]
inc r12
xor ebx, ebx
nop dword [rax]
mov r13d, ebx
rol r13d, 0x13
movsx ebx, bpl
add ebx, r13d
movzx ebp, byte [r12]
inc r12
test bpl, bpl
jne 0x1400016f0
cmp ebx, 0x91afca54
je 0x140001723
cmp ebx, 0x7c0dfcaa
je 0x140001723
cmp ebx, 0xec0e4e8e
jne 0x1400016cb
mov r12d, dword [r8 + r9 + 0x1c]
add r12, r8
movzx r13d, word [r11]
cmp ebx, 0x91afca54
je 0x1400016c2
cmp ebx, 0x7c0dfcaa
je 0x14000175c
cmp ebx, 0xec0e4e8e
jne 0x1400016c9
mov ebx, dword [r12 + r13*4]
add rbx, r8
mov qword [rsp + 0x28], rbx
jmp 0x1400016c9
mov r15d, dword [r12 + r13*4]
add r15, r8
jmp 0x1400016c9
mov r8, qword [rdx + 0x20]
movsxd r9, dword [r8 + 0x3c]
mov r9d, dword [r9 + r8 + 0x88]
mov r10d, dword [r9 + r8 + 0x20]
mov r11d, dword [r9 + r8 + 0x24]
add r10, r8
add r11, r8
mov di, 1
jmp 0x1400017ad
add r10, 4
add r11, 2
test di, di
je 0x140001800
mov ebx, dword [r10]
movzx r12d, byte [rbx + r8]
add rbx, r8
inc rbx
xor ebp, ebp
nop dword [rax]
mov r13d, ebp
rol r13d, 0x13
movsx ebp, r12b
add ebp, r13d
movzx r12d, byte [rbx]
inc rbx
test r12b, r12b
jne 0x1400017c0
cmp ebp, 0x534c0ab8
jne 0x1400017a0
mov ebx, dword [r8 + r9 + 0x1c]
add rbx, r8
movzx r14d, word [r11]
mov r14d, dword [rbx + r14*4]
add r14, r8
dec edi
jmp 0x1400017a0
cmp qword [rsp + 0x28], 0
je 0x1400015f0
test r15, r15
je 0x1400015f0
test rax, rax
je 0x1400015f0
test r14, r14
je 0x1400015f0
mov rbx, qword [rsp + 0x20]
mov edx, dword [rbx + 0x50]
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call rax
mov rdi, rax
mov ecx, dword [rbx + 0x54]
test rcx, rcx
je 0x1400018bc
mov rax, rcx
and rax, 3
je 0x140001ba7
xor r9d, r9d
nop word [rax + rax]
movzx edx, byte [rsi + r9]
mov byte [rdi + r9], dl
inc r9
cmp rax, r9
jne 0x140001860
lea rax, [rdi + r9]
lea r8, [rsi + r9]
mov rdx, rcx
sub rdx, r9
cmp ecx, 4
jb 0x1400018bc
nop word cs:[rax + rax]
movzx ecx, byte [r8]
mov byte [rax], cl
movzx ecx, byte [r8 + 1]
mov byte [rax + 1], cl
movzx ecx, byte [r8 + 2]
mov byte [rax + 2], cl
movzx ecx, byte [r8 + 3]
add r8, 4
mov byte [rax + 3], cl
add rax, 4
add rdx, 0xfffffffffffffffc
jne 0x140001890
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 6]
test rax, rax
je 0x140001995
mov rcx, qword [rsp + 0x20]
lea rdx, [rcx + 0x18]
movzx ecx, word [rcx + 0x14]
add rcx, rdx
jmp 0x1400018f0
dec rax
add rcx, 0x28
test rax, rax
je 0x140001995
mov r9d, dword [rcx + 0x10]
test r9, r9
je 0x1400018e0
mov edx, dword [rcx + 0xc]
mov r8d, dword [rcx + 0x14]
add rdx, rdi
mov r10, r9
add r8, rsi
and r10, 3
je 0x140001950
xor r11d, r11d
nop word cs:[rax + rax]
movzx ebx, byte [r8 + r11]
mov byte [rdx + r11], bl
inc r11
cmp r10, r11
jne 0x140001920
mov r10, r9
sub r10, r11
add r8, r11
add rdx, r11
cmp r9d, 4
jae 0x140001960
jmp 0x1400018e0
mov r10, r9
cmp r9d, 4
jb 0x1400018e0
nop dword [rax]
movzx r9d, byte [r8]
mov byte [rdx], r9b
movzx r9d, byte [r8 + 1]
mov byte [rdx + 1], r9b
movzx r9d, byte [r8 + 2]
mov byte [rdx + 2], r9b
movzx r9d, byte [r8 + 3]
add r8, 4
mov byte [rdx + 3], r9b
add rdx, 4
add r10, 0xfffffffffffffffc
jne 0x140001960
jmp 0x1400018e0
mov rax, qword [rsp + 0x20]
mov r13d, dword [rax + 0x90]
mov eax, dword [r13 + rdi + 0xc]
test eax, eax
je 0x140001a5f
add r13, rdi
lea rcx, [rdi + 8]
mov qword [rsp + 0x30], rcx
jmp 0x1400019d0
mov eax, dword [r13 + 0x20]
add r13, 0x14
test eax, eax
je 0x140001a5f
mov ecx, eax
add rcx, rdi
call qword [rsp + 0x28]
mov rsi, rax
mov ebx, dword [r13 + 0x10]
mov rax, qword [rbx + rdi]
test rax, rax
je 0x1400019c0
mov r12d, dword [r13]
add r12, rdi
mov rcx, qword [rsp + 0x30]
lea rbp, [rcx + rbx]
add rbx, rdi
jmp 0x140001a2d
lea rdx, [rax + rdi]
add rdx, 2
mov rcx, rsi
call r15
lea rcx, [r12 + 8]
test r12, r12
mov qword [rbx], rax
cmovne r12, rcx
mov rbx, rbp
mov rax, qword [rbp]
add rbp, 8
test rax, rax
je 0x1400019c0
test r12, r12
je 0x140001a00
mov rcx, qword [r12]
test rcx, rcx
jns 0x140001a00
movsxd rax, dword [rsi + 0x3c]
mov eax, dword [rax + rsi + 0x88]
mov edx, dword [rax + rsi + 0x10]
mov eax, dword [rax + rsi + 0x1c]
add rax, rsi
movzx ecx, cx
sub rcx, rdx
mov eax, dword [rax + rcx*4]
add rax, rsi
jmp 0x140001a0e
mov rax, qword [rsp + 0x20]
cmp dword [rax + 0xb4], 0
je 0x140001b6c
mov rax, qword [rsp + 0x20]
mov r11d, dword [rax + 0xb0]
mov r10d, dword [r11 + rdi + 4]
test r10d, r10d
je 0x140001b6c
mov rax, rdi
mov rcx, qword [rsp + 0x20]
sub rax, qword [rcx + 0x30]
lea rdx, [r11 + rdi]
add rdx, 4
add r11, rdi
mov ecx, eax
shr ecx, 0x10
lea r8, [0x140070034]
mov r9, r11
jmp 0x140001adf
mov esi, dword [rdx]
lea r11, [r9 + rsi]
lea rdx, [r9 + rsi]
add rdx, 4
mov r10d, dword [r9 + rsi + 4]
mov r9, r11
test r10d, r10d
je 0x140001b6c
mov esi, r10d
lea r10, [rsi - 8]
cmp r10, 2
jb 0x140001ac2
mov r11d, dword [r11]
add r11, rdi
lea rsi, [r9 + 8]
shr r10, 1
jmp 0x140001b1c
and ebx, 0xfff
add word [r11 + rbx], ax
nop dword [rax + rax]
dec r10
add rsi, 2
test r10, r10
je 0x140001ac0
movzx ebx, word [rsi]
mov r15d, ebx
shr r15d, 0xc
dec r15d
cmp r15d, 9
ja case.0x140001b36.4
movsxd r15, dword [r8 + r15*4]
add r15, r8
jmp r15
and ebx, 0xfff
add word [r11 + rbx], cx
jmp case.0x140001b36.4
and ebx, 0xfff
add dword [r11 + rbx], eax
jmp case.0x140001b36.4
and ebx, 0xfff
add qword [r11 + rbx], rax
jmp case.0x140001b36.4
mov rax, qword [rsp + 0x20]
mov esi, dword [rax + 0x28]
add rsi, rdi
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
call r14
mov rcx, rdi
mov edx, 1
xor r8d, r8d
call rsi
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, rdi
mov r8, rsi
mov rdx, rcx
cmp ecx, 4
jae 0x140001890
jmp 0x1400018bc