Function at 0x14006c350
Capabilities:
Parse pe header
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov rsi, r9
mov rdi, r8
mov word [r9], bx
mov dword [rdx], ebx
mov r14, rdx
mov byte [r8], bl
mov qword [rsp + 0x30], rbx
mov ebp, 1
xor r9d, r9d
mov edx, 0x80000000
mov r8d, ebp
mov dword [rsp + 0x28], 0x80
xor r15b, r15b
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x14006c3df
lea r8d, [rbx + 2]
xor r9d, r9d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x14006c3e6
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14006c61c
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r12, rax
test rax, rax
jne 0x14006c426
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14006c617
mov eax, 0x5a4d
cmp word [r12], ax
jne 0x14006c5f6
movsxd rbx, dword [r12 + 0x3c]
mov eax, 0x100
add rbx, r12
test word [rbx + 0x16], ax
je 0x14006c466
movzx eax, word [rbx + 4]
mov ecx, 0x8664
cmp ax, cx
je 0x14006c466
mov ecx, 0x200
cmp ax, cx
je 0x14006c466
mov byte [rdi], bpl
jmp 0x14006c469
mov byte [rdi], 2
mov eax, dword [rbx + 8]
mov dword [r14], eax
movzx eax, word [rbx + 0x5e]
or ax, bp
mov word [rsi], ax
cmp byte [rdi], 2
jne 0x14006c51c
movsxd rbx, dword [r12 + 0x3c]
mov edx, pe_nt_image_headers64
add rbx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14006c5f6
cmp dword [rbx], 0x4550
jne 0x14006c5f6
movzx r8d, word [rbx + 6]
lea rax, [rbx + 0x108]
cmp r8d, ebp
jl 0x14006c5f6
mov r9, qword [str..textbss]
mov r10, qword [str..tls]
mov rdx, qword [str..bss]
mov r11, qword [str.rt_bss]
nop dword [rax]
cmp dword [rax + 0x10], 0
jne 0x14006c50c
cmp qword [rax], r9
je 0x14006c50c
cmp qword [rax], r10
je 0x14006c50c
cmp qword [rax], rdx
je 0x14006c50c
cmp qword [rax], r11
je 0x14006c50c
mov ecx, dword [rax + 0x24]
bt ecx, 0x1d
jae 0x14006c50c
test cl, 0xc0
jne 0x14006c5f3
inc ebp
add rax, 0x28
cmp ebp, r8d
jle 0x14006c4e0
jmp 0x14006c5f6
mov edx, 0xf8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14006c5f6
cmp dword [rbx], 0x4550
jne 0x14006c5f6
movzx r8d, word [rbx + 6]
lea rcx, [rbx + 0xf8]
cmp r8d, ebp
jl 0x14006c5f6
mov r9, qword [str..textbss]
mov r10, qword [str..tls]
mov r11, qword [str..bss]
mov rbx, qword [0x1400e8a74]
mov rdi, qword [str..data]
mov edx, dword [rcx + 0x24]
test dl, 0x20
je 0x14006c592
mov eax, dword [rcx + 8]
cmp eax, 0x1000
jbe 0x14006c592
add eax, 0xfffff000
cmp dword [rcx + 0x10], eax
jb 0x14006c5f3
cmp qword [rcx], rbx
jne 0x14006c5ab
mov eax, dword [rcx + 8]
cmp eax, 0x1000
jbe 0x14006c5ab
add eax, 0xfffff000
cmp dword [rcx + 0x10], eax
jb 0x14006c5f3
cmp byte [rcx], 0
jne 0x14006c5b8
mov eax, dword [rcx + 8]
cmp dword [rcx + 0x10], eax
jb 0x14006c5f3
cmp dword [rcx + 0x10], 0
jne 0x14006c5e6
cmp dword [rcx + 8], 0x1000
jb 0x14006c5e6
cmp qword [rcx], r9
je 0x14006c5e6
cmp qword [rcx], r10
je 0x14006c5e6
cmp qword [rcx], r11
je 0x14006c5e6
cmp qword [rcx], rdi
je 0x14006c5e6
bt edx, 0x1d
jae 0x14006c5e6
test dl, 0xc0
jne 0x14006c5f3
inc ebp
add rcx, 0x28
cmp ebp, r8d
jle 0x14006c576
jmp 0x14006c5f6
mov r15b, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, r15b
mov r12, qword [rsp + 0x70]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret