Function at 0x1400704b4
Capabilities:
Access pe header

Disassembly:
push rax
pushf
mov eax, 0x669f515a
pushf
not eax
add eax, 0x460f6c6b
xor eax, 0x5e94b944
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x13931ddc
xor eax, 0xb9455c1
rol eax, 0x42
popf
pushf
not eax
add eax, 0x108d5654
xor eax, 0x17d8e6ba
rol eax, 0xc6
popf
pushf
not eax
add eax, 0x15804ccb
xor eax, 0x448a8a0b
rol eax, 0
popf
cmp eax, 3
jne 0x140070517
popf
pop rax
jmp 0x140070787
cmp eax, 0
jne 0x140070526
popf
pop rax
jmp 0x140070580
cmp eax, 4
jne 0x140070535
popf
pop rax
jmp 0x140070824
cmp eax, 1
jne 0x140070544
popf
pop rax
jmp 0x140070633
cmp eax, 2
jne 0x140070553
popf
pop rax
jmp 0x1400706eb
cmp eax, 7
jne 0x140070562
popf
pop rax
jmp 0x140070982
cmp eax, 6
jne 0x140070571
popf
pop rax
jmp 0x14007090b
cmp eax, 5
jne 0x140070580
popf
pop rax
jmp 0x140070886
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r14d, r9d
mov r15, r8
mov r12d, edx
mov rbp, rcx
xor ebx, ebx
jmp 0x1400705ac
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov rdi, rax
test rax, rax
je 0x140070600
push rax
pushf
mov eax, 0x9dae6a1d
pushf
not eax
add eax, 0xb50ed48
xor eax, 0x27643f9f
rol eax, 0x57
popf
pushf
not eax
add eax, 0x7b5a2c17
xor eax, 0x4c67b125
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xd0cac42
xor eax, 0x59aec5cc
rol eax, 0xec
popf
jmp 0x140070508
push rax
pushf
mov eax, 0x1af1009f
pushf
not eax
add eax, 0x39288c9c
xor eax, 0x61caad7c
rol eax, 0xc1
popf
pushf
not eax
add eax, 0x57dd24db
xor eax, 0x57dad7da
rol eax, 0x4d
popf
jmp 0x140070508
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
mov rcx, rbp
call fcn.14003f20c
mov rsi, rax
test rax, rax
je 0x1400706a5
push rax
pushf
mov eax, 0x6a2e4646
pushf
not eax
add eax, 0x30f2ace7
xor eax, 0x20019847
rol eax, 0x11
popf
pushf
not eax
add eax, 0x38d3b0b9
xor eax, 0x70960355
rol eax, 0xa1
popf
pushf
not eax
add eax, 0x57ef3724
xor eax, 0x6f305f26
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x27f71c6d
xor eax, 0x3bfa5227
rol eax, 0x82
popf
jmp 0x140070508
push rax
pushf
mov eax, 0xcd299758
pushf
not eax
add eax, 0x254881df
xor eax, 0x1cd67a7f
rol eax, 0x35
popf
pushf
not eax
add eax, 0x5a3eb009
xor eax, 0x2ee09781
rol eax, 0xe7
popf
pushf
not eax
add eax, 0x39c7d6c1
xor eax, 0x3e849b36
rol eax, 0x91
popf
jmp 0x140070508
mov rdx, r15
mov rcx, rax
call fcn.140040326
test rax, rax
je 0x140070741
push rax
pushf
mov eax, 0xa90e3242
pushf
not eax
add eax, 0x796d924a
xor eax, 0x2df6a3fe
rol eax, 0xdf
popf
pushf
not eax
add eax, 0x3ce74107
xor eax, 0x3b93f992
rol eax, 0x9e
popf
pushf
not eax
add eax, 0x336613f3
xor eax, 0x32c5aa4c
rol eax, 0x8a
popf
jmp 0x140070508
push rax
pushf
mov eax, 0x71d3b714
pushf
not eax
add eax, 0x35e92007
xor eax, 0x2b2f28bd
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x56b800d2
xor eax, 0x652f0f6b
rol eax, 0x85
popf
pushf
not eax
add eax, 0x2a4446d5
xor eax, 0x47365fc4
rol eax, 0x37
popf
jmp 0x140070508
push rsi
not esi
add eax, esi
pop rsi
add eax, 1
mov dword [rdi + 0x28], eax
test r14d, r14d
je 0x1400707de
push rax
pushf
mov eax, 0x1124ab82
pushf
not eax
add eax, 0x6d97dbba
xor eax, 0x7aa0dc
rol eax, 0x17
popf
pushf
not eax
add eax, 0x4de766e5
xor eax, 0x32ab4a21
rol eax, 0xc9
popf
pushf
not eax
add eax, 0x7f725616
xor eax, 0x5a21da40
rol eax, 0x4a
popf
jmp 0x140070508
push rax
pushf
mov eax, 0x17b2e24a
pushf
not eax
add eax, 0x2a970cd6
xor eax, 0x26ff627
rol eax, 0x70
popf
pushf
not eax
add eax, 0x6d579fc6
xor eax, 0x586c7527
rol eax, 0x7c
popf
pushf
not eax
add eax, 0x2a5e7ff1
xor eax, 0x65d2004f
rol eax, 0xe5
popf
jmp 0x140070508
mov eax, 0xf259b0eb
pushf
not eax
add eax, 0x8534ccd
xor eax, 0x4b1e52a0
rol eax, 0x4b
popf
pushf
not eax
add eax, 0x3317eb6b
xor eax, 0xb4de01c
rol eax, 9
popf
and word [rdi + 0x16], ax
push rax
pushf
mov eax, 0x9844f1fe
pushf
not eax
add eax, 0x23f98256
xor eax, 0x70e6792
rol eax, 0x76
popf
pushf
not eax
add eax, 0x1a18b4ba
xor eax, 0x22b585fc
rol eax, 0x67
popf
jmp 0x140070508
mov edx, r12d
mov rcx, rbp
call fcn.14006a586
mov dword [rdi + 0x58], eax
mov ebx, 0x720c5ec
pushf
not ebx
add ebx, 0x3d83d595
xor ebx, 0x3afb7da4
rol ebx, 0xa2
popf
pushf
not ebx
add ebx, 0x15031bb4
xor ebx, 0x3a6b28a3
rol ebx, 0x1d
popf
pushf
not ebx
add ebx, 0x58367d67
xor ebx, 0x351d2e02
rol ebx, 0x85
popf
push rax
pushf
mov eax, 0x4bbe4b08
pushf
not eax
add eax, 0x747a7a0e
xor eax, 0x6ed08fc6
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x4fb9419a
xor eax, 0x1852778d
rol eax, 0xa9
popf
jmp 0x140070508
xor edx, edx
mov r8d, 0xd2a09647
pushf
not r8d
add r8d, 0x7cc97653
xor r8d, 0x59197625
rol r8d, 0xb1
popf
pushf
not r8d
add r8d, 0x6a26d389
xor r8d, 0x3dcced25
rol r8d, 0x7d
popf
mov rcx, rsi
jmp 0x140070949
call qword [sym.imp.KERNEL32.dll_VirtualFree]
push rax
pushf
mov eax, 0xaa1275d5
pushf
not eax
add eax, 0x6b2a24f3
xor eax, 0x211cb220
rol eax, 0x7c
popf
pushf
not eax
add eax, 0x57214b8b
xor eax, 0x791899b7
rol eax, 0x2d
popf
jmp 0x140070508
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret