Function at 0x14006c2a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
xor r9d, r9d
mov rdi, r8
mov qword [r8], r9
mov rsi, rdx
mov r10, rcx
cmp rdx, 0x200
jb 0x14006c377
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14006c377
mov edx, dword [rcx + 0x3c]
cmp edx, 0x1000
jae 0x14006c377
lea ecx, [rdx + 0x200]
cmp rcx, rsi
ja 0x14006c377
test dl, 7
jne 0x14006c377
add rdx, r10
cmp dword [rdx], 0x4550
jne 0x14006c377
movzx ecx, word [rdx + 4]
cmp ecx, 0x1c4
ja 0x14006c330
je 0x14006c329
sub ecx, 0x14c
je 0x14006c340
sub ecx, 0x74
je 0x14006c322
cmp ecx, 2
jne 0x14006c377
mov eax, 0x3030501
jmp 0x14006c34c
mov eax, 0x3030701
jmp 0x14006c34c
cmp ecx, 0x200
je 0x14006c347
cmp ecx, 0x8664
jne 0x14006c377
mov eax, 0x3030103
jmp 0x14006c34c
mov eax, 0x3030401
mov ecx, 0x400
cmp word [rdx + 0x14], cx
ja 0x14006c377
movzx ecx, word [rdx + 0x18]
mov edx, 0x10b
cmp cx, dx
je 0x14006c50e
mov edx, 0x20b
cmp cx, dx
je 0x14006c50e
cmp rsi, 0x200
jb 0x14006c51c
cmp byte [r10 + 6], 1
jne case.0x14006c408.4
cmp dword [r10], 0x464c457f
jne case.0x14006c408.4
movzx ecx, byte [r10 + 4]
sub ecx, 1
je 0x14006c3af
cmp ecx, 1
jne case.0x14006c408.4
movzx ecx, byte [r10 + 5]
sub ecx, 1
je 0x14006c3d8
sub ecx, 1
jne case.0x14006c408.4
movzx eax, byte [r10 + 0x13]
lea edx, [rcx + 1]
movzx ecx, byte [r10 + 0x12]
shl cx, 8
or cx, ax
jmp 0x14006c3e0
movzx ecx, word [r10 + 0x12]
mov edx, r9d
movzx eax, cx
add eax, 0xfffffffe
cmp eax, 0x3c
ja case.0x14006c408.4
lea r8, [0x140000000]
cdqe
movzx eax, byte [r8 + rax + 0x6c618]
mov ecx, dword [r8 + rax*4 + 0x6c604]
add rcx, r8
jmp rcx
mov eax, 0x3030103
mov dword [rdi], eax
mov eax, 1
mov rsi, qword [rsp + 0x18]
pop rdi
ret
mov eax, 0x3030805
mov dword [rdi], eax
mov eax, 1
mov rsi, qword [rsp + 0x18]
pop rdi
ret
test edx, edx
je case.0x14006c408.4
mov eax, 0x3030205
mov dword [rdi], eax
mov eax, 1
mov rsi, qword [rsp + 0x18]
pop rdi
ret
test edx, edx
jne case.0x14006c408.4
mov eax, 0x3030501
mov dword [rdi], eax
lea eax, [rdx + 1]
mov rsi, qword [rsp + 0x18]
pop rdi
ret
cmp rsi, 0x200
jb 0x14006c51c
mov eax, dword [r10]
cmp eax, 0xcefaedfe
je 0x14006c491
cmp eax, 0xcffaedfe
je 0x14006c491
cmp eax, 0xfeedface
je 0x14006c48c
cmp eax, 0xfeedfacf
jne 0x14006c51c
mov ecx, r9d
jmp 0x14006c496
mov ecx, 1
mov eax, dword [r10 + 4]
test ecx, ecx
je 0x14006c4a0
bswap eax
cmp eax, 0x12
ja 0x14006c4cc
je 0x14006c4d8
cmp eax, 7
je 0x14006c4e3
cmp eax, 0xc
je 0x14006c4c1
cmp eax, 0xe
jne 0x14006c51c
test ecx, ecx
je 0x14006c51c
mov eax, 0x3030805
jmp 0x14006c4e8
test ecx, ecx
jne 0x14006c51c
mov eax, 0x3030501
jmp 0x14006c4e8
sub eax, 0x1000007
je 0x14006c4e3
cmp eax, 0xb
jne 0x14006c51c
test ecx, ecx
je 0x14006c51c
mov eax, 0x3030205
jmp 0x14006c4e8
mov eax, 0x3030103
mov r8d, dword [r10 + 0x10]
test ecx, ecx
je 0x14006c4f3
bswap r8d
mov edx, dword [r10 + 0x14]
test ecx, ecx
je 0x14006c4fd
bswap edx
cmp edx, 0x1000000
ja 0x14006c51c
cmp r8d, 0x40000
ja 0x14006c51c
mov dword [rdi], eax
mov eax, 1
mov rsi, qword [rsp + 0x18]
pop rdi
ret
mov qword [rsp + 0x10], rbx
cmp rsi, 0x2c
jb 0x14006c5f4
cmp dword [r10], 0x46464952
jne 0x14006c5f4
cmp dword [r10 + 8], 0x45564157
jne 0x14006c5f4
cmp dword [r10 + 0xc], 0x20746d66
jne 0x14006c5f4
mov edx, dword [r10 + 0x10]
lea eax, [rdx - 0x10]
cmp eax, 2
ja 0x14006c5f4
cmp word [r10 + 0x14], 1
jne 0x14006c5f4
movzx r8d, word [r10 + 0x22]
test r8b, 7
jne 0x14006c5f4
cmp r8d, 0x100
jae 0x14006c5f4
movzx ebx, word [r10 + 0x16]
cmp ebx, 0x100
jae 0x14006c5f4
add edx, 0x14
mov r11d, r9d
lea ecx, [rdx + 8]
cmp rcx, rsi
ja 0x14006c5f4
cmp dword [rdx + r10], 0x61746164
je 0x14006c5d3
mov ecx, dword [rdx + r10 + 4]
cmp ecx, 0x10000
ja 0x14006c5f4
add edx, 8
inc r11d
add edx, ecx
cmp r11d, 0xa
jl 0x14006c597
mov rbx, qword [rsp + 0x10]
mov eax, r9d
mov rsi, qword [rsp + 0x18]
pop rdi
ret
shr r8d, 3
imul r8d, ebx
cmp r8d, 0x100
jae 0x14006c5f4
mov dword [rdi], 3
mov r9d, 1
mov dword [rdi + 4], r8d
mov rbx, qword [rsp + 0x10]
mov eax, r9d
mov rsi, qword [rsp + 0x18]
pop rdi
ret