Function at 0x180013220
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x860
mov rax, qword [0x18006e168]
xor rax, rsp
mov qword [rsp + 0x850], rax
xor ebp, ebp
test rdx, rdx
mov r13, r9
mov r12d, r8d
mov rsi, rdx
mov rbx, rcx
mov edi, ebp
je 0x180013512
xor eax, eax
lea r9d, [rbp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x180013512
mov r14d, 0x40
lea r8, [rsp + 0x180]
mov rdx, rsi
mov rcx, rbx
mov r9, r14
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180013512
cmp word [rsp + 0x180], 0x5a4d
jne 0x180013507
movsxd rcx, dword [rsp + 0x1bc]
mov eax, ecx
cmp rax, qword [rsp + 0x50]
ja 0x180013507
cmp ecx, r14d
jb 0x180013507
lea rdx, [rsi + rcx]
lea r8, [rsp + 0x80]
mov r9d, 0xf8
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x180013512
cmp dword [rsp + 0x80], 0x4550
jne 0x180013507
cmp word [rsp + 0x98], 0x10b
jne 0x180013342
cmp word [rsp + 0x84], di
mov eax, 1
cmovne edi, eax
lea r8, [rsp + 0x1c0]
mov rdx, rsi
mov rcx, rbx
call fcn.180012290
test eax, eax
je 0x18001351d
test edi, edi
je 0x1800133aa
test r12d, r12d
jne 0x1800133a0
cmp qword [rsp + 0x1e0], rbp
je 0x1800133a0
mov eax, dword [rsp + 0x840]
test al, 1
je 0x1800133a0
test al, 2
jne 0x1800133a0
lea r9, [rsp + 0x1c0]
mov r8w, 0x8664
mov rdx, rsi
mov rcx, rbx
call fcn.180012a70
test eax, eax
jne 0x1800133af
jmp 0x18001351d
mov ecx, 6
jmp 0x180013517
test r12d, r12d
jne 0x1800133a0
mov r9d, dword [rsp + 0x8c0]
mov r8, r13
mov rdx, rsi
mov rcx, rbx
call fcn.180012410
test eax, eax
je 0x18001351d
mov rdi, qword [rsp + 0x1e0]
test rdi, rdi
je 0x1800134e0
lea rcx, [rsp + 0x830]
lea rdx, [rsp + 0x68]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov eax, dword [rcx + 0x10]
mov rcx, rbx
mov dword [rdx + 0x10], eax
mov eax, dword [rsp + 0x840]
mov rdx, rdi
and eax, 0xfffffffe
mov dword [rsp + 0x78], eax
xor eax, eax
lea r9d, [rax + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x18001351d
test byte [rsp + 0x5c], 0xf0
mov r9d, 4
mov r8d, 0x14
setne al
mov rdx, rdi
mov rcx, rbx
test al, al
lea rax, [rsp + 0x30]
cmovne r9d, r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x18001351d
mov rdx, qword [rsp + 0x1e0]
lea r8, [rsp + 0x68]
mov r9d, 0x14
mov rcx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18001351d
mov r9d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x1e0]
lea rax, [rsp + 0x30]
mov r8d, 0x14
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x18001351d
test byte [rsp + 0x840], 2
jne 0x1800133a0
lea r8, [rsp + 0x1c0]
lea rdx, [0x180053e98]
mov r9d, 0x688
mov rcx, rbx
call fcn.180013650
test eax, eax
setne bpl
mov eax, ebp
jmp 0x18001351f
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x10dd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.18003f5f0
add rsp, 0x860
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret