Function at 0x180005020
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x70
mov rax, qword [0x18000e0c0]
xor rax, rsp
mov qword [rsp + 0x68], rax
test r8, r8
mov rax, 0xffffffffffffffff
mov rbp, rdx
cmovne rax, r8
mov qword [rsp + 0x48], rax
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1800055cd
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x1800055cd
mov rax, qword gs:[0x30]
mov ebx, dword [rdi + 0x94]
mov rcx, qword [rax + 0x60]
mov rax, qword [0x18001cb58]
mov rcx, qword [rcx + 0x30]
test rax, rax
jne 0x1800050b2
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x1800050bf
mov r8, rbx
mov edx, 8
call rax
mov rsi, rax
test rsi, rsi
je 0x1800055cd
mov ebx, dword [rdi + 0x90]
mov rcx, rsi
mov r8d, dword [rdi + 0x94]
add rbx, rbp
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbx + 0xc]
add rbx, 0xc
xor edx, edx
mov edi, 0xffffffff
test ecx, ecx
je 0x18000511a
nop word [rax + rax]
cmp ecx, edx
lea rbx, [rbx + 0x14]
mov eax, ecx
cmovbe eax, edx
cmp ecx, edi
mov edx, eax
cmovae ecx, edi
mov edi, ecx
mov ecx, dword [rbx]
test ecx, ecx
jne 0x180005100
mov rax, qword gs:[0x30]
sub edx, edi
mov rcx, qword [rax + 0x60]
lea ebx, [rdx + 0x64]
mov rax, qword [0x18001cb58]
mov rcx, qword [rcx + 0x30]
test rax, rax
jne 0x18000515b
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], rax
mov r15, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x18000516d
mov r8, rbx
mov edx, 8
call rax
mov r15, rax
mov qword [rsp + 0x40], rax
test r15, r15
je 0x1800055cd
mov r12d, edi
mov r8, rbx
add r12, rbp
mov rcx, r15
mov rdx, r12
mov qword [rsp + 0x38], r12
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword gs:[0x30]
mov rax, qword [0x18001cb58]
mov rdx, qword [rcx + 0x60]
mov rcx, qword [rdx + 0x30]
test rax, rax
jne 0x1800051cc
mov ecx, 0x800000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor edx, edx
mov r8d, 0x800000
mov rcx, rax
mov r13, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x1800051dc
mov edx, 8
mov r8d, 0x800000
call rax
mov r13, rax
test r13, r13
je 0x1800055cd
mov ecx, dword [rsi + 0xc]
mov qword [rsp + 0xb0], r14
lea r14, [rsi + 0xc]
mov qword [rsp + 0x30], r14
test ecx, ecx
je 0x1800055a9
movabs rax, 0x7734773477347734
lea rsi, [0x180000000]
mov edi, ecx
mov rbx, rax
sub rdi, r12
add rdi, rbp
add rdi, r15
movsx eax, byte [rdi + 2]
lea rcx, [rdi + 2]
test eax, eax
je 0x180005244
nop dword [rax]
imul rbx, rbx, 0x21
cdqe
lea rcx, [rcx + 1]
add rbx, rax
movsx eax, byte [rcx]
test eax, eax
jne 0x180005230
xor ecx, ecx
cmp qword [0x18001ab50], rcx
jbe 0x18000526f
xor eax, eax
add rax, rax
cmp rbx, qword [rsi + rax*8 + 0x1ab60]
je 0x180005449
inc ecx
mov eax, ecx
cmp rax, qword [0x18001ab50]
jb 0x180005251
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
test rax, rax
jne 0x180005295
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
test rax, rax
je 0x180005585
mov rax, qword [0x18001ab50]
lea rdi, [0x180000000]
add rax, rax
mov qword [rdi + rax*8 + 0x1ab58], r15
mov rax, qword [0x18001ab50]
add rax, rax
mov qword [rdi + rax*8 + 0x1ab60], rbx
inc qword [0x18001ab50]
mov eax, dword [r14 - 0xc]
xor r9d, r9d
mov r11, qword [rax + rbp]
lea rbx, [rax + rbp]
mov r8d, 0xffffffff
test r11, r11
je 0x180005341
mov r10d, dword [r14 + 4]
sub r10, rax
add r10, rbx
nop dword [rax + rax]
mov eax, r9d
mov ecx, r11d
cmp r11, rax
mov edx, ebx
mov eax, r8d
cmovbe ecx, r9d
cmp r11, rax
cmovae r11d, r8d
sub edx, ebp
cmp edx, ecx
mov eax, edx
mov r8d, r10d
cmovbe eax, ecx
cmp edx, r11d
cmovae edx, r11d
mov r11, qword [rbx + 8]
sub r8d, ebp
cmp r8d, eax
mov r9d, r8d
cmovbe r9d, eax
cmp r8d, edx
cmovae r8d, edx
add rbx, 8
add r10, 8
test r11, r11
jne 0x1800052f0
sub r9d, r8d
add r9d, 0x64
cmp r9d, 0x800000
ja 0x18000557e
mov r12d, r8d
mov rcx, r13
add r12, rbp
mov r8d, r9d
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [r14 - 0xc]
mov r14d, dword [r14 + 4]
sub rsi, r12
sub r14, r12
add rsi, rbp
add rsi, r13
add r14, rbp
add r14, r13
mov rax, qword [rsi]
test rax, rax
je 0x180005574
mov r10, qword [0x18000eb30]
mov r9, qword [0x180014b40]
nop dword [rax]
movabs rdx, 0xffffffffffff
and rax, rdx
cmp rax, 0x1000
jb 0x180005574
mov rdx, qword [rsi]
movabs rcx, 0x7734773477347734
sub rdx, r12
add rdx, 2
add rdx, rbp
add rdx, r13
cmp r15, qword [0x180014b38]
jne 0x180005489
movsx eax, byte [rdx + 2]
add rdx, 2
test eax, eax
je 0x180005404
nop dword [rax]
imul rcx, rcx, 0x21
cdqe
lea rdx, [rdx + 1]
add rcx, rax
movsx eax, byte [rdx]
test eax, eax
jne 0x1800053f0
xor edx, edx
test r10, r10
je 0x180005558
mov r8, qword [r14]
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
lea rax, [rax + rax*2]
add rax, rax
cmp qword [rdi + rax*8 + 0xeb40], r8
je 0x180005466
cmp rcx, qword [rdi + rax*8 + 0xeb58]
je 0x180005474
inc edx
mov eax, edx
cmp rax, r10
jb 0x180005420
jmp 0x180005558
lea rdi, [0x180000000]
mov r15, qword [rdi + rax*8 + 0x1ab58]
test r15, r15
je 0x18000557e
jmp 0x1800052c7
cmp dword [rdi + rax*8 + 0xeb60], 0
je 0x180005558
lea rbx, [0x18000eb50]
mov rbx, qword [rbx + rax*8]
test rbx, rbx
jne 0x1800054eb
jmp 0x180005558
movsx eax, byte [rdx]
test eax, eax
je 0x1800054a4
imul rcx, rcx, 0x21
cdqe
lea rdx, [rdx + 1]
add rcx, rax
movsx eax, byte [rdx]
test eax, eax
jne 0x180005490
xor r8d, r8d
test r9, r9
je 0x180005558
xor eax, eax
nop dword [rax]
nop word [rax + rax]
lea rdx, [rax + rax*2]
add rdx, rdx
cmp rcx, qword [rdi + rdx*8 + 0x14b68]
je 0x1800054de
inc r8d
mov eax, r8d
cmp rax, r9
jb 0x1800054c0
jmp 0x180005558
mov rbx, qword [rdi + rdx*8 + 0x14b60]
test rbx, rbx
je 0x180005558
mov rcx, 0xffffffffffffffff
mov dword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], 8
mov rdi, r12
mov qword [rsp + 0x20], rax
sub rdi, r13
lea r8, [rsp + 0x60]
sub rdi, rbp
lea rdx, [rsp + 0x50]
add rdi, r14
mov r9d, 4
mov edi, edi
add rdi, rbp
cmp qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
cmovne rcx, qword [rsp + 0x48]
call fcn.18000602b
test eax, eax
jne 0x18000554a
mov qword [rdi], rbx
mov r9, qword [0x180014b40]
mov r10, qword [0x18000eb30]
mov rax, qword [rsi + 8]
lea rdi, [0x180000000]
add rsi, 8
add r14, 8
test rax, rax
jne 0x1800053a0
mov r12, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
lea rsi, [0x180000000]
mov ecx, dword [r14 + 0x14]
add r14, 0x14
mov r15, qword [rsp + 0x40]
movabs rax, 0x7734773477347734
mov qword [rsp + 0x30], r14
test ecx, ecx
jne 0x180005212
mov r14, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180008940
add rsp, 0x70
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
jmp 0x1800055b1