Function at 0x18007eb70
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov rax, qword [0x18017b008]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov rax, qword [rcx + 0x810]
lea rsi, [rcx + 0x808]
xor r12d, r12d
mov byte [rsp + 0x50], r8b
mov qword [rbp - 0x80], rdx
movzx r15d, r8b
mov qword [rsp + 0x68], rsi
mov r14, rdx
mov rbx, rcx
mov edi, r12d
test rax, rax
jne 0x18007ec03
mov qword [rcx + 0x868], r12
mov rax, qword [rbx + 0x810]
test rax, rax
jne 0x18007ec2c
mov qword [rbx + 0x870], r12
mov rax, qword [rbx + 0x810]
mov qword [rsp + 0x6f0], r13
test rax, rax
jne 0x18007ec65
mov qword [rbx + 0x858], r12
jmp 0x18007ec7f
mov rcx, qword [rsi]
mov edx, 0xb
call rax
mov qword [rsp + 0x68], rsi
mov qword [rbx + 0x868], rax
test rax, rax
je 0x18007ebd3
mov byte [rbx + 0xd18], 1
mov al, 1
jmp 0x18007f7ed
mov rcx, qword [rsi]
mov edx, 0xa
call rax
mov qword [rbx + 0x870], rax
test rax, rax
je 0x18007ebe6
mov rcx, rbx
call fcn.180081b20
test al, al
je 0x18007ebe6
mov rdx, r14
mov byte [rbx + 0xcf0], 1
mov rcx, rbx
call fcn.180081fb0
jmp 0x18007f7ed
mov rcx, qword [rsi]
mov edx, 4
call rax
mov qword [rbx + 0x858], rax
test rax, rax
jne 0x18007ed4f
mov rax, qword [rbx + 0x810]
test rax, rax
jne 0x18007ec94
mov qword [rbx + 0x860], r12
jmp 0x18007ecae
mov rcx, qword [rsi]
mov edx, 5
call rax
mov qword [rbx + 0x860], rax
test rax, rax
jne 0x18007ed4f
mov r8d, 0x20
lea rdx, [0x180144458]
mov rcx, r14
call fcn.18012c52c
mov rdi, rax
test rax, rax
jne 0x18007ed1e
mov dword [rbx], 4
lea rcx, [rbx + 4]
test r14, r14
jne 0x18007ece3
mov word [rcx], r12w
jmp 0x18007f7e3
mov r9, 0xffffffffffffffff
mov r8, r14
mov edx, 0x400
call fcn.18002a9a8
mov eax, 0x2800
mov ecx, 0x3ff
add ax, word [rbx + 0x800]
cmp ax, cx
ja 0x18007f7e3
mov word [rbx + 0x800], r12w
jmp 0x18007f7e3
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.18012caac
test eax, eax
jne 0x18007f78b
mov r9, rdi
lea edx, [rax + 1]
lea r8d, [rax + 0x40]
lea rcx, [rbp + 0x40]
call fcn.18012c794
cmp rax, 0x40
sete al
jmp 0x18007ed90
mov rax, qword [rbx + 0x858]
test rax, rax
je 0x18007ed6c
mov rcx, qword [rsi]
lea r9, [rbp + 0x40]
xor edx, edx
lea r8d, [rdx + 0x40]
call rax
jmp 0x18007ed8b
mov rax, qword [rbx + 0x860]
test rax, rax
je 0x18007f78b
mov rcx, qword [rsi]
lea r9, [rbp + 0x40]
xor edx, edx
lea r8d, [rdx + 0x40]
call rax
test eax, eax
setns al
test al, al
je 0x18007f78b
movzx eax, word [rbp + 0x40]
test rdi, rdi
je 0x18007eddd
mov ecx, 0x4944
cmp ax, cx
jne 0x18007eddd
mov rcx, rdi
call fcn.180034c8c
mov eax, dword [rbp + 0x48]
mov rdx, r14
mov rcx, rbx
mov dword [rbx + 0xcf8], eax
call fcn.1800804e0
test al, al
jne 0x18007f7e5
cmp dword [rbx], 0xb
je 0x18007f78b
jmp 0x18007f7e5
mov ecx, 0x5a4d
cmp ax, cx
jne 0x18007f78b
mov rdx, r14
mov rcx, rbx
call fcn.180081fb0
test al, al
je 0x18007f7d6
mov edx, dword [rbp + 0x7c]
test edx, edx
jle 0x18007f78b
test rdi, rdi
je 0x18007ee44
xor r8d, r8d
mov rcx, rdi
call fcn.18012caac
test eax, eax
jne 0x18007f78b
mov r9, rdi
lea edx, [rax + 1]
mov r8d, 0x108
lea rcx, [rbp + 0x80]
call fcn.18012c794
cmp rax, 0x108
sete al
jmp 0x18007ee8b
mov rax, qword [rbx + 0x858]
test rax, rax
je 0x18007ee64
mov rcx, qword [rsi]
lea r9, [rbp + 0x80]
mov r8d, 0x108
call rax
jmp 0x18007ee86
mov rax, qword [rbx + 0x860]
test rax, rax
je 0x18007f78b
mov rcx, qword [rsi]
lea r9, [rbp + 0x80]
mov r8d, 0x108
call rax
test eax, eax
setns al
test al, al
je 0x18007f78b
cmp dword [rbp + 0x80], 0x4550
jne 0x18007f78b
movzx eax, word [rbp + 0x98]
xor r9d, r9d
mov dword [rsp + 0x64], r12d
mov ecx, r9d
mov dword [rsp + 0x58], ecx
mov edx, r12d
mov dword [rsp + 0x60], edx
mov r8d, r12d
cmp eax, 0x10b
je 0x18007ef1c
cmp eax, 0x20b
jne 0x18007f78b
mov eax, dword [rbp + 0xd0]
mov dword [rbx + 0xcf4], eax
mov rax, qword [rbp + 0x104]
cmp eax, 6
jb 0x18007ef03
mov r8d, dword [rbp + 0x138]
mov edx, dword [rbp + 0x13c]
mov dword [rsp + 0x64], r8d
mov dword [rsp + 0x60], edx
test r15b, r15b
je 0x18007ef65
cmp eax, 0xe
jb 0x18007ef65
mov r12d, dword [rbp + 0x178]
mov ecx, dword [rbp + 0x17c]
jmp 0x18007ef61
mov eax, dword [rbp + 0xd0]
mov dword [rbx + 0xcf4], eax
mov rax, qword [rbp + 0xf4]
cmp eax, 6
jb 0x18007ef4a
mov r8d, dword [rbp + 0x128]
mov edx, dword [rbp + 0x12c]
mov dword [rsp + 0x64], r8d
mov dword [rsp + 0x60], edx
test r15b, r15b
je 0x18007ef65
cmp eax, 0xe
jb 0x18007ef65
mov r12d, dword [rbp + 0x168]
mov ecx, dword [rbp + 0x16c]
mov dword [rsp + 0x58], ecx
test r8d, r8d
je 0x18007f73b
test edx, edx
je 0x18007f73b
test r15b, r15b
je 0x18007ef8c
test r12d, r12d
je 0x18007f788
test ecx, ecx
je 0x18007f788
lea r13, [rbx + 0x860]
cmp qword [rbx + 0x858], r9
jne 0x18007efb8
cmp qword [r13], r9
je 0x18007efb8
mov dword [rsp + 0x5c], r9d
mov r14d, r9d
test r15b, r15b
je 0x18007f1f8
jmp 0x18007f158
movzx ecx, word [rbp + 0x94]
mov eax, r9d
mov esi, dword [rbp + 0x7c]
add ecx, 0x18
add esi, ecx
mov dword [rsp + 0x5c], r9d
movzx ecx, word [rbp + 0x86]
mov r11d, r9d
mov qword [rsp + 0x70], rcx
mov r10d, r9d
mov dword [rsp + 0x54], r9d
mov r14d, r9d
mov dword [rsp + 0x78], eax
mov r15, r9
test rcx, rcx
je 0x18007f12e
nop dword [rax]
test rdi, rdi
je 0x18007f036
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call fcn.18012caac
test eax, eax
jne 0x18007f116
mov r9, rdi
lea edx, [rax + 1]
lea r8d, [rax + 0x28]
lea rcx, [rbp - 0x10]
call fcn.18012c794
cmp rax, 0x28
sete al
jmp 0x18007f082
mov rax, qword [rbx + 0x858]
test rax, rax
je 0x18007f05a
mov rcx, qword [rsp + 0x68]
lea r9, [rbp - 0x10]
mov edx, esi
mov r8d, 0x28
mov rcx, qword [rcx]
call rax
jmp 0x18007f07d
mov rax, qword [r13]
test rax, rax
je 0x18007f125
mov rcx, qword [rsp + 0x68]
lea r9, [rbp - 0x10]
mov r8d, 0x28
mov edx, esi
mov rcx, qword [rcx]
call rax
test eax, eax
setns al
test al, al
je 0x18007f116
mov edx, dword [rbp - 4]
add esi, 0x28
mov r10d, dword [rsp + 0x64]
mov r8d, dword [rbp + 4]
mov r9d, dword [rbp]
cmp edx, r10d
ja 0x18007f0c2
mov eax, dword [rsp + 0x60]
lea ecx, [r9 + rdx]
add eax, r10d
cmp ecx, eax
jb 0x18007f0c2
mov r11d, r8d
mov dword [rsp + 0x5c], r8d
mov r10d, edx
mov dword [rsp + 0x54], edx
jmp 0x18007f0cc
mov r11d, dword [rsp + 0x5c]
mov r10d, dword [rsp + 0x54]
movzx eax, byte [rsp + 0x50]
test al, al
je 0x18007f0f5
cmp edx, r12d
ja 0x18007f0f5
mov eax, dword [rsp + 0x58]
lea ecx, [r9 + rdx]
add eax, r12d
cmp ecx, eax
movzx eax, byte [rsp + 0x50]
jb 0x18007f0f5
mov r14d, r8d
mov dword [rsp + 0x78], edx
test r11d, r11d
je 0x18007f103
test al, al
je 0x18007f120
test r14d, r14d
jne 0x18007f120
mov rcx, qword [rsp + 0x70]
inc r15
cmp r15, rcx
jb 0x18007f000
jmp 0x18007f125
mov r11d, dword [rsp + 0x5c]
mov r10d, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x70]
mov eax, dword [rsp + 0x78]
mov r8d, dword [rsp + 0x64]
cmp r15, rcx
je 0x18007f788
sub r11d, r10d
add r11d, r8d
cmp byte [rsp + 0x50], 0
mov dword [rsp + 0x5c], r11d
je 0x18007f1f8
mov rsi, qword [rsp + 0x68]
sub r14d, eax
add r14d, r12d
test rdi, rdi
je 0x18007f18f
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call fcn.18012caac
test eax, eax
jne 0x18007f788
mov r9, rdi
lea edx, [rax + 1]
lea r8d, [rax + 0x48]
lea rcx, [rbp - 0x10]
call fcn.18012c794
cmp rax, 0x48
sete al
jmp 0x18007f1dc
mov rax, qword [rbx + 0x858]
test rax, rax
je 0x18007f1af
mov rcx, qword [rsi]
lea r9, [rbp - 0x10]
mov edx, r14d
mov r8d, 0x48
call rax
jmp 0x18007f1d7
mov rax, qword [r13]
test rax, rax
je 0x18007f788
test r12d, r12d
je 0x18007f788
mov rcx, qword [rsi]
lea r9, [rbp - 0x10]
mov r8d, 0x48
mov edx, r12d
call rax
test eax, eax
setns al
test al, al
je 0x18007f788
cmp dword [rbp + 0x30], 0
je 0x18007f788
cmp dword [rbp + 0x34], 0
je 0x18007f788
mov r13d, dword [rsp + 0x60]
xor r14d, r14d
xor r15d, r15d
mov qword [rbp - 0x48], r14
xor ecx, ecx
mov dword [rsp + 0x54], r14d
xorps xmm0, xmm0
mov qword [rbp], r15
movabs rax, 0x2492492492492493
mov dword [rsp + 0x58], r15d
mul r13
movups xmmword [rbp - 0x58], xmm0
movups xmmword [rbp - 0x10], xmm0
xor r12d, r12d
mov qword [rsp + 0x70], rcx
sub r13, rdx
mov qword [rbp - 0x68], rcx
shr r13, 1
mov r8d, r14d
add r13, rdx
mov r9d, r15d
movzx edx, byte [rsp + 0x50]
shr r13, 4
movups xmmword [rbp - 0x78], xmm0
test dl, dl
je 0x18007f295
mov rcx, qword [rbp - 0x80]
lea rax, [rbp + 0x390]
mov qword [rsp + 0x40], r12
xor edx, edx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], pe_nt_image_headers64
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call fcn.18001fd48
movzx edx, byte [rsp + 0x50]
mov r9d, r15d
mov r8d, r14d
mov rsi, r12
test r13, r13
je 0x18007f4a5
mov r12d, dword [rsp + 0x64]
test rdi, rdi
je 0x18007f2e7
mov r14d, dword [rsp + 0x5c]
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call fcn.18012caac
test eax, eax
jne 0x18007f788
mov r9, rdi
lea edx, [rax + 1]
lea r8d, [rax + 0x1c]
lea rcx, [rbp - 0x38]
call fcn.18012c794
mov r15, qword [rsp + 0x68]
cmp rax, 0x1c
sete al
jmp 0x18007f34b
mov rax, qword [rbx + 0x858]
test rax, rax
je 0x18007f311
mov r15, qword [rsp + 0x68]
lea r9, [rbp - 0x38]
mov r14d, dword [rsp + 0x5c]
mov r8d, 0x1c
mov edx, r14d
mov rcx, qword [r15]
call rax
jmp 0x18007f346
mov rax, qword [rbx + 0x860]
test rax, rax
je 0x18007f788
test r12d, r12d
je 0x18007f788
mov r15, qword [rsp + 0x68]
lea r9, [rbp - 0x38]
mov r8d, 0x1c
mov edx, r12d
mov rcx, qword [r15]
call rax
mov r14d, dword [rsp + 0x5c]
test eax, eax
setns al
test al, al
je 0x18007f788
add r12d, 0x1c
cmp qword [rbx + 0x858], 0
jne 0x18007f36b
cmp qword [rbx + 0x860], 0
jne 0x18007f374
add r14d, 0x1c
mov dword [rsp + 0x5c], r14d
cmp byte [rbx + 0x818], 0
jne 0x18007f39e
mov rax, qword [rbx + 0x810]
mov byte [rbx + 0x818], 1
test rax, rax
je 0x18007f397
mov rcx, qword [r15]
xor edx, edx
call rax
mov qword [rbx + 0x820], rax
mov rax, qword [rbx + 0x820]
test rax, rax
je 0x18007f3b8
mov rcx, qword [r15]
lea r8, [rbp - 0x38]
mov edx, 1
call rax
mov eax, dword [rbp - 0x2c]
cmp eax, 2
jne 0x18007f515
movzx edx, byte [rsp + 0x50]
test dl, dl
je 0x18007f4f5
mov eax, dword [rbp - 0x28]
mov rcx, rbx
mov dword [rbx + 0xd1c], eax
mov eax, dword [rbp - 0x24]
mov dword [rbx + 0xd20], eax
mov eax, dword [rbp - 0x20]
mov dword [rbx + 0xd24], eax
movzx eax, word [rbp - 0x2e]
mov word [rbx + 0xd28], ax
mov byte [rbx + 0xd18], 1
mov qword [rbx + 0x8d8], rdi
call fcn.180081970
test al, al
je 0x18007f47f
cmp byte [rbx + 0xd2a], 0
je 0x18007f47f
cmp dword [rbx + 0xd40], 0
je 0x18007f47f
mov rcx, qword [rbx + 0xd48]
test rcx, rcx
je 0x18007f56c
xor edx, edx
lea rax, [rbp + 0x190]
mov qword [rsp + 0x40], rdx
xor r9d, r9d
mov qword [rsp + 0x38], rdx
xor r8d, r8d
mov qword [rsp + 0x30], pe_nt_image_headers64
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
call fcn.18001fd48
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x390]
call fcn.18001f3b8
test eax, eax
je 0x18007f580
movzx edx, byte [rsp + 0x50]
mov r8d, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x58]
inc rsi
cmp rsi, r13
jb 0x18007f2a6
mov r14, qword [rbp - 0x48]
xor r12d, r12d
mov r15, qword [rbp]
mov rcx, qword [rbp - 0x50]
xor sil, sil
mov rax, rcx
mov qword [rbx + 0x8d8], rdi
shr rax, 0x20
test eax, eax
je 0x18007f587
mov dword [rbx + 0xd1c], r14d
mov sil, 1
shr r14, 0x20
shr rcx, 0x10
mov word [rbx + 0xd28], cx
mov byte [rbx + 0xd18], sil
mov dword [rbx + 0xd20], r14d
mov dword [rbx + 0xd24], r8d
jmp 0x18007f58f
movups xmm0, xmmword [rbp - 0x38]
mov r8d, dword [rbp - 0x20]
movsd xmm1, qword [rbp - 0x28]
movups xmmword [rbp - 0x58], xmm0
mov dword [rsp + 0x54], r8d
movsd qword [rbp - 0x48], xmm1
jmp 0x18007f489
cmp eax, 4
jne 0x18007f539
movups xmm0, xmmword [rbp - 0x38]
mov eax, dword [rbp - 0x20]
movsd xmm1, qword [rbp - 0x28]
movups xmmword [rbp - 0x78], xmm0
mov qword [rsp + 0x70], rax
movsd qword [rbp - 0x68], xmm1
jmp 0x18007f47f
cmp eax, 0x11
jne 0x18007f47f
movups xmm0, xmmword [rbp - 0x38]
mov r9d, dword [rbp - 0x20]
movsd xmm1, qword [rbp - 0x28]
movzx edx, byte [rsp + 0x50]
mov r8d, dword [rsp + 0x54]
movups xmmword [rbp - 0x10], xmm0
mov dword [rsp + 0x58], r9d
movsd qword [rbp], xmm1
jmp 0x18007f48e
mov r9d, dword [rsp + 0x58]
movzx edx, byte [rsp + 0x50]
mov r8d, dword [rsp + 0x54]
jmp 0x18007f48e
mov al, 1
jmp 0x18007f7e5
test dl, dl
jne 0x18007f78b
mov rax, qword [rbp - 8]
shr rax, 0x20
test eax, eax
je 0x18007f67f
mov sil, 1
mov dword [rbx + 0xd54], r15d
mov rax, r15
mov byte [rbx + 0xd18], sil
shr rax, 0x20
mov byte [rbx + 0xd50], sil
mov dword [rbx + 0xd58], eax
mov dword [rbx + 0xd5c], r9d
cmp r15d, 8
jbe 0x18007f78b
test rdi, rdi
je 0x18007f60d
xor r8d, r8d
mov edx, r9d
mov rcx, rdi
call fcn.18012caac
test eax, eax
jne 0x18007f78b
mov r9, rdi
lea edx, [rax + 1]
lea r8d, [rax + 4]
lea rcx, [rsp + 0x60]
call fcn.18012c794
cmp rax, 4
sete al
jmp 0x18007f669
mov r10, qword [rbx + 0x858]
test r10, r10
je 0x18007f634
mov rax, qword [rsp + 0x68]
mov r8d, 4
mov edx, r9d
lea r9, [rsp + 0x60]
mov rcx, qword [rax]
call r10
jmp 0x18007f664
mov r10, qword [rbx + 0x860]
test r10, r10
je 0x18007f78b
test eax, eax
je 0x18007f78b
mov edx, eax
lea r9, [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov r8d, 4
mov rcx, qword [rax]
call r10
test eax, eax
setns al
test al, al
je 0x18007f78b
cmp dword [rsp + 0x60], 0x4244504d
jne 0x18007f78b
movzx eax, word [rbp + 0x96]
shr ax, 9
and al, 1
mov byte [rbx + 0xcf0], al
je 0x18007f6db
cmp dword [rbp - 0x6c], 0
je 0x18007f6db
mov eax, dword [rbp + 0x88]
mov r8, rdi
mov r9d, dword [rsp + 0x70]
xor edx, edx
mov dword [rbx + 0xcf8], eax
mov rcx, rbx
mov eax, dword [rbp - 0x74]
mov sil, 1
mov dword [rbx + 0xcfc], eax
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x28], eax
mov eax, dword [rbp - 0x64]
mov dword [rsp + 0x20], eax
call fcn.1800824e0
movzx eax, sil
jmp 0x18007f7e5
test sil, sil
jne 0x18007f732
mov rax, qword [rbp - 0x80]
lea rcx, [rbx + 4]
mov dword [rbx], 0x13
test rax, rax
jne 0x18007f700
mov word [rcx], r12w
movzx eax, sil
jmp 0x18007f7e5
mov r9, 0xffffffffffffffff
mov r8, rax
mov edx, 0x400
call fcn.18002a9a8
mov eax, 0x2800
mov ecx, 0x3ff
add ax, word [rbx + 0x800]
cmp ax, cx
ja 0x18007f732
mov word [rbx + 0x800], r12w
movzx eax, sil
jmp 0x18007f7e5
mov dword [rbx], 0x13
lea rcx, [rbx + 4]
test r14, r14
jne 0x18007f753
mov word [rcx], r9w
jmp 0x18007f7d6
mov r9, 0xffffffffffffffff
mov r8, r14
mov edx, 0x400
call fcn.18002a9a8
mov eax, 0x2800
mov ecx, 0x3ff
add ax, word [rbx + 0x800]
cmp ax, cx
ja 0x18007f7d6
xor eax, eax
mov word [rbx + 0x800], ax
jmp 0x18007f7d6
xor r12d, r12d
mov rax, qword [rbp - 0x80]
lea rcx, [rbx + 4]
mov dword [rbx], 0x11
test rax, rax
jne 0x18007f7a4
mov word [rcx], r12w
jmp 0x18007f7d6
mov r9, 0xffffffffffffffff
mov r8, rax
mov edx, 0x400
call fcn.18002a9a8
mov eax, 0x2800
mov ecx, 0x3ff
add ax, word [rbx + 0x800]
cmp ax, cx
ja 0x18007f7d6
mov word [rbx + 0x800], r12w
test rdi, rdi
je 0x18007f7e3
mov rcx, rdi
call fcn.180034c8c
xor al, al
mov r13, qword [rsp + 0x6f0]
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.18000b6d0
add rsp, 0x6a0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret