Function at 0x18004c190
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xc0
mov rax, qword [0x180069028]
xor rax, rsp
mov qword [rbp - 9], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x29], 1
xor r14d, r14d
mov qword [rbp - 0x19], r14
mov rdi, qword [0x1801a90b8]
mov qword [rbp - 0x61], rdi
mov eax, 0x5a4d
cmp word [0x1801a42e0], ax
jne 0x18004c300
movsxd rsi, dword [0x1801a431c]
lea rbx, [0x1801a42e0]
add rsi, rbx
cmp dword [rsi], 0x4550
jne 0x18004c300
mov eax, 0x20b
cmp word [rsi + 0x18], ax
jne 0x18004c300
mov r13d, dword [rsi + 0x50]
mov edx, r13d
xor ecx, ecx
lea r9d, [r14 + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x18004c300
movzx ecx, word [rsi + 0x14]
mov eax, dword [rcx + rsi + 0x24]
mov dword [rbp - 0x75], eax
sub r13d, eax
mov qword [rbp - 0x69], r14
mov eax, dword [rbp + 0x67]
cmp eax, 1
jne 0x18004c278
mov edx, r13d
lea r8, [rbp - 0x69]
mov rcx, rdi
call fcn.18004bdd0
mov r15, rax
jmp 0x18004c543
cmp eax, 2
jne 0x18004c431
mov qword [rbp - 0x71], r14
cmp qword [0x1801a9218], r14
jne 0x18004c343
lea rax, str.x____xxxxxxxx____xxxxxxxxx____xxxxxxxx
mov qword [rsp + 0x20], rax
lea r9, [0x18005f008]
mov r8, qword [0x1801a9138]
lea rdx, str.PAGELK
mov rcx, rdi
call fcn.180048050
mov rbx, rax
mov qword [0x1801a9218], rax
test rax, rax
je 0x18004c2ef
mov dword [rbp - 0x31], r14d
lea r8, [rax + 1]
mov r9d, 4
lea rdx, [rbp - 0x31]
mov rcx, rdi
call fcn.180046b10
test al, al
jne 0x18004c32f
mov qword [0x1801a9218], r14
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.18004f530
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movsxd rcx, dword [rbp - 0x31]
add rcx, 5
add rcx, rbx
mov qword [0x1801a9218], rcx
je 0x18004c2ef
mov r9d, r13d
lea rdx, [rbp - 0x71]
mov rcx, rdi
call fcn.180049bf0
test al, al
je 0x18004c2ef
mov r15, qword [rbp - 0x71]
test r15, r15
je 0x18004c2ef
cmp qword [0x1801a91f8], r14
jne 0x18004c3f8
lea rax, str.xx____x___x_x____xxxxxxx____x
mov qword [rsp + 0x20], rax
lea r9, [0x18005f088]
mov r8, qword [0x1801a9138]
lea rdx, [0x18005ef54]
mov rcx, rdi
call fcn.180048050
mov qword [0x1801a91f8], rax
test rax, rax
je 0x18004c41e
lea rbx, [rax + 0xc]
mov qword [0x1801a91f8], rbx
mov dword [rbp - 0x31], r14d
lea r8, [rbx + 1]
mov r9d, 4
lea rdx, [rbp - 0x31]
mov rcx, rdi
call fcn.180046b10
test al, al
jne 0x18004c3e4
mov qword [0x1801a91f8], r14
mov r8d, r13d
mov rdx, r15
mov rcx, rdi
call fcn.180046d30
jmp 0x18004c2ef
movsxd rcx, dword [rbp - 0x31]
add rcx, 5
add rcx, rbx
mov qword [0x1801a91f8], rcx
je 0x18004c41e
mov byte [rbp - 0x79], r14b
mov dword [rsp + 0x20], r13d
mov r9, r15
lea rdx, [rbp - 0x79]
mov rcx, rdi
call fcn.180049ff0
test al, al
je 0x18004c41e
cmp byte [rbp - 0x79], r14b
jne 0x18004c53c
mov r8d, r13d
mov rdx, r15
mov rcx, rdi
call fcn.180046d30
jmp 0x18004c2ef
mov ebx, r13d
test r13d, r13d
je 0x18004c2ef
mov ecx, dword [0x1801a89e0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1801ab3c0], ecx
jle 0x18004c50d
lea rcx, [0x1801ab3c0]
call fcn.18004e77c
cmp dword [0x1801ab3c0], 0xffffffff
jne 0x18004c50d
mov qword [rbp - 0x59], r14
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], 0xf
mov byte [rbp - 0x59], 0
mov r8d, 0x15
lea rdx, [0x18005f130]
lea rcx, [rbp - 0x59]
call fcn.180044970
nop
lea r8, [rbp - 0x59]
mov rdx, qword [0x1801a9138]
mov rcx, rdi
call fcn.1800471b0
mov qword [0x1801ab4a8], rax
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x18004c501
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004c4fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004c4fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004e5ec
nop
lea rcx, [0x1801ab3c0]
call fcn.18004e71c
cmp qword [0x1801ab4a8], 0
je 0x18004c2ef
mov qword [rbp - 0x71], r14
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x71]
mov rcx, rdi
call fcn.18004abf0
test al, al
je 0x18004c2ef
mov r15, qword [rbp - 0x71]
lea rbx, [0x1801a42e0]
test r15, r15
je 0x18004c2ef
mov r8d, dword [rsi + 0x54]
mov rdx, rbx
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [rsi + 0x14]
add rbx, 0x28
xor eax, eax
cmp ax, word [rsi + 6]
jae 0x18004c5a6
add rbx, rsi
lea rdi, [0x1801a42e0]
test dword [rbx + 0x14], 0x80
ja 0x18004c592
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, rdi
mov ecx, dword [rbx - 4]
add rcx, r12
call sub.VCRUNTIME140.dll_memcpy
inc r14d
add rbx, 0x28
movzx eax, word [rsi + 6]
cmp r14d, eax
jl 0x18004c575
mov rdi, qword [rbp - 0x61]
mov r14, r15
mov eax, dword [rbp - 0x75]
sub r15, rax
mov rbx, r15
sub rbx, qword [rsi + 0x30]
mov rdx, r12
lea rcx, [rbp - 0x59]
call fcn.18004d8d0
mov rdx, rbx
mov rcx, rax
call fcn.18004c700
mov rdx, r15
mov rcx, r12
call fcn.18004c800
test al, al
je 0x18004c300
mov rdx, r12
lea rcx, [rbp - 0x59]
call fcn.18004da20
mov rdx, rax
mov rcx, rdi
call fcn.18004c8b0
test al, al
je 0x18004c68a
mov r9d, r13d
mov r8d, dword [rbp - 0x75]
add r8, r12
mov rdx, r14
mov rcx, rdi
call fcn.180046b10
test al, al
je 0x18004c68a
mov ebx, dword [rsi + 0x28]
add rbx, r15
mov rsi, qword [rbp - 0x69]
mov qword [rsp + 0x20], rsi
mov r9d, r13d
mov r8, r14
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.1800458a0
test al, al
je 0x18004c68e
xor eax, eax
mov dword [rbp - 0x75], eax
mov rax, qword [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x19]
mov r8, rbx
lea rdx, [rbp - 0x75]
mov rcx, rdi
call fcn.18004cbc0
test al, al
je 0x18004c68e
mov rax, qword [rbp - 0x39]
test rax, rax
je 0x18004c671
mov ecx, dword [rbp - 0x75]
mov dword [rax], ecx
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r14
jmp 0x18004c302
mov rsi, qword [rbp - 0x69]
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rbp + 0x67]
mov rdx, r14
cmp eax, 1
jne 0x18004c6e0
mov r8, rsi
mov rcx, rdi
call fcn.180046e20
test al, al
je 0x18004c300
mov rdx, rsi
mov rcx, rdi
call fcn.180046f60
test al, al
je 0x18004c300
mov rdx, rsi
mov rcx, rdi
call fcn.180047080
jmp 0x18004c300
cmp eax, 2
jne 0x18004c6d3
mov r8d, r13d
mov rcx, rdi
call fcn.180046d30
jmp 0x18004c300