Function at 0x180021350
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x18009a918]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, r9
movzx esi, dx
mov r14, rcx
mov word [rsp + 0x58], r8w
xor r12d, r12d
mov qword [rsp + 0x50], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x60], r12
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800216f1
cmp byte [0x18009b380], r12b
je 0x1800213e0
mov eax, 0x464
lea r15, str.E:_buildsARK23181_2_trufos_dllkillFile.c
mov qword [rsp + 0x28], r15
mov word [rsp + 0x20], ax
xor r9d, r9d
mov edx, 0x12c
mov r8d, 0x4e49423a
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x180021403
xor edx, edx
mov r8d, 0x12c
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
lea r15, str.E:_buildsARK23181_2_trufos_dllkillFile.c
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x180021417
mov ebx, 0xc000009a
jmp 0x18002169b
mov qword [rsp + 0x40], r12
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0x12c
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov rax, qword [0x18009b4a0]
call qword [0x18007d538]
mov ebx, eax
test eax, eax
jns 0x1800214ab
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002169b
test byte [rcx + 0x1c], 1
je 0x18002169b
cmp byte [rcx + 0x19], 2
jb 0x18002169b
mov edx, 0x2c
lea r9, str.Pt_ZwReadFile
mov dword [rsp + 0x20], ebx
lea r8, [0x180091350]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
jmp 0x18002169b
cmp qword [rsp + 0x70], 0x40
jae 0x1800214f8
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x180021696
test byte [rcx + 0x1c], 1
je 0x180021696
cmp byte [rcx + 0x19], 2
jb 0x180021696
mov edx, 0x2d
lea r8, [0x180091350]
mov rcx, qword [rcx + 0x10]
call fcn.180001070
jmp 0x180021696
movzx edx, byte [rsp + 0xd0]
cmp dl, 1
jne 0x180021545
mov ecx, 0x5a4d
mov rax, qword [rsp + 0x50]
cmp word [rax], cx
je 0x180021545
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x180021696
test byte [rcx + 0x1c], dl
je 0x180021696
cmp byte [rcx + 0x19], 2
jb 0x180021696
mov edx, 0x2e
jmp 0x1800214e3
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dl, 1
jne 0x180021592
cmp dword [rcx], 0x4550
je 0x180021592
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x180021696
test byte [rcx + 0x1c], dl
je 0x180021696
cmp byte [rcx + 0x19], 2
jb 0x180021696
mov edx, 0x2f
jmp 0x1800214e3
mov dword [rsp + 0x64], r12d
mov eax, ecx
sub eax, dword [rsp + 0x50]
add eax, 4
mov dword [rsp + 0x60], eax
mov eax, 0xffff
cmp si, ax
jne 0x1800215b9
test rdi, rdi
je 0x1800215ce
movzx eax, word [rcx + 4]
jmp 0x1800215cb
movzx eax, word [rcx + 4]
cmp ax, si
jne 0x180021696
test rdi, rdi
je 0x1800215ce
mov word [rdi], ax
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 2
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov rax, qword [0x18009b4a8]
call qword [0x18007d538]
mov ebx, eax
test eax, eax
jns 0x180021647
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x18002169b
test byte [rcx + 0x1c], 1
je 0x18002169b
cmp byte [rcx + 0x19], 2
jb 0x18002169b
mov edx, 0x30
lea r9, str.Pt_ZwWriteFile
jmp 0x180021492
mov r8, qword [rsp + 0x70]
cmp r8, 2
je 0x180021691
lea rax, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, rax
je 0x180021696
test byte [rcx + 0x1c], 1
je 0x180021696
cmp byte [rcx + 0x19], 2
jb 0x180021696
mov edx, 0x31
mov dword [rsp + 0x20], r8d
lea r9d, [rdx - 0x2f]
lea r8, [0x180091350]
mov rcx, qword [rcx + 0x10]
call fcn.1800010a0
jmp 0x180021696
mov ebx, r12d
jmp 0x18002169b
mov ebx, 0xc00000e5
cmp qword [rsp + 0x50], 0
je 0x1800216ed
cmp byte [0x18009b380], 0
je 0x1800216d2
mov r9d, 0x4e6
mov qword [rsp + 0x20], r15
mov r8d, 0x4e49423a
lea rdx, [rsp + 0x50]
lea rcx, [0x18009cc40]
call fcn.18004be40
mov eax, ebx
jmp 0x1800216f6
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov eax, ebx
jmp 0x1800216f6
mov eax, 0x57
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18005e1d0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret