Function at 0x180006708
Capabilities:
Access peb ldr_data
Inspect section memory permissions
Parse pe header
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
xor ebp, ebp
mov r12d, ebp
mov r13d, ebp
mov r14d, ebp
mov qword [rsp + 0x20], rbp
mov edi, ebp
mov qword [rsp + 0x88], rbp
mov r15d, ebp
call fcn.1800066fc
lea r9d, [rbp + 1]
mov rbx, rax
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x180006766
movsxd rdx, dword [rbx + 0x3c]
lea rcx, [rdx - 0x40]
cmp rcx, 0x3bf
ja 0x180006766
cmp dword [rdx + rbx], 0x4550
je 0x18000676b
sub rbx, r9
jmp 0x180006742
mov rax, qword gs:[0x60]
mov qword [rsp + 0x98], rbx
mov r11d, 4
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x20]
mov qword [rsp + 0x90], rsi
test rsi, rsi
je 0x1800069b1
mov r10d, 0xffff
mov rdx, qword [rsi + 0x50]
movzx r8d, word [rsi + 0x48]
mov rcx, rbp
ror ecx, 0xd
cmp byte [rdx], 0x61
jb 0x1800067bf
movzx eax, byte [rdx]
sub eax, 0x20
cdqe
jmp 0x1800067c2
movzx eax, byte [rdx]
add rcx, rax
add rdx, r9
add r8w, r10w
jne 0x1800067ad
cmp ecx, 0x6a4abc5b
jne 0x1800068d1
mov rdx, qword [rsi + 0x20]
mov edi, 5
mov esi, 0xffff
movsxd rax, dword [rdx + 0x3c]
mov ebp, dword [rax + rdx + 0x88]
mov r10d, dword [rbp + rdx + 0x20]
mov r11d, dword [rbp + rdx + 0x24]
add r10, rdx
add r11, rdx
xor ebx, ebx
mov r8d, dword [r10]
mov ecx, ebx
add r8, rdx
mov al, byte [r8]
ror ecx, 0xd
movsx eax, al
add r8, r9
add ecx, eax
mov al, byte [r8]
test al, al
jne 0x180006810
cmp ecx, 0xec0e4e8e
je 0x18000684a
cmp ecx, 0x7c0dfcaa
je 0x18000684a
cmp ecx, 0x91afca54
je 0x18000684a
cmp ecx, 0x7946c61b
je 0x18000684a
cmp ecx, 0xef632f2
jne 0x1800068b9
mov eax, dword [rbp + rdx + 0x1c]
movzx r8d, word [r11]
lea r9, [rdx + rax]
cmp ecx, 0xec0e4e8e
jne 0x180006867
mov r12d, dword [r9 + r8*4]
add r12, rdx
jmp 0x1800068b0
cmp ecx, 0x7c0dfcaa
jne 0x180006878
mov r13d, dword [r9 + r8*4]
add r13, rdx
jmp 0x1800068b0
cmp ecx, 0x91afca54
jne 0x180006889
mov r14d, dword [r9 + r8*4]
add r14, rdx
jmp 0x1800068b0
cmp ecx, 0x7946c61b
jne 0x1800068a1
mov ebx, dword [r9 + r8*4]
add rbx, rdx
mov qword [rsp + 0x20], rbx
xor ebx, ebx
jmp 0x1800068b0
cmp ecx, 0xef632f2
jne 0x1800068b0
mov r15d, dword [r9 + r8*4]
add r15, rdx
add di, si
mov r9d, 1
add r10, 4
add r11, 2
test di, di
jne 0x180006805
xor ebp, ebp
jmp 0x18000695a
cmp ecx, 0x3cfa685d
jne 0x180006970
mov r8, qword [rsi + 0x20]
mov ebx, 1
mov esi, 0xffff
movsxd rax, dword [r8 + 0x3c]
movzx edi, bx
mov r11d, dword [rax + r8 + 0x88]
mov r9d, dword [r11 + r8 + 0x20]
mov r10d, dword [r11 + r8 + 0x24]
add r9, r8
add r10, r8
mov ecx, dword [r9]
mov edx, ebp
add rcx, r8
mov al, byte [rcx]
ror edx, 0xd
movsx eax, al
add rcx, rbx
add edx, eax
mov al, byte [rcx]
test al, al
jne 0x180006914
cmp edx, 0x534c0ab8
jne 0x18000694d
mov eax, dword [r11 + r8 + 0x1c]
movzx edx, word [r10]
add di, si
lea rcx, [r8 + rax]
mov ebp, dword [rcx + rdx*4]
add rbp, r8
mov qword [rsp + 0x88], rbp
xor ebp, ebp
add r9, 4
add r10, 2
test di, di
jne 0x18000690a
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov r10d, 0xffff
test r12, r12
je 0x180006989
test r13, r13
je 0x180006989
test r14, r14
je 0x180006989
test r15, r15
je 0x180006989
test rdi, rdi
jne 0x1800069a3
mov rsi, qword [rsi]
mov r9d, 1
mov qword [rsp + 0x90], rsi
test rsi, rsi
jne 0x1800067a1
mov rbx, qword [rsp + 0x98]
mov r11d, 4
movsxd rdi, dword [rbx + 0x3c]
mov r9d, r11d
xor ecx, ecx
add rdi, rbx
mov r8d, 0x3000
mov edx, dword [rdi + 0x50]
mov qword [rsp + 0x90], rdi
call r14
mov edx, dword [rdi + 0x50]
mov rcx, rax
mov rbp, rax
call r15
mov edx, dword [rdi + 0x54]
xor r15d, r15d
mov rcx, rbx
lea r11d, [r15 + 1]
test rdx, rdx
je 0x180006a03
mov r8, rbp
sub r8, rbx
mov al, byte [rcx]
mov byte [r8 + rcx], al
add rcx, r11
sub rdx, r11
jne 0x1800069f5
movzx r9d, word [rdi + 6]
movzx eax, word [rdi + 0x14]
test r9, r9
je 0x180006a49
lea rcx, [rdi + 0x2c]
add rcx, rax
mov edx, dword [rcx - 8]
mov r8d, dword [rcx]
mov r10d, dword [rcx - 4]
add rdx, rbp
add r8, rbx
sub r9, r11
test r10, r10
je 0x180006a40
mov al, byte [r8]
add r8, r11
mov byte [rdx], al
add rdx, r11
sub r10, r11
jne 0x180006a30
add rcx, 0x28
test r9, r9
jne 0x180006a18
mov ebx, dword [rdi + 0x90]
mov ecx, 8
add rbx, rbp
cmp dword [rbx], r15d
je 0x180006afb
mov ecx, dword [rbx + 0xc]
add rcx, rbp
call r12
mov r15, rax
xor eax, eax
test r15, r15
je 0x180006ae7
mov r14d, dword [rbx]
mov esi, dword [rbx + 0x10]
add r14, rbp
add rsi, rbp
jmp 0x180006ae2
test r14, r14
je 0x180006abd
movabs rax, 0x8000000000000000
test qword [r14], rax
je 0x180006abd
movsxd rax, dword [r15 + 0x3c]
movzx edx, word [r14]
mov ecx, dword [rax + r15 + 0x88]
mov eax, dword [rcx + r15 + 0x10]
mov ecx, dword [rcx + r15 + 0x1c]
add rcx, r15
sub rdx, rax
mov eax, dword [rcx + rdx*4]
add rax, r15
jmp 0x180006acd
mov rdx, qword [rsi]
mov rcx, r15
add rdx, 2
add rdx, rbp
call r13
mov qword [rsi], rax
mov ecx, 8
xor eax, eax
add rsi, rcx
test r14, r14
je 0x180006ae2
add r14, rcx
cmp qword [rsi], rax
jne 0x180006a81
add rbx, 0x14
xor r15d, r15d
cmp dword [rbx], r15d
jne 0x180006a60
lea ecx, [r15 + 8]
mov eax, dword [rdi + 0xb4]
mov r10, rbp
sub r10, qword [rdi + 0x30]
test eax, eax
je 0x180006bc7
mov r8d, dword [rdi + 0xb0]
mov r11d, eax
add r8, rbp
test eax, eax
je 0x180006bc7
mov esi, 0xfff
mov edi, 2
cmp dword [r8 + 4], r15d
je 0x180006bbf
mov r9d, dword [r8 + 4]
mov edx, dword [r8]
lea rbx, [r8 + 8]
sub r9, rcx
add rdx, rbp
shr r9, 1
je 0x180006baf
mov r14d, 1
movzx ecx, word [rbx]
sub r9, r14
movzx eax, cx
shr ax, 0xc
cmp ax, 0xa
jne 0x180006b71
and rcx, rsi
add qword [rcx + rdx], r10
jmp 0x180006ba3
cmp ax, 3
jne 0x180006b80
and rcx, rsi
add dword [rcx + rdx], r10d
jmp 0x180006ba3
cmp ax, r14w
jne 0x180006b96
mov rax, r10
and rcx, rsi
shr rax, 0x10
add word [rcx + rdx], ax
jmp 0x180006ba3
cmp ax, di
jne 0x180006ba3
and rcx, rsi
add word [rcx + rdx], r10w
add rbx, rdi
test r9, r9
jne 0x180006b55
lea ecx, [r9 + 8]
mov eax, dword [r8 + 4]
add r8, rax
sub r11, rax
jne 0x180006b2f
mov rdi, qword [rsp + 0x90]
movzx esi, word [rdi + 6]
movzx eax, word [rdi + 0x14]
test rsi, rsi
je 0x180006cd7
mov r14, qword [rsp + 0x20]
lea rbx, [rdi + 0x3c]
mov edx, 0x80000000
mov r13d, 0x40000000
mov r12d, 0x20000000
mov edi, 8
add rbx, rax
mov ecx, dword [rbx - 0x18]
mov dword [rsp + 0x80], r15d
dec rsi
add rcx, rbp
test dword [rbx], edx
mov r8d, r15d
cmovne r8d, edi
mov eax, 2
mov dword [rsp + 0x80], r8d
test dword [rbx], r13d
cmovne r8d, eax
mov dword [rsp + 0x80], r8d
test dword [rbx], edx
je 0x180006c48
test dword [rbx], r13d
mov eax, 4
cmovne r8d, eax
mov dword [rsp + 0x80], r8d
test dword [rbx], r12d
mov eax, 0x10
cmovne r8d, eax
mov dword [rsp + 0x80], r8d
test dword [rbx], r12d
je 0x180006caa
test dword [rbx], edx
mov eax, 0x80
cmovne r8d, eax
mov dword [rsp + 0x80], r8d
test dword [rbx], r12d
je 0x180006caa
test dword [rbx], r13d
mov eax, 0x20
cmovne r8d, eax
mov dword [rsp + 0x80], r8d
test dword [rbx], r12d
je 0x180006caa
test dword [rbx], edx
je 0x180006caa
test dword [rbx], r13d
mov eax, pe_nt_image_headers64
cmovne r8d, eax
mov dword [rsp + 0x80], r8d
mov edx, dword [rbx - 0x14]
test rdx, rdx
je 0x180006cbd
lea r9, [rsp + 0x80]
call r14
add rbx, 0x28
mov edx, 0x80000000
test rsi, rsi
jne 0x180006bfa
mov rdi, qword [rsp + 0x90]
mov ebx, dword [rdi + 0x28]
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
add rbx, rbp
call qword [rsp + 0x88]
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 1]
call rbx
mov rax, rbx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret