Function at 0x60001450
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov eax, 0x5a4d
mov r13, rcx
cmp word [rcx], ax
jne 0x600018f8
movsxd rbp, dword [rcx + 0x3c]
add rbp, rcx
cmp dword [rbp], 0x4550
jne 0x600018f8
mov rcx, qword [0x60180c20]
mov ebx, dword [rbp + 0x50]
mov rdi, qword [rbp + 0x30]
test rcx, rcx
jne 0x600014b9
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x30]
mov qword [0x60180c20], rcx
lea rdx, str.VirtualAlloc
call fcn.60001910
mov r9d, 4
mov r8d, 0x2000
mov rdx, rbx
mov rcx, rdi
call rax
mov qword [rsp + 0x50], rax
mov rsi, rax
test rax, rax
jne 0x6000154b
mov rcx, qword [0x60180c20]
mov ebx, dword [rbp + 0x50]
test rcx, rcx
jne 0x6000151b
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x30]
mov qword [0x60180c20], rcx
lea rdx, str.VirtualAlloc
call fcn.60001910
mov r9d, 4
mov r8d, 0x2000
mov rdx, rbx
xor ecx, ecx
call rax
mov qword [rsp + 0x50], rax
mov rsi, rax
test rax, rax
je 0x600018f8
mov rcx, qword [0x60180c20]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
test rcx, rcx
jne 0x60001587
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x30]
mov qword [0x60180c20], rcx
lea rdx, [0x60018820]
call fcn.60001910
call rax
mov rcx, qword [0x60180c20]
mov rbx, rax
test rcx, rcx
jne 0x600015ca
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x30]
mov qword [0x60180c20], rcx
lea rdx, [0x60018810]
call fcn.60001910
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x28]
call rax
mov rcx, qword [0x60180c20]
xor r14d, r14d
mov r15, rax
mov qword [rax + 8], rsi
mov qword [rax + 0x20], r14
mov qword [rax + 0x10], r14
mov ebx, dword [rbp + 0x50]
test rcx, rcx
jne 0x60001628
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x30]
mov qword [0x60180c20], rcx
lea rdx, str.VirtualAlloc
call fcn.60001910
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rsi
call rax
mov rcx, qword [0x60180c20]
mov ebx, dword [rbp + 0x54]
test rcx, rcx
jne 0x6000167d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x30]
mov qword [0x60180c20], rcx
lea rdx, str.VirtualAlloc
call fcn.60001910
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rsi
call rax
mov r8d, dword [rbp + 0x54]
mov rdx, r13
add r8d, dword [r13 + 0x3c]
mov rcx, rax
mov rbx, rax
call fcn.60003850
movsxd rax, dword [r13 + 0x3c]
mov ecx, 0x10b
add rax, rbx
mov qword [r15], rax
cmp word [rax + 0x18], cx
je 0x600018f4
mov qword [rax + 0x30], rsi
xor eax, eax
mov rcx, qword [r15]
mov qword [rsp + 0x58], r12
mov r12, qword [r15 + 8]
movzx edi, word [rcx + 0x14]
add rdi, 0x28
cmp ax, word [rcx + 6]
jae 0x60001801
add rdi, rcx
mov eax, dword [rdi]
test eax, eax
jne 0x60001773
movsxd r8, dword [rbp + 0x38]
test r8d, r8d
jle 0x600017e5
mov esi, dword [rdi - 4]
mov rcx, qword [0x60180c20]
add rsi, r12
test rcx, rcx
jne 0x6000173e
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
mov rdx, qword [rax]
mov rax, qword [rdx]
mov rcx, qword [rax + 0x30]
mov qword [0x60180c20], rcx
lea rdx, str.VirtualAlloc
mov rbx, r8
call fcn.60001910
mov r9d, 4
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rsi
call rax
mov r8, rbx
mov dword [rdi - 8], eax
xor edx, edx
mov rcx, rax
call fcn.60002ba0
jmp 0x600017e5
mov ebx, dword [rdi - 4]
mov rsi, rax
mov rcx, qword [0x60180c20]
add rbx, r12
test rcx, rcx
jne 0x600017ae
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax]
mov rax, qword [r8]
mov rcx, qword [rax + 0x30]
mov qword [0x60180c20], rcx
lea rdx, str.VirtualAlloc
call fcn.60001910
mov r9d, 4
mov r8d, 0x1000
mov rdx, rsi
mov rcx, rbx
call rax
mov edx, dword [rdi + 4]
mov rcx, rax
mov r8d, dword [rdi]
add rdx, r13
mov rbx, rax
call fcn.60003850
mov dword [rdi - 8], ebx
mov rcx, qword [r15]
inc r14d
add rdi, 0x28
movzx eax, word [rcx + 6]
cmp r14d, eax
jl 0x600016f3
mov rsi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rbx, rsi
sub rbx, qword [rbp + 0x30]
je 0x600018ae
cmp dword [rcx + 0xb4], 0
jbe 0x600018ae
mov rdi, qword [r15 + 8]
mov r11d, dword [rcx + 0xb0]
add r11, rdi
mov eax, dword [r11]
test eax, eax
je 0x600018ae
xor esi, esi
nop word [rax + rax]
mov r10d, dword [r11 + 4]
lea rdx, [r11 + 8]
mov r9d, eax
mov r8d, esi
add r9, rdi
lea rax, [r10 - 8]
test rax, 0xfffffffffffffffe
jbe 0x6000189c
nop dword [rax]
movzx eax, word [rdx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
cmp eax, 3
je 0x6000187e
cmp eax, 0xa
jne 0x60001882
add qword [rcx + r9], rbx
jmp 0x60001882
add dword [rcx + r9], ebx
mov r10d, dword [r11 + 4]
inc r8d
add rdx, 2
mov eax, r8d
lea rcx, [r10 - 8]
shr rcx, 1
cmp rax, rcx
jb 0x60001860
mov eax, r10d
add r11, rax
mov eax, dword [r11]
test eax, eax
jne 0x60001840
mov rsi, qword [rsp + 0x50]
mov rcx, r15
call fcn.60001270
test eax, eax
je 0x600018f4
mov rcx, r15
call fcn.600010a0
mov rax, qword [r15]
mov ecx, dword [rax + 0x28]
test ecx, ecx
je 0x600018dc
lea rax, [rsi + rcx]
mov dword [r15 + 0x24], 1
mov qword [r15 + 0x18], rax
mov rax, r15
mov r14, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
add rsp, 0x20
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor eax, eax
jmp 0x600018df
xor eax, eax
add rsp, 0x20
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret