Function at 0x180040900
Capabilities:
Parse pe header
Write file on windows

Disassembly:
push rdi
push r13
sub rsp, 0x68
mov r8, qword [rcx + 0x48]
movabs rax, 0x6db6db6db6db6db7
sub r8, qword [rcx + 0x40]
mov rdi, rcx
sar r8, 3
mov r10, rdx
imul r8, rax
mov rax, qword [rcx + 0x30]
mov r13b, 1
movzx ecx, word [rax + 6]
cmp rcx, r8
je 0x180040942
xor al, al
add rsp, 0x68
pop r13
pop rdi
ret
mov qword [rsp + 0x88], rbx
test r10, r10
je 0x180040eba
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x40000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rcx, r10
mov dword [rsp + 0x20], 2
lea r8d, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x78], rax
cmp rax, 0xffffffffffffffff
je 0x180040ec2
mov qword [rsp + 0x60], rbp
mov rbp, qword [rdi + 0x78]
mov qword [rsp + 0x58], rsi
lea esi, [rbx + 0x40]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r14
mov r14, qword [rdi + 0x18]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x80], ebx
cmp rbp, 0xffffffffffffffff
je 0x180040a12
test r14, r14
je 0x180040a12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x1800409ec
test eax, eax
je 0x1800409ec
xor bpl, bpl
xor ebx, ebx
jmp 0x180040a15
xor ebx, ebx
lea r9, [rsp + 0x80]
mov r8d, esi
mov qword [rsp + 0x20], rbx
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne bpl
jmp 0x180040a15
xor bpl, bpl
mov r14d, dword [rdi + 0x28]
mov byte [rsp + 0x80], bpl
test r14d, r14d
je 0x180040a9f
mov r12, qword [rdi + 0x20]
mov byte [rsp + 0x80], bpl
test r12, r12
je 0x180040a9f
mov r15, qword [rdi + 0x78]
mov dword [rsp + 0x80], ebx
cmp r15, 0xffffffffffffffff
je 0x180040a90
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x180040a6a
test eax, eax
jne 0x180040a8e
xor ebx, ebx
lea r9, [rsp + 0x80]
mov r8d, r14d
mov qword [rsp + 0x20], rbx
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180040a90
jmp 0x180040a93
xor ebx, ebx
xor bpl, bpl
mov byte [rsp + 0x80], bpl
lea esi, [r14 + 0x40]
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x180040ad4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180040ad4
mov rbp, qword [rdi + 0x30]
test rbp, rbp
je 0x180040ad4
cmp dword [rbp], 0x4550
jne 0x180040ad4
mov ecx, 0x10b
mov eax, ebx
cmp word [rbp + 0x18], cx
setne al
jmp 0x180040add
mov rbp, qword [rdi + 0x30]
mov eax, 1
mov r14, qword [rdi + 0x78]
shl eax, 4
mov dword [rsp + 0x90], ebx
lea r15d, [rax + 0xf8]
cmp r14, 0xffffffffffffffff
je 0x180040bed
test rbp, rbp
je 0x180040bed
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x180040b2b
test eax, eax
jne 0x180040beb
xor ebx, ebx
lea r9, [rsp + 0x90]
mov r8d, r15d
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180040bed
movzx r13d, byte [rsp + 0x80]
mov rax, qword [rdi + 0x30]
add esi, r15d
movzx r14d, bx
cmp bx, word [rax + 6]
jae 0x180040c0e
nop
mov r15, qword [rdi + 0x78]
movzx eax, r14w
imul rbp, rax, 0x38
mov dword [rsp + 0x90], ebx
add rbp, qword [rdi + 0x40]
cmp r15, 0xffffffffffffffff
je 0x180040bff
test rbp, rbp
je 0x180040bff
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x180040bb4
test eax, eax
jne 0x180040bfd
xor ebx, ebx
lea r9, [rsp + 0x90]
mov rdx, rbp
mov qword [rsp + 0x20], rbx
mov rcx, r15
lea r8d, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180040bff
mov rax, qword [rdi + 0x30]
add esi, 0x28
inc r14w
cmp r14w, word [rax + 6]
jb 0x180040b70
jmp 0x180040c0e
xor ebx, ebx
xor r13b, r13b
mov byte [rsp + 0x80], r13b
jmp 0x180040b5a
xor ebx, ebx
mov rax, qword [rdi + 0x30]
xor r13b, r13b
mov byte [rsp + 0x80], r13b
movzx r12d, bx
mov word [rsp + 0x90], bx
cmp bx, word [rax + 6]
jae 0x180040e1b
movzx eax, r12w
imul r13, rax, 0x38
mov rax, qword [rdi + 0x40]
mov ebp, dword [rax + r13 + 0x14]
test ebp, ebp
je 0x180040df6
cmp ebp, esi
jbe 0x180040cdc
mov r12, qword [rdi + 0x78]
mov r15d, ebp
sub r15d, esi
mov edx, 1
mov ecx, r15d
call fcn.180052358
mov r14, rax
test rax, rax
je 0x180040ee0
mov dword [rsp + 0x98], ebx
cmp r12, 0xffffffffffffffff
je 0x180040ed8
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x180040c9f
test eax, eax
jne 0x180040ed6
xor ebx, ebx
lea r9, [rsp + 0x98]
mov r8d, r15d
mov qword [rsp + 0x20], rbx
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180040ed8
mov rcx, r14
call fcn.18005047c
mov rax, qword [rdi + 0x40]
mov esi, ebp
movzx r12d, word [rsp + 0x90]
mov ebp, dword [rax + r13 + 0x30]
test ebp, ebp
je 0x180040df6
mov r14, qword [rdi + 0x78]
mov r15, qword [rax + r13 + 0x28]
mov dword [rsp + 0x90], ebx
cmp r14, 0xffffffffffffffff
je 0x180040eea
test r15, r15
je 0x180040eea
mov edx, dword [rax + r13 + 0x14]
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x180040d35
test eax, eax
jne 0x180040ee8
xor ebx, ebx
lea r9, [rsp + 0x90]
mov r8d, ebp
mov qword [rsp + 0x20], rbx
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180040eea
mov rax, qword [rdi + 0x40]
add esi, ebp
mov ecx, dword [rax + r13 + 0x30]
mov ebp, dword [rax + r13 + 0x10]
cmp ecx, ebp
jae 0x180040df6
mov r15, qword [rdi + 0x78]
lea edx, [rbx + 1]
sub ebp, ecx
mov ecx, ebp
call fcn.180052358
mov r14, rax
test rax, rax
je 0x180040ee0
mov dword [rsp + 0x90], ebx
cmp r15, 0xffffffffffffffff
je 0x180040ed8
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x180040dc6
test eax, eax
jne 0x180040ed6
xor ebx, ebx
lea r9, [rsp + 0x90]
mov r8d, ebp
mov qword [rsp + 0x20], rbx
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180040ed8
mov rcx, r14
call fcn.18005047c
add esi, ebp
mov rax, qword [rdi + 0x30]
inc r12w
mov word [rsp + 0x90], r12w
cmp r12w, word [rax + 6]
jb 0x180040c24
movzx r13d, byte [rsp + 0x80]
mov r14d, dword [rdi + 0x60]
mov r12, qword [rsp + 0x50]
test r14d, r14d
je 0x180040e8c
mov r15, qword [rdi + 0x58]
test r15, r15
je 0x180040e8c
mov rbp, qword [rdi + 0x78]
mov dword [rsp + 0x80], ebx
cmp rbp, 0xffffffffffffffff
je 0x180040e89
xor r9d, r9d
xor r8d, r8d
mov edx, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x180040e65
test eax, eax
jne 0x180040e89
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], 0
mov r8d, r14d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180040e8c
xor r13b, r13b
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, qword [rdi + 0x78]
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
cmp rcx, 0xffffffffffffffff
je 0x180040ec2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x78], 0xffffffffffffffff
mov rbx, qword [rsp + 0x88]
movzx eax, r13b
add rsp, 0x68
pop r13
pop rdi
ret
xor ebx, ebx
mov rcx, r14
call fcn.18005047c
xor r13b, r13b
jmp 0x180040e1b
xor ebx, ebx
xor r13b, r13b
jmp 0x180040e1b