Function at 0x18000b0c0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe8
mov r14, r8
lea rax, vtable.Gdiplus::Bitmap.0
mov qword [rbp - 0x31], rax
xor ebx, ebx
mov qword [rbp - 0x51], rbx
lea r8, [rbp - 0x51]
xor edx, edx
mov rcx, qword [rcx]
call fcn.1800b86b0
mov dword [rbp - 0x21], eax
mov rax, qword [rbp - 0x51]
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x59], rbx
lea r8, [rbp - 0x59]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov dword [rbp + 0x67], 0x706d6218
mov byte [rbp + 0x6b], bl
lea rax, [rbp + 0x68]
mov r15, 0xffffffffffffffff
mov rbx, r15
inc rbx
cmp byte [rax + rbx], 0
jne 0x18000b141
mov rsi, qword [r14 + 0x10]
mov rcx, r14
mov r12, qword [r14 + 0x18]
mov rdi, rsi
mov r13, r12
cmp r12, 0xf
jbe 0x18000b164
mov rcx, qword [r14]
mov r8, rsi
cmp rbx, rsi
cmovb r8, rbx
lea rdx, [rbp + 0x68]
call fcn.18018a980
test eax, eax
jne 0x18000b2b7
cmp rsi, rbx
jb 0x18000b2b7
ja 0x18000b2bd
mov cl, 0x2d
mov word [rsp + 0x20], 0x2d
movsx ebx, cl
movzx eax, bx
xor ax, 0x56
mov word [rsp + 0x22], ax
movzx eax, bx
xor ax, 0x18
mov word [rsp + 0x24], ax
mov word [rsp + 0x26], ax
movzx r10d, bx
xor r10w, 0x1a
mov word [rsp + 0x28], r10w
movzx eax, bx
xor ax, 0x4e
mov word [rsp + 0x2a], ax
movzx r11d, bx
xor r11w, 0x4b
mov word [rsp + 0x2c], r11w
movzx eax, bx
xor ax, 0x19
mov word [rsp + 0x2e], ax
movzx r9d, bx
xor r9w, 0x1d
mov word [rsp + 0x30], r9w
mov word [rsp + 0x32], r9w
mov word [rsp + 0x34], bx
movzx r8d, bx
xor r8w, 0x1c
mov word [rsp + 0x36], r8w
movzx ecx, bx
xor cx, 0x4c
mov word [rsp + 0x38], cx
mov word [rsp + 0x3a], r9w
mov word [rsp + 0x3c], ax
mov word [rsp + 0x3e], bx
mov word [rsp + 0x40], r8w
mov word [rsp + 0x42], r8w
movzx eax, bx
xor ax, 0x49
mov word [rsp + 0x44], ax
movzx edx, bx
xor dx, 0x1e
mov word [rsp + 0x48], bx
movzx eax, bx
xor ax, 0x14
mov word [rbp - 0x7f], ax
mov word [rbp - 0x7d], cx
mov word [rbp - 0x7b], r10w
mov word [rbp - 0x77], bx
mov word [rbp - 0x75], r9w
mov word [rbp - 0x73], r9w
mov word [rbp - 0x71], r9w
mov word [rbp - 0x6f], r9w
mov word [rbp - 0x6d], r11w
movzx eax, bx
xor ax, 0x15
mov word [rbp - 0x6b], ax
mov word [rbp - 0x69], r8w
movzx ecx, bx
xor cx, 0x48
mov word [rbp - 0x65], r11w
movzx eax, bx
xor ax, 0x1f
xor bx, 0x50
mov word [rbp - 0x5d], bx
jmp 0x18000b72a
mov r13, r12
mov rdi, rsi
mov dword [rbp + 0x67], 0x67706a1a
mov byte [rbp + 0x6b], 0
lea rax, [rbp + 0x68]
mov rbx, r15
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x18000b2d0
mov rcx, r14
cmp r12, 0xf
jbe 0x18000b2e5
mov rcx, qword [r14]
mov r8, rsi
cmp rbx, rsi
cmovb r8, rbx
lea rdx, [rbp + 0x68]
call fcn.18018a980
test eax, eax
jne 0x18000b414
cmp rsi, rbx
jb 0x18000b414
ja 0x18000b414
mov cl, 0x7d
mov word [rsp + 0x20], 0x7d
movsx edi, cl
movzx eax, di
xor ax, 6
mov word [rsp + 0x22], ax
movzx eax, di
xor ax, 0x48
mov word [rsp + 0x24], ax
mov word [rsp + 0x26], ax
movzx r11d, di
xor r11w, 0x4a
mov word [rsp + 0x28], r11w
movzx eax, di
xor ax, 0x1e
mov word [rsp + 0x2a], ax
movzx ebx, di
xor bx, 0x1b
mov word [rsp + 0x2c], bx
movzx eax, di
xor ax, 0x49
mov word [rsp + 0x2e], ax
movzx r9d, di
xor r9w, 0x4d
mov word [rsp + 0x30], r9w
movzx r10d, di
xor r10w, 0x4c
mov word [rsp + 0x32], r10w
movzx r8d, di
xor r8w, 0x50
mov word [rsp + 0x36], r10w
movzx ecx, di
xor cx, 0x1c
mov word [rsp + 0x38], cx
mov word [rsp + 0x3a], r9w
mov word [rsp + 0x3c], ax
mov word [rsp + 0x40], r10w
mov word [rsp + 0x42], r10w
movzx eax, di
xor ax, 0x19
mov word [rsp + 0x44], ax
movzx edx, di
xor dx, 0x4e
movzx eax, di
xor ax, 0x44
mov word [rbp - 0x7f], ax
mov word [rbp - 0x7d], cx
mov word [rbp - 0x75], r9w
mov word [rbp - 0x73], r9w
mov word [rbp - 0x71], r9w
mov word [rbp - 0x6f], r9w
movzx eax, di
xor ax, 0x45
mov word [rbp - 0x6b], ax
mov word [rbp - 0x69], r10w
movzx ecx, di
xor cx, 0x18
movzx eax, di
xor ax, 0x4f
jmp 0x18000b702
mov dword [rbp + 0x67], 0x66696710
mov byte [rbp + 0x6b], 0
lea rax, [rbp + 0x68]
mov rbx, r15
inc rbx
cmp byte [rax + rbx], 0
jne 0x18000b426
mov rcx, r14
cmp r13, 0xf
jbe 0x18000b43d
mov rcx, qword [r14]
jmp 0x18000b443
mov rsi, rdi
mov r12, r13
mov r8, rdi
cmp rbx, rdi
cmovb r8, rbx
lea rdx, [rbp + 0x68]
call fcn.18018a980
test eax, eax
jne 0x18000b5a9
cmp rdi, rbx
jb 0x18000b5a9
ja 0x18000b5a9
mov cl, 0x6c
mov word [rsp + 0x20], WSAGetLastError
movsx esi, cl
movzx eax, si
xor ax, 0x17
mov word [rsp + 0x22], ax
movzx eax, si
xor ax, 0x59
mov word [rsp + 0x24], ax
mov word [rsp + 0x26], ax
movzx ebx, si
xor bx, 0x5b
mov word [rsp + 0x28], bx
movzx eax, si
xor ax, 0xf
mov word [rsp + 0x2a], ax
movzx edi, si
xor di, 0xa
mov word [rsp + 0x2c], di
movzx eax, si
xor ax, 0x58
mov word [rsp + 0x2e], ax
movzx r10d, si
xor r10w, 0x5c
mov word [rsp + 0x30], r10w
movzx r11d, si
xor r11w, 0x5e
mov word [rsp + 0x32], r11w
movzx r8d, si
xor r8w, 0x41
mov word [rsp + 0x34], r8w
movzx r9d, si
xor r9w, 0x5d
mov word [rsp + 0x36], r9w
movzx ecx, si
xor cx, 0xd
mov word [rsp + 0x38], cx
mov word [rsp + 0x3a], r10w
mov word [rsp + 0x3c], ax
mov word [rsp + 0x3e], r8w
mov word [rsp + 0x40], r9w
mov word [rsp + 0x42], r9w
movzx eax, si
xor ax, 8
mov word [rsp + 0x44], ax
movzx edx, si
xor dx, 0x5f
mov word [rsp + 0x48], r8w
movzx eax, si
xor ax, 0x55
mov word [rbp - 0x7f], ax
mov word [rbp - 0x7d], cx
mov word [rbp - 0x7b], bx
mov word [rbp - 0x77], r8w
mov word [rbp - 0x75], r10w
mov word [rbp - 0x73], r10w
mov word [rbp - 0x71], r10w
mov word [rbp - 0x6f], r10w
mov word [rbp - 0x6d], di
movzx eax, si
xor ax, 0x54
mov word [rbp - 0x6b], ax
mov word [rbp - 0x69], r9w
movzx eax, si
xor ax, 9
mov word [rbp - 0x67], ax
mov word [rbp - 0x65], di
mov word [rbp - 0x61], r11w
mov word [rbp - 0x5f], ax
xor si, 0x11
mov word [rbp - 0x5d], si
jmp 0x18000b736
mov dword [rbp + 0x67], 0x66697475
mov byte [rbp + 0x6b], 0
lea rax, [rbp + 0x68]
mov rbx, r15
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x18000b5c0
mov rcx, r14
cmp r13, 0xf
jbe 0x18000b5d5
mov rcx, qword [r14]
mov r8, rdi
cmp rbx, rdi
cmovb r8, rbx
lea rdx, [rbp + 0x68]
call fcn.18018a980
test eax, eax
jne 0x18000b75f
cmp rdi, rbx
jb 0x18000b75f
ja 0x18000b75f
mov cl, 0x69
mov word [rsp + 0x20], WSAGetLastError
movsx edi, cl
movzx eax, di
xor ax, 0x12
mov word [rsp + 0x22], ax
movzx ecx, di
xor cx, 0x5c
mov word [rsp + 0x24], cx
mov word [rsp + 0x26], cx
movzx r11d, di
xor r11w, 0x5e
mov word [rsp + 0x28], r11w
movzx eax, di
xor ax, 0xa
mov word [rsp + 0x2a], ax
movzx ebx, di
xor bx, 0xf
mov word [rsp + 0x2c], bx
movzx eax, di
xor ax, 0x5d
mov word [rsp + 0x2e], ax
movzx r10d, di
xor r10w, 0x59
mov word [rsp + 0x32], cx
movzx r8d, di
xor r8w, 0x44
movzx r9d, di
xor r9w, 0x58
movzx ecx, di
xor cx, 8
mov word [rsp + 0x38], cx
mov word [rsp + 0x3c], ax
movzx eax, di
xor ax, 0xd
mov word [rsp + 0x44], ax
movzx edx, di
xor dx, 0x5a
movzx eax, di
xor ax, 0x50
mov word [rbp - 0x7f], ax
mov word [rbp - 0x7d], cx
movzx eax, di
xor ax, 0x51
mov word [rbp - 0x6b], ax
movzx ecx, di
xor cx, 0xc
movzx eax, di
xor ax, 0x5b
xor di, 0x14
mov word [rsp + 0x30], r10w
mov word [rsp + 0x36], r9w
mov word [rbp - 0x69], r9w
mov word [rbp - 0x6f], r10w
mov word [rbp - 0x71], r10w
mov word [rbp - 0x73], r10w
mov word [rbp - 0x75], r10w
mov word [rsp + 0x42], r9w
mov word [rsp + 0x40], r9w
mov word [rsp + 0x3a], r10w
mov word [rsp + 0x34], r8w
mov word [rsp + 0x3e], r8w
mov word [rsp + 0x48], r8w
mov word [rbp - 0x7b], r11w
mov word [rbp - 0x77], r8w
mov word [rbp - 0x6d], bx
mov word [rbp - 0x65], bx
mov word [rbp - 0x5d], di
mov word [rbp - 0x5f], cx
mov word [rbp - 0x61], ax
mov word [rbp - 0x67], cx
mov word [rsp + 0x46], dx
mov word [rbp - 0x79], dx
mov word [rbp - 0x63], dx
xor r12d, r12d
mov word [rbp - 0x5b], r12w
lea rdx, [rbp - 0x41]
lea rcx, [rsp + 0x22]
call qword [sym.imp.ole32.dll_CLSIDFromString]
jmp 0x18000b88b
mov dword [rbp + 0x67], 0x676e7034
mov byte [rbp + 0x6b], 0
lea rax, [rbp + 0x68]
mov rbx, r15
inc rbx
cmp byte [rax + rbx], 0
jne 0x18000b771
mov rcx, r14
cmp r12, 0xf
jbe 0x18000b786
mov rcx, qword [r14]
mov r8, rsi
cmp rbx, rsi
cmovb r8, rbx
lea rdx, [rbp + 0x68]
call fcn.18018a980
test eax, eax
jne 0x18000b888
cmp rsi, rbx
jb 0x18000b888
ja 0x18000b888
mov cl, reloc.WS2_32.dll_WSASetLastError
mov word [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
movsx edi, cl
movzx eax, di
xor ax, 0xb
mov word [rsp + 0x22], ax
movzx eax, di
xor ax, 0x45
mov word [rsp + 0x24], ax
mov word [rsp + 0x26], ax
movzx r11d, di
xor r11w, 0x47
mov word [rsp + 0x28], r11w
movzx eax, di
xor ax, 0x13
mov word [rsp + 0x2a], ax
movzx ebx, di
xor bx, 0x16
mov word [rsp + 0x2c], bx
movzx edx, di
xor dx, 0x44
mov word [rsp + 0x2e], dx
movzx r10d, di
xor r10w, 0x40
movzx eax, di
xor ax, 0x46
mov word [rsp + 0x32], ax
movzx r8d, di
xor r8w, 0x5d
movzx r9d, di
xor r9w, 0x41
movzx ecx, di
xor cx, 0x11
mov word [rsp + 0x38], cx
mov word [rsp + 0x3c], dx
movzx eax, di
xor ax, 0x14
mov word [rsp + 0x44], ax
movzx edx, di
xor dx, 0x43
movzx eax, di
xor ax, 0x49
mov word [rbp - 0x7f], ax
mov word [rbp - 0x7d], cx
movzx eax, di
xor ax, 0x48
mov word [rbp - 0x6b], ax
movzx ecx, di
xor cx, 0x15
movzx eax, di
xor ax, 0x42
xor di, 0xd
jmp 0x18000b6cb
xor r12d, r12d
mov dword [rbp + 0x7f], 0x32
mov dword [rbp + 0x67], 0x67706a25
mov byte [rbp + 0x6b], 0
lea rax, [rbp + 0x68]
mov rbx, r15
inc rbx
cmp byte [rax + rbx], 0
jne 0x18000b8a4
mov rdi, qword [r14 + 0x10]
mov rcx, r14
mov rsi, qword [r14 + 0x18]
cmp rsi, 0xf
jbe 0x18000b8c1
mov rcx, qword [r14]
mov r8, rdi
cmp rbx, rdi
cmovb r8, rbx
lea rdx, [rbp + 0x68]
call fcn.18018a980
test eax, eax
jne 0x18000b907
cmp rdi, rbx
jb 0x18000b907
ja 0x18000b907
mov dword [rbp - 0x19], 1
movups xmm0, xmmword [0x1801b6d30]
movups xmmword [rbp - 0x11], xmm0
mov dword [rbp + 3], 4
mov dword [rbp - 1], 1
lea rax, [rbp + 0x7f]
mov qword [rbp + 7], rax
mov dword [rbp + 0x67], 0x67706a35
mov byte [rbp + 0x6b], 0
lea rax, [rbp + 0x68]
inc r15
cmp byte [rax + r15], 0
jne 0x18000b916
mov rcx, r14
cmp rsi, 0xf
jbe 0x18000b92c
mov rcx, qword [r14]
mov r8, rdi
cmp r15, rdi
cmovb r8, r15
lea rdx, [rbp + 0x68]
call fcn.18018a980
test eax, eax
jne 0x18000b950
cmp rdi, r15
jb 0x18000b950
ja 0x18000b950
lea r9, [rbp - 0x19]
jmp 0x18000b953
xor r9d, r9d
mov r15, qword [rbp - 0x51]
lea r8, [rbp - 0x41]
mov rdx, qword [rbp - 0x59]
mov rcx, r15
call fcn.1800b87b0
test eax, eax
je 0x18000b970
mov dword [rbp - 0x21], eax
jmp 0x18000b973
mov eax, r12d
test eax, eax
je 0x18000b9c1
mov rcx, r15
call fcn.1800b8720
nop
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x18000b9ba
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18000b9b5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000bac5
mov rcx, r8
call fcn.1800c17e8
xor al, al
jmp 0x18000baa1
mov qword [rbp - 0x49], r12
lea rdx, [rbp - 0x49]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ole32.dll_GetHGlobalFromStream]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_GlobalSize]
movsxd rdi, eax
mov rsi, qword [rbp + 0x6f]
mov r9, qword [rsi + 8]
mov rdx, qword [rsi]
mov rcx, r9
sub rcx, rdx
cmp rdi, rcx
jae 0x18000ba00
lea rax, [rdx + rdi]
mov qword [rsi + 8], rax
jmp 0x18000ba33
jbe 0x18000ba33
mov rax, qword [rsi + 0x10]
sub rax, rdx
cmp rdi, rax
jbe 0x18000ba1b
mov rdx, rdi
mov rcx, rsi
call fcn.180041470
jmp 0x18000ba33
mov r8, rdi
sub r8, rcx
lea rbx, [r8 + r9]
xor edx, edx
mov rcx, r9
call fcn.18018a540
mov qword [rsi + 8], rbx
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rdi
mov rdx, rax
mov rcx, qword [rsi]
call fcn.180189ea0
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [rbp - 0x59]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, r15
call fcn.1800b8720
nop
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x18000ba9f
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18000ba9a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000bac5
mov rcx, r8
call fcn.1800c17e8
mov al, 1
mov byte [r14], 0
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov qword [r14 + 0x10], r12
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800e1ef4
int3