Function at 0x180013650
Capabilities:
Parse pe header

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x230
mov rax, qword [0x18006e168]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov ebp, r9d
mov r13, r8
mov r12, rdx
lea r8d, [rbp + 0x1c8]
xor edx, edx
mov r9d, 0x1000
mov rsi, rcx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
mov rdi, rax
jne 0x1800136a9
xor eax, eax
jmp 0x180013944
xor edx, edx
lea rcx, [rsp + 0x1d0]
mov qword [rsp + 0x30], 0
lea r8d, [rdx + 0x40]
call sub.MSVCR80.dll_memset
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x1d0]
mov r9d, 0x40
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov word [rsp + 0x1d0], 0x5a4d
mov dword [rsp + 0x20c], 0x40
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800136a2
cmp qword [rsp + 0x30], 0x40
jne 0x1800136a2
lea rcx, [rsp + 0x80]
xor edx, edx
mov r8d, 0x108
mov qword [rsp + 0x228], rbx
lea rbx, [rdi + 0x40]
call sub.MSVCR80.dll_memset
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x80]
mov r9d, 0x108
mov rdx, rbx
mov rcx, rsi
mov dword [rsp + 0x80], 0x4550
mov qword [rsp + 0x20], rax
mov word [rsp + 0x94], 0xf0
mov word [rsp + 0x96], 0x2000
mov word [rsp + 0x86], 1
mov word [rsp + 0x98], 0x20b
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18001393a
cmp qword [rsp + 0x30], 0x108
jne 0x18001393a
xor edx, edx
lea rcx, [rsp + 0x1a8]
lea r8d, [rdx + 0x28]
call sub.MSVCR80.dll_memset
lea eax, [rbx + 0x108]
movabs r11, 0x72756f7465642e
sub eax, edi
lea edi, [rbp + 0x58]
lea r8, [rsp + 0x1a8]
add eax, 0x28
lea rdx, [rbx + 0x108]
mov r9d, 0x28
mov dword [rsp + 0x1b4], eax
lea rax, [rsp + 0x30]
mov rcx, rsi
mov qword [rsp + 0x1a8], r11
mov dword [rsp + 0x1b8], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18001393a
cmp qword [rsp + 0x30], 0x28
jne 0x18001393a
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x40]
call sub.MSVCR80.dll_memset
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x40]
lea rdx, [rbx + 0x130]
mov r9d, 0x40
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 0x40
mov dword [rsp + 0x44], 0x727444
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x4c], edi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18001393a
cmp qword [rsp + 0x30], 0x40
jne 0x18001393a
xor eax, eax
lea rcx, [rsp + 0x198]
lea r8, [rsp + 0x190]
mov dword [rsp + 0x190], eax
mov dword [rsp + 0x194], eax
mov dword [rsp + 0x198], eax
mov dword [rsp + 0x19c], eax
mov dword [rsp + 0x1a0], eax
mov dword [rsp + 0x1a4], eax
mov dword [rsp + 0x194], 0
lea eax, [rbp + 0x18]
lea rdx, [rbx + 0x170]
mov dword [rsp + 0x190], eax
mov rax, qword [r12]
mov r9d, 0x18
mov qword [rcx], rax
mov rax, qword [r12 + 8]
mov qword [rcx + 8], rax
lea rax, [rsp + 0x30]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18001393a
cmp qword [rsp + 0x30], 0x18
jne 0x18001393a
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x188]
mov r9, rbp
mov r8, r13
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18001393a
cmp qword [rsp + 0x30], rbp
jne 0x18001393a
mov eax, 1
jmp 0x18001393c
xor eax, eax
mov rbx, qword [rsp + 0x228]
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.18003f5f0
add rsp, 0x230
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret