Function at 0x180018fcc
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov r15d, r8d
mov rbx, rdx
xor r12d, r12d
test r9, r9
jne 0x180019029
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rbx, rbx
cmove rbx, rax
mov qword [rsp + 0xc8], rbx
cmp rbx, rax
jne 0x180019029
lea r13d, [r12 + 1]
test r15d, r15d
cmove r12d, r13d
jmp 0x18001902f
mov r13d, 1
mov dword [rsp + 0x20], r12d
mov eax, ebx
shr rax, 4
xor edx, edx
div qword [reloc.WS2_32.dll_inet_addr]
mov rsi, rdx
mov r9, qword [0x180174de0]
mov r8, qword [r9 + rdx*8]
jmp 0x18001905c
cmp qword [r8], rbx
je 0x180019061
mov r8, qword [r8 + 0x10]
test r8, r8
jne 0x180019053
xor ecx, ecx
test r8, r8
setne cl
xor eax, eax
test r8, r8
sete al
test r15d, r15d
cmovne eax, ecx
test eax, eax
jne 0x180019320
mov qword [rsp + 0x48], rbx
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x180019320
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x180019320
mov r14d, dword [rax + rbx + 0x90]
test r14d, r14d
je 0x180019320
test r15d, r15d
je 0x1800190e0
and qword [rsp + 0xc0], 0
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0xc8]
lea rcx, [0x180174de0]
call fcn.1800193a8
jmp 0x18001915a
mov rdi, qword [r9 + rdx*8]
jmp 0x1800190ef
cmp qword [rdi], rbx
je 0x1800190f4
mov rdi, qword [rdi + 0x10]
test rdi, rdi
jne 0x1800190e6
test rdi, rdi
jne 0x180019113
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc000008c
call qword [sym.imp.KERNEL32.dll_RaiseException]
xor edx, edx
mov rcx, qword [r9 + rsi*8]
jmp 0x180019127
cmp rcx, rdi
je 0x18001912e
mov rdx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x18001911b
jmp 0x18001915a
mov rax, qword [rcx + 0x10]
test rdx, rdx
je 0x18001913d
mov qword [rdx + 0x10], rax
jmp 0x180019141
mov qword [r9 + rsi*8], rax
mov rax, qword [0x180174de8]
mov qword [rcx + 0x10], rax
mov qword [0x180174de8], rcx
sub qword [0x180174df8], r13
lea rsi, [rbx + r14]
mov qword [rsp + 0x28], rsi
cmp dword [rsi + 0xc], 0
je 0x18001930f
mov edi, dword [rsi + 0xc]
add rdi, rbx
lea rdx, str.KERNEL32.DLL
mov rcx, rdi
call fcn.1800296d0
test eax, eax
jne 0x1800192db
mov edi, dword [rsi]
add rdi, rbx
mov qword [rsp + 0x38], rdi
mov r14d, dword [rsi + 0x10]
add r14, rbx
mov qword [rsp + 0x40], r14
mov rax, qword [rdi]
test rax, rax
je 0x1800192b4
js 0x180019297
add rax, 2
add rax, rbx
mov r8, qword [0x180174dd8]
sub r8, rax
movzx ecx, byte [rax]
movzx edx, byte [rax + r8]
sub ecx, edx
jne 0x1800191d6
add rax, r13
test edx, edx
jne 0x1800191c3
test ecx, ecx
jne 0x180019297
mov r13, qword [r14]
mov qword [rsp + 0x30], r13
test r15d, r15d
je 0x1800191f9
xor eax, eax
cmp r13, qword [sym.mi.dll_BT_NetFilter]
setne al
jmp 0x1800191fe
mov eax, 1
test eax, eax
je 0x180019297
xor edx, edx
lea r8d, [rdx + 0x30]
lea rcx, [rsp + 0x50]
call fcn.180023140
mov r8d, gethostbyname
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
lea r9, [rsp + 0xc0]
mov r8d, 4
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180019297
test r15d, r15d
cmovne r13, qword [sym.mi.dll_BT_NetFilter]
mov qword [r14], r13
lea r9, [rsp + 0xc0]
mov r8d, dword [rsp + 0x74]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test r15d, r15d
je 0x1800192b4
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xc8]
lea rcx, [0x180174de0]
call fcn.1800193a8
jmp 0x1800192b4
add rdi, 8
mov qword [rsp + 0x38], rdi
add r14, 8
mov qword [rsp + 0x40], r14
mov r13d, 1
jmp 0x1800191a0
mov r13d, 1
jmp 0x180019306
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180019306
mov r9, qword [rsp + 0xd8]
inc r9
mov r8d, r15d
mov rdx, rax
lea rcx, sym.mi.dll_BT_NetFilter
call fcn.180018fcc
add rsi, 0x14
jmp 0x18001915e
test r12d, r12d
je 0x180019320
lea rcx, [0x180174de0]
call fcn.18001947c
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret