Function at 0x180012f20
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x18006e168]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
xor esi, esi
mov r14d, r8d
mov r15, rdx
mov r12d, esi
mov r13d, esi
mov rbp, rsi
mov rbx, rsi
mov rdi, rcx
xor eax, eax
add rbx, 0x10000
lea r8, [rsp + 0x38]
lea r9d, [rax + 0x30]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x180013103
nop
nop
nop
mov rcx, qword [rsp + 0x50]
mov rax, rcx
and eax, 0xfff
cmp rax, 0xfff
je 0x180013103
mov rax, qword [rsp + 0x38]
add rcx, rax
cmp rcx, rbx
jb 0x180013103
cmp dword [rsp + 0x58], 0x1000
jne 0x1800130d6
mov eax, dword [rsp + 0x5c]
cmp al, 1
je 0x1800130d6
bt eax, 8
jb 0x1800130d6
test rbx, rbx
jne 0x18001300b
lea ecx, [rbx + 0x57]
jmp 0x1800130d0
xor eax, eax
lea r8, [rsp + 0x68]
mov rdx, rbx
lea r9d, [rax + 0x30]
mov rcx, rdi
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x1800130d6
lea r8, [rsp + 0x1a0]
mov r9d, 0x40
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1800130d6
cmp word [rsp + 0x1a0], 0x5a4d
jne 0x1800130cb
movsxd rcx, dword [rsp + 0x1dc]
mov eax, ecx
cmp rax, qword [rsp + 0x80]
ja 0x1800130cb
cmp ecx, 0x40
jb 0x1800130cb
lea rdx, [rbx + rcx]
lea r8, [rsp + 0xa0]
mov r9d, 0xf8
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1800130d6
cmp dword [rsp + 0xa0], 0x4550
je 0x18001311a
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x50]
lea r8, [rsp + 0x38]
add rbx, rcx
mov r9d, 0x30
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
jne 0x180012fb0
test rbp, rbp
jne 0x18001317b
mov ecx, 0x10dd
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1800131e7
bt word [rsp + 0xb6], 0xd
jb 0x180013152
cmp word [rsp + 0xb8], 0x10b
mov rbp, rbx
jne 0x180012f60
cmp word [rsp + 0xa4], si
je 0x180012f60
mov r13d, 1
jmp 0x180012f60
cmp word [rsp + 0xb8], 0x20b
jne 0x180012f60
cmp word [rsp + 0xa4], si
je 0x180012f60
mov r12d, 1
jmp 0x180012f60
test r13d, r13d
je 0x18001318a
test r12d, r12d
jne 0x180013190
mov esi, 1
mov dword [rsp + 0x30], esi
jmp 0x1800131d1
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
mov rbx, rax
je 0x1800131cd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call rbx
test eax, eax
je 0x180013113
mov esi, dword [rsp + 0x30]
mov r9, r15
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
mov dword [rsp + 0x20], r14d
call fcn.180013220
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.18003f5f0
mov rbx, qword [rsp + 0x240]
add rsp, 0x1f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret