Function at 0x18000a140
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xc0
mov rax, qword [0x180037040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbp, qword [rsp + 0x120]
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
xor eax, eax
mov r15d, r8d
mov dword [rsp + 0x30], r8d
xor r8d, r8d
mov qword [rsp + 0x58], rbp
mov qword [rbp], r8
mov ecx, 0x48
rep stosb byte [rdi], al
mov rax, qword gs:[0x30]
mov r13d, r9d
mov r12, rdx
mov rcx, qword [rax + 0x30]
cmp qword [rcx + 0x60], r8
je 0x18000a3a8
mov qword [rsp + 0x118], r14
mov ebx, 0x5a4d
movzx r14d, r8w
mov dword [rsp + 0x40], 0x84c05e40
mov dword [rsp + 0x44], 0x6ae69f02
mov dword [rsp + 0x48], 0xa7dc6e73
nop dword [rax]
movzx eax, r14w
cmp eax, r15d
jae 0x18000a2a5
movzx edi, r14w
xor edx, edx
mov ecx, dword [rsp + rdi*4 + 0x40]
call fcn.180009630
mov rbp, rax
test rax, rax
je 0x18000a293
xor r8d, r8d
lea rcx, [rdi + rdi*2]
lea r15, [rsp + 0x60]
lea r15, [r15 + rcx*8]
cmp word [rax], bx
jne 0x18000a31d
movsxd rsi, dword [rax + 0x3c]
add rsi, rax
cmp dword [rsi], 0x4550
jne 0x18000a31d
mov ebx, r8d
cmp r8w, word [rsi + 6]
jae 0x18000a30e
movzx ecx, word [rsi + 0x14]
add rcx, rsi
mov eax, ebx
lea rdx, [rax + rax*4]
lea rdi, [rcx + rdx*8]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
inc rcx
cmp byte [rdi + rcx + 0x18], 0
jne 0x18000a260
dec rcx
lea rdx, [rdi + 0x18]
call fcn.180004220
not eax
cmp eax, 0xa21c1ea3
je 0x18000a2ed
movzx eax, word [rsi + 6]
inc ebx
cmp ebx, eax
jb 0x18000a242
mov r15d, dword [rsp + 0x30]
mov ebx, 0x5a4d
xor r8d, r8d
inc r14w
cmp r14w, 3
jb 0x18000a1e0
mov r14, qword [rsp + 0x118]
mov esi, r8d
test r15d, r15d
je 0x18000a3a8
lea rbx, [rsp + 0x68]
nop
mov rax, qword [rbx]
test rax, rax
je 0x18000a399
mov edi, dword [rbx + 8]
test edi, edi
je 0x18000a399
test r13d, r13d
je 0x18000a327
test al, 0xf
je 0x18000a327
add rax, 0x10
and rax, 0xfffffffffffffff0
add edi, 0xfffffff0
jmp 0x18000a331
mov ecx, dword [rdi + 0x24]
mov qword [r15], rbp
lea rax, [rcx + rbp]
sub ecx, dword [rdi + 0x2c]
mov qword [r15 + 8], rax
mov eax, dword [rdi + 0x28]
mov dword [r15 + 0x10], eax
mov dword [r15 + 0x14], ecx
jmp 0x18000a289
mov r15d, dword [rsp + 0x30]
mov ebx, 0x5a4d
jmp 0x18000a296
mov r15d, dword [rsp + 0x30]
jmp 0x18000a296
mov ecx, 0xffffffff
sub ecx, r12d
add edi, ecx
cmp r12, 2
jne 0x18000a37a
mov rdx, qword [rsp + 0x38]
mov ecx, edi
add rcx, rax
movzx edx, word [rdx]
test r13d, r13d
je 0x18000a363
cmp rax, rcx
jae 0x18000a375
nop
cmp dx, word [rax]
je 0x18000a394
add rax, 0x10
cmp rax, rcx
jb 0x18000a350
mov rax, r8
jmp 0x18000a394
cmp rax, rcx
jae 0x18000a375
cmp dx, word [rax]
je 0x18000a394
inc rax
cmp rax, rcx
jb 0x18000a368
mov rax, r8
jmp 0x18000a394
mov r8, qword [rsp + 0x38]
mov r9, r12
mov edx, edi
mov dword [rsp + 0x20], r13d
mov rcx, rax
call fcn.18000a0b0
xor r8d, r8d
test rax, rax
jne 0x18000a3cc
inc esi
add rbx, 0x18
cmp esi, r15d
jb 0x18000a2c0
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18000b670
add rsp, 0xc0
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, esi
lea rdx, [rcx + rcx*2]
mov rcx, qword [rsp + rdx*8 + 0x60]
mov rdx, qword [rsp + 0x58]
mov qword [rdx], rcx
jmp 0x18000a3aa