Function at 0x180006b80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rsi, rdx
mov r13, qword [0x1802e4ca0]
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x180006e3f
movsxd rbx, dword [rdx + 0x3c]
add rbx, rdx
cmp dword [rbx], 0x4550
jne 0x180006e3f
mov eax, 0x20b
cmp word [rbx + 0x18], ax
jne 0x180006e3f
mov edi, dword [rbx + 0x50]
mov edx, edi
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
test rax, rax
je 0x180006e4f
movzx eax, word [rbx + 0x14]
mov eax, dword [rax + rbx + 0x24]
mov dword [rsp + 0x30], eax
sub edi, eax
mov edx, edi
mov qword [rsp + 0x40], rdx
jne 0x180006c1a
xor ebp, ebp
mov r15, rbp
jmp 0x180006dfb
mov ecx, dword [0x1802e18d4]
mov rax, qword gs:[0x58]
mov r8d, 4
mov rcx, qword [rax + rcx*8]
xor ebp, ebp
mov eax, dword [r8 + rcx]
cmp dword [0x1802e4ce4], eax
jle 0x180006cf9
lea rcx, [0x1802e4ce4]
call fcn.1800097c0
cmp dword [0x1802e4ce4], 0xffffffff
jne 0x180006cf4
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], bpl
lea r8d, [rbp + 0x15]
lea rdx, [0x180290588]
lea rcx, [rsp + 0x48]
call fcn.180005340
nop
lea r8, [rsp + 0x48]
mov rdx, qword [0x1802e4c98]
mov rcx, r13
call fcn.1800023a0
mov qword [0x1802e4d48], rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180006ce8
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ce2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006ce2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180009630
nop
lea rcx, [0x1802e4ce4]
call fcn.180009760
mov rdx, qword [rsp + 0x40]
cmp qword [0x1802e4d48], 0
je 0x180006c12
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x38]
mov rcx, r13
call fcn.1800054a0
test al, al
je 0x180006c12
mov r15, qword [rsp + 0x38]
test r15, r15
je 0x180006dfb
mov r8d, dword [rbx + 0x54]
mov rdx, rsi
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
movzx edi, word [rbx + 0x14]
add rdi, 0x2c
mov r14d, ebp
cmp bp, word [rbx + 6]
jae 0x180006d84
add rdi, rbx
nop word [rax + rax]
mov r8d, dword [rdi - 4]
mov edx, dword [rdi]
add rdx, rsi
mov ecx, dword [rdi - 8]
add rcx, r12
call sub.VCRUNTIME140.dll_memcpy
inc r14d
lea rdi, [rdi + 0x28]
movzx eax, word [rbx + 6]
cmp r14d, eax
jl 0x180006d60
mov r14d, dword [rsp + 0x30]
mov rdi, r15
sub rdi, r14
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.180007760
mov rdx, rdi
sub rdx, qword [rbx + 0x30]
mov rcx, rax
call fcn.180006e70
mov rdx, r12
lea rcx, [rsp + 0x48]
call fcn.1800078b0
mov rdx, rax
mov rcx, r13
call fcn.180006f70
test al, al
je 0x180006dfb
lea r8, [r14 + r12]
mov r9, qword [rsp + 0x40]
mov rdx, r15
mov rcx, r13
call fcn.180002060
test al, al
je 0x180006dfb
mov r8d, dword [rbx + 0x28]
add r8, rdi
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.180007290
test al, al
jne 0x180006e29
mov r8d, 0x3010
xor edx, edx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, r15
mov rcx, r13
call fcn.180002280
jmp 0x180006e4f
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, r15
jmp 0x180006e51
xor edx, edx
mov r8d, 0x3010
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret