Function at 0x1800015b0
Capabilities:
Access peb ldr_data
Check os version
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x60
xor ebx, ebx
lea rax, str.clr.dll
mov r12d, ebx
mov esi, ebx
mov rbp, r8
mov r13, rdx
nop dword [rax]
nop dword [rax + rax]
movzx edi, word [rax + rsi*2]
inc rsi
cmp di, word [rdx + rsi*2 - 2]
jne 0x1800015f9
cmp rsi, 8
jne 0x1800015e0
jmp 0x180001a61
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180001a61
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x98], r15
mov rcx, rax
mov dword [rsp + 0x20], ebx
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0xa8], rax
mov r15, rax
test rax, rax
je 0x180001a50
xor r9d, r9d
mov qword [rsp + 0x90], r14
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x48], rax
mov r14, rax
test rax, rax
je 0x180001a3f
movsxd rbx, dword [rax + 0x3c]
xor ecx, ecx
add rbx, rax
mov r8d, 0x3000
lea r9d, [rcx + 4]
mov edx, dword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [rbx + 0x54]
mov rsi, r14
mov rdi, rax
mov r12, rax
rep movsb byte [rdi], byte [rsi]
movsxd r9, dword [r14 + 0x3c]
xor eax, eax
add r9, r14
mov r8d, eax
cmp ax, word [rbx + 6]
jae 0x180001717
nop word [rax + rax]
mov eax, r8d
inc r8d
lea rdx, [rax + rax*4]
shl rdx, 3
mov esi, dword [rdx + r9 + 0x11c]
mov edi, dword [rdx + r9 + 0x114]
add rsi, r14
mov ecx, dword [rdx + r9 + 0x118]
add rdi, r12
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rbx + 6]
cmp r8d, eax
jb 0x1800016e0
movsxd r11, dword [r12 + 0x3c]
add r11, r12
mov r9, qword [r11 + 0x30]
mov qword [r11 + 0x30], rbp
mov ecx, dword [r11 + 0xb4]
test ecx, ecx
je 0x180001885
mov eax, dword [r11 + 0xb0]
add rcx, rax
add rcx, r12
lea r10, [rax + r12]
cmp r10, rcx
jae 0x180001885
mov r8d, dword [rsp + 0xa8]
xor r15d, r15d
mov rdi, qword [rsp + 0xa8]
mov ecx, dword [r10 + 4]
test ecx, ecx
je 0x18000187d
mov eax, dword [r10]
lea rsi, [rax + r12]
test rsi, rsi
je 0x180001790
lea rax, [rcx - 8]
mov r8, rax
shr r8, 1
cmp rax, 2
jae 0x180001790
mov r8d, r15d
jmp 0x18000179d
test r8d, r8d
je 0x180001858
lea rdi, [r10 + 8]
test r8d, r8d
je 0x180001858
nop word [rax + rax]
movzx edx, word [rdi]
dec r8d
movzx eax, dx
movzx ecx, dx
shr ax, 0xc
cmp ax, 0xa
jne 0x1800017de
and edx, 0xfff
sub qword [rsi + rdx], r9
movzx eax, word [rdi]
and eax, 0xfff
add qword [rax + rsi], rbp
jmp 0x180001847
cmp ax, 3
jne 0x1800017fb
and ecx, 0xfff
sub dword [rcx + rsi], r9d
movzx eax, word [rdi]
and eax, 0xfff
add dword [rax + rsi], ebp
jmp 0x180001847
cmp ax, 1
jne 0x18000182a
and ecx, 0xfff
mov rax, r9
shr rax, 0x10
sub word [rcx + rsi], ax
mov rax, rbp
movzx ecx, word [rdi]
and ecx, 0xfff
shr rax, 0x10
add rcx, rsi
add word [rcx], ax
jmp 0x180001847
cmp ax, 2
jne 0x180001847
and ecx, 0xfff
sub word [rcx + rsi], r9w
movzx eax, word [rdi]
and eax, 0xfff
add word [rax + rsi], bp
add rdi, 2
test r8d, r8d
jne 0x1800017b0
mov ecx, dword [r10 + 4]
mov eax, ecx
dec r8d
mov ecx, dword [r11 + 0xb4]
add r10, rax
mov eax, dword [r11 + 0xb0]
add rax, r12
add rcx, rax
cmp r10, rcx
jb 0x180001763
mov r15, qword [rsp + 0xa8]
cmp dword [r11 + 0x94], 0
je 0x180001a31
mov r15d, dword [r11 + 0x90]
add r15, r12
cmp dword [r15], 0
je 0x180001a29
nop word [rax + rax]
mov edi, dword [r15 + 0xc]
mov edx, 0x104
add rdi, r12
mov rcx, rdi
call fcn.1800079b0
mov edx, 2
mov rsi, rax
lea rcx, [rax + 1]
call fcn.180004e50
mov rbx, rax
test rax, rax
je 0x180001a16
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.180005314
mov r8d, 4
lea rdx, str.api_
mov rcx, rbx
call fcn.1800077fc
test eax, eax
je 0x180001921
mov r8d, 4
lea rdx, str.ext_
mov rcx, rbx
call fcn.1800077fc
test eax, eax
jne 0x180001969
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r13
call fcn.1800010c0
mov rsi, rax
test rax, rax
je 0x180001969
mov rcx, rbx
call fcn.1800077f4
mov rdi, qword [rsp + 0x40]
mov edx, 2
lea rcx, [rdi + 1]
call fcn.180004e50
mov rbx, rax
test rax, rax
je 0x180001a16
lea rcx, [rdi + rdi]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x20]
mov rdi, rsi
nop dword [rax]
cmp word [rdi + 0x38], 2
jbe 0x18000199f
movzx r8d, word [rdi + 0x48]
mov rcx, rbx
mov rdx, qword [rdi + 0x50]
shr r8, 1
call fcn.1800077fc
test eax, eax
je 0x1800019e5
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x180001980
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rsi, rsi
je 0x180001a0e
mov ecx, dword [r15]
mov edx, dword [r15 + 0x10]
test ecx, ecx
jne 0x1800019c5
mov ecx, edx
mov edi, ecx
add rdi, r12
mov rcx, qword [rdi]
test rcx, rcx
je 0x180001a0e
mov r14, rdx
sub r14, rdi
add r14, r12
test rcx, rcx
jns 0x1800019eb
movzx edx, cx
jmp 0x1800019f3
mov rsi, qword [rdi + 0x20]
jmp 0x1800019b3
lea rdx, [r12 + 2]
add rdx, rcx
mov r8, rbx
mov rcx, rsi
call fcn.180001a80
mov qword [r14 + rdi], rax
add rdi, 8
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1800019de
mov rcx, rbx
call fcn.1800077f4
add r15, 0x14
cmp dword [r15], 0
jne 0x1800018b0
mov r14, qword [rsp + 0x48]
mov r15, qword [rsp + 0xa8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rdi, qword [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x90]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
mov rax, r12
add rsp, 0x60
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret