Function at 0x1800ddff0
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x510
mov rax, qword [0x1801724e0]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov dword [rsp + 0x8c], r9d
mov qword [rsp + 0xa8], r8
mov r14d, edx
mov dword [rsp + 0x88], edx
mov rdi, rcx
mov qword [rsp + 0xa0], rcx
mov rax, qword [rsp + 0x560]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x568]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x570]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x578]
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0x78], 0x440042
lea rax, str.LdrpResSearchResourceHandle_Enter
mov qword [r11 - 0x4b8], rax
mov r15d, 0x40
mov dword [rsp + 0xd0], 0x420040
lea rax, str.LdrpResSearchResourceHandle_Exit
mov qword [r11 - 0x460], rax
xor edx, edx
lea r8d, [r15 + 0x6c]
lea rcx, [r11 - 0xe8]
call sym.ntdll.dll_memset
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
xor esi, esi
mov r13d, 0x7ffe0385
test eax, eax
je 0x1800de0f3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22b
jmp 0x1800de0f6
mov rcx, r13
mov ebx, 1
test byte [rcx], bl
je 0x1800de139
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
mov r12d, 0x7ffe0384
test eax, eax
je 0x1800de127
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x90]
add rcx, 0x22a
jmp 0x1800de12a
mov rcx, r12
movzx edx, byte [rcx]
lea rcx, [rsp + 0x78]
call fcn.1800dbab0
jmp 0x1800de13f
mov r12d, 0x7ffe0384
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1800de6df
mov ebx, r14d
and ebx, 0x1000
mov dword [rsp + 0x90], ebx
lea rdx, [rsp + 0x98]
mov rcx, rdi
call fcn.1800dda68
test eax, eax
jns 0x1800de179
test ebx, ebx
jne 0x1800de474
mov r9d, r15d
lea r8, [rsp + 0x200]
xor edx, edx
mov rcx, rdi
call fcn.1800ddf44
test eax, eax
js 0x1800de474
mov eax, 0x5a4d
cmp word [rsp + 0x200], ax
je 0x1800de1b6
mov edi, 0xc000007b
mov dword [rsp + 0x70], edi
mov rax, rsi
jmp 0x1800de3ed
mov r15d, dword [rsp + 0x23c]
mov edx, r15d
test ebx, ebx
je 0x1800de1f5
lea rcx, [r15 + 0x108]
cmp rcx, rdx
jb 0x1800de1a5
cmp edx, 0x10000000
ja 0x1800de1a5
lea eax, [r15 + 0x108]
cmp eax, edx
jbe 0x1800de1a5
mov rbx, qword [rsp + 0x98]
mov eax, ebx
cmp rcx, rax
jb 0x1800de1fd
jmp 0x1800de1a5
mov rbx, qword [rsp + 0x98]
mov r9d, 0x108
lea r8, [rsp + 0xf0]
mov rcx, rdi
call fcn.1800ddf44
test eax, eax
js 0x1800de474
cmp dword [rsp + 0xf0], 0x4550
jne 0x1800de1a5
mov eax, 0x10b
cmp word [rsp + 0x108], ax
jne 0x1800de2b4
lea ecx, [rax + 0x41]
movzx eax, word [rsp + 0xf4]
cmp ax, cx
je 0x1800de26e
mov ecx, 0x1c0
sub ax, cx
cmp ax, 4
ja 0x1800de1a5
movzx eax, ax
mov ecx, 0x15
bt ecx, eax
jae 0x1800de1a5
cmp dword [rsp + 0x164], 2
ja 0x1800de282
mov edi, 0xc0000089
jmp 0x1800de1aa
cmp dword [rsp + 0x17c], esi
je 0x1800de278
movzx ecx, word [rsp + 0x104]
cmp cx, 0x78
jb 0x1800de1a5
mov r14d, dword [rsp + 0x178]
test r14d, r14d
jne 0x1800de320
mov eax, 0xc0000089
jmp 0x1800de474
mov eax, 0x20b
cmp word [rsp + 0x108], ax
jne 0x1800de1a5
mov eax, 0x200
cmp word [rsp + 0xf4], ax
je 0x1800de2e9
mov eax, 0x8664
cmp word [rsp + 0xf4], ax
jne 0x1800de1a5
cmp dword [rsp + 0x174], 2
jbe 0x1800de278
cmp dword [rsp + 0x18c], esi
je 0x1800de278
mov eax, 0x88
movzx ecx, word [rsp + 0x104]
cmp cx, ax
jb 0x1800de1a5
mov r14d, dword [rsp + 0x188]
jmp 0x1800de2a5
cmp word [rsp + 0xf6], si
je 0x1800de1a5
movzx eax, word [rsp + 0xf6]
lea edi, [rax + rax*4]
shl edi, 3
movzx eax, cx
add eax, 0x18
add eax, edi
add eax, r15d
cmp eax, ebx
ja 0x1800de1a5
mov r8d, edi
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlAllocateHeap
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x1800de37b
mov edi, 0xc0000017
mov dword [rsp + 0x70], edi
jmp 0x1800de3ed
movzx edx, word [rsp + 0x104]
add edx, 0x18
add edx, r15d
mov r9d, edi
mov r8, rax
mov rcx, qword [rsp + 0xa0]
call fcn.1800ddf44
mov edi, eax
mov dword [rsp + 0x70], eax
test eax, eax
js 0x1800de3e8
mov rbx, qword [rsp + 0x78]
mov edx, esi
movzx r8d, word [rsp + 0xf6]
test r8d, r8d
je 0x1800de3d6
mov ecx, dword [rbx + 0xc]
cmp r14d, ecx
jb 0x1800de3cb
add ecx, dword [rbx + 0x10]
cmp r14d, ecx
jb 0x1800de3d6
add rbx, 0x28
inc edx
cmp edx, r8d
jl 0x1800de3bb
cmp edx, r8d
jl 0x1800de4a1
mov edi, 0xc000007b
mov dword [rsp + 0x70], edi
mov rax, qword [rsp + 0x78]
mov ebx, 1
test rax, rax
je 0x1800de412
mov rcx, qword gs:[0x60]
mov r8, rax
xor edx, edx
mov rcx, qword [rcx + 0x30]
call sym.ntdll.dll_RtlFreeHeap
mov edi, dword [rsp + 0x70]
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800de436
mov rax, qword gs:[0x60]
mov r13, qword [rax + 0x90]
add r13, 0x22b
mov edi, dword [rsp + 0x70]
test byte [r13], bl
je 0x1800de472
call sym.ntdll.dll_RtlGetCurrentServiceSessionId
test eax, eax
je 0x1800de460
mov rax, qword gs:[0x60]
mov r12, qword [rax + 0x90]
add r12, 0x22a
mov edi, dword [rsp + 0x70]
movzx edx, byte [r12]
lea rcx, [rsp + 0xd0]
call fcn.1800dbab0
mov eax, edi
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.18008b0e0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r15d, dword [rbx + 0x14]
mov eax, dword [rbx + 0xc]
sub r15, rax
mov eax, r14d
add r15, rax
je 0x1800de3df
mov rdx, r15
mov r14, qword [rsp + 0xa0]
mov rcx, r14
call fcn.1800de6f0
mov edi, eax
mov dword [rsp + 0x70], eax
test eax, eax
js 0x1800de3e8
cmp dword [rsp + 0x8c], 3
jne 0x1800de549
mov word [rsp + 0x240], si
mov eax, dword [rsp + 0x88]
test al, 0x20
je 0x1800de50c
mov eax, 1
mov word [rsp + 0x240], ax
mov word [rsp + 0x244], si
jmp 0x1800de549
lea rcx, [rsp + 0x240]
mov qword [rsp + 0x20], rcx
mov r9d, eax
mov rax, qword [rsp + 0xa8]
movzx r8d, word [rax + 0x10]
xor edx, edx
xor ecx, ecx
call fcn.180053480
mov edi, eax
mov dword [rsp + 0x70], eax
test eax, eax
jns 0x1800de549
cmp dword [rsp + 0x90], esi
jne 0x1800de3e8
mov word [rsp + 0x74], si
mov r8d, dword [rsp + 0x98]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9, r15
mov rdx, r14
xor ecx, ecx
call fcn.1800520d4
mov edi, eax
mov dword [rsp + 0x70], eax
test eax, eax
js 0x1800de3e8
mov r15, qword [rsp + 0xc8]
test r15, r15
je 0x1800de3e8
cmp word [rsp + 0x74], si
jne 0x1800de5fc
mov word [rsp + 0x450], si
mov r14d, esi
jmp 0x1800de656
lea rax, [rsp + 0x450]
mov qword [rsp + 0xe8], rax
mov eax, 0xac
mov word [rsp + 0xe2], ax
movzx ecx, word [rsp + 0x74]
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rsp + 0xe0]
call sym.ntdll.dll_RtlLcidToLocaleName
mov edi, eax
mov dword [rsp + 0x70], eax
test eax, eax
js 0x1800de3e8
lea rax, [rsp + 0x450]
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], si
jne 0x1800de64c
cmp r14d, dword [r15]
jae 0x1800de6a1
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1800de6a1
mov eax, r14d
lea rbx, [rax + rax]
mov r8, rbx
lea rdx, [rsp + 0x450]
call sym.ntdll.dll_RtlCopyMemory
lea eax, [r14 + 1]
mov dword [r15], eax
mov rax, qword [rsp + 0xb0]
mov word [rbx + rax], si
mov rax, qword [rsp + 0x78]
mov ebx, 1
jmp 0x1800de3f2
lea eax, [r14 + 1]
mov dword [r15], eax
mov edi, 0xc0000023
mov dword [rsp + 0x70], edi
mov rax, qword [rsp + 0x78]
mov ebx, 1
jmp 0x1800de3f2
mov edi, 0xc000000d
mov dword [rsp + 0x70], edi
mov rax, rsi
jmp 0x1800de3f2