Function at 0x180010f40
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov ebx, dword [rsp + 0x90]
mov r15, rdx
lea edx, [r8 + 0x13]
mov r14, rcx
mov dword [rsp + 0x98], edx
cmp r8d, edx
jae 0x180011195
mov r13, qword [rsp + 0x98]
lea edx, [r8 - 0xcc]
mov r12d, dword [rsp + 0x90]
mov edi, dword [rsp + 0x90]
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x30], edx
xor esi, esi
lea r10, str.syscalls_wow64.txt
lea r9, [0x180000000]
cmp edx, 0x52
ja case.default.0x180010fd0
movzx eax, byte [r9 + rdx + 0x11418]
mov ecx, dword [r9 + rax*4 + 0x113cc]
add rcx, r9
jmp rcx
mov r13, rsi
mov qword [0x180195298], r10
jmp case.0x180010fd0.14
mov edx, 0x40
mov rcx, r14
call fcn.18009c3f0
jmp 0x180011388
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
cmp rcx, rdx
jae 0x18001101f
lea rax, [rcx + 1]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x180011014
mov rax, qword [r14]
mov word [rax + rcx], 0x5f
jmp 0x180011390
mov r9b, 0x5f
xor r8d, r8d
mov rcx, r14
lea edx, [r8 + 1]
call fcn.180001e40
jmp 0x180011388
mov r9, qword [r14]
xor r8d, r8d
mov qword [rsp + 0x28], rsi
xor ecx, ecx
mov qword [rsp + 0x20], rsi
lea edx, [r8 + 0x34]
call fcn.1800691c0
jmp 0x180011388
mov r9, r14
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov edx, 0x11c
xor ecx, ecx
call fcn.1800bd090
mov r9, qword [r14 + 8]
jmp 0x180011039
mov eax, dword [r15 + 4]
mov dword [r14 + 0x14], eax
mov eax, dword [r15 + 8]
mov dword [r14 + 0x28], eax
jmp case.0x180010fd0.14
mov r9, r14
jmp 0x180011039
mov sil, 0x61
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
cmp rcx, rdx
jae 0x1800110bc
lea rax, [rcx + 1]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x1800110b1
mov rax, qword [r14]
mov byte [rax + rcx], sil
mov byte [rax + rcx + 1], 0
jmp 0x1800110cf
xor r8d, r8d
movzx r9d, sil
mov rcx, r14
lea edx, [r8 + 1]
call fcn.180001e40
inc sil
cmp sil, 0x7a
jbe 0x180011090
jmp 0x180011388
mov eax, 0xd5
cmp eax, 0xd5
je 0x1800113ba
add eax, 0x71
cmp eax, 0x146
jb 0x1800110e2
mov r8, r14
mov edx, 0x44
xor ecx, ecx
call fcn.18001be70
jmp 0x180011388
mov eax, dword [r15]
mov dword [r14], eax
jmp case.0x180010fd0.14
mov r12d, 1
jmp case.0x180010fd0.14
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
cmp rcx, rdx
jae 0x18001114d
lea rax, [rcx + 1]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x180011142
mov rax, qword [r14]
mov word [rax + rcx], PathMakeUniqueName
jmp 0x180011390
mov r9b, PathMakeUniqueName
jmp 0x180011022
mov dword [rsp + 0x28], SHRegGetIntW
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov rdx, r14
xor ecx, ecx
call fcn.180081f80
mov rdi, rax
jmp 0x180011388
test r14, r14
jne 0x1800111ef
mov esi, 0x4d
mov eax, esi
sub eax, 0x4d
je 0x1800111b6
sub eax, 1
je 0x1800111af
cmp eax, 1
jne 0x1800111da
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, 0xffffffff
jmp 0x1800111da
mov rax, qword [0x180195298]
lea r9, str.VRANGESDZ128rrikz
mov edx, 0x61
mov qword [rsp + 0x20], rax
mov rcx, r15
lea r8d, [rdx - 0x60]
call fcn.1800c8a10
inc esi
cmp esi, 0x50
jb 0x180011184
mov r8d, dword [rsp + 0x90]
xor esi, esi
mov edx, dword [rsp + 0x30]
cmp qword [r14], 0
je case.0x180010fd0.14
mov ebp, 0x8d
nop
cmp ebp, 0x8d
je 0x18001125b
cmp ebp, 0x1695
je 0x180011235
cmp ebp, 0x2c9d
jne 0x1800112cc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800112cc
mov qword [r14], rsi
mov rsi, qword [r13 + 0x28]
test rsi, rsi
je 0x1800112cc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800112cc
mov r13, qword [r14]
cmp qword [r13], 0xffffffffffffffff
je 0x1800112cc
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov edx, 0xbf
mov rcx, r13
call fcn.18006a4c0
test eax, eax
je 0x1800112cc
mov esi, 0x1b
nop dword [rax + rax]
cmp esi, 0x1b
je 0x1800112a0
cmp esi, 0x45
jne 0x1800112c4
lea r12d, [rsi - 0x46]
jmp 0x1800112c4
mov rax, qword [0x180195298]
lea r9, str.ney_Amerika_Yerli_Dilleri
mov edx, 0x49
mov qword [rsp + 0x20], rax
mov rcx, r15
lea r8d, [rdx - 0x47]
call fcn.1800c8a10
add esi, 0x2a
cmp esi, 0x6f
jb 0x180011290
add ebp, 0x1608
mov esi, 0
cmp ebp, 0x4218
jbe 0x180011200
jmp 0x180011388
mov sil, 0x41
nop dword [rax + rax]
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
cmp rcx, rdx
jae 0x18001131c
lea rax, [rcx + 1]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x180011311
mov rax, qword [r14]
mov byte [rax + rcx], sil
mov byte [rax + rcx + 1], 0
jmp 0x18001132f
xor r8d, r8d
movzx r9d, sil
mov rcx, r14
lea edx, [r8 + 1]
call fcn.180001e40
inc sil
cmp sil, 0x5a
jbe 0x1800112f0
mov sil, 0x30
nop dword [rax + rax]
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
cmp rcx, rdx
jae 0x18001136c
lea rax, [rcx + 1]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x180011361
mov rax, qword [r14]
mov byte [rax + rcx], sil
mov byte [rax + rcx + 1], 0
jmp 0x18001137f
xor r8d, r8d
movzx r9d, sil
mov rcx, r14
lea edx, [r8 + 1]
call fcn.180001e40
inc sil
cmp sil, 0x39
jbe 0x180011340
mov r8d, dword [rsp + 0x90]
mov edx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x98]
inc r8d
inc edx
mov dword [rsp + 0x90], r8d
mov dword [rsp + 0x30], edx
cmp r8d, eax
jae 0x180011195
jmp 0x180010fa3
mov eax, edi
jmp 0x180011197
mov eax, r12d
jmp 0x180011197