Function at 0x1800029c0
Capabilities:
Parse pe header

Disassembly:
push rbp
push r14
sub rsp, 0x78
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x2c], 0
mov r14, rcx
jne 0x1800029ea
mov eax, 0xa
jmp 0x180002d49
mov qword [rsp + 0x98], rbx
mov edx, 0x2e
mov qword [rsp + 0xa0], rsi
add rcx, 0x2c
mov qword [rsp + 0x70], rdi
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov r8, rax
test rax, rax
je 0x180002d2d
movzx r10d, byte [rax]
lea r9, str..vbs
mov rdx, rax
test r10b, r10b
je 0x180002a4f
nop dword [rax]
movzx ecx, byte [r9]
test cl, cl
je 0x180002a4f
movzx eax, byte [rdx]
or cl, 0x20
or al, 0x20
cmp al, cl
jne 0x180002a4f
inc rdx
inc r9
cmp byte [rdx], 0
jne 0x180002a30
movsx ecx, byte [rdx]
mov rdi, 0xffffffffffffffff
movsx eax, byte [r9]
lea esi, [rdi + 4]
lea ebx, [rdi + 5]
cmp ecx, eax
jne 0x180002a7c
mov dword [0x180010f60], 5
mov dword [0x180010f64], edi
jmp 0x180002b55
lea r9, [0x180007954]
mov rdx, r8
test r10b, r10b
je 0x180002aaf
nop dword [rax + rax]
movzx ecx, byte [r9]
test cl, cl
je 0x180002aaf
movzx eax, byte [rdx]
or cl, 0x20
or al, 0x20
cmp al, cl
jne 0x180002aaf
inc rdx
inc r9
cmp byte [rdx], 0
jne 0x180002a90
movsx ecx, byte [rdx]
movsx eax, byte [r9]
cmp ecx, eax
jne 0x180002acf
mov dword [0x180010f60], 6
mov dword [0x180010f64], edi
jmp 0x180002b55
lea r9, str..exe
mov rdx, r8
test r10b, r10b
je 0x180002aff
nop
movzx ecx, byte [r9]
test cl, cl
je 0x180002aff
movzx eax, byte [rdx]
or cl, 0x20
or al, 0x20
cmp al, cl
jne 0x180002aff
inc rdx
inc r9
cmp byte [rdx], 0
jne 0x180002ae0
movsx ecx, byte [rdx]
movsx eax, byte [r9]
cmp ecx, eax
jne 0x180002b12
mov dword [0x180010f60], ebx
jmp 0x180002b55
lea rdx, [0x180007960]
test r10b, r10b
je 0x180002b40
nop
movzx ecx, byte [rdx]
test cl, cl
je 0x180002b40
movzx eax, byte [r8]
or cl, 0x20
or al, 0x20
cmp al, cl
jne 0x180002b40
inc r8
inc rdx
cmp byte [r8], 0
jne 0x180002b20
movsx ecx, byte [r8]
movsx eax, byte [rdx]
cmp ecx, eax
jne 0x180002d32
mov dword [0x180010f60], esi
lea rdx, [rsp + 0x30]
lea rcx, [r14 + 0x2c]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x180002b74
mov esi, 1
mov eax, esi
jmp 0x180002d34
cmp dword [rsp + 0x44], 0
jne 0x180002b87
mov esi, 2
mov eax, esi
jmp 0x180002d34
xor edx, edx
lea rcx, [r14 + 0x2c]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__open]
mov dword [0x180010f40], eax
test eax, eax
jns 0x180002ba4
mov eax, esi
jmp 0x180002d34
mov ebp, dword [rsp + 0x44]
mov ecx, eax
mov dword [0x180010f44], ebp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor edx, edx
mov dword [rsp + 0x20], ebp
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
je 0x180002c08
xor r9d, r9d
mov qword [rsp + 0x20], rbp
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
mov rcx, rsi
cmove rax, rdi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x180010f60]
add eax, 0xfffffffd
mov qword [0x180010f50], rdi
cmp eax, 1
ja 0x180002d13
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x180002c97
cmp dword [rdi + 0x3c], 0
je 0x180002c97
movsxd rcx, dword [rdi + 0x3c]
add rcx, rdi
cmp dword [rcx], 0x4550
jne 0x180002c97
movzx r9d, word [rcx + 4]
mov edx, 0x88
mov r10d, 0x14c
mov eax, 0x78
cmp r9w, r10w
cmovne eax, edx
lea rdx, [rax + rcx]
test rdx, rdx
je 0x180002c97
movzx r8d, word [rcx + 0x16]
xor eax, eax
mov ebx, dword [rdx + 0x70]
and r8d, 0x2000
cmp r9w, r10w
setne al
inc eax
mov dword [0x180010f64], eax
test ebx, ebx
je 0x180002d13
cmp dword [rdx], 0
je 0x180002ca1
mov ebx, 0x14
call fcn.180002760
jmp 0x180002d32
neg r8d
lea rdx, str.v4.0.30319
mov r8d, 0x1f
lea rcx, [0x180010f68]
sbb eax, eax
add eax, 2
mov dword [0x180010f60], eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rdx, rbx
mov rbx, qword [0x180010f50]
mov rcx, rbx
call fcn.1800026f0
cmp rax, 0xffffffffffffffff
je 0x180002d13
mov eax, dword [rbx + rax + 8]
test eax, eax
je 0x180002d13
mov edx, eax
mov rcx, rbx
call fcn.1800026f0
cmp rax, 0xffffffffffffffff
je 0x180002d13
lea rdx, [rbx + 0x10]
mov r8d, 0x1f
add rdx, rax
lea rcx, [0x180010f68]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [0x180010f44]
xor ebx, ebx
mov dword [r14], eax
mov eax, dword [0x180010f60]
mov dword [r14 + 0x1238], eax
jmp 0x180002d32
mov ebx, 4
mov eax, ebx
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180005590
add rsp, 0x78
pop r14
pop rbp
ret