Function at 0x18014dc60
Capabilities:
Access peb ldr_data
Check os version
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rdi, rdx
lea rcx, str.clr.dll
xor esi, esi
mov rdx, r8
mov r14d, esi
mov rbp, r9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x18014e0dd
mov qword [rsp + 0x30], rsi
lea eax, [rsi + 3]
mov dword [rsp + 0x28], 0x80
lea r8d, [rsi + 1]
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov edx, 0x80000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x18014e0dd
mov qword [rsp + 0x28], rsi
lea r8d, [rsi + 2]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x40], rax
mov r15, rax
test rax, rax
je 0x18014e0d4
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea edx, [rsi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x48], rax
mov r12, rax
test rax, rax
je 0x18014e0cb
movsxd rbx, dword [rax + 0x3c]
lea r9d, [rsi + 4]
add rbx, rax
xor ecx, ecx
mov r8d, 0x3000
mov edx, dword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [rbx + 0x54]
xor r10d, r10d
mov rdi, rax
mov rsi, r12
rep movsb byte [rdi], byte [rsi]
movsxd r8, dword [r12 + 0x3c]
mov r14, rax
add r8, r12
mov r9d, r10d
cmp r10w, word [rbx + 6]
jae 0x18014ddab
lea r15d, [r10 + 1]
mov eax, r9d
add r9d, r15d
lea rdx, [rax + rax*4]
mov esi, dword [r8 + rdx*8 + 0x11c]
mov edi, dword [r8 + rdx*8 + 0x114]
add rsi, r12
mov ecx, dword [r8 + rdx*8 + 0x118]
add rdi, r14
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rbx + 6]
cmp r9d, eax
jb 0x18014dd73
mov r15, qword [rsp + 0x40]
movsxd rdx, dword [r14 + 0x3c]
add rdx, r14
mov qword [rsp + 0x58], rdx
mov r11, qword [rdx + 0x30]
mov qword [rdx + 0x30], rbp
mov ecx, dword [rdx + 0xb4]
test ecx, ecx
je 0x18014deec
mov eax, dword [rdx + 0xb0]
add rcx, rax
add rcx, r14
lea rsi, [rax + r14]
cmp rsi, rcx
jae 0x18014deec
xor r13d, r13d
mov ebx, 0xfff
lea r15d, [r13 + 1]
lea r12d, [r13 + 3]
cmp dword [rsi + 4], r13d
je 0x18014deda
mov r10d, dword [rsi + 4]
lea r8, [rsi + 8]
mov edi, dword [rsi]
sub r10, 8
shr r10, 1
add rdi, r14
test r10d, r10d
je 0x18014deb9
mov edx, 2
movzx r9d, word [r8]
dec r10d
movzx eax, r9w
movzx ecx, r9w
shr ax, 0xc
cmp ax, 0xa
jne 0x18014de4f
and r9, rbx
sub qword [r9 + rdi], r11
movzx eax, word [r8]
and rax, rbx
add qword [rax + rdi], rbp
jmp 0x18014dea8
cmp ax, r12w
jne 0x18014de68
and rcx, rbx
sub dword [rcx + rdi], r11d
movzx eax, word [r8]
and rax, rbx
add dword [rax + rdi], ebp
jmp 0x18014dea8
cmp ax, r15w
jne 0x18014de90
and rcx, rbx
mov rax, r11
shr rax, 0x10
sub word [rcx + rdi], ax
mov rax, rbp
movzx ecx, word [r8]
and rcx, rbx
shr rax, 0x10
add word [rcx + rdi], ax
jmp 0x18014dea8
cmp ax, dx
jne 0x18014dea8
and rcx, rbx
sub word [rcx + rdi], r11w
movzx eax, word [r8]
and rax, rbx
add word [rax + rdi], bp
add r8, rdx
test r10d, r10d
jne 0x18014de22
mov rdx, qword [rsp + 0x58]
mov eax, dword [rsi + 4]
mov ecx, dword [rdx + 0xb0]
add rsi, rax
mov eax, dword [rdx + 0xb4]
add rax, r14
add rcx, rax
cmp rsi, rcx
jb 0x18014ddf6
mov r12, qword [rsp + 0x48]
xor r10d, r10d
mov r13, qword [rsp + 0x50]
mov r15, qword [rsp + 0x40]
cmp dword [rdx + 0x94], r10d
je 0x18014e0c2
mov ebx, dword [rdx + 0x90]
add rbx, r14
cmp dword [rbx], r10d
je 0x18014e0c2
mov r13, qword [rsp + 0xc0]
mov r12d, 2
mov edi, dword [rbx + 0xc]
mov edx, 0x104
add rdi, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov rdx, r12
mov rsi, rax
lea rcx, [rax + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbp, rax
test rax, rax
je 0x18014e0a6
mov r9, rdi
mov qword [rsp + 0x20], rsi
lea r8, [rsi + 1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
mov edi, 4
lea rdx, str.api_
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x18014df96
mov r8d, edi
lea rdx, str.ext_
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x18014dfde
lea r9, [rsp + 0x58]
mov r8, rbp
mov rdx, r13
call fcn.18014d748
mov rsi, rax
test rax, rax
je 0x18014dfde
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x58]
mov rdx, r12
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbp, rax
test rax, rax
je 0x18014e0a6
lea rcx, [rdi + rdi]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov eax, 2
mov rsi, qword [rcx + 0x20]
mov rdi, rsi
cmp word [rdi + 0x38], ax
jbe 0x18014e01b
movzx r8d, word [rdi + 0x48]
mov rcx, rbp
mov rdx, qword [rdi + 0x50]
shr r8, 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x18014e061
mov eax, 2
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x18014dff7
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rsi, rsi
je 0x18014e097
mov ecx, dword [rbx]
test ecx, ecx
jne 0x18014e03d
mov ecx, dword [rbx + 0x10]
mov edi, dword [rbx + 0x10]
mov r15d, ecx
add rdi, r14
add r15, r14
mov rax, qword [r15]
test rax, rax
je 0x18014e097
mov r13, qword [rsp + 0xb0]
jns 0x18014e067
movzx r8d, ax
jmp 0x18014e06e
mov rsi, qword [rdi + 0x20]
jmp 0x18014e02f
lea r8, [r14 + 2]
add r8, rax
mov r9, rbp
mov rdx, rsi
mov rcx, r13
call fcn.18014e0f8
add r15, 8
mov qword [rdi], rax
add rdi, 8
mov rax, qword [r15]
test rax, rax
jne 0x18014e059
mov r13, qword [rsp + 0xc0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12d, 2
add rbx, 0x14
cmp dword [rbx], 0
jne 0x18014df19
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov r15, qword [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xb8]
mov rax, r14
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret