Function at 0x14017380c
Capabilities:
Access peb ldr_data
Check os version
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rdi, rdx
lea rcx, str.clr.dll
xor esi, esi
mov rdx, r8
mov r14d, esi
mov rbp, r9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x140173c89
mov qword [rsp + 0x30], rsi
lea eax, [rsi + 3]
mov dword [rsp + 0x28], 0x80
lea r8d, [rsi + 1]
xor r9d, r9d
mov dword [rsp + 0x20], eax
mov edx, 0x80000000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140173c89
mov qword [rsp + 0x28], rsi
lea r8d, [rsi + 2]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x40], rax
mov r15, rax
test rax, rax
je 0x140173c80
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea edx, [rsi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x48], rax
mov r12, rax
test rax, rax
je 0x140173c77
movsxd rbx, dword [rax + 0x3c]
lea r9d, [rsi + 4]
add rbx, rax
xor ecx, ecx
mov r8d, 0x3000
mov edx, dword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [rbx + 0x54]
xor r10d, r10d
mov rdi, rax
mov rsi, r12
rep movsb byte [rdi], byte [rsi]
movsxd r8, dword [r12 + 0x3c]
mov r14, rax
add r8, r12
mov r9d, r10d
cmp r10w, word [rbx + 6]
jae 0x140173957
lea r15d, [r10 + 1]
mov eax, r9d
add r9d, r15d
lea rdx, [rax + rax*4]
mov esi, dword [r8 + rdx*8 + 0x11c]
mov edi, dword [r8 + rdx*8 + 0x114]
add rsi, r12
mov ecx, dword [r8 + rdx*8 + 0x118]
add rdi, r14
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rbx + 6]
cmp r9d, eax
jb 0x14017391f
mov r15, qword [rsp + 0x40]
movsxd rdx, dword [r14 + 0x3c]
add rdx, r14
mov qword [rsp + 0x58], rdx
mov r11, qword [rdx + 0x30]
mov qword [rdx + 0x30], rbp
mov ecx, dword [rdx + 0xb4]
test ecx, ecx
je 0x140173a94
mov eax, dword [rdx + 0xb0]
add rcx, rax
add rcx, r14
lea rsi, [rax + r14]
cmp rsi, rcx
jae 0x140173a94
mov r15d, 1
mov ebx, 0xfff
lea r12d, [r15 + 2]
mov eax, dword [rsi + 4]
test eax, eax
je 0x140173a82
mov edi, dword [rsi]
lea r10, [rax - 8]
add rdi, r14
shr r10, 1
lea r8, [rsi + 8]
test r10d, r10d
je 0x140173a64
mov edx, 2
movzx r9d, word [r8]
dec r10d
movzx eax, r9w
movzx ecx, r9w
shr ax, 0xc
cmp ax, 0xa
jne 0x1401739f7
and r9, rbx
sub qword [r9 + rdi], r11
movzx eax, word [r8]
and rax, rbx
add qword [rax + rdi], rbp
jmp 0x140173a50
cmp ax, r12w
jne 0x140173a10
and rcx, rbx
sub dword [rcx + rdi], r11d
movzx eax, word [r8]
and rax, rbx
add dword [rax + rdi], ebp
jmp 0x140173a50
cmp ax, r15w
jne 0x140173a38
and rcx, rbx
mov rax, r11
shr rax, 0x10
sub word [rcx + rdi], ax
mov rax, rbp
movzx ecx, word [r8]
and rcx, rbx
shr rax, 0x10
add word [rcx + rdi], ax
jmp 0x140173a50
cmp ax, dx
jne 0x140173a50
and rcx, rbx
sub word [rcx + rdi], r11w
movzx eax, word [r8]
and rax, rbx
add word [rax + rdi], bp
add r8, rdx
test r10d, r10d
jne 0x1401739ca
mov eax, dword [rsi + 4]
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rdx + 0xb0]
add rsi, rax
mov eax, dword [rdx + 0xb4]
add rax, r14
add rcx, rax
cmp rsi, rcx
jb 0x1401739a1
mov r12, qword [rsp + 0x48]
xor r10d, r10d
mov r13, qword [rsp + 0x50]
mov r15, qword [rsp + 0x40]
cmp dword [rdx + 0x94], r10d
je 0x140173c6e
mov ebx, dword [rdx + 0x90]
add rbx, r14
cmp dword [rbx], r10d
je 0x140173c6e
mov r13, qword [rsp + 0xc0]
mov r12d, 2
mov edi, dword [rbx + 0xc]
mov edx, 0x104
add rdi, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov rdx, r12
mov rsi, rax
lea rcx, [rax + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbp, rax
test rax, rax
je 0x140173c52
mov r9, rdi
mov qword [rsp + 0x20], rsi
lea r8, [rsi + 1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
mov edi, 4
lea rdx, str.api_
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x140173b3e
mov r8d, edi
lea rdx, str.ext_
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140173b86
lea r9, [rsp + 0x58]
mov r8, rbp
mov rdx, r13
call fcn.140173324
mov rsi, rax
test rax, rax
je 0x140173b86
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x58]
mov rdx, r12
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbp, rax
test rax, rax
je 0x140173c52
lea rcx, [rdi + rdi]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov eax, 2
mov rsi, qword [rcx + 0x20]
mov rdi, rsi
cmp word [rdi + 0x38], ax
jbe 0x140173bc3
movzx r8d, word [rdi + 0x48]
mov rcx, rbp
mov rdx, qword [rdi + 0x50]
shr r8, 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x140173c10
mov eax, 2
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x140173b9f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rsi, rsi
je 0x140173c43
mov ecx, dword [rbx]
mov edx, dword [rbx + 0x10]
test ecx, ecx
jne 0x140173be7
mov ecx, edx
mov edi, ecx
add rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x140173c43
mov r13, qword [rsp + 0xb0]
mov r15d, edx
sub r15, rdi
add r15, r14
test rcx, rcx
jns 0x140173c16
movzx r8d, cx
jmp 0x140173c1d
mov rsi, qword [rdi + 0x20]
jmp 0x140173bd7
lea r8, [r14 + 2]
add r8, rcx
mov r9, rbp
mov rdx, rsi
mov rcx, r13
call fcn.140173ca4
mov qword [r15 + rdi], rax
add rdi, 8
mov rcx, qword [rdi]
test rcx, rcx
jne 0x140173c08
mov r13, qword [rsp + 0xc0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12d, 2
add rbx, 0x14
cmp dword [rbx], 0
jne 0x140173ac1
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov r15, qword [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xb8]
mov rax, r14
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret