Function at 0x1800a95d8
Capabilities:
Access peb ldr_data
Check os version
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rdi, rdx
lea rcx, str.clr.dll
xor esi, esi
mov rdx, r8
mov r14d, esi
mov rbp, r9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
je 0x1800a9a56
mov qword [rsp + 0x30], rsi
lea r8d, [rsi + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x50], rax
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1800a9a56
mov qword [rsp + 0x28], rsi
lea r8d, [rsi + 2]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x40], rax
mov r15, rax
test rax, rax
je 0x1800a9a4d
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea edx, [rsi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x48], rax
mov r12, rax
test rax, rax
je 0x1800a9a44
movsxd rbx, dword [rax + 0x3c]
lea r9d, [rsi + 4]
add rbx, rax
xor ecx, ecx
mov r8d, 0x3000
mov edx, dword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [rbx + 0x54]
xor r10d, r10d
mov rdi, rax
mov rsi, r12
rep movsb byte [rdi], byte [rsi]
movsxd r8, dword [r12 + 0x3c]
mov r14, rax
add r8, r12
mov r9d, r10d
cmp r10w, word [rbx + 6]
jae 0x1800a9724
lea r15d, [r10 + 1]
mov eax, r9d
add r9d, r15d
lea rdx, [rax + rax*4]
mov esi, dword [r8 + rdx*8 + 0x11c]
mov edi, dword [r8 + rdx*8 + 0x114]
add rsi, r12
mov ecx, dword [r8 + rdx*8 + 0x118]
add rdi, r14
rep movsb byte [rdi], byte [rsi]
movzx eax, word [rbx + 6]
cmp r9d, eax
jb 0x1800a96ec
mov r15, qword [rsp + 0x40]
movsxd rdx, dword [r14 + 0x3c]
add rdx, r14
mov qword [rsp + 0x58], rdx
mov r11, qword [rdx + 0x30]
mov qword [rdx + 0x30], rbp
mov ecx, dword [rdx + 0xb4]
test ecx, ecx
je 0x1800a9865
mov eax, dword [rdx + 0xb0]
add rcx, rax
add rcx, r14
lea rsi, [rax + r14]
cmp rsi, rcx
jae 0x1800a9865
xor r13d, r13d
mov ebx, 0xfff
lea r15d, [r13 + 1]
lea r12d, [r13 + 3]
cmp dword [rsi + 4], r13d
je 0x1800a9853
mov r10d, dword [rsi + 4]
lea r8, [rsi + 8]
mov edi, dword [rsi]
sub r10, 8
shr r10, 1
add rdi, r14
test r10d, r10d
je 0x1800a9832
mov edx, 2
movzx r9d, word [r8]
dec r10d
movzx eax, r9w
movzx ecx, r9w
shr ax, 0xc
cmp ax, 0xa
jne 0x1800a97c8
and r9, rbx
sub qword [r9 + rdi], r11
movzx eax, word [r8]
and rax, rbx
add qword [rax + rdi], rbp
jmp 0x1800a9821
cmp ax, r12w
jne 0x1800a97e1
and rcx, rbx
sub dword [rcx + rdi], r11d
movzx eax, word [r8]
and rax, rbx
add dword [rax + rdi], ebp
jmp 0x1800a9821
cmp ax, r15w
jne 0x1800a9809
and rcx, rbx
mov rax, r11
shr rax, 0x10
sub word [rcx + rdi], ax
mov rax, rbp
movzx ecx, word [r8]
and rcx, rbx
shr rax, 0x10
add word [rcx + rdi], ax
jmp 0x1800a9821
cmp ax, dx
jne 0x1800a9821
and rcx, rbx
sub word [rcx + rdi], r11w
movzx eax, word [r8]
and rax, rbx
add word [rax + rdi], bp
add r8, rdx
test r10d, r10d
jne 0x1800a979b
mov rdx, qword [rsp + 0x58]
mov eax, dword [rsi + 4]
mov ecx, dword [rdx + 0xb0]
add rsi, rax
mov eax, dword [rdx + 0xb4]
add rax, r14
add rcx, rax
cmp rsi, rcx
jb 0x1800a976f
mov r12, qword [rsp + 0x48]
xor r10d, r10d
mov r13, qword [rsp + 0x50]
mov r15, qword [rsp + 0x40]
cmp dword [rdx + 0x94], r10d
je 0x1800a9a3b
mov ebx, dword [rdx + 0x90]
add rbx, r14
cmp dword [rbx], r10d
je 0x1800a9a3b
mov r13, qword [rsp + 0xc0]
mov r12d, 2
mov edi, dword [rbx + 0xc]
mov edx, 0x104
add rdi, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov rdx, r12
mov rsi, rax
lea rcx, [rax + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbp, rax
test rax, rax
je 0x1800a9a1f
mov r9, rdi
mov qword [rsp + 0x20], rsi
lea r8, [rsi + 1]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
mov edi, 4
lea rdx, str.api_
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x1800a990f
mov r8d, edi
lea rdx, str.ext_
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1800a9957
lea r9, [rsp + 0x58]
mov r8, rbp
mov rdx, r13
call fcn.1800a9088
mov rsi, rax
test rax, rax
je 0x1800a9957
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x58]
mov rdx, r12
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbp, rax
test rax, rax
je 0x1800a9a1f
lea rcx, [rdi + rdi]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov eax, 2
mov rsi, qword [rcx + 0x20]
mov rdi, rsi
cmp word [rdi + 0x38], ax
jbe 0x1800a9994
movzx r8d, word [rdi + 0x48]
mov rcx, rbp
mov rdx, qword [rdi + 0x50]
shr r8, 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x1800a99da
mov eax, 2
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x1800a9970
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rsi, rsi
je 0x1800a9a10
mov ecx, dword [rbx]
test ecx, ecx
jne 0x1800a99b6
mov ecx, dword [rbx + 0x10]
mov edi, dword [rbx + 0x10]
mov r15d, ecx
add rdi, r14
add r15, r14
mov rax, qword [r15]
test rax, rax
je 0x1800a9a10
mov r13, qword [rsp + 0xb0]
jns 0x1800a99e0
movzx r8d, ax
jmp 0x1800a99e7
mov rsi, qword [rdi + 0x20]
jmp 0x1800a99a8
lea r8, [r14 + 2]
add r8, rax
mov r9, rbp
mov rdx, rsi
mov rcx, r13
call fcn.1800a9a74
add r15, 8
mov qword [rdi], rax
add rdi, 8
mov rax, qword [r15]
test rax, rax
jne 0x1800a99d2
mov r13, qword [rsp + 0xc0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12d, 2
add rbx, 0x14
cmp dword [rbx], 0
jne 0x1800a9892
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov r15, qword [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xb8]
mov rax, r14
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret