Function at 0x180003120
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
push rbx
push r14
sub rsp, 0x88
mov rax, qword [0x180007008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov r14, rcx
test rcx, rcx
je 0x18000342b
test rdx, rdx
je 0x18000342b
xorps xmm0, xmm0
mov qword [r11 + 0x18], rbp
movups xmmword [rdx], xmm0
mov qword [r11 - 0x18], rsi
movups xmmword [rdx + 0x10], xmm0
mov qword [r11 - 0x20], rdi
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm0
mov edx, 0x2e
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rsi, rax
test rax, rax
je 0x180003421
lea rdx, str..vbs
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rdi, 0xffffffffffffffff
lea ebp, [rdi + 4]
test eax, eax
jne 0x1800031b3
mov dword [rbx + 0x18], 5
mov dword [rbx + 0x1c], edi
jmp 0x18000322b
lea rdx, [0x18000d6e4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1800031d3
mov dword [rbx + 0x18], 6
mov dword [rbx + 0x1c], edi
jmp 0x18000322b
lea rdx, str..xsl
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1800031f3
mov dword [rbx + 0x18], 7
mov dword [rbx + 0x1c], edi
jmp 0x18000322b
lea rdx, str..exe
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x180003210
mov dword [rbx + 0x18], 4
jmp 0x18000322b
lea rdx, str..dll
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x180003421
mov dword [rbx + 0x18], ebp
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x180003244
mov ebp, 1
jmp 0x180003263
cmp dword [rsp + 0x44], 0
jne 0x180003252
mov ebp, 2
jmp 0x180003263
xor edx, edx
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__open]
mov dword [rbx], eax
test eax, eax
jns 0x180003292
mov eax, ebp
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180001010
add rsp, 0x88
pop r14
pop rbx
ret
mov qword [rsp + 0x70], r15
mov ecx, eax
movsxd r15, dword [rsp + 0x44]
mov qword [rbx + 8], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
xor r14d, r14d
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], r15d
lea r8d, [r14 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rsi, rax
test rax, rax
jne 0x1800032d4
mov rax, rdi
jmp 0x180003300
xor r9d, r9d
mov qword [rsp + 0x20], r15
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
jne 0x1800032fd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rdi, rax
lea rsi, [rbx + 0x10]
mov rcx, rsi
mov qword [rcx], rax
mov eax, dword [rbx + 0x18]
mov r15, qword [rsp + 0x70]
sub eax, ebp
cmp eax, 1
ja 0x180003419
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x180003402
movsxd rax, dword [rdi + 0x3c]
test eax, eax
je 0x180003402
cmp dword [rdi + rax], 0x4550
lea rcx, [rdi + rax]
jne 0x180003402
movzx edx, word [rcx + 4]
mov r9d, 0x14c
cmp dx, r9w
mov eax, 0x78
mov r8d, 0x88
cmovne eax, r8d
add rax, rcx
je 0x180003402
mov edi, dword [rax + 0x70]
mov eax, r14d
movzx r8d, word [rcx + 0x16]
and r8d, 0x2000
cmp dx, r9w
setne al
inc eax
mov dword [rbx + 0x1c], eax
test edi, edi
je 0x180003419
neg r8d
lea rbp, [rbx + 0x20]
mov r8d, 0x1f
lea rdx, str.v4.0.30319
sbb eax, eax
mov rcx, rbp
add eax, 2
mov dword [rbx + 0x18], eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rbx, qword [rsi]
mov edx, edi
mov rcx, rbx
call fcn.180003580
cmp eax, 0xffffffff
je 0x180003419
mov eax, eax
mov edx, dword [rax + rbx + 8]
test edx, edx
je 0x180003419
mov rcx, rbx
call fcn.180003580
cmp eax, 0xffffffff
je 0x180003419
mov edx, eax
mov r8d, 0x1f
add rdx, 0x10
mov rcx, rbp
add rdx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, r14d
jmp 0x180003265
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [rbx]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__close]
mov r14d, 4
mov eax, r14d
jmp 0x180003265
mov eax, 4
jmp 0x180003265
mov eax, 0xa
jmp 0x18000327a