Function at 0x1800029c0
Capabilities:
Parse pe header

Disassembly:
push rsi
push r14
sub rsp, 0x78
mov rax, qword [0x18000a008]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x2c], 0
mov r14, rcx
jne 0x1800029ea
mov eax, 0xa
jmp 0x180002d6a
mov qword [rsp + 0x98], rbx
mov edx, 0x2e
mov qword [rsp + 0xa8], rdi
add rcx, 0x2c
mov qword [rsp + 0x70], r15
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov r8, rax
test rax, rax
je 0x180002d50
movzx r10d, byte [rax]
lea r9, str..vbs
mov rdx, rax
test r10b, r10b
je 0x180002a4f
nop dword [rax]
movzx ecx, byte [r9]
test cl, cl
je 0x180002a4f
movzx eax, byte [rdx]
or cl, 0x20
or al, 0x20
cmp al, cl
jne 0x180002a4f
inc rdx
inc r9
cmp byte [rdx], 0
jne 0x180002a30
movsx ecx, byte [rdx]
mov edi, 3
movsx eax, byte [r9]
mov r15, 0xffffffffffffffff
lea ebx, [rdi + 1]
cmp ecx, eax
jne 0x180002a7f
mov dword [0x180010f20], 5
mov dword [0x180010f24], r15d
jmp 0x180002b55
lea r9, [0x180007954]
mov rdx, r8
test r10b, r10b
je 0x180002aaf
nop
movzx ecx, byte [r9]
test cl, cl
je 0x180002aaf
movzx eax, byte [rdx]
or cl, 0x20
or al, 0x20
cmp al, cl
jne 0x180002aaf
inc rdx
inc r9
cmp byte [rdx], 0
jne 0x180002a90
movsx ecx, byte [rdx]
movsx eax, byte [r9]
cmp ecx, eax
jne 0x180002ad0
mov dword [0x180010f20], 6
mov dword [0x180010f24], r15d
jmp 0x180002b55
lea r9, str..exe
mov rdx, r8
test r10b, r10b
je 0x180002aff
nop
movzx ecx, byte [r9]
test cl, cl
je 0x180002aff
movzx eax, byte [rdx]
or cl, 0x20
or al, 0x20
cmp al, cl
jne 0x180002aff
inc rdx
inc r9
cmp byte [rdx], 0
jne 0x180002ae0
movsx ecx, byte [rdx]
movsx eax, byte [r9]
cmp ecx, eax
jne 0x180002b12
mov dword [0x180010f20], ebx
jmp 0x180002b55
lea rdx, [0x180007960]
test r10b, r10b
je 0x180002b40
nop
movzx ecx, byte [rdx]
test cl, cl
je 0x180002b40
movzx eax, byte [r8]
or cl, 0x20
or al, 0x20
cmp al, cl
jne 0x180002b40
inc r8
inc rdx
cmp byte [r8], 0
jne 0x180002b20
movsx ecx, byte [r8]
movsx eax, byte [rdx]
cmp ecx, eax
jne 0x180002d50
mov dword [0x180010f20], edi
lea rdx, [rsp + 0x30]
lea rcx, [r14 + 0x2c]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x180002b74
mov edi, 1
mov eax, edi
jmp 0x180002d55
cmp dword [rsp + 0x44], 0
jne 0x180002b87
mov edi, 2
mov eax, edi
jmp 0x180002d55
xor edx, edx
lea rcx, [r14 + 0x2c]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__open]
mov dword [0x180010f00], eax
test eax, eax
jns 0x180002ba4
mov eax, edi
jmp 0x180002d55
mov esi, dword [rsp + 0x44]
mov dword [0x180010f04], esi
mov qword [rsp + 0xa0], rbp
cmp eax, r15d
je 0x180002c1e
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor edx, edx
mov dword [rsp + 0x20], esi
mov rcx, rax
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbp, rax
test rax, rax
je 0x180002c1e
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
mov rdi, rax
mov rcx, rbp
cmove rdi, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x180010f10], rdi
jmp 0x180002c28
mov rdi, r15
mov qword [0x180010f10], r15
mov eax, dword [0x180010f20]
mov rbp, qword [rsp + 0xa0]
add eax, 0xfffffffd
cmp eax, 1
ja 0x180002d34
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x180002cb8
cmp dword [rdi + 0x3c], 0
je 0x180002cb8
movsxd rcx, dword [rdi + 0x3c]
add rcx, rdi
cmp dword [rcx], 0x4550
jne 0x180002cb8
movzx r9d, word [rcx + 4]
mov edx, 0x88
mov r10d, 0x14c
mov eax, 0x78
cmp r9w, r10w
cmovne eax, edx
lea rdx, [rax + rcx]
test rdx, rdx
je 0x180002cb8
movzx r8d, word [rcx + 0x16]
xor eax, eax
mov ebx, dword [rdx + 0x70]
and r8d, 0x2000
cmp r9w, r10w
setne al
inc eax
mov dword [0x180010f24], eax
test ebx, ebx
je 0x180002d34
cmp dword [rdx], 0
je 0x180002cc4
mov ebx, 0x14
call fcn.180002760
mov eax, ebx
jmp 0x180002d55
neg r8d
lea rdx, str.v4.0.30319
mov r8d, 0x1f
lea rcx, [0x180010f28]
sbb eax, eax
add eax, 2
mov dword [0x180010f20], eax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rdx, rbx
mov rbx, qword [0x180010f10]
mov rcx, rbx
call fcn.1800026f0
cmp rax, r15
je 0x180002d34
mov eax, dword [rbx + rax + 8]
test eax, eax
je 0x180002d34
mov edx, eax
mov rcx, rbx
call fcn.1800026f0
cmp rax, r15
je 0x180002d34
lea rdx, [rbx + 0x10]
mov r8d, 0x1f
add rdx, rax
lea rcx, [0x180010f28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [0x180010f04]
xor ebx, ebx
mov dword [r14], eax
mov eax, dword [0x180010f20]
mov dword [r14 + 0x1238], eax
mov eax, ebx
jmp 0x180002d55
mov eax, 4
mov rdi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0x98]
mov r15, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800054c0
add rsp, 0x78
pop r14
pop rsi
ret