Function at 0x180012d20
Capabilities:
Check os version
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xad0]
sub rsp, 0xbd0
imul eax, r8d, 0x930
mov r15, r9
mov rsi, rcx
mov ebx, r8d
mov dword [rsp + 0x58], eax
cmp r8d, eax
ja 0x1800131af
mov r13, qword [rbp + 0xb30]
mov r14, qword [rsp + 0x50]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x50]
xor eax, eax
lea r9, [0x180000000]
mov ecx, 2
movabs r11, 0x64002e0032
movabs r10, 0x33005f0032
cmp ebx, 0x84b1
ja 0x1800130a9
je 0x1800132eb
cmp ebx, 0xcf
ja 0x180012f1b
je 0x180012e52
mov eax, ebx
sub eax, 0x1d
je 0x180012e3d
sub eax, 0x70
je 0x180012e1e
cmp eax, 0x3c
jne 0x1800132cc
mov eax, dword [r13]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov dword [rbp + 0xa3c], eax
lea rdx, [rbp + 0x6e0]
mov dword [rsp + 0x60], 0x200
mov ecx, 0xad
mov qword [rsp + 0x20], r15
call fcn.18006bdd0
mov ecx, 0xffffff0e
lea rdx, [rbp + 0x4e0]
call qword [0x1800d5910]
jmp 0x1800132c5
mov dword [rsp + 0x68], 0x77
mov dword [rsp + 0x6a], 0x73
mov qword [rsp + 0x6c], r10
mov qword [rsp + 0x72], r11
jmp 0x1800132cc
mov rax, qword [r13]
movsx rdx, word [r15]
mov rcx, qword [rax]
mov rdi, qword [rcx + rdx*8 - 8]
jmp 0x1800132cc
xor edx, edx
lea rcx, [rbp + 0xb0]
mov r8d, 0xff
mov r14, rax
call fcn.180070440
lea rcx, [rbp + 0xb0]
movups xmm0, xmmword [rcx]
lea rdx, [rbp + 0x2d0]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
mov rax, qword [rcx + 0x70]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx + 0x50], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x50], xmm1
movups xmmword [rdx + 0x60], xmm0
mov qword [rdx + 0x70], rax
mov eax, dword [rcx + 0x78]
mov dword [rdx + 0x78], eax
movzx eax, word [rcx + 0x7c]
mov word [rdx + 0x7c], ax
movzx eax, byte [rcx + 0x7e]
mov byte [rdx + 0x7e], al
jmp 0x1800132c5
cmp ebx, 0x1325
je 0x180013072
cmp ebx, 0x262d
je 0x180012f70
cmp ebx, 0x5d15
jne 0x1800132cc
mov eax, dword [0x18009fa64]
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x78], eax
mov edx, 0x16
movzx eax, word [0x18009fa68]
mov r8d, 0xe1
mov word [rsp + 0x7c], ax
call fcn.180006450
mov qword [rsp + 0x50], rax
jmp 0x1800132c5
movsx eax, byte [rdi]
dec eax
cmp eax, 0x21
ja case.0x180012f94.8
cdqe
movzx eax, byte [r9 + rax + 0x13704]
mov ecx, dword [r9 + rax*4 + 0x136e4]
add rcx, r9
jmp rcx
mov ecx, 0xf
nop dword [rax + rax]
cmp ecx, 0xf
je 0x180012fb3
cmp ecx, 0xb5
je case.0x180012f94.8
jmp 0x180012fcb
movzx eax, word [rsi + 2]
mov word [rdi + 2], ax
movzx eax, word [rsi + 4]
mov word [rdi + 4], ax
movzx eax, word [rsi + 6]
mov word [rdi + 6], ax
add ecx, 0xa6
cmp ecx, 0x15b
jb 0x180012fa0
mov eax, dword [rsi + 2]
mov ebx, 0x262d
mov dword [rdi + 2], eax
jmp 0x1800132cc
movzx eax, byte [rsi + 2]
mov ebx, 0x262d
mov byte [rdi + 2], al
jmp 0x1800132cc
mov ecx, 0xbb
nop
mov eax, ecx
sub eax, 0xbb
je 0x180013010
cmp eax, 1
je case.0x180012f94.8
jmp 0x180013026
movzx eax, word [rsi + 0xe]
mov word [rdi + 0xe], ax
mov eax, dword [rsi + 2]
mov dword [rdi + 2], eax
mov rax, qword [rsi + 6]
mov qword [rdi + 6], rax
inc ecx
cmp ecx, 0xbd
jb 0x180013000
mov eax, dword [rsi + 2]
mov ebx, 0x262d
mov dword [rdi + 2], eax
mov rax, qword [rsi + 6]
mov qword [rdi + 6], rax
jmp 0x1800132cc
movups xmm0, xmmword [rsi + 2]
mov ebx, 0x262d
movups xmmword [rdi + 2], xmm0
mov eax, dword [rsi + 0x12]
mov dword [rdi + 0x12], eax
jmp 0x1800132cc
mov rax, qword [rsi + 2]
mov qword [rdi + 2], rax
mov ebx, 0x262d
jmp 0x1800132cc
cmp byte [rdx], 0
je 0x180013098
mov rax, qword [r13]
mov edx, 0x124
movsx r8, word [r15]
mov rcx, qword [rax]
mov rcx, qword [rcx + r8*8 - 8]
call fcn.1800371e0
mov r8d, dword [rbp + 0xb20]
movzx eax, byte [rsi]
mov byte [rdi], al
movzx eax, byte [rsi + 1]
mov byte [rdi + 1], al
jmp 0x1800132cc
cmp ebx, 0x11625
ja 0x180013265
je 0x180013259
cmp ebx, 0x88a7
je 0x1800131cf
cmp ebx, 0xb99d
je 0x180013177
cmp ebx, 0x1107f
jne 0x1800132cc
xor edx, edx
lea rcx, [rbp + 0xb0]
mov r8d, 0x104
call fcn.180070440
lea rcx, [rbp + 0x3d0]
mov edx, 2
lea rax, [rbp + 0xb0]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180013110
mov eax, dword [rax]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
xor r12d, r12d
mov dword [rcx], eax
jmp 0x1800132c5
mov dword [rsp + 0x48], 0x79
mov r9, r13
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rax
xor edx, edx
mov qword [rsp + 0x30], rax
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call fcn.18003b070
test al, al
jne 0x1800132c5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0xc10]
add rsp, 0xbd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
lea rcx, [rbp + 0xb0]
mov r8d, 0x104
call fcn.180070440
lea rcx, [rbp + 0x1c0]
mov edx, 2
lea rax, [rbp + 0xb0]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180013200
mov eax, dword [rax]
mov dword [rcx], eax
jmp 0x1800132c5
mov edx, ecx
mov rcx, qword [r13]
call qword [rsp + 0x50]
jmp 0x1800132c5
cmp ebx, 0x19857
je 0x1800132b4
cmp ebx, 0x2202f
jne 0x1800132cc
mov r11d, dword [rbp - 0x60]
xor edi, edi
mov edx, dword [rbp - 0x68]
cmp r11d, 1
mov r8d, dword [rbp - 0x6c]
mov r9d, edi
sete r9b
mov r10d, edi
test edx, edx
lea esi, [rdi + 1]
mov ecx, edi
sete r10b
mov eax, r10d
and eax, r9d
cmp r8d, 4
cmove ecx, eax
test ecx, ecx
je 0x180013301
mov r14d, esi
jmp 0x1800135bd
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r8d, dword [rbp + 0xb20]
imul eax, r8d, 0xa8
add ebx, eax
cmp ebx, dword [rsp + 0x58]
ja 0x1800131af
mov rdx, qword [rbp + 0xb18]
jmp 0x180012d7c
mov word [0x1800d5918], ax
mov eax, dword [rbp + 0xa40]
mov dword [rsp + 0x58], eax
jmp 0x1800131af
cmp edx, 0xa
mov ecx, edi
mov eax, edi
sete cl
and ecx, r9d
cmp r8d, 4
cmove eax, ecx
test eax, eax
je 0x180013326
mov edx, 2
mov r14d, edx
jmp 0x1800135c2
cmp edx, 0x5a
mov ecx, edi
mov eax, edi
sete cl
and ecx, r9d
cmp r8d, 4
cmove eax, ecx
test eax, eax
je 0x180013349
mov r14d, 3
jmp 0x1800135bd
cmp r11d, 2
mov r9d, edi
mov ecx, edi
mov eax, edi
sete r9b
cmp edx, 0x33
sete cl
and ecx, r9d
cmp r8d, 3
cmove eax, ecx
test eax, eax
je 0x180013377
mov r14d, 0x15f
jmp 0x1800135bd
mov ecx, r9d
mov eax, edi
and ecx, r10d
cmp r8d, 4
cmove eax, ecx
test eax, eax
je 0x180013395
mov r14d, 0x190
jmp 0x1800135bd
cmp r8d, 5
mov eax, edi
cmove eax, ecx
test eax, eax
je 0x1800133ad
mov r14d, 0x1f4
jmp 0x1800135bd
cmp edx, esi
mov ecx, edi
mov eax, edi
sete cl
and ecx, r9d
cmp r8d, 5
cmove eax, ecx
test eax, eax
je 0x1800133cf
mov r14d, 0x1fe
jmp 0x1800135bd
cmp edx, 2
mov ecx, edi
mov eax, edi
sete cl
and ecx, r9d
cmp r8d, 5
cmove eax, ecx
test eax, eax
je 0x1800133f2
mov r14d, 0x208
jmp 0x1800135bd
movzx r11d, byte [rbp + 0xaa]
mov r10d, edi
cmp r11b, sil
mov ecx, edi
mov eax, edi
sete r10b
and r10d, r9d
cmp r8d, 6
sete cl
test edx, edx
cmove eax, r10d
test ecx, eax
je 0x180013427
mov r14d, 0x258
jmp 0x1800135bd
cmp r11b, sil
mov r8d, edi
mov eax, edi
setne r8b
and r8d, r9d
test edx, edx
cmove eax, r8d
test ecx, eax
je 0x18001344b
mov r14d, 0x259
jmp 0x1800135bd
cmp edx, esi
mov eax, edi
cmove eax, r10d
test ecx, eax
je 0x180013462
mov r14d, 0x262
jmp 0x1800135bd
cmp edx, esi
mov eax, edi
cmove eax, r8d
test ecx, eax
je 0x180013479
mov r14d, 0x263
jmp 0x1800135bd
mov ebx, 0x10
nop
mov eax, ebx
sub eax, 0x10
je 0x180013588
sub eax, esi
je 0x18001356e
sub eax, esi
je 0x180013558
sub eax, esi
je 0x180013542
cmp eax, esi
jne 0x1800135b2
mov rcx, qword [0x1800c56b0]
lea r9, [0x1800a2000]
mov dword [rsp + 0x28], edi
lea r8, [rbp + 0x3d0]
lea rdx, [0x18009f134]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1800135b2
mov qword [rsp + 0x30], rdi
lea r9, [rbp + 0x1c0]
mov qword [rsp + 0x28], rdi
lea edx, [rax + 0x4a]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call fcn.18002e300
lea rdx, [0x1800a0368]
lea rcx, [rbp + 0x1c0]
call fcn.180075fc0
test rax, rax
je 0x1800135b2
mov r8, rax
lea rcx, [rbp - 0x80]
mov edx, 0x10
call fcn.180075ee8
lea rcx, [rbp - 0x80]
call fcn.1800751f0
movsxd r14, eax
jmp 0x1800135b2
lea r8, str.Taypey_kunduzgi_vaqti
mov edx, 0x104
mov rcx, r12
call fcn.180073290
jmp 0x1800135b2
mov edx, 0x5c
lea rcx, [rbp + 0x3d0]
call fcn.18006f960
mov r12, rax
jmp 0x1800135b2
lea r8, [0x1800c54a0]
mov edx, 0x104
lea rcx, [rbp + 0x3d0]
call fcn.180073290
jmp 0x1800135b2
lea rdx, [rbp + 0x1c0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, str.GCEE_CKFINITE
mov edx, 0x104
lea rcx, [rbp + 0x1c0]
call fcn.1800732f0
inc ebx
cmp ebx, 0x15
jb 0x180013480
mov edx, 2
cmp dword [r13], edi
jne 0x1800136db
mov ebx, 0x6f
cmp ebx, 0x6f
je 0x180013679
cmp ebx, 0x31dd
je 0x180013619
cmp ebx, 0x634b
jne 0x1800136c4
mov rax, qword [r15]
lea rdx, [rbp + 0xb20]
mov r8d, 0x92
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
mov dword [rbp + 0xb20], r14d
call fcn.18004ff10
jmp 0x1800136c4
lea rcx, [rbp + 0x2d0]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x180013627
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x58]
mov rax, qword [r15]
lea r8, [rbp + 0xb20]
mov qword [rsp + 0x58], rax
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2d0]
mov word [rbp + 0xb20], dx
mov edx, 0x12f
mov qword [rsp + 0x20], rax
call fcn.18001fab0
jmp 0x1800136c4
mov rax, qword [r15]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov edx, 0x27
mov dword [rsp + 0x58], r14d
lea rcx, [rbp + 0xb20]
mov word [rbp + 0xb20], si
call fcn.180030a70
mov rdx, rdi
nop dword [rax + rax]
movzx ecx, byte [rbp + rdx - 0x5c]
mov byte [rbp + rdx + 0x2d0], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1800136b0
add ebx, 0x316e
mov edx, 2
cmp ebx, 0x944a
jbe 0x1800135d1
mov rax, r14
jmp 0x1800131b4