Function at 0x18028ab15
Capabilities:
Execute syscall
Parse pe header

Disassembly:
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18003cb02
mov r8d, dword [rbp + 0x7f]
mov rdx, qword [rbp + 0x77]
mov rcx, qword [rbp - 0x11]
call sub.VCRUNTIME140D.dll___vcrt_GetModuleFileNameW
test eax, eax
je 0x18003cb02
mov rcx, qword [rbp - 0x11]
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18003cb02
movsxd rax, dword [rcx + 0x3c]
test eax, eax
jle 0x18003cb02
add rax, rcx
cmp dword [rax], 0x4550
jne 0x18003cb02
movzx edx, word [rax + 0x14]
sub esi, ecx
movzx r8d, word [rax + 6]
add rdx, rax
mov edi, r14d
mov ebx, r14d
test r8d, r8d
je 0x18003c81f
nop dword [rax + rax]
mov eax, ebx
lea rcx, [rax + rax*4]
mov eax, dword [rdx + rcx*8 + 0x24]
cmp esi, eax
jb 0x18003c818
mov edi, esi
sub edi, eax
cmp esi, dword [rdx + rcx*8 + 0x20]
jb 0x18003c81f
inc ebx
cmp ebx, r8d
jb 0x18003c800
cmp ebx, r8d
je 0x18003cb02
inc ebx
cmp byte [0x18008e1b9], r14b
jne 0x18003c85e
cmp qword [0x18008e1b0], r14
jne 0x18003cb02
call fcn.18003c240
mov qword [0x18008e1b0], rax
test rax, rax
je 0x18003cb02
mov byte [0x18008e1b9], 1
jmp 0x18003c865
mov rax, qword [0x18008e1b0]
lea rdx, str.PDBOpenValidate5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18003cb02
lea rcx, [rbp - 0x31]
xor r9d, r9d
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov qword [rsp + 0x30], r14
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x77]
call qword [0x18003e360]
test eax, eax
je 0x18003cb02
mov rcx, qword [rbp - 0x31]
mov rsi, r14
mov qword [rbp - 0x49], r14
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [0x18003e360]
cmp eax, 0x1329141
jne 0x18003caec
mov rcx, qword [rbp - 0x31]
lea r9, [rbp - 0x29]
lea r8, [0x18004d5bc]
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [0x18003e360]
test eax, eax
je 0x18003caec
mov rcx, qword [rbp - 0x29]
lea r9, [rbp - 0x39]
mov qword [rsp + 0x30], r14
mov r8d, edi
mov qword [rsp + 0x28], r14
movzx edx, bx
mov qword [rsp + 0x20], r14
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x18003e360]
test eax, eax
je 0x18003cadb
mov rcx, qword [rbp - 0x39]
lea rdx, [rbp - 0x49]
mov rax, qword [rcx]
mov rax, qword [rax + 0xd0]
call qword [0x18003e360]
test al, al
je 0x18003cac7
mov rcx, qword [rbp - 0x49]
test rcx, rcx
je 0x18003cac7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x18003e360]
test eax, eax
je 0x18003caa3
mov rcx, qword [rbp - 0x49]
lea rdx, [rbp + 0x5f]
mov qword [rsp + 0x30], r14
lea r9, [rbp + 0x57]
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x6f]
lea rdx, [rbp - 0x41]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
xor edx, edx
mov rax, qword [rax + 0x18]
call qword [0x18003e360]
test al, al
je 0x18003cab7
movzx eax, word [rbp + 0x57]
cmp eax, ebx
jne 0x18003c9c0
mov ecx, dword [rbp + 0x6f]
cmp ecx, edi
ja 0x18003c9c0
add ecx, dword [rbp - 0x41]
cmp edi, ecx
jb 0x18003c9da
mov rcx, qword [rbp - 0x49]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x18003e360]
test eax, eax
jne 0x18003c970
jmp 0x18003caa3
mov eax, dword [rbp + 0x5f]
test eax, eax
je 0x18003cab7
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx*8]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor eax, eax
xchg qword [rsp + r13*2 - 0x725bffb0], rax
mov rcx, qword [rsp + rcx - 0x12001be0]
neg r13
jae 0x1802607af
call fcn.18009af65
and r15, qword [rsp + r15 - 0x17c00059]
not r15
neg r15w
jae 0x18022c855
mov r15, qword [rsp + r15 + 0x17c0ff9e]
xor word [rsp + 0x48], 0xa6b3
not qword [rsp + 0x48]
call fcn.1801d8027
syscall
call fcn.1801f5625
lea rbx, [rbx + 0x7b8c397]
call fcn.18022e6af
push r13
jne 0x180158202
mov rdx, r15
mov r14, r15
add qword [rsp + 0x10], 0xfffffffffff3f684
not dword [rsp + r14 - 0x483097e0]
sub r15, 0x65373c3e
push rdi
mov rbx, qword [rsp + r15 + 0x1d06a466]
push rbx
cmp edx, 0xbbb18aac
jae 0x18003c78a
mov rbx, qword [rsp + 0x20]
mov rbx, qword [rbx]
mov rdi, qword [rsp + r14 - 0x483097d0]
mov qword [rsp + rdx - 0x483097f0], r15
mov dword [rsp + r14 - 0x483097f0], 0xbe1966b5
and r8w, word [rsp + 0x21]
lea rbx, [rbx + 0x6f95f486]
setne r14b
push r9
add qword [rsp + r14 - 0x483097d9], 0xffffffffdb220523
add qword [rsp + r15 + 0x1d06a47e], 0x1d4b83
cmp dl, 0xb0
xchg qword [rsp + rdx - 0x483097b0], rbx
mov r14, qword [rsp + 0x38]
movsx r8d, word [rsp + 0xb]
mov r15, qword [rsp + r15*4 + 0x741a90f8]
mov r8, qword [rsp + rdx - 0x483097f0]
mov rdx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x10]
lea rsp, [rsp + 0x50]
ret
bswap r14
mov r14, qword [rsp + r14 + 0x38]
add byte [rsp + 0x30], 0x8f
shr word [rsp + 0x28], 0x5d
js 0x1801800ce
and dword [rsp + 0x30], 0x8039c498
call fcn.180172f33
xchg ecx, eax
xchg edx, eax
or eax, 0x5720030
invalid